The Challenge
If your team operates in the EU, you're likely facing a moving target with anti-money laundering (AML) compliance. Since the first directive in 1990, the EU has introduced six AML directives, with the Fifth and Sixth arriving by 2018. Each directive expands the scope, adding new sectors, offenses, or evidentiary requirements. Programs designed for one directive often become outdated before the next is implemented.
This analysis doesn't focus on a single institution. Instead, it examines how your compliance team can maintain a defensible program as the legal requirements expand and vary by member state.
The Environment and Constraints
Consider the layers your compliance officer must manage.
Expanding Obliged Entities. The Second Directive, introduced in December 2001, included notaries, auditors, and tax advisors, while the Fourth Directive brought in gambling firms. The Fifth Directive extended to virtual currencies, prepaid cards, and art dealers. Each expansion means new firms must build programs from scratch, and existing firms face new product exposures.
Growing List of Crimes. The Sixth Directive covers cybercrime, tax crimes, environmental crime, and intellectual property crime. This presents a typology challenge for transaction monitoring teams, as scenarios tuned to traditional offenses may not detect proceeds from newer crimes.
Increased Transparency Obligations. The Fourth Directive required Ultimate Beneficial Owners (UBOs) to be listed in national registries. The Fifth tightened these rules and increased cooperation between Financial Intelligence Units (FIUs). Your customer due diligence (CDD) files must now reconcile with external registry data, not just customer-provided documents.
Fragmentation. Obliged entities may differ across member states. If your firm operates cross-border, you can't assume one national interpretation applies everywhere.
The Risk-Based Approach
The EU's solution to this complexity is the risk-based approach (RBA), introduced in the Third Directive in 2005. It allows flexibility in applying CDD, with Simplified Due Diligence (SDD) for lower-risk relationships and Enhanced Due Diligence (EDD) for higher-risk ones. The Fourth Directive expanded the RBA to customer due diligence more broadly.
Here's how to implement it effectively:
- Conduct an Enterprise-Wide Risk Assessment. Map your customer types, products, delivery channels, and geographies against the sectors and offense categories now in scope. If you offer prepaid products or virtual currency services, the Fifth Directive's extension is a direct exposure.
- Tier Your CDD. Define objective criteria for SDD, standard CDD, and EDD. Document the rationale for each criterion, as examiners will ask.
- Align Monitoring Scenarios with the Risk Assessment. Ensure transaction monitoring identifies unusual activity. When the Sixth Directive broadens the offense list, revisit scenario coverage.
- Maintain Expected Controls. Effective internal controls include CDD procedures, record-keeping, and staff training. Update training when scope changes.
- Report Promptly. Submit Suspicious Activity Reports (SARs) to the relevant national FIU. Timely, accurate reporting turns monitoring into law enforcement intelligence.
Technology supports each step. Automated screening and monitoring allow you to apply a risk-based approach at scale. However, technology should implement your risk logic, not replace it.
Results and Metrics
While there are no quantified outcomes to report, the regulatory direction is clear. The EU Action Plan on AML and CFT, adopted by the European Commission in May 2020, outlines objectives such as:
- A single EU rulebook directly applicable to private entities
- Greater cooperation and information exchange among authorities
- Improved supervision of the AML framework
- Stronger enforcement and consistent implementation across member states
If a single rulebook materializes, the fragmentation problem shrinks. The Anti-Money Laundering Authority (AMLA) will support consistency through its oversight role, and the proposed Regulation on the Traceability of Transfers of Funds (TFR) is part of this change. For cross-border payment flows, expect traceability expectations around transfers to influence your payment data design, especially when mapping fields in ISO 20022 messages.
Strategic Adjustments
The lessons here are drawn from the directives themselves:
- Avoid Building Per Directive. Programs patched after each directive accumulate inconsistent logic. Develop a risk assessment that integrates new sectors and offenses as inputs.
- Don't Dismiss the Action Plan. A directly applicable rulebook changes policy management: less reliance on member-state transposition, more on a single interpretation.
- Ensure the RBA Doesn't Lead to Weak Controls. Flexibility is defensible only when your documented rationale is specific to your business.
Takeaways for Your Team
- Reassess your enterprise risk against the Fifth Directive's expanded products and the Sixth Directive's broader offense list.
- Verify your UBO verification process reconciles against national registries.
- Test monitoring scenarios for coverage of cybercrime, tax, environmental, and intellectual property offenses.
- Review training content against the current directive set.
- Track the Action Plan, AMLA's role, and the TFR as inputs for your next framework revision.
The directives will keep expanding. A risk-based program that's documented, tiered, and aligned with your actual exposure is the only structure that scales with that expansion.
