The Fifth Directive and how it affects enhanced due diligence

The Fifth Money Laundering Directive is set to be transposed into national law by 10 January 2020. The 5MLD came about in response to terrorist attacks across the EU and offshore leaks investigated in the Panama papers. The core aim of the 5MLD is to address modern-day money laundering concerns that were not covered in the Fourth Directive. One of the key changes to money laundering regulations that the Fifth Directive will bring is that Member States will have to implement enhanced due diligence (EDD) measures to monitor suspicious transactions involving high-risk countries more strictly.

How will the Fifth Money Laundering Directive affect enhanced due diligence?

The Fifth Directive will require enhanced due diligence when dealing with transactions from high-risk countries. As well as obtaining evidence of the source of funds and source of wealth, information on beneficial ownership and the background of the intended transaction must also be recorded. The EU may also designate a ‘blacklist’ of high-risk countries for money laundering.

The Fifth Money-Laundering Directive also looks set to amend the ‘reliable and independent source’ requirement for verification of customer information. This amendment will probably mean that the source will have to be provided and stored electronically.

EDD and transactions involving high-risk countries

Under the Fifth Directive, firms will have to get additional information on the customer and beneficial owners. This is an individual on whose behalf a transaction is being conducted and includes those who exercise ultimate effective control over a legal person or arrangement. Further, more information will have to be provided on the intended nature of the business relationship, the source of funds and wealth of the customer and beneficial owner, and the reasons for the particular transaction. 

Additionally, firms must apply at least one of the following additional measures to those carrying out transactions involving high-risk third countries:

  • Apply additional elements of EDD  
  • Introduce an enhanced reporting mechanism or systematic reporting for financial transactions
  • Limit business relationships or transactions with natural persons or legal entities from a designated high-risk third country

Politically exposed persons (PEPs)

The Fourth Directive increased the scope of enhanced due diligence to local PEPs in addition to foreign PEPs. The Fifth Directive adds additional due diligence required for PEPs, mainly with regards to offices, land and buildings that qualify as politically exposed. This includes all nationally registered international organisations with a political purpose. Under the 5MLD, Member States will be required to draft a list of new properties that are considered politically exposed, with the EU set to draft corresponding lists on a European level. These lists will not include the names of any politically exposed persons.  

Upcoming anti-money laundering training

Screenshot of AML: Know Your Risk
AML: Know Your Risk, is one of our courses that will be updated to comply with the Fifth Directive

In the coming months, we will be updating all of our online AML courses in line with the Fifth Money Laundering Directive. We will also be releasing a new course on the Fifth Directive. The interactive course will cover the key changes to money laundering regulations under the Fifth Directive, will be fully customisable and will include interactive modules. To get more information on our new AML training, complete the short form below.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.