1.Member States shall ensure that obliged entities can be held liable for breaches of national provisions transposing this Directive in accordance with this Article and Articles 59 to 61. Any resulting sanction or measure shall be effective, proportionate and dissuasive.
2.Without prejudice to the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on administrative sanctions and measures and ensure that their competent authorities may impose such sanctions and measures with respect to breaches of the national provisions transposing this Directive, and shall ensure that they are applied.
Member States may decide not to lay down rules for administrative sanctions or measures for breaches which are subject to criminal sanctions in their national law. In that case, Member States shall communicate to the Commission the relevant criminal law provisions.
[F1Member States shall further ensure that where their competent authorities identify breaches which are subject to criminal sanctions, they inform the law enforcement authorities in a timely manner.]
3.Member States shall ensure that where obligations apply to legal persons in the event of a breach of national provisions transposing this Directive, sanctions and measures can be applied to the members of the management body and to other natural persons who under national law are responsible for the breach.
4.Member States shall ensure that the competent authorities have all the supervisory and investigatory powers that are necessary for the exercise of their functions.
5.Competent authorities shall exercise their powers to impose administrative sanctions and measures in accordance with this Directive, and with national law, in any of the following ways:
(a)directly;
(b)in collaboration with other authorities;
(c)under their responsibility by delegation to such other authorities;
(d)by application to the competent judicial authorities.
In the exercise of their powers to impose administrative sanctions and measures, competent authorities shall cooperate closely in order to ensure that those administrative sanctions or measures produce the desired results and coordinate their action when dealing with cross-border cases.
Textual Amendments
F1 Inserted by Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU (Text with EEA relevance).
1.Member States shall ensure that this Article applies at least to breaches on the part of obliged entities that are serious, repeated, systematic, or a combination thereof, of the requirements laid down in:
(a)Articles 10 to 24 (customer due diligence);
(b)Articles 33, 34 and 35 (suspicious transaction reporting);
(c)Article 40 (record-keeping); and
(d)Articles 45 and 46 (internal controls).
2.Member States shall ensure that in the cases referred to in paragraph 1, the administrative sanctions and measures that can be applied include at least the following:
(a)a public statement which identifies the natural or legal person and the nature of the breach;
(b)an order requiring the natural or legal person to cease the conduct and to desist from repetition of that conduct;
(c)where an obliged entity is subject to an authorisation, withdrawal or suspension of the authorisation;
(d)a temporary ban against any person discharging managerial responsibilities in an obliged entity, or any other natural person, held responsible for the breach, from exercising managerial functions in obliged entities;
(e)maximum administrative pecuniary sanctions of at least twice the amount of the benefit derived from the breach where that benefit can be determined, or at least EUR 1 000 000.
3.Member States shall ensure that, by way of derogation from paragraph 2(e), where the obliged entity concerned is a credit institution or financial institution, the following sanctions can also be applied:
(a)in the case of a legal person, maximum administrative pecuniary sanctions of at least EUR 5 000 000 or 10 % of the total annual turnover according to the latest available accounts approved by the management body; where the obliged entity is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial accounts in accordance with Article 22 of Directive 2013/34/EU, the relevant total annual turnover shall be the total annual turnover or the corresponding type of income in accordance with the relevant accounting Directives according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking;
(b)in the case of a natural person, maximum administrative pecuniary sanctions of at least EUR 5 000 000, or in the Member States whose currency is not the euro, the corresponding value in the national currency on 25 June 2015.
4.Member States may empower competent authorities to impose additional types of administrative sanctions in addition to those referred to in points (a) to (d) of paragraph 2 or to impose administrative pecuniary sanctions exceeding the amounts referred to in point (e) of paragraph 2 and in paragraph 3.
1.Member States shall ensure that a decision imposing an administrative sanction or measure for breach of the national provisions transposing this Directive against which there is no appeal shall be published by the competent authorities on their official website immediately after the person sanctioned is informed of that decision. The publication shall include at least information on the type and nature of the breach and the identity of the persons responsible. Member States shall not be obliged to apply this subparagraph to decisions imposing measures that are of an investigatory nature.
Where the publication of the identity of the persons responsible as referred to in the first subparagraph or the personal data of such persons is considered by the competent authority to be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where publication jeopardises the stability of financial markets or an on-going investigation, competent authorities shall:
(a)delay the publication of the decision to impose an administrative sanction or measure until the moment at which the reasons for not publishing it cease to exist;
(b)publish the decision to impose an administrative sanction or measure on an anonymous basis in a manner in accordance with national law, if such anonymous publication ensures an effective protection of the personal data concerned; in the case of a decision to publish an administrative sanction or measure on an anonymous basis, the publication of the relevant data may be postponed for a reasonable period of time if it is foreseen that within that period the reasons for anonymous publication shall cease to exist;
(c)not publish the decision to impose an administrative sanction or measure at all in the event that the options set out in points (a) and (b) are considered insufficient to ensure:
that the stability of financial markets would not be put in jeopardy; or
the proportionality of the publication of the decision with regard to measures which are deemed to be of a minor nature.
2.Where Member States permit publication of decisions against which there is an appeal, competent authorities shall also publish, immediately, on their official website such information and any subsequent information on the outcome of such appeal. Moreover, any decision annulling a previous decision to impose an administrative sanction or a measure shall also be published.
3.Competent authorities shall ensure that any publication in accordance with this Article shall remain on their official website for a period of five years after its publication. However, personal data contained in the publication shall only be kept on the official website of the competent authority for the period which is necessary in accordance with the applicable data protection rules.
4.Member States shall ensure that when determining the type and level of administrative sanctions or measures, the competent authorities shall take into account all relevant circumstances, including where applicable:
(a)the gravity and the duration of the breach;
(b)the degree of responsibility of the natural or legal person held responsible;
(c)the financial strength of the natural or legal person held responsible, as indicated for example by the total turnover of the legal person held responsible or the annual income of the natural person held responsible;
(d)the benefit derived from the breach by the natural or legal person held responsible, insofar as it can be determined;
(e)the losses to third parties caused by the breach, insofar as they can be determined;
(f)the level of cooperation of the natural or legal person held responsible with the competent authority;
(g)previous breaches by the natural or legal person held responsible.
5.Member States shall ensure that legal persons can be held liable for the breaches referred to in Article 59(1) committed for their benefit by any person, acting individually or as part of an organ of that legal person, and having a leading position within the legal person based on any of the following:
(a)power to represent the legal person;
(b)authority to take decisions on behalf of the legal person; or
(c)authority to exercise control within the legal person.
6.Member States shall also ensure that legal persons can be held liable where the lack of supervision or control by a person referred to in paragraph 5 of this Article has made it possible to commit one of the breaches referred to in Article 59(1) for the benefit of that legal person by a person under its authority.
[F21. Member States shall ensure that competent authorities, as well as, where applicable, self-regulatory bodies, establish effective and reliable mechanisms to encourage the reporting to competent authorities, as well as, where applicable self-regulatory bodies, of potential or actual breaches of the national provisions transposing this Directive.
For that purpose, they shall provide one or more secure communication channels for persons for the reporting referred to in the first subparagraph. Such channels shall ensure that the identity of persons providing information is known only to the competent authorities, as well as, where applicable, self-regulatory bodies.]
2.The mechanisms referred to in paragraph 1 shall include at least:
(a)specific procedures for the receipt of reports on breaches and their follow-up;
(b)appropriate protection for employees or persons in a comparable position, of obliged entities who report breaches committed within the obliged entity;
(c)appropriate protection for the accused person;
(d)protection of personal data concerning both the person who reports the breaches and the natural person who is allegedly responsible for a breach, in compliance with the principles laid down in Directive 95/46/EC;
(e)clear rules that ensure that confidentiality is guaranteed in all cases in relation to the person who reports the breaches committed within the obliged entity, unless disclosure is required by national law in the context of further investigations or subsequent judicial proceedings.
3.Member States shall require obliged entities to have in place appropriate procedures for their employees, or persons in a comparable position, to report breaches internally through a specific, independent and anonymous channel, proportionate to the nature and size of the obliged entity concerned.
[F1Member States shall ensure that individuals, including employees and representatives of the obliged entity who report suspicions of money laundering or terrorist financing internally or to the FIU, are legally protected from being exposed to threats, retaliatory or hostile action, and in particular from adverse or discriminatory employment actions.
Member States shall ensure that individuals who are exposed to threats, hostile actions, or adverse or discriminatory employment actions for reporting suspicions of money laundering or terrorist financing internally or to the FIU are entitled to present a complaint in a safe manner to the respective competent authorities. Without prejudice to the confidentiality of information gathered by the FIU, Member States shall also ensure that such individuals have the right to effective remedy to safeguard their rights under this paragraph.]
Textual Amendments
F1 Inserted by Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU (Text with EEA relevance).
F2 Substituted by Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU (Text with EEA relevance).
1.Member States shall ensure that their competent authorities inform the ESAs of all administrative sanctions and measures imposed in accordance with Articles 58 and 59 on credit institutions and financial institutions, including of any appeal in relation thereto and the outcome thereof.
2.Member States shall ensure that their competent authorities, in accordance with their national law, check the existence of a relevant conviction in the criminal record of the person concerned. Any exchange of information for those purposes shall be carried out in accordance with Decision 2009/316/JHA and Framework Decision 2009/315/JHA as implemented in national law.
3.The ESAs shall maintain a website with links to each competent authority's publication of administrative sanctions and measures imposed in accordance with Article 60 on credit institutions and financial institutions, and shall show the time period for which each Member State publishes administrative sanctions and measures.