Specific obligations and differences of persons in the AML regime

8.8.2023

In connection with the adoption of the Whistleblower Protection Act and related amendments, the AML Act was also amended. What specifics apply to you as a person required to comply with the AML Act?

Efficiency

Obliged persons under the AML Act are required to implement an internal reporting system and other obligations no later than 1 August 2023.

Number of employees is not relevant

If you are a person obliged under the AML Act you are obliged to implement an internal reporting system, regardless of the number of employees. It is logical that the internal reporting system will be tailored to the needs of the specific obliged person and will differ between large banks with hundreds of employees and small real estate agencies, but the basic rules must be applied equally in all cases.

Extension of the range of notifiers

The internal notification system under the AML Act allows not only employees to submit notifications, but also other persons working for the obliged person other than in an employment relationship, e.g. self-employed collaborators. The obliged person is then obliged to receive notifications not only from employees and self-employed persons but also from persons performing voluntary activities, professional practice or internship with the obliged person. The same applies to jobseekers.

The possibility of submitting an anonymous notification

The AML Act explicitly imposes the obligation to accept anonymous notifications. The obligated person accepts anonymous notifications regarding violations of any law, including regulations in any protected area covered by the Whistleblower Protection Act. Logically, the provisions of the Act relating in particular to the mandatory identification of the whistleblower, the recording and protection of his/her identification data, etc. do not apply to anonymous notifications. On the contrary, the provisions that are relevant in the context will apply. Typical examples are the time limits for investigation of the notification, the obligation to register the notification and related documents, and the protection of information on the content of the notification from unauthorised access.

Prohibition on outsourcing the internal notification system

The Whistleblower Protection Act allows obliged entities to outsource the technical operation of the internal notification system to a third party. The amended provisions of the AML Act explicitly prohibit this possibility. Obliged persons cannot outsource the internal reporting system, primarily because notifications may contain sensitive information relating to breaches of AML rules which, given their sensitivity, cannot and should not be shared with other persons in this way. This prohibition then only applies where the operation of the internal notification system would involve the processing of the content of the notification (e.g. the activities of the relevant person). On the other hand, in the case of pure technical outsourcing, i.e. the provision of a technical solution where the provider does not have access to the content of the notifications and only provides a specific communication channel and the recording of the notifications in encrypted form, this prohibition does not apply.

Prohibition on sharing an internal notification system

The Whistleblower Protection Act allows up to a certain number of employees to share an internal notification system. For obliged persons under the AML Act, this option is excluded. Each obliged person under the AML must have its own internal whistleblowing system and its own competent person who assesses, registers and proposes corrective measures for the notifications received. The only exception to this rule is the possible sharing of a financial product provider's internal notification system with its tied agents.

Conclusion

If you are an obligated person under the AML Act, it is important to be aware of these specifics in fulfilling your obligations. Like persons required to comply with the Whistleblower Protection Act, persons required to comply with the AML Act are subject to penalties for failing to comply with their obligations.