European UnionAnti-Money-Laundering Regulation, Special Categories and Criminal Offence Data Processed by Obliged Entities (Articles 76 and 77(3))
Regulation (EU) 2024/1624, Arts. 76(1)-(4) and 77(3)
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Disclosure, Security, Retention
As of .
What it requires
- This duty takes effect on (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on (Article 90).
- If you are an obliged entity, process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679, and personal data relating to criminal convictions and offences referred to in Article 10 of that Regulation, only to the extent that it is strictly necessary for the purposes of preventing money laundering and terrorist financing, and subject to the safeguards of Article 76(2) and (3) (Article 76(1)).
- Inform your customers or prospective customers that special categories of data may be processed for the purpose of complying with the requirements of this Regulation (Article 76(2), point (a)).
- Process personal data covered by Article 9 of Regulation (EU) 2016/679 only if the data originate from reliable sources and are accurate and up-to-date (Article 76(2), point (b)).
- Do not take decisions that would lead to biased and discriminatory outcomes on the basis of personal data covered by Article 9 of Regulation (EU) 2016/679 (Article 76(2), point (c)).
- Adopt measures of a high level of security in accordance with Article 32 of Regulation (EU) 2016/679, in particular in terms of confidentiality, for personal data covered by Article 9 of that Regulation (Article 76(2), point (d)).
- Process personal data covered by Article 10 of Regulation (EU) 2016/679 only if you comply with the conditions of Article 76(2), the data relate to money laundering, its predicate offences or terrorist financing, and you have procedures in place that allow the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions, taking into account the fundamental right to a fair trial, the right of defence and the presumption of innocence (Article 76(3)).
- Process personal data on the basis of this Regulation only for the purposes of the prevention of money laundering and terrorist financing, and do not further process it in a way that is incompatible with those purposes (Article 76(4)).
- Do not process personal data on the basis of this Regulation for commercial purposes (Article 76(4)).
- Delete personal data upon expiry of the five-year retention period of Article 77(3), without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679 (Article 77(3)).
Who enforces it
Enforcement body
The supervisors, which Article 2(1), point (45), defines as the bodies entrusted with responsibilities aimed at ensuring compliance by obliged entities with the requirements of the Regulation, including the Anti-Money Laundering Authority (AMLA) when it performs the tasks entrusted to it in Article 5(2) of Regulation (EU) 2024/1620.
What this law does
Article 76(1) provides that, to the extent that it is strictly necessary for the purposes of preventing money laundering and terrorist financing, obliged entities may process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679 and personal data relating to criminal convictions and offences referred to in Article 10 of that Regulation, subject to the safeguards in paragraphs 2 and 3 of Article 76.
Article 76(2) permits an obliged entity to process personal data covered by Article 9 of Regulation (EU) 2016/679 provided that it informs its customers or prospective customers that such categories of data may be processed for the purpose of complying with the requirements of the Regulation, the data originate from reliable sources and are accurate and up-to-date, it does not take decisions that would lead to biased and discriminatory outcomes on the basis of those data, and it adopts measures of a high level of security in accordance with Article 32 of Regulation (EU) 2016/679, in particular in terms of confidentiality.
Article 76(3) permits an obliged entity to process personal data covered by Article 10 of Regulation (EU) 2016/679 provided that it complies with the conditions of Article 76(2), the data relate to money laundering, its predicate offences or terrorist financing, and it has procedures in place that allow the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions, taking into account the fundamental right to a fair trial, the right of defence and the presumption of innocence.
Article 76(4) provides that personal data shall be processed by obliged entities on the basis of the Regulation only for the purposes of the prevention of money laundering and terrorist financing and shall not be further processed in a way that is incompatible with those purposes. Article 76(4) prohibits the processing of personal data on the basis of the Regulation for commercial purposes.
Article 77(3) provides that the information referred to in Article 77(1) and (2) shall be retained for a period of 5 years commencing on the date of the termination of the business relationship, on the date of the carrying out of the occasional transaction, or on the date of refusal to enter into a business relationship or carry out an occasional transaction.
Article 77(3) provides that, without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679, obliged entities shall delete personal data upon expiry of the five-year period.
Article 77(3) lets competent authorities require further retention on a case-by-case basis where it is necessary for the prevention, detection, investigation or prosecution of money laundering or terrorist financing, for a further period that shall not exceed 5 years.
Article 3 lists credit institutions and financial institutions among the obliged entities.
Article 3, point (3), lists as further obliged entities, when acting in the exercise of their professional activities and in the cases it describes, auditors, external accountants and tax advisors, notaries, lawyers and other independent legal professionals, trust or company service providers, estate agents and other real estate professionals, persons trading in precious metals and stones or in high-value goods, providers of gambling services, crowdfunding service providers and crowdfunding intermediaries, persons trading or acting as intermediaries in the trade of cultural goods, credit intermediaries for mortgage and consumer credits, investment migration operators, non-financial mixed activity holding companies, football agents, and professional football clubs in respect of the transactions it lists.
Article 90 provides that the Regulation applies from , except in relation to the obliged entities referred to in Article 3, points (3)(n) and (o), to which it applies from .
When LexLint raises it
When your app profile says your app provides financial services.