On 16 June 2023, the European Banking Authority (EBA) published a report on the money laundering and terrorist financing (ML/TF) risks associated with payment institutions (PIs) in the EU, based on a risk assessment exercise conducted in 2022.

The report highlighted that:

1. PIs, as a sector, represent high inherent ML/TF risks, mainly due to the nature of their products and services, which allow anonymity, speed, and cross-border transactions, often involving cash or high-risk customers and jurisdictions.
2. some emerging ML/TF risks, such as the use of virtual IBANs, white labelling, and third-party merchant acquiring, may pose additional challenges for PIs and supervisors.
3. PIs' AML/CFT systems and controls are not robust enough to mitigate the ML/TF risks identified, and that PIs often fail to comply with their AML/CFT obligations, such as customer due diligence, transaction monitoring, and suspicious transaction reporting.
4. some of the weaknesses in PIs' AML/CFT controls are linked to current authorisation practices, which are not consistent or thorough enough across the EU, and do not always involve experts with the necessary AML/CFT expertise.
5. significant differences and shortcomings in the AML/CFT supervision of PIs across the EU, such as the lack of a clear and objective methodology for assessing the ML/TF risks of the PI sector and individual PIs, insufficient use of supervisory tools and resources, and inadequate cooperation and information exchange between home and host supervisors, especially in relation to the activities of agents of PIs in a cross-border context.
6. the significant risk profile associated with the PI sector did not always appear to be matched with a commensurate level of supervisory activity in all cases.

The report concluded that:

1. not all competent authorities are currently doing enough to comply with their legal obligations in respect of the AML/CFT supervision of PIs, and that addressing the identified weaknesses and inconsistencies is essential to protect the EU's single market from financial crime.
2. some of the findings require changes in the EU legal framework, such as establishing a more consistent approach to assessing the AML/CFT component of the authorisation of PIs, reinforcing the consideration of ML/TF risks in the process of passporting notifications, and taking steps towards a more consistent treatment of agents of PIs in a cross-border context.

This report therefore offers an opportunity to PIs to review the governance and implementation of their AML/CFT function against the finding in the reports and suggests that further enquiry and supervision from competent authorities should be expected, together with enhancement of the current regulatory framework to address some of the EBA’s findings.

Related content

EBA report on ML/TF risks associated with payment institutions - published by the European Banking Authority on 16 June 2023.