The CJEU on the risk-based approach and enhanced due diligence

The judgment concerned two fines imposed by the Latvian supervisory authority on a tax consulting and auditing firm. The firm had failed to apply enhanced due diligence measures in its business relationship with a foundation whose director is a Russian national. In another case, only standard due diligence was applied to a client who was majority-owned by a company based in Russia.

National risk assessments must be taken into account even if not enshrined in law

At first glance, enhanced due diligence might not have appeared mandatory, as Russia was not listed as a high-risk third country under Delegated Regulation (EU) 2016/1675, and under EU law, a non-governmental organisation as a contracting party does not in itself constitute a mandatory high-risk factor.

However, at the national level, Latvia had determined — also publishing this in state risk reports available on government websites — that economic ties to Russia and the involvement of foundations were to be considered potentially higher money laundering risks.

The CJEU ruled that such risk assessments issued at the national level, even if not legally binding, must still be taken into account by obliged entities. If such identified elevated risk factors are ignored, penalties may be lawfully imposed. This underscores the significance of the risk-based approach in anti-money laundering (AML) efforts.

Considerable additional effort for obliged entities under the German AML Act

For obliged entities, the ruling represents a significant increase in their compliance burden. It makes clear that, beyond the risk factors listed in Annexes 1 and 2 of the German Money Laundering Act (GwG), they must also consider all other relevant risk factors published in official national documents.

Further details can be found in the ruling itself (CJEU, 17.11.2022 – C-562/20) and in the journal BKR (Zeitschrift für Bank- und Kapitalmarktrecht), issue 4/23: “Current Developments in AML Law (2021–2022)”.