Recital 18

(18) Efficient usage of data leads to better monitoring and compliance of obliged entities. Therefore, both direct and indirect supervision by the Authority and supervisory authorities of all obliged entities across the AML/CFT supervisory system should rely on expeditious access to relevant data and information about the obliged entities themselves and the supervisory actions and measures taken regarding them, subject to limited retention periods in accordance with the applicable data protection framework. To that end, and taking into account the confidential and sensitive nature of the information, the Authority should establish a central AML/CFT database with information collected from all supervisory authorities, and should make such information available to any supervisory authority and non-AML/CFT authority within the system where necessary, on a confidential and need-to-know basis. The collected data should also cover the relevant aspects of the withdrawal of authorisation procedures and ‘fit and proper’ assessments of shareholders or members of the management body of individual obliged entities as that would enable supervisory authorities and non-AML/CFT authorities to duly consider possible shortcomings of specific entities and individuals that might have materialised in other Member States. The database should also include statistical information about supervisory authorities and FIUs. All collected data and information would enable effective oversight by the Authority of the proper functioning and effectiveness of the AML/CFT supervisory system. The information from the database would enable the Authority to react in a timely manner to potential weaknesses and cases of non-compliance by non-selected obliged entities. In order to ensure that the database contains all relevant information that is available across the AML/CFT supervisory system, supervisory authorities should have the flexibility to submit other categories of data in addition to those directly envisaged by this Regulation. In the same vein, the Authority, while managing the database and analysing the submitted data, would be best placed to identify which additional data points or categories of data could be requested from supervisory authorities to boost the effectiveness of the database. To assist in compiling, storing and using a coherent and structured dataset, it is necessary to further specify the format, procedures, timelines and other details regarding the scope and nature of the data to be transmitted to the database. For that purpose, the Authority should develop draft regulatory technical standards and submit them to the Commission. The specifications provided for in the regulatory technical standards would determine the appropriate level of detail for specific categories of information expected to be transmitted with respect to the various types of supervisory activities or categories of obliged entities. The data collected with regard to obliged entities in the non-financial sector should consider the principle of proportionality and the mandate of the Authority in the non-financial sector. In addition, considering that the Authority would introduce oversight at Union level in the non-financial sector for the first time, and that Directive (EU) 2024/1640 requires adjustments in the national institutional framework for supervision which need to be transposed, it is necessary to envisage a sufficient period to prepare the integration into the database of the information from supervisory authorities in the non-financial sector. Specifically, non-financial sector data should be submitted to the database by four years from the date of entry into force of this Regulation, which is one year after the deadline for transposition of Directive (EU) 2024/1640. However, supervisory authorities in the non-financial sector should be able to submit those data on a voluntary basis before that date. The personal data processed in the context of the database should be retained for a period of up to 10 years after the date of their collection by the Authority. Such a retention period is strictly necessary and proportionate for the purpose of supervisory activities carried out by the Authority and supervisory authorities. The length of the data retention period also ensures that the Authority and supervisory authorities retain access to the necessary information on the risk assessment, business activities, controls placed on and breaches by individual obliged entities in order to carry out their duties, which requires them to access case-related information over a longer period of time. Such a retention period is notably necessary since supervisory authorities should take into account, among other factors, the gravity, duration and repetitiveness of the breach to determine the level of sanctions or measures to be applied, which requires case-related information to be analysed over a longer period of reference. Similarly, such a retention period is also necessary with regard to information resulting from ‘fit and proper’ assessments of shareholders or members of the management body in order to ensure that supervisory authorities have sufficient information to assess whether they are of good repute, act with honesty and integrity, and possess the knowledge and expertise necessary to carry out their functions, and to ensure ongoing monitoring of those conditions as required by Directive (EU) 2024/1640. Personal data should be deleted where it is no longer necessary to keep them. In view of the purpose of the database and the use of the information contained therein by the various participants of the AML/CFT supervisory system, it should not contain any data covered by legal privilege.

← Recital 17 · All articles · Recital 19 →

Source: EUR-Lex CELLAR · retrieved 2026-09-04 · Text as adopted (Official Journal); later amendments are not incorporated in this text.