New EBA requirements for the MLRO
#1 New EBA requirements for the MLRO
The draft guidelines comprehensively address the entire AML/CFT governance regime for the first time at EU level. They set clear expectations on the role, tasks and responsibilities of the AML/CFT compliance officer and the management body and how they interact, including at group level. AML/CFT compliance officers must have sufficient seniority. This means that they are empowered to propose, on their own initiative, any necessary or appropriate measures to the management body in its supervisory and management function to ensure compliance with and effectiveness of internal anti-money laundering and counter-terrorist financing measures.#2 Rights and duties of the MLRO
Para 24. The AML/CFT Officer referred to in Article 8(4)(a) of Directive (EU) 2015/849 should be appointed at a level that includes the power to propose, on his or her own initiative, any necessary or appropriate measures to ensure compliance with and effectiveness of the internal anti-money laundering and counter-terrorist financing measures function. Para 25. Where the management body appoints an AML/CFT officer in accordance with paragraph 16, the management body should decide, taking into account the size and complexity of the business and its ML/TF risk, # whether the AML/CFT compliance officer role is to be performed on a full-time basis, or # whether this role can be performed by an employee or manager in addition to his/her existing functions within the financial services provider. Such a decision should be based on the principle of proportionality, taking into account, inter alia, the factors set out below. Point 26: Where the tasks of the anti-money laundering and counter-terrorist financing compliance officer are to be assigned to an employee who already has other tasks or functions within the financial services provider, the management body should consider possible conflicts of interest and take the necessary measures to avoid them. The management body should ensure that this person can devote sufficient time to the tasks of the AML/CFT officer. Para 27. The AML/CFT compliance officer should normally work in the country of establishment of the financial services provider. country of establishment of the financial services provider.#3 New EBA requirements for the MLRO
Point 28. In some cases, where it is appropriate to the ML/TF risk of the financial services provider and permitted under national law, the AML/CFT officer may be be located in another country. In such cases, management should appoint the AML/CFT compliance officer under the financial services provider’s governance arrangements. The financial undertaking should have the necessary systems and controls in place to ensure that the AML/CFT officer has the necessary knowledge of local anti-money laundering and counter-terrorist financing laws and regulations and can perform his or her duties in an equally effective and independent manner. The financial undertaking should ensure that the AML/CFT compliance officer has access to all internal documents and systems necessary for the performance of his or her duties. Point 29. The AML/CFT Officer should be able to delegate his duties to other employees acting under his direction and supervision. This delegation is subject to the condition that the ultimate responsibility for the effective performance of these tasks remains with the AML/CFT Officer. Point 30. In order to ensure the independence of the AML/CFT Officer, the new EBA requirements for the AML/CFT Officer provide for the following requirements: (a) Notwithstanding the overall responsibility of the members of the management body for the financial undertaking, the AML/CFT Officer should not report to a person who is responsible for the management of any of the activities that the AML/CFT Compliance Officer oversees. (b) The financial undertaking shall have procedures in place to ensure that the AML/CFT Compliance Officer has full and direct access at all times to all information necessary for the performance of his function. The decision as to what information he/she needs to have access to in this regard should be made solely by the AML/CFT Compliance Officer. (c) The AML/CFT officer should have an independent reporting line to the management body Management body, if a management body exists in the structure of the financial services provider.#4 Requirements for the competent management body are further strengthened – New EBA requirements for the money laundering officer.
Without prejudice to the general and collective responsibility of the management body, the draft guidelines also set out the tasks and role of the board member or senior manager, where there is no board, responsible for AML/CFT as a whole, and the role of the group AML/CFT officer. As the information reaching the management body needs to be sufficiently comprehensive to allow for informed decision-making, the new EBA requirements for the money laundering officer specify what information should be included at least in the AML/CFT officer’s activity report to the management body.#5 Parent company to appoint MLRO at group level
Where a financial services business is part of a group, the new EBA requirements for the Money Laundering Officer provide that a group-level AML/CFT compliance officer should be appointed in the parent company to ensure the establishment and implementation of effective group-wide AML/CFT policies and procedures and to ensure that any deficiencies affecting the whole or a large part of the group are effectively addressed. The provisions of the new EBA requirements for the Money Laundering Officer are also consistent with existing ESA guidance, in particular the revised guidelines on internal governance under the Capital Requirements Directive (CRD), the revised joint ESMA-EBA guidelines on the assessment of the suitability of members of the management body, the draft guidelines on the authorisation of credit institutions and the draft guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing.Tasks and duties of the Business Continuity Manager
Tasks and duties of the Business Continuity Manager
# Target group for the seminar Tasks and Duties of the Business Continuity Manager: # Board members and managing directors at banks, financial service providers, investment and fund companies, leasing and factoring companies # Managers and specialists from the areas of emergency management, outsourcing management, IT compliance, compliance officers and internal audit.Your benefits with the Business Continuity Manager course:
#1 Tasks and duties of the Business Continuity Manager #2 Business impact analyses and risk impact analyses #3 Ongoing monitoring duties of the Business Continuity ManagerGet a head start with the Business Continuity Manager course:
Each participant receives the S+P Tool Box with the course: + Guidelines for BCM (approx. 30 pages) + Sample reporting for Business Continuity Managers + S+P Tool Risk Impact Analysis for more audit security#1 Tasks and duties of the Business Continuity Manager
MaRisk AT 7.3: The significantly expanded range of tasks of BCM: o Objectives for emergency management and derivation of an emergency management process o Emergency concept for time-critical activities and processes o Determination of suitable measures for damage reduction New reporting obligations: at least quarterly reporting on the status of emergency management Emergency concept with business continuation and recovery plans Interface outsourcing: outsourcers and insourcers must have coordinated contingency concepts.#2 Business Impact Analyses and Risk Impact Analyses
More stringent requirements for business impact analyses: o Impact on activities and processes o Type and extent of (im-)material damage o Timing of the failure. Risk impact analyses for the identified time-critical activities and processes: o Identify and assess potential hazards. o Carrying out qualitatively tightened risk analysis on the basis of uniform scoring criteria Consideration of emergency scenarios o (Partial) failure of a site (e.g. due to flood, major fire, area closure, access control failure) o Significant failure of IT systems or communication infrastructure o Loss of a critical number of employees o Failure of service providers (e.g. suppliers, electricity providers)#3 Ongoing monitoring obligations of the business continuity manager
MaRisk + BAIT: Requirements for monitoring and control activities Benchmarks for monitoring and control activities and their implementation Audit-proof assessment of impact and risk analyses o The effectiveness and appropriateness of the emergency concept must be reviewed regularly. o For time-critical activities and processes, the relevant scenarios must be demonstrated at least annually and on an ad hoc basis. Reviews of the emergency concept shall be recorded. o Results shall be analysed with regard to necessary improvements. o The results are to be communicated in writing to the respective persons responsible.This could also be of interest to you as a business continuity manager
MaRisk 6.0: Stricter requirements for emergency management. From the ICT Guidelines, requirements for emergency management are implemented in the newly formulated section AT 7.3. Risk analyses must first be carried out for all time-critical activities and processes identified within the scope of an impact analysis to be carried out. The emergency concept must show which substitute solutions are available in a timely manner in the event of an emergency and how a return to normal operation is to proceed. An overview of all activities and processes (e.g. in the form of a process map) serves as a basis for this. The effectiveness and adequacy of the emergency concept must be reviewed regularly.#1 MaRisk 6.0: Stricter requirements for emergency management
Chapter AT 7.3 Emergency management has now been worded as follows: The institution shall define objectives for emergency management and, derived from this, establish an emergency management process. Precautions must be taken for emergencies in time-critical activities and processes (emergency concept). The measures defined in the emergency concept must be suitable for reducing the extent of possible damage. The emergency concept must be updated as required, reviewed annually to ensure that it is up to date and communicated appropriately. The management must receive written reports on the status of the emergency management at least quarterly and on an ad hoc basis. The contingency plan must include business continuity and recovery plans. Business continuity plans must ensure that substitute solutions are available promptly in the event of an emergency. Recovery plans shall allow for a return to normal operations within a reasonable period of time. Adequate internal and external communication must be ensured in the event of emergencies. In the case of outsourcing of time-critical activities and processes, the outsourcing institution and the outsourcing company shall have coordinated contingency plans. The effectiveness and appropriateness of the emergency concept shall be reviewed regularly. For time-critical activities and processes, it shall be demonstrated for all relevant scenarios at least annually and on an ad hoc basis. Reviews of the emergency concept shall be recorded. Results shall be analysed with regard to necessary improvements. Risks shall be managed appropriately. The results are to be communicated in writing to the respective persons responsible. MaRisk provides the following explanations on the stricter requirements for emergency management.#2 Time-critical activities and processes
Time-critical activities and processes are those which, if impaired for a defined period of time, are expected to cause unacceptable damage to the institution. In order to identify time-critical activities and processes as well as supporting activities and processes, IT systems and other resources required for this purpose as well as potential threats, the Institute conducts impact analyses and risk analyses. An overview of all activities and processes (e.g. in the form of a process map) serves as a basis for this.#3 Impact analyses – MaRisk 6.0: Stricter requirements for emergency management
In business impact analyses, the consequences that an impairment of activities and processes can have for business operations are considered over graduated periods of time. The impact analyses should consider the following aspects, among others: – Nature and extent of the (im)material damage. – Impact of the timing of the failure on the damage (e.g. failure of payment transactions during peak business hours).#4 Risk Analyses – Tasks and Duties of the Business Continuity Manager
In risk analyses (risk impact analyses) for the identified time-critical activities and processes, potential hazards are identified and evaluated which could cause an impairment of the time-critical business processes.#5 Emergency concept – tasks and duties of the business continuity manager
In the emergency concept, responsibilities, objectives and measures for the continuation or recovery of time-critical activities and processes are determined and criteria for the classification as well as for the triggering of the plans are defined.#6 Emergency Scenarios – MaRisk 6.0: Stricter Requirements for Emergency Management
At least the following scenarios are taken into account: – (Partial) failure of a location (e.g. due to flood, major fire, area closure,failure of access control). – Significant failure of IT systems or communication infrastructure (e.g. due to errors or attacks) – Loss of a critical number of employees (e.g. pandemic, food poisoning, strike) – Failure of service providers (e.g. suppliers, electricity providers)#7 Reviews of the emergency plan – tasks and duties of the business continuity manager
The frequency and scope of the reviews should generally be based on the hazard situation. Service providers should be involved appropriately. Reviews include, among other things: – Testing of technical precautionary measures – communication, crisis management and alerting exercises – Emergency or full-scale exercises.#8 What implementation deadlines apply to the New MaRisk 6.0?
The new version of MaRisk comes into force upon publication. There is a transition period until 31.12.2021. This applies to the documentation requirement related to the outsourcing register in AT 9 para. 14 MaRisk only insofar as the obligation to maintain an outsourcing register also applies as of 01.01.2022 when the FISG comes into force. Otherwise, the first date of application for the specification of this requirement in MaRisk is also based on the law. Different implementation deadlines apply to the adjustment of outsourcing agreements that already exist or are being negotiated. A separate implementation period until 31 December 2022 is granted for this. An adjustment of contractual relationships concluded on the basis of a public procurement procedure can be omitted due to the special legal problems insofar as these contracts are limited in time and must be re-awarded within the next five years. BaFin assumes that the new requirements will already be sufficiently taken into account in award procedures initiated from 01.01.2022. Institutions with a high NPL portfolio must already comply with the requirements of the NPE Guidelines immediately after the end of the transition period on 31 December 2021, provided that these institutions have an NPL ratio greater than 5% on the two preceding quarterly reporting dates (30 September 2021 and 31 December 2021). The first quarterly reporting date relevant for the classification as an institution with a high NPL ratio is therefore 30.09.2021.Participants have also booked the following courses MaRisk + SREP + Depot A:
Seminare MaRisk + SREP Seminare Depot A Seminare Auslagerungscontrolling Seminar Risikomanagement ComplianceWhat are the tasks of the compliance function?
#1 What are the tasks of the compliance function?
In principle, the compliance function reports directly to the Executive Board. It can also be linked to other control units, provided there is a direct reporting line to the management. In order to fulfil its tasks, the compliance function may also have recourse to other functions and units. Depending on the size of the institution as well as the type, scope, complexity and risk content of the business activities, the compliance function is to be located in an area independent of the market and trading divisions. Book the seminar What rights does the compliance officer have? online. Convenient and easy with the seminar form online and product no. A01.#2 Target group for the course: What rights does the compliance officer have?
# Board members and managing directors at banks, financial service providers, insurance companies, leasing and factoring companies # Compliance officers and employees of compliance and legal departments, heads of internal audit, data protection officers, # One unit §25h (7) German Banking Act, legal advisors, compliance specialists and managers#3 Your benefits with the course: What rights does the compliance officer have?
#1 Practical implementation of a compliance system – new duties of care and liability risks for the compliance function – whistle-blowing system according to §25 of the German Banking Act (KWG) #2 Compliance interfaces with data protection, the one unit §25(7) German Banking Act and internal auditing #3 Minimum requirements for an overall ICS with compliance, corporate governance, data protection, internal audit and the central office#4 Your advantage with the course: What rights does the compliance officer have?
Each participant receives the following S+P Tool Box free of charge with the seminar What rights does the compliance officer have? + Compliance and Corporate Governance Organisational Handbook (incl. EBA requirements, 40 pages) + S+P Check: Data protection for practitioners in accordance with EU-DSGVO + Checklist: Monitoring and documentation of control actions + Sample report for the reporting of guarantors and authorised representatives + S+P Tool Legal Inventory: Risk Assessment for Compliance OfficersAgile Compliance Management in Practice
- Requirements of MaRisk and European banking supervision for a compliance system
- MaRisk-compliant organisation and staffing of the compliance function
- Guarantor position under liability law – BGH rulings on the responsibility of agents
- „Red Flags“: Limiting Personal Liability Risks for the Compliance Function
- Minimum requirements for a whistle-blowing system
- Compliance reporting: monitoring and control plan, sample for audit-proof reporting
Manage compliance interfaces to DPO, CISO, MLRO, outsourcing officer and internal audit securely.
- The Three Lines of Defence Model: Compliance and Internal Audit Interface
- Risk-oriented auditing, documentation and reporting by the commissioners
- IT compliance: Supervisory requirements for IT and the CISO
- Data protection compliance: rights and duties of the data protection officer – optimally designing interfaces between compliance, IPM and data protection
MaRisk AT 4.4.2: Tasks and Duties of the Compliance Officer
- ICS significance for a proper business organisation §25a German Banking Act
- MaRisk AT 8: What must the compliance officer pay attention to in adjustment processes?
- Managing compliance-relevant risks securely with ICS key controls:
- Remuneration Directive: Control and approval duties of compliance officers on remuneration policy
- Avoiding legal risks: integrated risk analysis for an audit-proof legal inventory
- Avoiding duplication of work – clearly assigning interfaces and tasks
- Self Assessment § 25d German Banking Act: Are Executive Board and Supervisory Board Compliant?
Participants have also booked the following Compliance courses:
Was ist die CATWOE Technik?
#Was ist die CATWOE Technik?
Mit der Arbeitswelt 4.0 kommen neue Herausforderungen auf Geschäftsführer und Führungskräfte zu. Bist du fit für den digitalen Wandel? Benötigt dein Unternehmen einen Change? Mit dem Seminar Change Management erhältst du die wichtigsten Kenntnisse und Tools an die Hand um mit deinem Unternehmen und deinem Team Change-Projekte erfolgreich umzusetzen: Tag 1- Grundlagen des agilen Managements
- Sichere Umsetzung von Change-Projekten als Führungskraft
- Was ist die CATWOE Technik?
- Überzeugend Führen im digitalen Wandel
- Teams erfolgreich durch Veränderungsprozesse führen
- Agiles Projektmanagement mit Scrum & Co.
- Vom Change zum Innovationsmanagement
Dein Nutzen mit dem Seminar Change Management
Tag 1- Grundlagen des agilen Managements
- Sichere Umsetzung von Change-Projekten als Führungskraft
- Überzeugend Führen im digitalen Wandel
- Teams erfolgreich durch Veränderungsprozesse führen
- Agiles Projektmanagement mit Scrum & Co.
- Vom Change zum Innovationsmanagement
Zielgruppe für das Seminar Change Management
- Geschäftsführer, Prokuristen und Führungskräfte
- Teamleiter, die im Vertrieb, Einkauf, HR Management oder im Controlling tätig sind.
Dein Vorsprung mit dem Seminar Change Management
Die Teilnehmer erhalten für ihren Sprint die S+P Tool Box: + S+P Test: Benötigt dein Unternehmen einen Change? + S+P Test Digitaler Wandel: Wie professionell managst du Veränderungen? + Was ist die CATWOE Technik? + S+P Leitfaden: Instrumente für den agilen Sprint + S+P Test: Wie gut beherrschst du die Moderationstechniken? + S+P Leitfaden: Agile Methoden für Change Management Seminarprogramm Tag 1: Seminar Change ManagementGrundlagen des agilen Managements
- Welche Kultur benötigt ein schlankes Unternehmen?
- Die wichtigsten Erfolgstreiber im Lean Management
- Toyota-Produktionssystem – Lessons Learned für die eigene Branche
- Verzögerungskosten (Cost of Delay) gezielt identifizieren und reduzieren
- Aufgaben des Managements: Dynamik im Unternehmen managen
- Die Lean-Falle und wie du ihr ausweichst
Sichere Umsetzung von Change-Projekten als Führungskraft
- Was bedeutet Agilität für die Zusammenarbeit und Prozesse im Unternehmen?
- Was ist die CATWOE Technik?
- Führungsaufgabe Agilität – so kommunizierst du den digitalen Wandel im Unternehmen
- „Spielregeln‘‘ und Kommunikationswege im Team klar definieren
- Mit Zielen führen und Ziele agil formulieren
- Teammitglieder „mit ins Boot holen‘‘ – Agilität zur gemeinsamen Sache machen
Überzeugend Führen im digitalen Wandel
- Das Unternehmen verändern – Aufbau einer Innovationskultur
- Besonderes Augenmerk: Ängste + Widerstände + Akzeptanz
- Wie kommuniziere ich schwierige Themen und Kritik?
- Einbettung im Gesamtchange – Schnittstellenbetrachtung
- Rollen im Change-Projekt festlegen
- Flexibler Umgang mit Veränderungen im Team
- Flow schaffen und ein Pull-System etablieren
Teams erfolgreich durch Veränderungsprozesse führen
- Wie funktionieren agile Teams?
- Mehr Flexibilität im Tagesgeschäft – Einsatz von agilen Techniken
- Der Mix macht´s: Kombination agiler Techniken
- Das Miteinander in agilen Teams
- Projektmanager und Scrum Master als Team-Coaches
- Wie Führung helfen kann Agilität zur Gewohnheit zu machen
- Teams im Veränderungsprozess richtig führen
Agiles Projektmanagement mit Scrum & Co.
- Wie agiles Projektmanagement funktioniert
- Was ist Scrum und wie kann es eingesetzt werden?
- Projektanforderungen im Griff: Use Cases, Burn-Down-Charts & Co.
- Projektmanager und Scrum Master als Team-Coaches
- Mit der teamzentrierten Arbeitsweise zum Erfolg
Innovationsmanagement mit Sprint & Co.
- Wie funktioniert der Google Design Sprint?
- Montag: Erstelle deinen Routenplan
- Dienstag: Neu kombinieren und verbessern
- Mittwoch: Rumble – zwei mögliche Alternativen im Test
- Donnerstag: Wie du deinen Prototypen erstellst
- Freitag: Persönliches Gespräch an Stelle von Big Data