The European Banking Authority (EBA) today published its Report on money laundering and terrorist financing (ML/TF) risks associated with EU payment institutions. Its findings suggest that ML/TF risks in the sector may not be assessed and managed effectively by institutions and their supervisors.

In 2022, the EBA assessed the scale and nature of ML/TF risk in the payment institutions sector. It considered how payment institutions identify and manage ML/TF risks and what supervisors do to mitigate those risks when considering an application for the authorisation of a payment institution and during the life of a payment institution.

The EBA’s findings suggest that generally institutions in the sector do not manage ML/TF risk adequately. AML/CFT internal controls in payment institutions are often insufficient to prevent ML/TF. This is in spite of the high inherent ML/TF risk to which the sector is exposed.
​
The EBA’s findings also suggest that not all competent authorities are currently doing enough to supervise the sector effectively. As a result, payment institutions with weak AML/CFT controls can operate in the EU, for example by establishing themselves in Member States where authorisation and AML/CFT supervision processes are less stringent to passport their activities cross-border afterwards.
Failure to manage ML/TF risks in the payment institutions sector can impact the integrity of the EU’s financial system. The EBA’s work on access to financial services further suggests that failure to address those risks will also undermine efforts to improve access by payment institutions to payment accounts.

​Several of these findings relate to issues addressed in EBA Guidelines. A more robust implementation by supervisors and institutions of provisions in these guidelines will mitigate the sector’s exposure to ML/TF risks.

Legal basis and background Article 9a(5) of Regulation (EU) 1095/2010 (‘EBA founding regulation’) mandates the EBA to perform risk assessments on significant ML/TF risks affecting the EU’s financial sector.

The EBA drew on a number of sources to inform this risk assessment. These include the findings of the EBA peer review on authorisation of payment institutions under PSD2, data extracted from the EBA’s AML/CFT database, EuReCA (available here), questionnaire responses, bilateral interviews with selected EU supervisors, national and supervisory assessments of ML/TF risks in the sector, and any other information available to EBA through its work on ML/TF risks and supervision.

Findings of this risk assessment will be feeding into the EBA’s bi-annual ML/TF risk assessment exercise under Article 6(5) of Directive (EU) 2015/849.
​
The EBA, in line with its legal duty to lead, coordinate and monitor the AML/CFT efforts of all EU financial services providers and supervisors, remains committed to tackling ML/TF risks holistically, across all financial sectors within its remit.   

​Findings of this risk assessment will be feeding into the EBA’s bi-annual ML/TF risk assessment exercise under Article 6(5) of Directive (EU) 2015/849.
​
The EBA, in line with its legal duty to lead, coordinate and monitor the AML/CFT efforts of all EU financial services providers and supervisors, remains committed to tackling ML/TF risks holistically, across all financial sectors within its remit.  

Download the EBA Report HERE

In 2022 Transactive Systems UAB was second among Lithuanian electronic money and payment institutions in terms of annual turnover (€13.1 billion), with operating income amounting to almost €4mn.

In revoking its electronic money authorisation, the Bank of Lithuania said that the following “main violations and deficiencies were identified” at the regulated #fintech firm Transactive Systems UAB:
 

• failed to properly identify clients, their representatives and beneficiaries;
• did not ensure adequate monitoring of business relations and operations*;
• in opening virtual accounts for its clients, Transactive Systems UAB enabled the opening of anonymous accounts;
• had absolutely no control measures for identifying cases of terrorist financing;
• failed to ensure proper implementation of international financial sanctions restrictive measures, and its monitoring and verification systems were ineffective;
• did not identify suspicious customer transactions and did not report them to the Financial Crimes Investigation Service;
• failed to ensure that the internal control function responsible for the organisation of money laundering and the prevention of terrorist financing was independent and a conflict of interest was avoided; and
• provided incorrect, incomplete and inaccurate information to the Bank of Lithuania.

* including that institution's immediate and retrospective monitoring of transactions was ineffective, the selected monitoring model did not correspond to the volume of processed transactions, suspicious transactions were not reviewed and properly analysed.

* measures aimed at determining whether the client's funds and assets were not obtained directly or indirectly from a criminal act or by participating in such an act were of poor quality and insufficient.
 

If these are a description of the ‘main violations and deficiencies’ identified, what else was going on?  

Over the past few weeks at events like ACAMS (ACAMSAssembly ACAMSEurope) Joby Carpenter Craig Timm Natasha Powell Shelley Schachter-Cahm and I discussed the situation of fintech and financial crime controls.
 
Many others and I had great discussions about good fintech companies having their reputations impinged by a few bad fintech actors both big (yes some fintech banks who know who they are and some from China who know who they are) and small (some from the east side of the EU bloc, Israel and disturbingly some regulated fintech firms from the UK who also know who they are) whose mentality is that an authorisation is akin to a driver's licence exam. They also often say if country A doesn't jump to our demands, then we will go to country B and will whine to your ministers and FDI agencies.

While it is good to see such decisive regulatory action here, the question has to be asked "How did Transactive Systems UAB get through what is supposed to be a thorough and rigorous common EU approach to regulatory authorisation by national competent authorities (NCAs) in the first place?"

​Particularly given the lengths that many EU authorities go to verifying the existence, performance and execution of the #financialcrime business wide risk assessments, the  risk registers, the risk appetite statements, #moneylaundering policies and procedures under EBA Guideline 14 and the vetting of managers, owners and directors of #blockchain emoney and #blockchain payments. Did this company say one thing, and then do the polar opposite? Did the regular trust but not verify?

Interestingly, back in January 2023, the Bank of Lithuania restricted the activities of the company by instructions:
 

• not to establish business relations with new clients and not to provide services to existing clients who provide financial services (including brokerage, investment ( Forex , CDF), money transfers, issuance of electronic money), as well as for customers whose activities are related to virtual currencies (including operators of virtual currency exchanges, operators of depository virtual currency wallets, exchange of virtual assets, loans with virtual assets).
• not to provide a payment account service when the conditions are created for the use of such a payment account by third parties whose identity has not been determined in accordance with the Law on the Prevention of Money Laundering and Terrorist Financing.
• not to provide a payment account service when the conditions are created for the use of such a payment account by third parties whose identity has not been determined in accordance with the Law on the Prevention of Money Laundering and Terrorist Financing

The news cannot but help take us to:
 

1. discussions of regulatory arbitrage between EU NCAs and consistency in approach by the European Banking Authority’s to ensure a level playing field for NCAs.
2. if the Lithuanian regulator is identifying and responding in a hard manner (the revocation, not the fine), are other regulators in the EU doing their bit too across ALL INDUSTRIES whether a bank, emoney, insurer etc.
3. would further examples like this lead to direct rule by ESAs if there is regulatory arbitrage and indeed greater powers for AMLA?
4. should penalties be higher and should there be higher Fitness & Probity standards harmonised across the EU?

​Well run regulated fintech must be getting depressed. Banks will jump on this example as evidence that fintechs cannot be trusted to adhere AML, sanction and financial crime laws properly and some regulators might do so too, recalibrating their supervisory engagement models. Those going through authorisation will find it tougher to satisfy their future regulator compared to others who went through the process a few years ago.
 
Another telling issue in this case is the fact the Bank of Lithuania says that it “has received many complaints and inquiries from individuals and legal entities of various European Union countries and financial market supervisory authorities regarding possible fraud related to clients of Transactive Systems UAB or accounts opened there. Although the Bank of Lithuania has repeatedly drawn the institution's attention to the importance of money laundering and terrorist financing risk management and fraud prevention, gross and systematic violations of the legal acts regulating the prevention of money laundering and terrorist financing were identified during the inspection.”  This comes across really weak.

​Separately, getting really tired of hearing from people who should know better saying that "I will not apply to country A for my authorisation (recommend my client not to do so) because I hear it is easier and faster at country B".  While I am not saying that country B is Lithuania, it is news that one would have to share as a both a positive and negative when asked "Peter what are the best 3-5 EU member states you would suggest for a fintech authorisation and why?" It's a question I am asked every month.  And you know what, the answer is ‘It depends – on your business model, access to banking services, access to talent and reputation of the regulator’ to name but a few points. 

​Contact Peter Oakes at the details here or via Linkedin if you want to know more about how I help fintech businesses get authorised in Europe and the UK and my non-executive director services to regulated fintech, MiFID and banks.

Links to sources:
1) Bank of Lithuania Announcement of 2 June 2023
2) Previous restriction imposed on Transactive Systems UAB on 20 January 2023
​3) Linkedin Post HERE