LEGAL BASIS OF REQUIREMENTS ON FINANCIAL INSTITUTIONS, DNFBPS AND VASPS

1.
All requirements for financial institutions, DNFBPs or VASPs should be introduced either (a) in law (see the specific requirements in Recommendations 10, 11 and 20 in this regard), or (b) for all other cases, in law or enforceable means (the country has discretion).
2.
In Recommendations 10, 11 and 20, the term “law” refers to any legislation issued or approved through a Parliamentary process or other equivalent means provided for under the country’s constitutional framework, which imposes mandatory requirements with sanctions for non-compliance. The sanctions for non-compliance should be effective, proportionate and dissuasive (see Recommendation 35). The notion of law also encompasses judicial decisions that impose relevant requirements, and which are binding and authoritative in all parts of the country.
3.
The term “Enforceable means” refers to regulations, guidelines, instructions or other documents or mechanisms that set out enforceable AML/CFT requirements in mandatory language with sanctions for non-compliance, and which are issued or approved by a competent authority. The sanctions for non-compliance should be effective, proportionate and dissuasive (see Recommendation 35).
4.
In considering whether a document or mechanism has requirements that amount to enforceable means, the following factors should be taken into account:
- (a)
  There must be a document or mechanism that sets out or underpins requirements addressing the issues in the FATF Recommendations, and providing clearly stated requirements which are understood as such. For example:
  - (i)
    if particular measures use the word shall or must, this should be considered mandatory;
  - (ii)
    if they use should, this could be mandatory if both the regulator and the regulated institutions demonstrate that the actions are directly or indirectly required and are being implemented; language such as measures are encouraged, are recommended or institutions should consider is less likely to be regarded as mandatory. In any case where weaker language is used, there is a presumption that the language is not mandatory (unless the country can demonstrate otherwise).
- (b)
  The document/mechanism must be issued or approved by a competent authority.
- (c)
  There must be sanctions for non-compliance (sanctions need not be in the same document that imposes or underpins the requirement, and can be in another document, provided that there are clear links between the requirement and the available sanctions), which should be effective, proportionate and dissuasive. This involves consideration of the following issues:
  - (i)
    there should be an adequate range of effective, proportionate and dissuasive sanctions available if persons fail to comply with their obligations;
  - (ii)
    the sanctions should be directly or indirectly applicable for a failure to comply with an AML/CFT requirement. If non-compliance with an AML/CFT requirement does not have a sanction directly attached to it, then the use of sanctions for violation of broader requirements, such as not having proper systems and controls or not operating in a safe and sound manner, is satisfactory provided that, at a minimum, a failure to meet one or more AML/CFT requirements could be (and has been as appropriate) adequately sanctioned without a need to prove additional prudential failures unrelated to AML/CFT; and
  - (iii)
    whether there is satisfactory evidence that effective, proportionate and dissuasive sanctions have been applied in practice.
5.
In all cases it should be apparent that financial institutions and DNFBPs understand that sanctions would be applied for non-compliance and what those sanctions could be.