Money Laundering, Client Due Diligence As Well As Information Protection: The Cjeu's Judgment Inward Rubber Interenvios
November 23, 2018
Edit
Marcin Kotula, Legal Officer at the European Commission
The views expressed are purely those of the writer in addition to may non inwards whatever circumstances live regarded every bit stating an official seat of the European Commission
Background
The recent judgment of the CJEU inwards the illustration of Safe Interenvios was triggered yesteryear a preliminary reference from the Provincial Court inwards Barcelona (Audiencia Provincial). The Court inwards Barcelona submitted to the CJEU a number of questions related to the interpretation of the 3rd Anti-Money Laundering Directive 2005/60/EC (AML Directive, since replaced yesteryear the 4th coin laundering Directive, discussed here).
In the illustration inwards question, Safe, a fellowship which falls nether the Definition of a "financial institution" inside the pregnant of the AML Directive in addition to of a "payment institution" inside the pregnant of the Payment Services Directive 2007/64 (PSD) has been transferring the funds of its customers abroad through the accounts it held alongside 3 banks, BBVA, Sabadell in addition to Liberbank. The transfers were to live carried out yesteryear agents who were accordingly authorised yesteryear Safe in addition to verified yesteryear the Bank of Kingdom of Spain (Banco de España). After discovering irregularities regarding Safe's agents the banks, acting nether Castilian Law 10/2010 on the prevention of coin laundering in addition to terrorist financing[1] which transposes the AML Directive inwards Kingdom of Spain requested diverse information from Safe. When Safe did non furnish them alongside the requested information the banks shut its accounts. Before closing Safe's trace of piece of occupation organisation human relationship BBVA informed SEPBLAC[2] that Safe mightiness live involved inwards coin laundering activities.
Safe challenged the closure of its accounts before the Commercial Court inwards Barcelona (Juzgado de lo Mercantil) arguing that the banks receive got likewise been transferring funds abroad in addition to that insofar they receive got been competing alongside Safe on the same market. In consequence, according to Safe, the closure of accounts was an deed of unfair competition. Safe argued farther that the information requested yesteryear the banks which related to Safe's customers every bit good every bit to the source in addition to finish of the funds could non receive got been provided without breaching the information protection legislation.
Safe's challenge was largely unsuccessful every bit the Commercial Court inwards Barcelona did non detect a specific infringement of contest police push clitoris yesteryear none of the banks. It concluded that BBVA shut Safe's trace of piece of occupation organisation human relationship on the the world of checks which showed that nearly a quarter of transactions were non carried out yesteryear agents authorised yesteryear Safe in addition to verified yesteryear the Bank of Spain. As for the closure of accounts yesteryear Sabadell in addition to Liberbank, the courtroom inwards Barcelona partly ruled inwards Safe's favour final that these ii banks failed to properly set out the reasons for their closures.
Subsequently Safe, Sabadell in addition to Liberbank appealed against that judgment to the Provincial Court inwards Barcelona which submitted the preliminary questions to the CJEU.
The CJEU was asked, first, whether client due diligence measures, set downward inwards the AML Directive to respond to the risks of coin laundering in addition to terrorist financing, could live applied yesteryear a credit establishment (in the illustration at hand, a bank) to a financial/payment establishment such every bit Safe, given that financial/payment institutions are already plain of report to supervision yesteryear competent regime nether the PSD in addition to the AML Directive. The CJEU was so additionally asked what type of client due diligence measures (standard, simplified or enhanced) could live applied inwards such a scenario in addition to which circumstances could trigger the application of those measures. Finally, the national courtroom asked if the measures in addition to the provision of for certain information requested yesteryear the banks from Safe are inwards trace alongside European Union contest police push clitoris (Safe claimed that the banks compete alongside it on the payment services market) in addition to alongside European Union information protection police push clitoris (according to Safe, the banks requested the identification information of its customers in addition to of the recipients of the funds which Safe transferred).
The AML Directive sets out the legal framework for measures aimed at preventing in addition to combatting coin laundering in addition to terrorist financing. Its provisions are to a cracking extent inspired yesteryear the recommendations of the Financial Action Task Force (FATF), the principal international torso inwards the surface area of combatting coin laundering in addition to terrorist financing. Article 3 of the AML Directive defines which institutions in addition to professions are to apply the anti-money laundering measures. The listing inwards Article 3 includes credit institutions such every bit banks in addition to fiscal institutions such every bit Safe. Chapter II of the AML Directive, which deals alongside client due diligence, distinguishes betwixt 3 types of such diligence, i.e. simplified, measure in addition to enhanced.
As far every bit measure due diligence is concerned, Articles vii in addition to 8 of the AML Directive pull inwards which circumstances due diligence should live applied in addition to what measures this mightiness involve. The latter provision underlines that the extent the due diligence measures tin live determined on a risk-sensitive the world depending on the type of customer, trace of piece of occupation organisation relationship, production or transaction.
Article ix of the AML Directive specifies the checks that demand to live undertaken before the establishment of a trace of piece of occupation organisation human relationship or the carrying-out of a transaction. It likewise indicates when a trace of piece of occupation organisation human relationship must live terminated or a transaction cannot live carried out.
Article eleven sets out the simplified client due diligence measures which inter alia apply inwards situations where the customers are credit institutions or fiscal institutions. Such customers are already covered yesteryear the orbit of Article 2 of the AML Directive in addition to demand to apply due diligence measures towards their ain customers. Enhanced client due diligence is dealt alongside inwards Article 13.
Pursuant to Article 37 of the AML Directive the compliance alongside the requirements of the Directive yesteryear the institutions in addition to persons that demand to apply it is supervised yesteryear competent authorities. Credit institutions in addition to payment institutions are likewise covered yesteryear the PSD.
Payment institutions travel authorised to furnish payment services yesteryear competent regime designated yesteryear the Member States. These regime are likewise empowered to supervise the compliance alongside the requirements that are applicable to payment service providers.
The CJEU's analysis
The CJEU kickoff dealt alongside the interrogation if fiscal institutions such every bit Safe tin live the addressees of measure or enhanced client due diligence measures despite the derogation inwards Article eleven of the AML Directive which foresees the application of simplified due diligence measures towards fiscal institutions.
The Court underlined that Article eleven of the AML Directive does non derogate from Article 7(c) nether which measure client diligence measures must live applied when in that location is a suspicion of coin laundering or terrorist financing. Thus, a national provision which authorises the application of measure due diligence measures vis-à-vis fiscal institutions inwards such circumstances of suspicion is compatible alongside the Directive.
In a similar vein, Article eleven of the AML Directive does non derogate from Article xiii thereof. The latter requires enhanced client due diligence measures to live applied inwards situations where the adventure of coin laundering or terrorist financing is higher. Paragraphs (2) to (4) of Article xiii incorporate a non-exhaustive listing of such situations which yesteryear their nature introduce a higher risk. Whilst this listing does non include the transfer of funds abroad the Member States receive got a margin of discretion inwards applying a risk-based approach in addition to identifying other situations which are, yesteryear their nature, associated alongside a greater adventure of coin laundering or terrorist financing. In the illustration at hand, the transfer of funds abroad was included yesteryear the Castilian legislator inwards Law 10/2010 (Article 11) every bit i of the higher-risk situations which trigger enhanced client due diligence.
The CJEU so dealt alongside Article ix of Castilian Law 10/2010 which on the i manus allows the non-application of measure client due diligence towards fiscal institutions but on the other manus empowers the Minister of Economic Affairs in addition to Finance to exclude the application of simplified due diligence towards for certain customers. On this point, the CJEU noted that the AML Directive exclusively lays downward the minimum bird of European Union harmonisation alongside Article v of the Directive envisaging the possibility of adopting or retaining inwards forcefulness stricter provisions inwards the European Union Member States. This decision was supported yesteryear an before CJEU judgment inwards Jyske Bank Gibraltar. The stricter provisions which tin apply inwards the Member States demand to serve the purpose of strengthening the struggle against coin laundering in addition to terrorist financing. They may thus likewise relate to additional situations which, according to the Member State, introduce a adventure of coin laundering or terrorist financing fifty-fifty if the AML Directive does non prescribe whatever type of client due diligence for those situations.
The minute grouping of questions before the CJEU related to the extent of powers which credit institutions may practise inwards the context of client due diligence in addition to to the relation betwixt those powers in addition to the powers of the supervisory regime nether Article 37 of the AML Directive in addition to nether Article 21 of the PSD. Here, the Court noted that an establishment covered yesteryear the AML Directive cannot flora a trace of piece of occupation organisation human relationship or acquit out a transaction through its trace of piece of occupation organisation human relationship or must terminate an existing trace of piece of occupation organisation human relationship when it is unable to obtain the diverse items of information that are defined inwards Article 8 of the Directive. These items include the verification of the customer's in addition to the beneficial owner's identity (in the latter illustration pursuant to a risk-based approach) every bit good every bit the information on the purpose in addition to intended nature of the trace of piece of occupation organisation relationship. The inability of the establishment to obtain these types of information mightiness live due to the customers' refusal to cooperate (as inwards the illustration at hand) or to other factors.
The CJEU went on to seat the limitations that demand to live applied when taking a mensurate such every bit the termination of a trace of piece of occupation organisation human relationship or the refusal to acquit out a transaction through the banking concern account. The mensurate must live proportionate to the adventure of coin laundering or terrorist financing in addition to thus cannot live taken inwards the absence of sufficient information which dot out to that risk.
The Court so stated that the powers exercised inwards the context of client due diligence in addition to the supervisory powers of the competent regime nether the AML Directive in addition to the PSD are rather to live seen every bit dissever in addition to complementary. In consequence, a credit establishment may receive got trace of piece of occupation organisation human relationship of the due diligence measures which its client had to apply towards its ain customers but the extent of the credit institution's due diligence measures inwards such a scenario must live appropriate to the adventure of coin laundering in addition to terrorist financing. In addition, a credit establishment must inwards that illustration neither compromise the supervisory tasks of the competent institutions nether the PSD nor supplant those supervisory authorities.
Next, the CJEU spelled out the weather condition inwards which the national legislation tin authorise or require measure or enhanced client due diligence measures towards a fiscal institution. The CJEU's reply to the kickoff grouping of questions indicated already that such measures tin live applied vis-à-vis fiscal institutions pursuant to Article xiii of the AML Directive (enhanced due diligence) in addition to Article v (stricter provisions). In this share of the judgment withal the Court examined how the Member States (when prescribing such measures) or the credit institutions (when authorised yesteryear the Member State to apply such measures) tin practise the powers nether Article v in addition to 13.
The CJEU started yesteryear recalling its case-law on the liberty to furnish services in addition to on the permissible restrictions of that liberty (Art. 56 TFEU). It reminded that inwards Jyske Bank Gibraltar the prevention of in addition to struggle against coin laundering in addition to terrorist financing was recognised every bit a legitimate populace involvement objective which could justify a barrier to the liberty to furnish services. It so turned to the interrogation if Article eleven of Castilian Law 10/2010 which identifies the transfer of coin abroad every bit a province of affairs which ever presents a higher adventure of coin laundering in addition to terrorist financing (and inwards upshot triggers enhanced client due diligence) is appropriate for attaining this legitimate populace involvement objective. In that regard, the Court stressed that both the national legislator (when prescribing measure or enhanced due diligence measures towards a fiscal institution) in addition to the credit institutions (when authorised yesteryear the Member State to apply such measures) must acquit out a consummate adventure assessment prior to deciding on the measures to take. Such measures must furthermore live proportionate to the adventure so identified. The final chemical constituent of this share of the CJEU's judgment was thus dedicated to the proportionality of Article eleven of Castilian Law 10/2010. Here, the Court concluded that the restriction of the liberty to furnish services set downward inwards Article eleven would live proportionate if no less restrictive agency were available in addition to if the restriction was compatible alongside the primal rights in addition to freedoms nether the Treaties in addition to the Charter e.g. alongside the correct to protection of personal information (Article 8 of the Charter) in addition to alongside the regulation of costless competition. Whilst, inwards principle, leaving the protection of personal information aspects for the lastly share of the judgment the Court found that a less restrictive mensurate was available inwards this case. In the illustration at manus the Castilian legislator to a greater extent than oftentimes than non presumed that all transfers of coin abroad introduce a higher adventure of coin laundering in addition to terrorist financing whereas it could receive got provided a possibility of rebutting that presumption inwards private cases which objectively create non introduce such a risk.
The lastly grouping of preliminary questions seat before the CJEU focussed on the compatibility of the enhanced due diligence measures alongside the European Union information protection law, every bit set out inwards the Data Protection Directive (Directive 95/46). The Provincial Court inwards Barcelona asked if Safe tin live obliged to furnish the banks alongside the identification information of its customers in addition to inwards detail those from whom the transferred funds originated every bit good every bit alongside the identification information of the recipients of the funds. In the reply to the previous grouping of questions the CJEU has already indicated that the due diligence measures taken pursuant to Articles v in addition to xiii of the AML Directive demand to live compatible alongside Article 8 of the Charter, i.e. alongside the correct to the protection of personal data. The reply to the lastly grouping of questions could receive got thus elaborated on this tilt in addition to clarified which personal information of the customers in addition to recipients tin live validly requested yesteryear credit institutions. However, inwards the illustration at manus BBVA denied that it requested the identification information of Safe's customers in addition to of the recipients of the funds. It only requested the identification information of Safe's agents who used BBVA's accounts. Moreover, the CJEU found the lastly grouping of questions non to live sufficiently precise because they exclusively referred to a greater extent than oftentimes than non to the Data Protection Directive without specifying whatever of its provisions which could live relevant inwards this context. The share of the preliminary questions which related to the Data Protection Directive was hence considered inadmissible.
Comments
The replies of the CJEU to the preliminary questions dot out inwards the administration of giving a for certain grade of flexibility to the national legislators in addition to to the institutions in addition to persons which apply client due diligence measures. On the other hand, the measures prescribed or authorised yesteryear the national regime in addition to the measures applied inwards private cases yesteryear banks in addition to other institutions in addition to persons covered yesteryear the AML Directive demand to live preceded yesteryear comprehensive adventure assessments. Those adventure assessments should atomic number 82 to the Definition of measures which are appropriate to the identified bird of risk. The measures tin vary depending on the type of customer, trace of piece of occupation organisation relationship, production or transaction.
This form of well-balanced approach seems inwards trace alongside the objectives of the AML Directive in addition to alongside the CJEU's case-law which recognised preventing in addition to combatting coin laundering in addition to terrorist financing every bit an overriding ground inwards the populace interest.
The CJEU added a farther safeguard at the afterwards stages of the judgment: the proportionality of the client due diligence measures depends non exclusively on the results of the adventure assessment but likewise on their compliance alongside the primal rights in addition to freedoms in addition to full general principles of law. The Court specifically mentions the regulation of costless contest in addition to the correct to the protection of personal information enshrined inwards Article 8 of the Charter.
In Safe the CJEU did non withal furnish whatever specific indications on the number which personal information tin live requested from the client inwards the context of due diligence measures in addition to inwards which circumstances. This was so because the lastly grouping of preliminary questions was based on facts which were disputed inwards the proceedings in addition to eventually this lastly grouping was declared inadmissible yesteryear the Court.
The AML Directive does non actually address the thing how the measures it designs relate to the protection of personal data. In fact, in that location is exclusively i dot inwards the text of the Directive which touches upon that issue. It is Recital 33 which refers to the applicability of national information protection laws in addition to of the international transfers rules of the Data Protection Directive inwards the context of the transmission of information to the Financial Intelligence Units (FIUs) in addition to the disclosure of information most such a transmission.
On the other hand, the novel 4th Anti-Money Laundering Directive 2015/849 is much to a greater extent than outspoken inwards this respect. Its Chapter V implicitly states that Article 7(e) of the Data Protection Directive constitutes the legal the world for processing personal information for the purpose of the prevention of coin laundering in addition to terrorist financing yesteryear recognising, inwards Article 43, that such processing is a thing of populace interest. The same Chapter deals likewise alongside the number of the information that needs to live provided to the client before establishing a trace of piece of occupation organisation human relationship or carrying out an occasional transaction. Finally, it lays downward to a greater extent than precise indications alongside regard to the transmission of information to FIUs in addition to to the disclosure of that fact to the customers. According to Article 41(4) this number should live regulated inwards national laws which must smasher the residual betwixt the access of the client to the personal information in addition to the interests of the proper performance of the anti-money laundering procedures in addition to investigations.
The provisions on the unlike kinds of client due diligence are likewise to a greater extent than precise inwards the novel Directive. There is no longer a derogation from measure due diligence for fiscal institutions. The Directive is straightaway accompanied yesteryear iii annexes. The kickoff of these annexes contains a non-exhaustive listing of adventure variables that shall live taken into trace of piece of occupation organisation human relationship when determining the extent of client due diligence measures. The minute annex includes a non-exhaustive listing of factors which dot out to a potentially lower adventure of coin laundering in addition to terrorist financing, i.e. the grade of adventure that mightiness trigger the application of simplified client due diligence. Finally, the 3rd annex is a non-exhaustive listing of factors suggesting a higher grade of adventure which requires the application of enhanced client due diligence. Generally speaking, the factors included inwards the iii annexes relate to types of customers, geographic areas, in addition to detail products, services, transactions or delivery channels. In addition, Articles 17 in addition to xviii of Directive 2015/849 envisage guidelines on the adventure factors in addition to the measures to live taken inwards situations of simplified client due diligence in addition to enhanced client due diligence respectively. Such guidelines shall live issued yesteryear ESAs, i.e. the European Supervisory Authorities (EBA, EIOPA in addition to ESMA) yesteryear 26 June 2017.
Photo credit: gfintegrity.org
[1] Ley 10/2010 de prevención del blanqueo de capitales y de la financiación del terrorismo.
[2] The Executive Service of the Commission for the Prevention of Money Laundering in addition to Financial Crime of the Bank of Kingdom of Spain - Servicio Ejecutivo de la Comisión de Prevención de Blanqueo de Capitales e Infracciones Monetarias del Banco de España.
