Marcin Kotula, Legal Officer at the
European Commission
The
views expressed are purely those of the author and may not in any circumstances
be regarded as stating an official position of the European Commission
Background
The recent judgment of the CJEU in the
case of Safe
Interenvios was triggered by a preliminary reference from the
Provincial Court in Barcelona (Audiencia Provincial). The Court in Barcelona
submitted to the CJEU a number of questions related to the interpretation of
the third Anti-Money Laundering Directive
2005/60/EC (AML Directive, since replaced by the fourth money laundering Directive,
discussed here).
In the case in question, Safe, a
company which falls under the definition of a "financial institution"
within the meaning of the AML Directive and of a "payment
institution" within the meaning of the Payment
Services Directive 2007/64 (PSD) has been transferring the funds of its
customers abroad through the accounts it held with 3 banks, BBVA, Sabadell and
Liberbank. The transfers were to be carried out by agents who were accordingly
authorised by Safe and verified by the Bank of Spain (Banco de España). After
discovering irregularities regarding Safe's agents the banks, acting under
Spanish Law 10/2010 on the prevention of money laundering and terrorist
financing[1]
which transposes the AML Directive in Spain requested various information from
Safe. When Safe did not provide them with the requested information the banks
closed its accounts. Before closing Safe's account BBVA informed SEPBLAC[2]
that Safe might be involved in money laundering activities.
Safe challenged the closure of its
accounts before the Commercial Court in Barcelona (Juzgado de lo Mercantil)
arguing that the banks have also been transferring funds abroad and that
insofar they have been competing with Safe on the same market. In consequence,
according to Safe, the closure of accounts was an act of unfair competition.
Safe argued further that the information requested by the banks which related
to Safe's customers as well as to the origin and destination of the funds could
not have been provided without breaching the data protection legislation.
Safe's challenge was largely
unsuccessful as the Commercial Court in Barcelona did not find a specific
infringement of competition law by none of the banks. It concluded that BBVA
closed Safe's account on the basis of checks which showed that nearly a quarter
of transactions were not carried out by agents authorised by Safe and verified by
the Bank of Spain. As for the closure of accounts by Sabadell and Liberbank,
the court in Barcelona partly ruled in Safe's favour concluding that these two
banks failed to properly set out the reasons for their closures.
Subsequently Safe, Sabadell and Liberbank
appealed against that judgment to the Provincial Court in Barcelona which
submitted the preliminary questions to the CJEU.
The CJEU was asked, first, whether customer due diligence
measures, laid down in the AML Directive to respond to the risks of money
laundering and terrorist financing, could be applied by a credit institution
(in the case at hand, a bank) to a financial/payment institution such as Safe,
given that financial/payment institutions are already subject to supervision by
competent authorities under the PSD and the AML Directive. The CJEU was then
additionally asked what type of customer due diligence measures (standard,
simplified or enhanced) could be applied in such a scenario and which
circumstances could trigger the application of those measures. Finally, the
national court asked if the measures and the provision of certain information
requested by the banks from Safe are in line with EU competition law (Safe
claimed that the banks compete with it on the payment services market) and with
EU data protection law (according to Safe, the banks requested the
identification data of its customers and of the recipients of the funds which
Safe transferred).
The AML Directive sets out the legal
framework for measures aimed at preventing and combatting money laundering and
terrorist financing. Its provisions are to a great extent inspired by the
recommendations of the Financial Action
Task Force (FATF), the main international body in the area of combatting
money laundering and terrorist financing.
Article 3 of the AML Directive defines which institutions and
professions are to apply the anti-money laundering measures. The list in
Article 3 includes credit institutions such as banks and financial institutions
such as Safe. Chapter II of the AML Directive, which deals with customer due
diligence, distinguishes between 3 types of such diligence, i.e. simplified,
standard and enhanced.
As far as standard due diligence is
concerned, Articles 7 and 8 of the AML Directive describe in which circumstances
due diligence should be applied and what measures this might involve. The
latter provision underlines that the extent the due diligence measures can be
determined on a risk-sensitive basis depending on the type of customer,
business relationship, product or transaction.
Article 9 of the AML Directive
specifies the checks that need to be undertaken before the establishment of a
business relationship or the carrying-out of a transaction. It also indicates
when a business relationship must be terminated or a transaction cannot be
carried out.
Article 11 sets out the simplified
customer due diligence measures which inter alia apply in situations where the
customers are credit institutions or financial institutions. Such customers are
already covered by the scope of Article 2 of the AML Directive and need to
apply due diligence measures towards their own customers. Enhanced customer due
diligence is dealt with in Article 13.
Pursuant to Article 37 of the AML
Directive the compliance with the requirements of the Directive by the
institutions and persons that need to apply it is supervised by competent
authorities. Credit institutions and payment
institutions are also covered by the PSD.
Payment institutions get authorised to
provide payment services by competent authorities designated by the Member
States. These authorities are also empowered to supervise the compliance with
the requirements that are applicable to payment service providers.
The
CJEU's analysis
The CJEU first dealt with the question
if financial institutions such as Safe can be the addressees of standard or
enhanced customer due diligence measures despite the derogation in Article 11
of the AML Directive which foresees the application of simplified due diligence
measures towards financial institutions.
The Court underlined that Article 11 of
the AML Directive does not derogate from Article 7(c) under which standard
customer diligence measures must be applied when there is a suspicion of money
laundering or terrorist financing. Thus, a national provision which authorises
the application of standard due diligence measures vis-à-vis financial
institutions in such circumstances of suspicion is compatible with the
Directive.
In a similar vein, Article 11 of the
AML Directive does not derogate from Article 13 thereof. The latter requires
enhanced customer due diligence measures to be applied in situations where the
risk of money laundering or terrorist financing is higher. Paragraphs (2) to
(4) of Article 13 contain a non-exhaustive list of such situations which by
their nature present a higher risk. Whilst this list does not include the
transfer of funds abroad the Member States have a margin of discretion in
applying a risk-based approach and identifying other situations which are, by
their nature, associated with a greater risk of money laundering or terrorist
financing. In the case at hand, the transfer of funds abroad was included by
the Spanish legislator in Law 10/2010 (Article 11) as one of the higher-risk
situations which trigger enhanced customer due diligence.
The CJEU then dealt with Article 9 of
Spanish Law 10/2010 which on the one hand allows the non-application of
standard customer due diligence towards financial institutions but on the other
hand empowers the Minister of Economic Affairs and Finance to exclude the
application of simplified due diligence towards certain customers. On this
point, the CJEU noted that the AML Directive only lays down the minimum level
of EU harmonisation with Article 5 of the Directive envisaging the possibility of
adopting or retaining in force stricter provisions in the EU Member States.
This conclusion was supported by an earlier CJEU judgment in Jyske
Bank Gibraltar. The stricter provisions which can apply in the Member
States need to serve the purpose of strengthening the fight against money
laundering and terrorist financing. They may thus also relate to additional
situations which, according to the Member State, present a risk of money
laundering or terrorist financing even
if the AML Directive does not prescribe any type of customer due diligence for
those situations.
The second group of questions before
the CJEU related to the extent of powers which credit institutions may exercise
in the context of customer due diligence and to the relation between those
powers and the powers of the supervisory authorities under Article 37 of the
AML Directive and under Article 21 of the PSD. Here, the Court noted that an
institution covered by the AML Directive cannot establish a business
relationship or carry out a transaction through its account or must terminate
an existing business relationship when it is unable to obtain the various items
of information that are defined in
Article 8 of the Directive. These items include the verification of the
customer's and the beneficial owner's identity (in the latter case pursuant to
a risk-based approach) as well as the information on the purpose and intended
nature of the business relationship. The inability of the institution to obtain
these types of information might be due to the customers' refusal to cooperate
(as in the case at hand) or to other factors.
The CJEU went on to identify the
limitations that need to be applied when taking a measure such as the
termination of a business relationship or the refusal to carry out a
transaction through the bank account. The measure must be proportionate to the
risk of money laundering or terrorist financing and thus cannot be taken in the
absence of sufficient information which point out to that risk.
The Court then stated that the powers
exercised in the context of customer due diligence and the supervisory powers
of the competent authorities under the AML Directive and the PSD are rather to
be seen as separate and complementary. In consequence, a credit institution may
take account of the due diligence measures which its customer had to apply
towards its own customers but the extent of the credit institution's due
diligence measures in such a scenario must be appropriate to the risk of money
laundering and terrorist financing. In addition, a credit institution must in
that case neither compromise the supervisory tasks of the competent
institutions under the PSD nor replace those supervisory authorities.
Next, the CJEU spelled out the
conditions in which the national legislation can authorise or require standard
or enhanced customer due diligence measures towards a financial institution.
The CJEU's reply to the first group of questions indicated already that such
measures can be applied vis-à-vis financial institutions pursuant to Article 13
of the AML Directive (enhanced due diligence) and Article 5 (stricter
provisions). In this part of the judgment however the Court examined how the
Member States (when prescribing such measures) or the credit institutions (when
authorised by the Member State to apply such measures) can exercise the powers
under Article 5 and 13.
The CJEU started by recalling its
case-law on the freedom to provide services and on the permissible restrictions
of that freedom (Art. 56 TFEU). It reminded that in Jyske Bank Gibraltar the prevention of and fight against money
laundering and terrorist financing was recognised as a legitimate public
interest objective which could justify a barrier to the freedom to provide
services. It then turned to the question if Article 11 of Spanish Law 10/2010
which identifies the transfer of money abroad as a situation which always
presents a higher risk of money laundering and terrorist financing (and in
consequence triggers enhanced customer due diligence) is appropriate for
attaining this legitimate public interest objective. In that regard, the Court
stressed that both the national legislator (when prescribing standard or
enhanced due diligence measures towards a financial institution) and the credit
institutions (when authorised by the Member State to apply such measures) must
carry out a complete risk assessment prior to deciding on the measures to take.
Such measures must furthermore be proportionate to the risk so identified. The
final element of this part of the CJEU's judgment was thus dedicated to the
proportionality of Article 11 of Spanish Law 10/2010. Here, the Court concluded
that the restriction of the freedom to provide services laid down in Article 11
would be proportionate if no less restrictive means were available and if the
restriction was compatible with the fundamental rights and freedoms under the
Treaties and the Charter e.g. with the right to protection of personal data
(Article 8 of the Charter) and with the principle of free competition. Whilst,
in principle, leaving the protection of personal data aspects for the last part
of the judgment the Court found that a less restrictive measure was available
in this case. In the case at hand the Spanish legislator generally presumed
that all transfers of money abroad present a higher risk of money laundering
and terrorist financing whereas it could have provided a possibility of
rebutting that presumption in individual cases which objectively do not present
such a risk.
The last group of preliminary questions
put before the CJEU focussed on the compatibility of the enhanced due diligence
measures with the EU data protection law, as set out in the Data Protection
Directive (Directive 95/46). The Provincial Court in Barcelona asked if Safe
can be obliged to provide the banks with the identification data of its
customers and in particular those from whom the transferred funds originated as
well as with the identification data of the recipients of the funds. In the
reply to the previous group of questions the CJEU has already indicated that
the due diligence measures taken pursuant to Articles 5 and 13 of the AML
Directive need to be compatible with Article 8 of the Charter, i.e. with the
right to the protection of personal data. The reply to the last group of questions
could have thus elaborated on this statement and clarified which personal data
of the customers and recipients can be validly requested by credit
institutions. However, in the case at hand BBVA denied that it requested the
identification data of Safe's customers and of the recipients of the funds. It
merely requested the identification data of Safe's agents who used BBVA's
accounts. Moreover, the CJEU found the last group of questions not to be
sufficiently precise because they only referred generally to the Data
Protection Directive without specifying any of its provisions which could be
relevant in this context. The part of the preliminary questions which related
to the Data Protection Directive was therefore considered inadmissible.
Comments
The replies of the CJEU to the
preliminary questions point out in the direction of giving a certain degree of
flexibility to the national legislators and to the institutions and persons
which apply customer due diligence measures. On the other hand, the measures
prescribed or authorised by the national authorities and the measures applied
in individual cases by banks and other institutions and persons covered by the
AML Directive need to be preceded by comprehensive risk assessments. Those risk
assessments should lead to the definition of measures which are appropriate to
the identified level of risk. The measures can vary depending on the type of
customer, business relationship, product or transaction.
This kind of well-balanced approach
seems in line with the objectives of the AML Directive and with the CJEU's
case-law which recognised preventing and combatting money laundering and
terrorist financing as an overriding reason in the public interest.
The CJEU added a further safeguard at
the later stages of the judgment: the proportionality of the customer due
diligence measures depends not only on the results of the risk assessment but
also on their compliance with the fundamental rights and freedoms and general
principles of law. The Court specifically mentions the principle of free
competition and the right to the protection of personal data enshrined in
Article 8 of the Charter.
In Safe the CJEU did not however
provide any specific indications on the issue which personal data can be
requested from the customer in the context of due diligence measures and in
which circumstances. This was so because the last group of preliminary
questions was based on facts which were disputed in the proceedings and
eventually this last group was declared inadmissible by the Court.
The AML Directive does not really
address the matter how the measures it designs relate to the protection of
personal data. In fact, there is only one point in the text of the Directive
which touches upon that issue. It is Recital 33 which refers to the
applicability of national data protection laws and of the international
transfers rules of the Data Protection Directive in the context of the
transmission of information to the Financial Intelligence Units (FIUs) and the
disclosure of information about such a transmission.
On the other hand, the new fourth
Anti-Money Laundering Directive 2015/849 is much more outspoken in this
respect. Its Chapter V implicitly states that Article 7(e) of the Data
Protection Directive constitutes the legal basis for processing personal data
for the purpose of the prevention of money laundering and terrorist financing
by recognising, in Article 43, that such processing is a matter of public
interest. The same Chapter deals also with the issue of the information that needs
to be provided to the customer before establishing a business relationship or
carrying out an occasional transaction. Finally, it lays down more precise
indications with regard to the transmission of information to FIUs and to the
disclosure of that fact to the customers. According to Article 41(4) this issue
should be regulated in national laws which must strike the balance between the
access of the customer to the personal data and the interests of the proper
functioning of the anti-money laundering procedures and investigations.
The provisions on the different kinds
of customer due diligence are also more precise in the new Directive. There is
no longer a derogation from standard due diligence for financial institutions.
The Directive is now accompanied by three annexes. The first of these annexes
contains a non-exhaustive list of risk variables that shall be taken into
account when determining the extent of customer due diligence measures. The
second annex includes a non-exhaustive list of factors which point out to a
potentially lower risk of money laundering and terrorist financing, i.e. the
degree of risk that might trigger the application of simplified customer due
diligence. Finally, the third annex is a non-exhaustive list of factors
suggesting a higher degree of risk which requires the application of enhanced
customer due diligence. Generally speaking, the factors included in the three
annexes relate to types of customers, geographic areas,
and particular products, services, transactions or delivery channels. In
addition, Articles 17 and 18 of Directive 2015/849 envisage guidelines on the risk factors and the measures to be taken in
situations of simplified customer due diligence and enhanced customer due
diligence respectively. Such guidelines shall be issued by ESAs, i.e. the European
Supervisory Authorities (EBA, EIOPA and ESMA) by 26 June 2017.
Photo credit: gfintegrity.org
[1] Ley 10/2010 de prevención del blanqueo de
capitales y de la financiación del terrorismo.
[2] The Executive Service of the
Commission for the Prevention of Money Laundering and Financial Crime of the
Bank of Spain - Servicio Ejecutivo de la Comisión de Prevención de Blanqueo de
Capitales e Infracciones Monetarias del Banco de España.