By Sergio Silvestri, Director of the European School of Banking Management

Il Legislative Decree no. 90 of 25 May 2017, published in the Official Journal on 19 June and entered into force on July 4th, has substantially rewritten Legislative Decree no. 231 of 2007 (implementing the previous anti-money laundering directive), introducing several innovations regarding the subjects subject to the obligations, registration activities, communications to the competent authorities, the concept of beneficial owner, customer due diligence measures, controls, retention obligations and sanctions.

The new anti-money laundering regulations, implementing the European directive, update the list of entities subject to the obligations and the scope of the services to be monitored, simplifying the data and document retention procedures, in compliance with European law.

The starting point of the directive, in fact, is the broadening and rationalisation of the principle ofrisk-based approach (risk-based approach), already considered by the previous directive, according to which the measures aimed at preventing or mitigating money laundering and terrorist financing must be proportionate to the risks actually identified.

The new provisions also guarantee a system of control of the operators who carry out the activity of money transfer, characterized by a high risk of criminal infiltration.

In accordance with the directive, a sanctioning system based on effective, proportionate and dissuasive measures, to be applied to natural persons and legal entities directly responsible for the violation of the provisions established for the prevention of money laundering and terrorist financing.

Below are some of the most significant changes introduced by the new legislation.

First of all, theElimination of the obligation to maintain a single computer archive for banking and financial intermediariesThe new Articles 31 and 32 require that document, data, and information storage systems must allow for the unambiguous reconstruction of certain essential elements and must be suitable for ensuring compliance with the rules on the disclosure of personal data.

It is requiredadequate customer verificationyou, with the registration of information, even for occasional operations involving a transfer of funds over €1.000 (article 17, paragraph 1).

In the provision of payment services and in the issuance and distribution of e-money, banks, payment institutions and electronic money institutions, including those with their registered office in another Member State, as well as their branches, shall comply with the obligations of due diligence of the customers for operations of amount less than €15.000, including cases in which these are carried out through conventional subjects and agents (Article 17, paragraph 6).

However, the due diligence obligations do not apply to the mere drafting and transmission of tax returns and personnel administration obligations (Article 17, paragraph 8).

Legal entities and private legal entities other than companies must electronically communicate information regarding their beneficial ownership to their respective Registers. Trusts that produce legal effects relevant for tax purposes are required to be registered in a special section of the Company Register, to which the information regarding the beneficial ownership of the trust must be communicated (Article 21);

The new legislation provides for control and monitoring measures that must be adopted by payment institutions and electronic money institutions with respect to their affiliated entities and agents, who must be recorded in a special register kept by the Body of Financial Agents and Credit Brokers (Articles 43-45).

At the same time, the reporting obligations of the supervisory bodies are attenuated: it is necessary to report to the supervisory authorities any facts that may constitute serious, repeated, systematic or multiple violations of the decree, of which they become aware in the exercise of their functions (Article 46).

Furthermore, they must be adopted procedures times ad encourage internal reporting of potential or actual violations of anti-money laundering provisions by the employees (the so-called whistleblowing).

On the gaming frontThe legislation requires distributors and operators of land-based gaming to identify customers who request or carry out gaming transactions for amounts equal to or greater than €2.000 (for the VLT sector, the limit is €500). If there is a risk of money laundering or terrorist financing, anti-money laundering measures must be applied regardless of the amount requested. The identification requirement for online gaming occurs through the gaming account, which can only be topped up through traceable payments. Casino operators must identify and verify customers if the value of transactions carried out for the purchase or exchange of chips, or the collection of winnings, is equal to or greater than €2.000. Casino operators under public control must identify customers upon entry to the casino (Articles 52-54).

Finally, we also point out theextinction by 31 December 2018 of all anonymous bearer passbooks (Article 49) and the proportionality of sanctions based on the professional's non-compliance.