Review of the policy and procedures on money laundering and terrorist financing

Leite Borges Law Firm reminds the importance of financial entities required to comply with the preventive duties on money laundering and terrorist financing ("AML") under Law nº. 83/2017, of 18 August ("AML Law"), to verify the need to review their AML policy and procedures.

Obliged entities have a duty to review, at intervals appropriate to existing risks or at such other intervals as defined by regulation, the timeliness of AML policies, procedures and controls, in accordance with Article 12(3) of the AML Law.

The notice of Banco de Portugal n. 1/2022 ("Notice"), applicable to financial entities subject to the supervision of Banco de Portugal, provides, in AML regulations, in Article 6(1), that the review of the timeliness of the policies, procedures and controls referred to in Article 12(3) of the AML Law shall be carried out at intervals not exceeding 12 months.

The intervals for the review, in whole or in part, of AML policies, procedures and controls or practices may be extended to 24 months, where justified by the nature, scale and complexity of the activity pursued by the financial entity and the specific operational reality or business area concerned has a lower exposure to AML risks (Article 6 (2) of the Notice).

The CMVM Regulation n. 2/2020 ("Regulation"), applicable to obliged entities of a financial nature subject to the exclusive supervision of the CMVM and to entities of a financial nature whose supervision is shared with Banco de Portugal, provides for, in its AML regulations, specifically in Article 3(3), that obliged entities assess the timeliness and suitability of policies and procedures and controls, as a rule, with a periodicity of no more than 12 months between each evaluation and carry out the respective review, if appropriate.

Obliged entities may provide for valuations to be carried out at intervals of less than 12 months, provided that no more than 24 months between each valuation, where this is justified by the lower exposure to AML risk to which obliged entities are subject, which should be assessed on the basis of nature; the size and complexity of the activity carried out, the type of clients and the operations carried out (Article 3(4) of the Regulation).

As of next year, ASF Regulatory Standard n. 10/2024-R, of 27 November ("Regulatory Standard"), applicable to obliged entities subject to ASF supervision, will also determine, in AML regulation, specifically in Article 5(2)(e), that the appropriate policies, procedures and controls for the effective management of AML risks must be, at least revised at intervals not exceeding 3 years, with a view, inter alia, to their possible updating.

The ASF may, under the Regulatory Standard, determine an extraordinary review when there is an inadequacy of the policies, procedures and controls in this matter due to the activities carried out and the risks verified (Article 5(3) of the Regulatory Standard).

The Regulatory Standard was published in the Official Gazette on 27 November 2024, entering into force on 27 December 2024 (Article 36(1) and (2) of the Regulatory Standard).

For each of the obliged entities, the exact frequency of review of the AML policy and procedures is, as a rule, set out in the respective AML policy and procedures.

Obliged entities should pay special attention to this issue, given its importance and constant monitoring by national supervisory authorities.