## 1autea2020005 - EXECUTIVE SUMMARY

## Source details

**Canonical URL:** [1autea2020005 - EXECUTIVE SUMMARY](https://www.imf.org/-/media/files/publications/cr/2020/english/1autea2020005.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2020/english/1autea2020005.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2020/english/1autea2020005.pdf.json)

---

### INTRODUCTION
- This Technical Note (TN) sets out findings and recommendations from the 2019 Financial Sector Assessment Program (FSAP) for Austria in the areas of AML/CFT.
- Scope: targeted review of progress addressing ML/TF vulnerabilities in the banking sector (including AML/CFT supervision and cross-border activities), progress in enhancing transparency of legal persons and arrangements, and risks related to Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs).
- Clarification: This review is not an assessment or evaluation of Austria’s AML/CFT regime. Austria’s AML/CFT system was assessed by the FATF and the Mutual Evaluation Report (MER) was adopted in September 2016.

### PROGRESS SINCE THE LAST ASSESSMENT
- Legislative and regulatory actions since the 2016 MER and 2013 FSAP:
  - Amendments to the Financial Markets Anti-Money Laundering Act (FM AML Act).
  - Adoption of the Beneficial Owners Register Act (BORA).
  - Transposition of the Fourth and the Fifth Anti-Money Laundering Directives (4AMLD and 5AMLD).
- Outcomes:
  - Significant enhancements to legal/regulatory framework; a number of upgrades on technical compliance ratings by FATF via two Follow-Up Reports (FURs).
  - Measures to improve framework for lawyers, notaries, tax advisors, and other DNFBPs; implementation still needs strengthening.
- Beneficial Ownership Register:
  - Register of Beneficial Owners established in 2017 via BORA to implement 4AMLD; July 2019 BORA amendment transposed 5AMLD into domestic law.
  - Competent authorities have timely access to BO information via the register.

### ASSESSING AND UNDERSTANDING ML/TF RISKS (NRA)
- Current status:
  - Austria is reviewing its ML/TF national risk assessment (NRA). Last NRA completed in 2015 but was not comprehensive.
- Recommendations:
  - Ensure revised NRA includes comprehensive review and assessment of ML/TF threats and vulnerabilities (including misuse of legal persons and arrangements, VAs/VASPs risks).
  - Following the revision, adopt an AML/CFT strategy and action plan to align national policies and priorities with NRA findings.

### AML/CFT SUPERVISION IN THE BANKING SECTOR — FRAMEWORK AND TOOLS
- FMA approach and tools:
  - Financial Market Authority (FMA) adopted risk-based approach and developed an offsite risk rating tool to classify financial institutions (FIs) by ML/TF risk profile; methodology and risk-scoring tool positive but need refinement.
  - The tool captures customers, products and services, geographical locations and delivery channels, and internal control quality; filled by annual AML questionnaire (last data collection completed by mid-August 2019).
- Sector vulnerabilities:
  - Large financial sector; complex ownership structures; cross-border linkages; significant exposure to Central, Eastern, and South Eastern Europe (CESEE).
  - High-profile cross-border ML/TF scandals involving large international institutions, including some Austrian banks, underline need for stronger group-wide supervision.
- Cross-border cooperation and legal constraints:
  - Submission of information to authorities in third countries permissible under FM AML Act only if equivalent level of professional secrecy (European Banking Authority list equivalence); uncertainty about home/host responsibilities and access to information affects cross-border supervision.
  - According to EBA list equivalence, the Russian Federation is currently not equivalent.
- Supervisory practice recommendations:
  - Revise onsite inspection approach and shorten supervisory cycle to increase frequency of onsite inspections.
  - Emphasize effective implementation of Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) especially for higher risk activities and cross-border exposures (non-resident customers, offshore corporate structures, CESEE).
  - Improve communication and information exchange between AML and prudential teams (including OeNB and ECB).
  - Monitor group-level AML/CFT controls and employ remedial actions where necessary.

### AML/CFT SUPERVISION — RISK METHODOLOGY, CLASSIFICATION, AND ONSITE ACTIVITY
- Risk methodology and inputs:
  - Offsite risk scoring tool uses quantitative and qualitative inputs including outsourcing, cash transactions, client as a foreign trust, money remittances, PEPs, BO risk, location risk, transaction volume, number of transactions, complemented by onsite findings and statutory audit reports.
- Risk classification results (risk categories and counts/statistics):
  - High Risk: 1% (6 banks)
  - Elevated Risk: 1.5% (9 banks)
  - Moderate Risk: 18.1% (110 banks)
  - Low Risk: 79.4% (482 banks)
- Findings:
  - Given size, complexity, and cross-border linkages, distribution (majority low risk; very few elevated/moderate) suggests the risk-scoring outputs may understate risk.
  - Offsite tool results drive onsite activities; reassessment of criteria is advised.
- Onsite framework and frequency:
  - Two types of onsite measures: onsite inspections (one to three weeks; team of two up to five) and onsite examinations (three-hour visit involving two people).
  - Prescribed inspection cycles by risk classification:
    - High risk: Onsite Inspections Max. 3 years; Onsite Examinations and Other Measures Yearly
    - Elevated risk: Onsite Inspections Max. 5 years; Onsite Examinations and Other Measures Max. 3 years
    - Moderate risk: Onsite Inspections Max. 8 years; Onsite Examinations and Other Measures Max 5 years
    - Low risk: Onsite Inspections - ; Onsite Examinations and Other Measures Max 15 years
  - Recent onsite activity counts:
    - 2016: 20 / 26 (AML Onsite Inspections on Credit Institutions / AML Examinations on Credit Institutions)
    - 2017: 24 / 24
    - 2018: 30 / 29
    - 2019 Ongoing: 27 / 23
- Recommendations:
  - Reassess and validate risk-rating criteria to achieve a more realistic distribution across four risk categories.
  - Shorten supervisory cycle and intensify frequency of onsite inspections to validate risk scoring and internal control quality.
  - Suggested minimum frequencies:
    - High-risk banks: inspect at least annually.
    - Elevated-risk banks: inspect once every 18 to 24 months maximum.
  - Conduct more frequent and comprehensive visits, including for low-rated banks.

### SUPERVISORY FINDINGS, ENFORCEMENT, AND RESOURCES
- Common supervisory deficiencies:
  - Breaches of CDD obligations; inadequate transaction monitoring; failure to identify and verify BO; weak internal controls and procedures.
- Administrative penal proceedings by FMA:
  - 35 in 2016
  - 21 in 2017
  - 11 in 2018
- Significant fines in 2018:
  - EUR 2,748,000 imposed on one large bank for inadequate verification of BO identity and failure to update ownership/control documentation.
  - EUR 414,000 imposed on another Austrian bank for similar violations and late reporting of a suspicious transaction.
  - Other pecuniary fines range from EUR 600 to EUR 200,000.
- Resourcing:
  - AML Division current staff allocated: 18,25 FTE (two teams: “Onsite Inspections Team” and “Enforcement Team”); five additional staff assigned since 2016 MER.
  - Recommendation: consider allocating further resources to AML/CFT supervision in the short term to address workload and new responsibilities (e.g., VAs/VASPs).

### PASSPORTED PSPs, EMIs, AGENTS, AND CROSS-BORDER SUPERVISION
- Key statistics:
  - 63 foreign EMIs operating in Austria under the EU passporting regime.
  - 281 passported PSPs and their agents.
  - Austrian banks’ exposure: 24 percent exposure in 2018 to CESEE countries.
  - Almost 600 banks in Austria.
  - 6 significant institutions under the SSM representing 60 percent of total system assets.
  - High concentration: three banks hold 50 percent of market share.
- Findings and recommendations:
  - Home supervisor responsibility for passported institutions creates host-supervisor oversight gaps for agents; FMA should increase oversight of agents and ensure cooperation with home supervisors.
  - Consider MOUs with third countries where Austrian banks have branches/subsidiaries: Albania, Belarus, Serbia, Kosovo, Montenegro, North Macedonia, Moldova and Ukraine.

### VIRTUAL ASSETS (VAs) AND VIRTUAL ASSET SERVICE PROVIDERS (VASPs)
- Legal developments:
  - FM AML Act amended to transpose 5AMLD into national legislation, commencing January 10, 2020.
  - Act assigns FMA responsibility for registration and monitoring of VAs/VASPs; VAs/VASPs are obliged entities under the FMA AML Act and subject to AML/CFT obligations.
  - Act defines virtual currencies and virtual currencies service providers in line with the FATF definition; the definition goes beyond the 5AMLD by including custodial wallet providers and other services.
  - Registration period started on October 1, 2019; registration mandatory on January 10, 2020; offering VA services without registration carries a fine of up to EUR 200,000.
- Market status and risks:
  - FMA aware of 12 local companies providing VA-related services; no concrete data on VASPs based abroad offering products and services in Austria.
  - Authorities consider use of Bitcoin as a high ML risk; national studies (e.g., Bitcrime, TITANIUM, VIRTCRIME) and participation in research initiatives to build forensic and analytical capability.
- Data, capacity, and resource gaps:
  - Low level of data and no clarity on how many providers would apply for registration.
  - FMA has limited IT systems and needs skilled staff; skills will take time to build.
- Recommendations (short term priorities):
  - Monitor developments closely and consider VA/VASP risks in updated NRA. Priority: MT.
  - Foster cooperation and dialogue with industry to understand challenges. Priority: NT.
  - Allocate sufficient human and technological resources to monitor VAs/VASPs and build in-house expertise. Priority: NT.
  - Ensure thematic focus on VASPs during the next inspection plan for 2020.

### ENTITY TRANSPARENCY AND BENEFICIAL OWNERSHIP
- Company landscape and Treuhänd:
  - Common company forms listed (GmbH, AG, GmbH, etc.); approximately 272.795 legal companies in Austria.
  - Treuhänd is a civil contract (trustee Treuhänder acts in own name for settlor Treugeber); often lawyers and notaries act as Treuhänder.
- BO Register (BORA) and enhancements:
  - BORA (took effect January 15, 2018) establishes Central Register for BOs; amended July 2019 to transpose 5AMLD and provide for public access to BO data.
  - Master data sources: Commercial Register, Register of Associations, Supplementary Register for Others; on average 353,010 reportable companies recorded.
  - Exemptions under Art. 6: 280,495 legal entities currently covered by exception (e.g., ordinary partnerships and limited partnerships if all partners are natural persons; limited liability companies if all shareholders are natural persons; associations pursuant to the Associations Act).
  - Reporting obligations: identification and verification of BO; retention of copies; review at least once a year; reporting of changes within four weeks.
  - Registry Authority achieved reporting rate of more than 95 percent as of September 2, 2019.
  - Compliance package (identification and verification documents submitted yearly) to enter into force on November 10, 2020.
  - Starting on January 10, 2020, natural persons and organizations may consult the register without demonstrating a legitimate interest.
  - Risk classification of legal entities to be put in place by January 10, 2020 (very high/high/medium/low).
- Outstanding issues and recommendations:
  - Continue implementing measures enhancing transparency of legal entities, particularly Treuhänd arrangements.
  - Ensure legal requirement for trustees (or equivalent persons) to hold information on regulated agents or service providers to trusts.
  - Ensure proper and timely implementation of CDD obligations by lawyers, notaries, and accountants in company formation and real estate transactions.
  - Ensure that associations are legally required to maintain a list of their members.

### STRs RECEIVED BY REPORTING ENTITIES (TABLE 2 FIGURES)
- Banks: 2015 — 1755; 2016 — 2002; 2017 — 2976; 2018 — 2710
- Business industries: 2015 — 5; 2016 — 6; 2017 — 6; 2018 — 5
- Insurances: 2015 — 12; 2016 — 16; 2017 — 17; 2018 — 18
- Lawyers: 2015 — 12; 2016 — 11; 2017 — 15; 2018 — 23
- Casinos: 2015 — 1; 2016 — 0; 2017 — 1; 2018 — 2
- Notaries: 2015 — 4; 2016 — 4; 2017 — 20; 2018 — 15
- Trusts: 2015 — 2; 2016 — 4; 2017 — 2; 2018 — 4
- Traders: 2015 — 0; 2016 — 0; 2017 — 0; 2018 — 0
- Accountants: 2015 — 1; 2016 — 3; 2017 — 3; 2018 — 1
- Real Estate Agents: 2015 — 1; 2016 — 0; 2017 — 3; 2018 — 0

### MAIN FSAP RECOMMENDATIONS FOR AML/CFT (HIGHLIGHTS)
- Enhancing reporting and STRs:
  - Enhance quality and consistency of reporting across sectors, especially DNFBPs where reporting is very low. Provide guidance on typologies and timely feedback to obliged entities to increase quantity and quality of STRs. Priority: NT.
  - Monitor proper implementation of new obligations imposed in national legislation (FMA Act and BORA) as part of transposition of 5AMLD. Priority: NT.
- Assessing ML/TF risks and national coordination:
  - Conclude revision and update of the NRA, deepening analysis of ML/TF risks, including legal persons/arrangements and NPOs. Priority: NT.
  - Adopt an AML/CFT strategy and action plan aligned with NRA findings. Priority: MT.
  - Monitor implementation of recommendations set by the National AML/CFT Coordination Committee and ensure timely involvement of private sector where relevant. Priority: MT.
- Banking sector AML/CFT supervision:
  - Revise methodology and risk scoring tool to align results with banks’ ML/TF risk profiles; calibrate to better reflect ML/TF risk exposure. Priority: NT.
  - Ensure banks implement legal changes (lower threshold for high-risk third country involvement triggering EDD; obligation to inspect the BO Register as part of CDD). Priority: NT.
  - Support establishing an EU-level arrangement responsible for AML/CFT supervision. Priority: MT.
  - Expand information in risk scoring tool to consider cross-border risks and expand quantitative/qualitative information for assessing inherent ML/TF risks and internal controls. Priority: NT.
  - Increase frequency and scope of onsite inspections, including for low risk institutions. Priority: NT.
  - Reinforce EDD conduct for higher risk activities and increase onsite inspections in branches and subsidiaries, particularly in CESEE. Priority: NT.
  - Increase supervision over Passported PSPs and EMIs using agents; ensure closer cooperation with countries where agents operate. Priority: NT.
  - Increase efforts to improve cross-border information exchanges with non-EU/EEA countries; consider MOUs with third countries where Austrian banks have branches/subsidiaries (Albania, Belarus, Serbia, Kosovo, Montenegro, North Macedonia, Moldova and Ukraine). Priority: MT.
  - Foster increased collaboration and information sharing between AML team and prudential supervisors (including OeNB and ECB). Priority: NT.
  - Increase supervisory resources for the AML division and provide training for new responsibilities (e.g., VA/VASPs). Priority: NT.
- Entity transparency:
  - Continue pursuing implementation of measures to enhance transparency of legal entities and Treuhänd arrangements. Priority: NT.
  - Ensure trustees hold information on regulated agents/service providers to trusts. Priority: NT.
  - Ensure CDD obligations by lawyers, notaries, accountants in company formation and real estate transactions. Priority: NT.
- VAs and VASPs:
  - Monitor VA/VASP developments and consider VA/VASP risks in the updated 2015 NRA. Priority: MT.
  - Foster cooperation and dialogue with industry to understand challenges in adjusting systems to comply with AML/CFT. Priority: NT.
  - Allocate sufficient human and technological resources to monitor VAs/VASPs and build in-house expertise. Priority: NT.
  - Ensure proper implementation of AML/CFT framework by VASPs. Priority: NT.

*1autea2020005 - EXECUTIVE SUMMARY*

### EXECUTIVE SUMMARY __________________________________________________________________________ 4

### EXECUTIVE SUMMARY

### INTRODUCTION
- This Technical Note (TN) sets out findings and recommendations from the 2019 Financial Sector Assessment Program (FSAP) for Austria in the areas of AML/CFT.
- Scope: targeted review of progress addressing ML/TF vulnerabilities in the banking sector (including AML/CFT supervision and cross-border activities), progress in enhancing transparency of legal persons and arrangements, and risks related to Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs).
- Clarification: This review is not an assessment or evaluation of Austria’s AML/CFT regime. Austria’s AML/CFT system was assessed by the FATF and the Mutual Evaluation Report (MER) was adopted in September 2016.

### PROGRESS SINCE THE LAST ASSESSMENT
- Key legislative and regulatory actions taken since the 2016 MER and the 2013 FSAP:
  - Amendments to the Financial Markets Anti-Money Laundering Act (FM AML Act).
  - Adoption of the Beneficial Owners Register Act (BORA).
  - Transposition of the Fourth and the Fifth Anti-Money Laundering Directives (4AMLD and 5AMLD) into national legislation.
- Outcomes:
  - Significant enhancements to the legal and regulatory framework resulted in a number of upgrades on technical compliance ratings by the FATF in the context of two Follow-Up Reports (FURs).
  - Measures to improve the legal and regulatory framework for lawyers, notaries, tax advisors, and other DNFBPs; implementation still needs strengthening.
- Beneficial Ownership Register:
  - A Register of Beneficial Owners of Companies, Other Legal Entities and Trusts established in 2017 via BORA to implement 4AMLD.
  - July 2019 BORA amendment transposed 5AMLD into domestic law.
  - Competent authorities have timely access to BO information via the register.

### ASSESSING AND UNDERSTANDING ML/TF RISKS (NRA)
- Austria is reviewing its ML/TF national risk assessment (NRA).
  - Last NRA completed in 2015 but was not comprehensive.
- Recommendations:
  - Ensure the revised NRA includes comprehensive review and assessment of ML/TF threats and vulnerabilities (including misuse of legal persons and arrangements, VAs/VASPs risks).
  - Following the revision, adopt an AML/CFT strategy and action plan to align national policies and priorities with NRA findings.

### AML/CFT SUPERVISION IN THE BANKING SECTOR
- FMA supervisory approach and tools:
  - Financial Market Authority (FMA) has adopted a risk-based approach and developed an offsite risk rating tool to classify financial institutions (FIs) by ML/TF risk profile.
  - The methodology and risk-scoring tool are positive developments but require further refinement.
  - Currently almost 80 percent of the banks are rated low risk.
- Sector vulnerabilities:
  - Large financial sector, possibility of complex ownership structures, cross-border linkages, and significant exposure to Central, Eastern, and South Eastern Europe (CESEE) increase ML/TF vulnerability.
  - High-profile cross-border ML/TF scandals involving large international institutions, including some Austrian banks, underline need for stronger group-wide supervision.
- Cross-border cooperation and legal constraints:
  - Legal/regulatory frameworks allow cross-border cooperation with EU/EEA countries, but legal obstacles hinder effective information exchange with several third countries.
  - Under the FM AML Act, submission of information to authorities in third countries is permissible only if they are subject to, or have agreed to, an equivalent level of professional secrecy corresponding to relevant European legal acts (European Banking Authority list equivalence).
  - Uncertainty about home/host supervisory responsibilities and access to information affects cross-border supervision.
- Supervisory practice recommendations:
  - Revise onsite inspection approach and shorten supervisory cycle to increase frequency of onsite inspections.
  - Emphasize effective implementation of Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) especially for higher risk activities and cross-border exposures (non-resident customers, offshore corporate structures, CESEE).
  - Improve communication and information exchange between AML and prudential teams (including OeNB and ECB).
  - Monitor group-level AML/CFT controls and employ remedial actions where necessary.

### VIRTUAL ASSETS (VAs) AND VIRTUAL ASSET SERVICE PROVIDERS (VASPs)
- Legal developments:
  - FM AML Act amended to transpose 5AMLD into national legislation, commencing January 2020.
  - The Act assigns the FMA responsibility for registration and monitoring of VAs/VASPs; VAs/VASPs are obliged entities under the FMA AML Act and subject to AML/CFT obligations.
  - The Act defines virtual currencies and virtual currencies service providers in line with the FATF definition, and the definition goes beyond the 5AMLD.
- Market status and risks:
  - FMA aware of five local companies providing VA-related services.
  - No concrete data on VA/VASPs based abroad offering products and services in Austria.
- Recommendations:
  - Continue efforts to address ML/TF risks associated with VAs and VASPs to ensure proper implementation of AML/CFT obligations.
  - Allocate sufficient human and technological resources to monitor VAs/VASPs and build in-house expertise.

### ENTITY TRANSPARENCY AND BENEFICIAL OWNERSHIP
- BO register and transparency:
  - BORA and the BO Register have been key developments to increase entity transparency and help address deficiencies identified in the 2016 MER.
  - Legal persons and arrangements have obligation to obtain and maintain up-to-date BO information and provide this to the register.
  - Competent authorities have timely access to BO information through the register.
- Remaining issues and recommendations:
  - Continue implementing measures enhancing transparency of legal entities, particularly Treuhänd arrangements.
  - Ensure a legal requirement for trustees (or equivalent persons) to hold information on regulated agents or service providers to trusts.
  - Ensure proper and timely implementation of CDD obligations by lawyers, notaries, and accountants when setting up companies and in relation to real estate transactions.

### MAIN FSAP RECOMMENDATIONS FOR AML/CFT (HIGHLIGHTS FROM TABLE 1)
- Enhancing reporting and STRs:
  - Enhance the quality and consistency of reporting across sectors, especially DNFBPs where reporting is very low. Provide guidance on typologies and timely feedback to obliged entities to increase quantity and quality of STRs in line with ML/TF risks. Priority: NT.
  - Monitor proper implementation of new obligations imposed in national legislation (FMA Act and BORA) as part of transposition of 5AMLD. Priority: NT.
- Assessing ML/TF risks and national coordination:
  - Conclude revision and update of the NRA, deepening analysis of ML/TF risks, including legal persons/arrangements and NPOs. Priority: NT.
  - Adopt an AML/CFT strategy and action plan aligned with NRA findings. Priority: MT.
  - Monitor implementation of recommendations set by the National AML/CFT Coordination Committee and ensure timely involvement of private sector where relevant. Priority: MT.
- Banking sector AML/CFT supervision:
  - Revise methodology and risk scoring tool to align results with banks’ ML/TF risk profiles; calibrate to better reflect ML/TF risk exposure. Priority: NT.
  - Ensure banks implement legal changes (lower threshold for high-risk third country involvement triggering EDD; obligation to inspect the BO Register as part of CDD). Priority: NT.
  - Support establishing an EU-level arrangement responsible for AML/CFT supervision. Priority: MT.
  - Expand information in risk scoring tool to consider cross-border risks and expand quantitative/qualitative information for assessing inherent ML/TF risks and internal controls. Priority: NT.
  - Increase frequency and scope of onsite inspections, including for low risk institutions, to confirm risk assessments and quality of ML/TF risk management. Priority: NT.
  - Reinforce EDD conduct for higher risk activities and increase onsite inspections in branches and subsidiaries, particularly in CESEE. Priority: NT.
  - Increase supervision over Passported Payment Providers (PSPs) and E-money Institutions (EMIs) using agents; ensure closer cooperation with countries where agents operate. Priority: NT.
  - Increase efforts to improve cross-border information exchanges with non-EU/EEA countries; consider MOUs with third countries where Austrian banks have branches/subsidiaries (Albania, Belarus, Serbia, Kosovo, Montenegro, North Macedonia, Moldova and Ukraine). Priority: MT.
  - Foster increased collaboration and information sharing between AML team and prudential supervisors (including OeNB and ECB). Priority: NT.
  - Increase supervisory resources for the AML division and provide training for new responsibilities (e.g., VA/VASPs). Priority: NT.
- Entity transparency:
  - Continue pursuing implementation of measures to enhance transparency of legal entities and Treuhänd arrangements. Priority: NT.
  - Ensure trustees hold information on regulated agents/service providers to trusts. Priority: NT.
  - Ensure CDD obligations by lawyers, notaries, accountants in company formation and real estate transactions. Priority: NT.
- VAs and VASPs:
  - Monitor VA/VASP developments and consider VA/VASP risks in the updated 2015 NRA. Priority: MT.
  - Foster cooperation and dialogue with industry to understand challenges in adjusting systems to comply with AML/CFT. Priority: NT.
  - Allocate sufficient human and technological resources to monitor VAs/VASPs and build in-house expertise. Priority: NT.
  - Ensure proper implementation of AML/CFT framework by VASPs. Priority: NT.

- Note: NT = Near Term (within 6 months/1 year); MT = Medium Term (within 2 to 2 1/2 years).

*1autea2020005 - EXECUTIVE SUMMARY*

### 2.      Staff analysis is based on a range of   background information and benefitted from

### 2.      Staff analysis is based on a range of   background information and benefitted from

### Background and information sources
- Staff reviewed available information including the most recent MER from 2016, and the FURs from December 2017 and November 2018.
- Analysis draws on the authorities’ responses to questions submitted by staff ahead of the FSAP, and discussions held on the mission in  September 3–18, 2019.

### Progress since the last assessment — Compliance with the International Standard
- Austria was assessed by the FATF in 2015 and the report was adopted in 2016; Austria was placed under the FATF’s enhanced follow-up process.
- 2016 MER conclusions:
  - Austria has a strong legal and institutional framework for combating ML and TF.
  - Technical compliance framework strong in relation to legal and law enforcement requirements, preventive measures, and supervision for FIs and DNFBPs.
  - Improvements required in national AML/CFT policy coordination, assessment of risk, and targeted financial sanctions.
- Effectiveness findings from 2016 MER:
  - Substantial results: investigation and prosecution of persons financing terrorism; implementation of targeted financial sanction related to proliferation financing; international cooperation.
  - Moderate results: understanding of risk; transparency of legal persons and arrangements; confiscation; targeted financial sanctions related to TF.
  - Fundamental improvements needed: collection and use of financial intelligence; investigation and prosecution of ML.
  - FATF has yet to assess Austria’s improvement in addressing effectiveness.
- FATF follow-up:
  - FATF conducted two FURs and concluded Austria made progress on most technical deficiencies from the 2016 MER.
  - Austria’s first enhanced FUR adopted in December 2017: Austria received a total of 12 upgrades where sufficient progress has been made.
  - Austria’s second enhanced FUR adopted in November 2018: two upgrades provided in the area of transparency and BO information of legal persons and legal arrangements (R. 24 and 25).
  - Progress also analyzed for implementation of new FATF requirements changed since the 2016 MER (R. 7, 18 and 21).

### Legislative, regulatory framework and recent initiatives
- FM AML Act amendments:
  - Amended in 2018 and most recently in July 2019 to transpose obligations from the 4AMLD and 5AMLD.
  - Authorities informed that Austria transposed into legislation the 4AMLD in 2018 and most recently the 5AMLD (Federal Law Gazette I No. 62/2019, July 22, 2019).
  - Transposition of the 5AMLD enters into effect on January 10, 2020.
- Sanctioning regime enhancements:
  - Art. 34 and 35 of the FM AML Act now allow fines for individual persons: up to  EUR 5,000,000 and for legal persons up to  EUR 5,000,000 or 10 percent of the total turnover.
  - Under the previous framework (Art. 98 of the Banking Act and similar provisions), the maximum monetary fine was EUR 150,000.
- July 2019 amendments (selected highlights and entry into force dates):
  - Incorporates VASPs to the list of obliged entities; VASPs subject to same AML/CFT requirements as credit and FIs (very limited exceptions). Entry into force: August 1, 2019.
  - Adds a definition of VAs. Entry into force: January 10, 2020.
  - Adds a definition of VASPs in line with the FATF definition; FM-AML Act goes beyond the 5AMLD by including custodial wallet providers, exchanges between VAs and fiat, exchanges of VAs for other VAs, transfer of virtual currencies, provision of financial services related to issuance and selling of virtual currencies. Entry into force: October 1, 2019.
  - Requires national coordination group to consult state authorities supervising gambling sector AML/CFT when drawing up the NRA. Entry into force: August 1, 2019.
  - Requires obliged entities to inspect the BO Register as part of CDD when establishing a new business relationship with a legal person; for trusts/legal arrangements established in another EU member state or third country obliged entities must seek proof of registration from national BO Register where those countries require registration in a BO Register that fulfils Art. 30 and 31 of Directive (EU) 2015/849. Entry into force: January 10, 2020.
  - Lowers threshold for high-risk third country involvement that triggers EDD requirements to include business relationships and transactions with any kind of involvement of high-risk third countries (Art.9 para. 1). Previous threshold: customer established in a third country. Entry into force: January 10, 2020.
  - Requires VASPs offering services for Austrian customers or basing operations in Austria to apply for registration with the FMA (Art. 32a para. 1); application must include description of proposed AML/CFT measures (Art. 32a para. 1 point 4). Entry into force: October 1, 2019 (registration requirement enters into force on January 10, 2020).
  - Offering VA services without registration now carries a fine of up to  EUR 200,000 (Art. 34 para. 4). Entry into force: January 10, 2020.
- BORA amendments (July 2019):
  - Transposition of the 5AMLD into domestic law.
  - Provides for public access to BO data held in the BO register.
  - Introduces a know-your-customer registry (identification and verification of BO identity by means of “compliance-packages”).
  - Changes will enter into force on January 10, 2020 and November 10, 2020 respectively.
- Lawyers and civil notaries:
  - AML/CFT legal framework strengthened via amendments in Lawyers’ Act, Notarial Code, and Disciplinary Statute for lawyers and lawyer-candidates—DST (Federal Law Gazette I No. 10/2017 of January 13, 2017).
  - Main scope of 2016 amendments (entered into force January 1, 2017): alignment with 4 AMLD and addressed most deficiencies identified in the FATF-MER 2016.
  - Law amending Lawyers’ Act, Notarial Code, DST and Court Jurisdiction Act (Federal Law Gazette I No. 61/2019 of July 22, 2019) entered into force in August 2019 to clarify and specify AML/CFT provisions regarding lawyers and civil notaries in alignment with Directive 2015/849 (4 AMLD).
- Institutional initiatives:
  - National AML/CFT committee operational since January 2017: tasks include keeping NRA up-to-date; developing national strategies and measures; issuing recommendations.
  - National anti-corruption strategy adopted in 2018; a comprehensive action plan is underway and monitored; Federal Bureau of Anti-Corruption has taken initiatives.
  - Austria reviewing ML/TF country risk assessment; last ML/TF NRA completed in 2015 but not considered comprehensive per 2016 MER. Authorities advised to ensure assessment includes ML/TF risks for all types of legal persons in Austria.
  - OeNB measures to improve financial sanctions regime; expedited EU procedures mean new listings normally transposed within 48 hours after adoption by the UN Security Council. OeNB has adopted a risk-based inspection plan.
  - Public-private partnership initiative led by the FIU established and underway; FIU taking the lead and initiative has achieved positive results.

### STRs received by reporting entities (Table 2 figures)
- Banks: 2015 — 1755; 2016 — 2002; 2017 — 2976; 2018 — 2710
- Business industries: 2015 — 5; 2016 — 6; 2017 — 6; 2018 — 5
- Insurances: 2015 — 12; 2016 — 16; 2017 — 17; 2018 — 18
- Lawyers: 2015 — 12; 2016 — 11; 2017 — 15; 2018 — 23
- Casinos: 2015 — 1; 2016 — 0; 2017 — 1; 2018 — 2
- Notaries: 2015 — 4; 2016 — 4; 2017 — 20; 2018 — 15
- Trusts: 2015 — 2; 2016 — 4; 2017 — 2; 2018 — 4
- Traders: 2015 — 0; 2016 — 0; 2017 — 0; 2018 — 0
- Accountants: 2015 — 1; 2016 — 3; 2017 — 3; 2018 — 1
- Real Estate Agents: 2015 — 1; 2016 — 0; 2017 — 3; 2018 — 0

### Conclusions and policy recommendations (summary)
- Significant progress has been made in aligning Austria’s AML/CFT framework with the FATF standard and the European AMLDs; Austria has made progress in addressing most technical deficiencies from the 2016 MER.
- Key recommendations to authorities:
  - Conclude the revision and update of the NRA as soon as feasible and adopt an AML/CFT strategy and action plan in line with the findings of the NRA.
    - Extend scope of the NRA to include more in-depth analysis of ML/TF risks in the jurisdiction, assessment of ML/TF risks faced by legal persons and arrangements, and NPOs sector.
    - Ensure broader participation of the private sector at an earlier stage.
  - Adopt an AML/CFT strategy and action plan to align national policies and priorities with NRA findings.
  - Continue efforts on domestic coordination and cooperation among all relevant agencies; ensure broader engagement with private sector and monitor implementation of recommendations from the National AML/CFT Coordination Committee.
  - Enhance quality and consistency of reporting across sectors, with emphasis on DNFBPs where reporting is very low; FIU should provide guidance on typologies and timely feedback to obliged entities to increase quantity and quality of STRs in line with ML/TF risks.
  - Monitor the proper implementation of new obligations imposed in national legislation (FMA Act and BORA) as part of transposition of the 5AMLD.

### AML/CFT measures and risk-based supervision in the banking sector
- ML/TF vulnerabilities in the banking sector:
  - Austria is a major regional and international financial center with significant cross-border linkages.
  - The financial system is dominated by banks that hold 75 percent of the total financial sector assets.
  - As of September 2019, there are almost 600 banks in Austria with complex ownership and financial linkages; Austria has one of the densest banking and branch networks in Europe.
  - Austrian banks serve as a gateway to CESEE countries; Austrian banking groups control significant shares of banking markets in CESEE and have subsidiaries with significant market shares in 19 countries, including Russia.
  - Banking sector considered the most vulnerable channel to ML activity; NRA identified banks as bearing a moderate to high risk for ML/TF.
  - Capital market assessed to have a moderate level of ML/TF; insurance sector assessed to have a low level of ML/TF.
  - 2016 MER notes banks have a good understanding of their ML/TF risks and AML/CFT obligations; main risks associated with offshore activities, high exposure to nonresident customers and offshore corporate schemes.
- AML/CFT supervision of banks:
  - AML/CFT supervision for the financial sector falls under the responsibility of the FMA; Austria adopted an integrated approach where the FMA performs both prudential and AML/CFT supervision.
  - Prudential oversight is dual: OeNB and FMA (except for significant institutions supervised directly by the ECB).
  - Supervision mandated to the FMA by the FM AML Act includes all persons and entities conducting financial activities listed under the FATF definition of FIs, comprising a total of 780 institutions as follows:
    - (i) 544 credit institutions;
    - (ii) 24 credit institutions that are subsidiaries;
    - (iii) 6 insurance companies/subsidiaries;
    - (iv) 6 payment institutions;
    - (v) 9 payment institutions/subsidiaries via freedom of establishment;
    - (vi) no EMI;
    - (vi) 2 EMIs/subsidiaries via freedom of services;
    - (vii) 14 Investment Fund Management companies;
    - (viii) 5 real estate investment fund management companies;
    - (ix) 8 corporate provision funds;
    - (x) 65 investment firms (supervised by another FMA department);
    - (xi) 43 investment service providers (supervised by another FMA department);
    - (xii) 32 licensed or registered alternative investment fund managers.
  - FMA powers:
    - Granting licenses; issuing regulations; conducting offsite activities and onsite inspections; compelling production of relevant information; reviewing risk assessments by FIs; enforcing obligations through disciplinary and financial sanctions and powers to withdraw, restrict or suspend licenses.
  - AML/CFT supervision conducted by specialized AML Division:
    - Division IV/5-Prevention of ML/TF established in 2011; part of Department IV (integrated supervision).
    - Division covers credit and payment institutions and insurance companies; Division III/2 supervises investment firms and investment service providers for AML purposes.
    - Current staff allocated to the Division: 18,25 FTE, comprised of two teams: “Onsite Inspections Team” (also does offsite surveillance) and “Enforcement Team” (primarily administrative proceedings and actions to restore legal compliance).
    - To address gaps from 2016 MER in resources, five additional staff were assigned to the unit since then.

*International Monetary Fund — Austria FSAP (selected section).*

### 25.      Overall the FMA has a sound understanding of ML/TF risks present in the

### Overall the FMA has a sound understanding of ML/TF risks present in the institutions it supervises and is conscious of the cross-border risks

### Risk methodology and supervisory tools
- Findings:
  - The FMA developed a methodology and supervisory tools in line with a risk-based approach to classify institutions by ML/TF risk exposure; the tool is a good initial step but needs adjustments to reflect more realistic bank risk exposure.
  - The FMA developed an offsite risk scoring tool to develop institutional ML/TF risk profiles, form supervisory strategies, and allocate resources.
  - The tool captures quantitative and qualitative information addressing FATF risk factors: customers, products and services, geographical locations and delivery channels, and the quality of internal control systems.
  - The tool is filled by an annual AML questionnaire sent to obliged entities; last data collection completed by mid-August 2019.
  - The tool considers factors including outsourcing, cash transactions, client as a foreign trust, money remittances, PEPs, risk of BO, risk of location, transaction volume, and number of transactions; it also analyzes quality of risk mitigation measures, complemented by onsite findings, supervisory/expert judgement, statutory audit reports, etc.
- Recommendations:
  - Add additional inputs beyond annual self-reporting: audit reports, financial information from the prudential team, and additional risk factors to better capture all risks, including cross-border risks.
  - Enhance granularity on overseas branches/subsidiaries: number; locations; size; customer base; volume of transactions; products and services at branch/subsidiary level; qualitative information on risk management systems and information-sharing robustness between head office and branches/subsidiaries.

### Risk classification results and implications for onsite activity
- Key statistics (risk classifications):
  - High Risk: 1% (6 banks)
  - Elevated Risk: 1.5% (9 banks)
  - Moderate Risk: 18.1% (110 banks)
  - Low Risk: 79.4% (482 banks)
- Findings:
  - Given size, complexity, and cross-border linkages of Austrian banks, the distribution (majority low risk; very few elevated/moderate) suggests the risk-scoring outputs may understate risk.
  - The offsite tool results drive onsite activities; therefore, reassessment of risk rating criteria is advised to ensure realistic distribution capturing domestic and cross-border exposures.
- Recommendations:
  - Reassess and validate risk-rating criteria to achieve a more realistic distribution across the four risk categories.

### Onsite supervision intensity, frequency, and practices
- Current onsite framework:
  - Two types of onsite measures: onsite inspections (fully-fledged analysis, sample testing, access to core banking system) and onsite examinations (familiarization, identify outstanding issues).
  - Typical durations and teams:
    - Onsite inspections: one to three weeks; team of two people (up to five for large banks).
    - Onsite examinations: three-hour visit involving two people.
    - Management talks: three to four hours at FMA premises.
- Prescribed inspection cycles by risk classification:
  - High risk: Onsite Inspections Max. 3 years; Onsite Examinations and Other Measures Yearly
  - Elevated risk: Onsite Inspections Max. 5 years; Onsite Examinations and Other Measures Max. 3 years
  - Moderate risk: Onsite Inspections Max. 8 years; Onsite Examinations and Other Measures Max 5 years
  - Low risk: Onsite Inspections - ; Onsite Examinations and Other Measures Max 15 years
- Recent onsite activity counts:
  - Year / AML Onsite Inspections on Credit Institutions / AML Examinations on Credit Institutions
    - 2016: 20 / 26
    - 2017: 24 / 24
    - 2018: 30 / 29
    - 2019 Ongoing: 27 / 23
- Findings:
  - Number of onsite measures has increased but remains insufficient given large supervised population and cross-border risk profile.
  - Unclear why banks rated low risk have no established inspection periodicity; only seven low-risk FIs were subject to onsite inspections between 2016-2019.
  - Almost 80 percent of banks are rated low risk, yet only seven onsite inspections of low-risk banks occurred in 2016-2019.
- Recommendations:
  - Shorten supervisory cycle and intensify frequency of onsite inspections to validate risk scoring and internal control quality.
  - Suggested minimum frequencies:
    - High-risk banks: inspect at least annually.
    - Elevated-risk banks: inspect once every 18 to 24 months maximum.
  - Conduct more frequent and comprehensive visits, including for low-rated banks, to form informed judgements and validate offsite tool results.

### Supervisory findings, enforcement, and resourcing
- Findings:
  - Common deficiencies identified: breaches of CDD obligations; inadequate transaction monitoring; failure to identify and verify BO; weak internal controls and procedures.
  - Administrative penal proceedings by FMA:
    - 35 in 2016
    - 21 in 2017
    - 11 in 2018
  - Significant fines in 2018:
    - EUR 2,748,000 imposed on one of the largest banks for inadequate verification of BO identity and failure to update ownership/control documentation (Panama Papers connection).
    - EUR 414,000 imposed on another Austrian bank for similar violations and late reporting of a suspicious transaction.
    - Other pecuniary fines range from EUR 600 to EUR 200,000.
- Findings on resourcing:
  - Resources are stretched given the large population of institutions, financial system complexity, cross-border linkages, and recent incorporation of VAs and VASPs under FMA responsibility.
  - FM AML Act introduces obligation to regulate and supervise VAs and VASPs; FMA will assume regulation and monitoring of VASPs, increasing resource pressure while in-house expertise is being developed.
- Recommendations:
  - Consider allocating further resources to AML/CFT supervision in the short term to address workload and new responsibilities.

### Passported PSPs, EMIs, agents, and cross-border supervision
- Key statistics:
  - 63 foreign EMIs operating in Austria under the EU passporting regime.
  - 281 passported PSPs and their agents.
  - Austrian banks’ exposure: 24 percent exposure in 2018 to CESEE countries.
  - Banking system structure:
    - Almost 600 banks in Austria.
    - 6 significant institutions under the SSM representing 60 percent of total system assets.
    - High concentration: three banks hold 50 percent of market share.
- Findings and recommendations for PSPs/agents:
  - Under current EU framework, home supervisor is responsible for AML oversight of authorized payment institutions operating under free provision of services.
  - PSPs and EMIs must comply with Austrian AML/CFT rules, notify FMA if agents used, and provide overview of internal AML/CFT controls; after meeting criteria, PSPs and EMIs must notify a central contact point for the FMA.
  - Central contact point may help oversee compliance of agent networks, but FMA must ensure proper compliance by agents with local AML/CFT requirements.
  - More oversight on agents is needed; FMA should increase oversight to ensure proper supervision and full compliance.
  - Strengthen coordination and cooperation between home and host supervisors, including:
    - Home supervisor assessment of ML/TF risk associated with the business model and institution’s management of those risks, including internal controls quality.
    - Sharing information likely to impact ML/TF risk assessment regarding agents’ activities in the host country and any host supervisor assessments.
- Cross-border supervision findings:
  - Austria is an important regional/international financial center and gateway to CESEE countries; vulnerable to proceeds transiting through Austria (corruption, embezzlement); offshore companies with Austrian bank accounts are vulnerable; professional intermediaries often act as trustees.
  - FM AML Act (Art. 24) requires group-wide ML/TF policies rolled out across groups; group-wide policies must be implemented at branches and subsidiaries in member states and third countries; exchange of information, including customer information, is permitted for CDD and STR submission.
  - Effective cross-border supervision requires effective home and host supervision, with cooperation and information sharing frameworks ensuring confidentiality, exclusive supervisory use, reciprocity, support for home supervisor visits, timely communication, and removal of obstacles for parent bank access to branch/subsidiary information.
  - High-profile cross-border ML/TF scandals in the Euro Area, including some Austrian banks, require closer scrutiny of critical bank activities; differential quality of AML/CFT supervision across countries increases ML/TF exposure.
- Recommendations:
  - Focus efforts to ensure banks properly implement AML/CFT obligations, conduct EDD for higher-risk activities and client categories, and reinforce control over cross-border activities.
  - Strengthen timely exchange of developments between FMA prudential banking supervision and AML division, and ensure information is shared with OeNB and ECB to reinforce supervisory approach.

*Source: IMF. Content unit: 1autea2020005 - 25. Overall the FMA has a sound understanding of ML/TF risks present in the institutions it supervises and is conscious of the cross-border risks.*

### 53.      As experienced by the Danske Bank and other high-level scandals affecting

### 1autea2020005 - 53.      As experienced by the Danske Bank and other high-level scandals affecting

### Cross-border AML/CFT supervision and reputation risk
- Loss of reputation risk from high-level scandals (e.g., Danske Bank) calls for enhanced AML/CFT supervision and collective efforts across the European region.
- AML/CFT supervision of FIs is the primary responsibility of national AML/CFT supervisors.
- Uneven AML/CFT supervision, regulatory arbitrage, and differences in implementation of the FATF standard contribute to increased ML/TF risks in the Euro Area.
- Ongoing debate in the region on whether to assign AML prevention to a common European institution.
- Consolidation of AML/CFT supervision can enhance quality, consistency, and address “weak links” exploitable for ML/TF.

### Recommendations on institutional arrangements
- Encourage support for establishment of a Euro Area or EU Level arrangement directly responsible for AML/CFT supervision.
- Need for deeper integration/consolidation of AML/CFT supervision and enhanced collaboration between national authorities and the ECB.
- Consider pursuing MOUs with third countries where Austrian banks have branches and subsidiaries (i.e., Albania, Belarus, Serbia, Kosovo, Montenegro, North Macedonia, Moldova, and Ukraine).

### FMA cooperation powers, legal basis, and practical limitations
- FM AML ACT envisages close domestic and cross-border cooperation, including allowing the conduct of inspections.
- 5AMLD requires information-sharing mechanisms between prudential and AML/CFT supervisors (including the SSM).
- The FMA:
  - Is an active member in the European Supervisory Authorities’ Joint Sub-Committee on AML (AMLC), which convenes three times a year.
  - Is required by the FMA AML Law to cooperate with EU/EEA counterparts and empowered to cooperate with the European Supervisory Authorities and other participants of the European System of Financial Supervision and make all information available without delay.
  - Has explicit legal basis under Art. 25 para. 5 FM AML Act to cooperate with authorities in member states and third countries that perform duties corresponding to FMA duties and must share all information that serves the purpose of supervision of financial markets (may include information about shareholders, management, and customers).
- Submission of information to third countries is permissible only under specific circumstances per Art. 25 para 6 FM AML Act (equivalent level of professional secrecy, explicit consent from notifying supervisory authority when affected, reciprocity or reciprocal agreement).
- Evaluation of equivalency is done by the FMA Department for International and Legislative Affairs, taking into account the European Banking Authority assessment of equivalence. According to this list, the Russian Federation is currently not equivalent.
- The FMA should put additional efforts to ensure group-wide policies and procedures are implemented by Austrian banks with branches and subsidiaries located in Russia and pursue full access to critical information in relation to all aspects of the business conducted by the branches and subsidiaries.

### Practical challenges and FMA remedies
- Legal obstacles hinder effective information exchange with some third countries when rules have not been harmonized; local rules on confidentiality, professional secrecy, data protection, and information exchange should be analyzed case-by-case.
- Current limitation reportedly extends to Russia, but not to the rest of third countries where Austrian banks have subsidiaries; uncertainty exists regarding Ukraine.
- Art. 24 grants FMA powers to supervise effective implementation of strategies and procedures throughout the group, including inspections; however, implementing group-wide policies can be challenging where local rules prohibit them.
- Where local rules prevent implementation, FMA actions include:
  - Requiring the group through the parent company to take additional measures to avert related risks.
  - In extreme cases, instructing the group to refrain from carrying out further transactions with those countries or to suspend their business there altogether.
- FMA is entrusted to conclude cooperation agreements (MOUs) for exchange of confidential information with third-country competent authorities only on basis of reciprocity and equivalent requirements of professional secrecy; existence of an MOU does not exclude FMA from examining legal permissibility under Art. 25.
- FMA has signed bilateral and multilateral MOUs and a multilateral agreement on practical modalities for exchange of information between ECB and national AML authorities in January 2019.
- Given a recent change in FM AML Act (power under Art. 25 para. 5), there is no obstacle to share information in the absence of an MOU, though MOUs can determine practical modalities.

### Supervisory colleges, MOUs, and third-country coverage
- Supervisory colleges and MOUs are important for speeding up practical supervisory activities for cross-border issues and confidence-building, particularly towards non-EEA member states and CESEE cooperation.
- Note on MOUs:
  - Third countries with Austrian branches/subsidiaries with which the FMA has an MOU regarding credit institutions: Bosnia and Herzegovina, Russia and Switzerland.
  - Third countries with Austrian branches/subsidiaries without an MOU: Albania; Belarus; Serbia; Kosovo; Montenegro; North Macedonia; Moldova; and Ukraine.

### FMA authority over group entities and enforcement tools
- Art. 24: FMA supervises effective implementation of group-wide strategies and procedures where parent company is incorporated in Austria.
- For credit institutions/FIs with registered office in Austria but place of incorporation in another member state, FMA shall cooperate with competent authorities of that member state.
- Obliged entities must implement group-wide policies and procedures, including sharing all relevant information within the group regardless of MOUs.
- If obliged entity cannot comply, Art. 24 para 4 FM AML Act requires obliged entities to inform FMA and ensure branches/subsidiaries in the third country apply additional measures; if insufficient, FMA may:
  - Prescribe that the group shall not be allowed to establish or shall terminate business relationships.
  - Prohibit undertaking transactions in the third country.
  - Request the group to close down its operations in the third country when necessary.

### Conclusions and policy recommendations (summary)
- Authorities have demonstrated strong commitment to strengthen banking AML/CFT supervision and address cross-border risks.
- Risk scoring tool already considers risk location and locations of subsidiaries and branches in EU member states and third countries.
- Banking sector remains high priority for FMA given size, number of credit institutions, significance for Austria’s financial sector, and ML/TF risk exposure; more resources allocated to supervision of banks.
- FMA actions: increased onsite inspections and examinations, guidance for industry, Circular on “Risk Assessment” published in March 2018, and three additional Circulars at end of 2018 and in 2019 covering CDD obligations, internal organization, and STRs (Circulars are not legally binding but have helped increase compliance).

Key recommendations (verbatim from source):
- Ensure that banks and other FIs implement the recent changes to the legal framework (i.e., lower threshold for high-risk third country involvement that triggers EDD requirements; obligation to inspect the BO Register as part of the CDD obligations).
- Revise the methodology and risk-scoring tool to ensure that the results generated are in line with the ML/TF risks profile of the banks. Further calibrations seem to be needed to reflect a more realistic distribution of the banks in terms of ML/TF risk exposure, when considering the complexity, sophistication, and cross-border operations of Austrian banks.
- Expand the information incorporated into the risk-scoring tool to further consider cross-border risks. Similarly, expand the quantitative and qualitative information that is critical for the assessment if ML/TF inherent risks and the internal control environment. For instance, not only information provided on annual basis by the institutions but also other additional input, like audit reports, financial information provided by the prudential team, and more granular data on cross-border risks.
- Support the establishment of a Euro Area or EU level arrangement directly responsible for AML/CFT supervision.
- Increase the frequency and scope of onsite inspections over banks to ensure timely and proper assessment of the inherent ML/TF risks within the institution, the quality of the ML/TF risk management framework, and overall compliance with the AML/CFT obligations. Conduct onsite inspection of low risk institutions on a more regular basis to ensure and confirm the preliminary assessment of the inherent ML/TF risks and the quality of the risk management framework.
- Reinforce the efforts to ensure that banks properly conduct enhanced CDD for higher risk activities (i.e., offshore customers and activities and complex ownership and control schemes) and reinforce the control over their cross-border activities. Increase the number, frequency, and scope of onsite inspections in branches and subsidiaries, particularly those in CESEE countries to ensure that there is an effective implementation of sound risk management practices and that the group-wide policies and procedures are applied effectively.
- Increase AML/CFT supervision over PSPs and EMIs providing services via agents and ensure closer dialogue and cooperation other member states where agents operate.
- Increase the efforts improve cross-border information exchanges with non-EU/EEA countries. Consider pursuing MOUs with third countries where Austrian banks have branches and subsidiaries (i.e., Albania, Belarus, Serbia, Kosovo, Montenegro, North Macedonia, Moldova, and Ukraine).
- Foster increased collaboration and exchange of information between the AML team and the prudential supervisors (OeNB and ECB) on a timely basis to gain a deeper understanding of the ML/TF risks and its possible impact on other risks (i.e., reputational, operational, etc.).
- Increase the supervisory resources allocated to the AML Division and ensure proper training to build the necessary skills to address the recently assigned responsibilities (i.e., VA/VASPs).

### Transparency of legal persons and arrangements — corporate landscape and Treuhänd
- Common company forms in Austria: (1) general partnerships (“offene Gesellschaft”); (2) limited partnership (“Kommanditgesellschaft”) regulated by the UGB; (3) limited liability company (“Gesellschaft mit beschränkter Haftung—GmbH”) regulated by the GmbHG; (4) stock corporation (“Aktiengesellschaft—AG”) regulated by the AktG; (5) cooperative societies (“Genossenschaft”) regulated by the GenG; (6) private foundations (“Privatstiftung”) regulated by the PSG; (7) associations (“Verein”) regulated by the VerG.
- Other specific forms: European companies, European economic interest groupings, and European cooperative societies.
- There are approximately 272.795 legal companies in Austria.
- Austria’s legal arrangement Treuhänd:
  - Treuhänd is a civil contract, not regulated in law but based on autonomy of contracting parties and delimited by jurisprudence and doctrine.
  - Created when a Treuhänder (trustee) is authorized to exercise rights over property in his or her own name on the basis of a binding agreement with a Treugeber (settlor).
  - Often lawyers and notaries act as Treuhänder.
  - Trustees and Treuhänder must hold accurate and up-to-date information on parties to a trust, although there is no requirement to maintain information on trusts regulated agents or service providers.
- Information on legal persons is kept up-to-date and accessible online in the legal information system of the federal government; the business portal describes processes to create a legal person and prerequisites; further information is available through other sources.

*Source: 1autea2020005 - 53.      As experienced by the Danske Bank and other high-level scandals affecting*

### 76.      There is currently no assessment of   ML/TF risks arising from the different types of

### 1autea2020005 - 76.      There is currently no assessment of   ML/TF risks arising from the different types of

### Assessment of ML/TF risks and ongoing initiatives
- 2016 MER: no assessment of ML/TF risks arising from different types of legal persons and arrangements was included in Austria’s NRA; competent authorities’ understanding of risks and vulnerabilities of legal persons and arrangements "appears to be adequate."
- Authorities plan to update the NRA and include an explicit assessment of ML/TF risks posed by legal persons and arrangements.
- Most widespread type of legal persons involved in domestic ML schemes: the limited liability company (GmbH), mainly due to ease and cost of creation.
- Risk amplifiers:
  - Professional intermediaries (e.g., lawyer or tax advisor) acting as trustee (Treuhänder).
  - Cross-border complex ownership structures with multiple layers of legal persons in jurisdictions where legal and/or BO information is not publicly available and reliable.

### Role of gatekeepers (notaries, lawyers, accountants) and CDD obligations
- At the time of the 2016 MER, concerns existed whether notaries, lawyers, and accountants fulfilled their gatekeeper role effectively; deficiencies included:
  - Lack of requirements to understand ownership and control structures of customers.
  - Lack of requirements to identify customers that are legal persons or arrangements, including BO of a trust, and to identify/verify settlor, trustee(s), or protector of a trust.
- Amendments were introduced to reinforce CDD obligations applicable to lawyers, notaries, and accountants; most deficiencies were addressed and positively considered by the FATF in its first follow-up report (December 2017).
- Recommendation: responsible supervisory/monitoring agencies must ensure proper implementation by notaries, lawyers, and accountants.

### Vulnerable sectors: company formation and real estate
- 2016 MER: real estate sector perceived as vulnerable to ML/TF risks; misuse for investment of illicit proceeds from organized crime and corruption; Treuhänd arrangements often used in real estate transactions.
- Importance of ensuring proper and timely implementation of CDD obligations and continued mitigating measures for company formation and real estate transactions.
- Recent improvements in legal and regulatory framework for notaries, lawyers, and accountants are noted; effective implementation is key.

### Transparency of legal persons and arrangements — legal framework overview
- Company Register ("Firmenbuch"):
  - Main source of information for legal company formation and ownership; electronic database administered by 16 Austrian regional courts ("Landesgerichte").
  - Registers company name, legal form, status, seat and business address, directors and persons with general commercial power of representation, shareholders, etc.
  - Entire content, including important documents filed by legal persons (e.g., articles of association), is open to the public (for a fee) either for inspection at court or online.
- Register contents and obligations:
  - Contains reliable basic information on legal ownership, including percentage of shares belonging to each shareholder; registry kept up-to-date and companies obliged to notify courts of any changes without delay.
  - Before registration, documents and background information (e.g., articles of association, ID papers) must be submitted and certified by a notary in physical presence of establishing persons.
  - Sanctions and monetary penalties are available for failure to meet reporting requirements; changes not notified are not legally effective.
- Associations:
  - Should be registered in local register of associations with statutes containing relevant information.
  - No clear requirements to maintain identities of those who own, control, or direct activities (senior officers, board members, trustees).
  - Information entered in Local Register of Associations is forwarded to BMI’s Central Register of Associations.

### Measures to enhance entity transparency — BO information and BORA
- 2016 MER identified gaps in access to BO information: no general obligation to obtain/keep BO information up-to-date; no assured timely access; no requirement for companies to cooperate with competent authorities to identify BO; no sanction for failure to maintain BO information; Commercial Register contained only legal owners.
- Progress and creation of BO Register:
  - A Register of Beneficial Owner of Companies, other Legal Entities and Trusts created in 2017 (through BORA) in implementation of the 4AMLD; obliges legal persons and arrangements to obtain, maintain, and keep up-to-date BO information and provide it to the register. Competent authorities have timely access.
  - BORA took effect on January 15, 2018 and establishes a Central Register for recording BOs of companies and other legal entities such as foundations and trusts.
  - Registry Authority (Federal Ministry of Finance) has extensive analytic capabilities, power to request documentation on BO from companies, and to carry out offsite audits.
  - BORA amended in July 2019 to transpose the 5AMLD; 5AMLD removes need to demonstrate a "legitimate interest" for public access and extends BO reporting requirements to legal arrangements similar to a trust.
  - Authorities expect to implement remaining obligations, including public access via the homepage of the Ministry of Finance by January 2020.
- BO Register master data sources and exemptions:
  - Master data automatically taken from Commercial Register, Register of Associations, Supplementary Register for Others; completed with BO information via automated or manual reports with safeguards for data quality.
  - Final obligation to identify BO remains with FIs and DNFBPs.
  - On average 353,010 reportable companies are recorded in the Register (referred to as legal entities).
  - Exemptions under Art. 6: 280,495 legal entities currently covered by the exception, including:
    - ordinary partnerships and limited partnerships if all partners are natural persons;
    - limited liability companies, if all the shareholders are natural persons;
    - commercial and industrial cooperative societies;
    - mutual insurance associations, small mutual insurance associations, and savings banks;
    - associations pursuant to the Associations Act.
  - Exemption does not apply if another person is the BO.

### Reporting, access, enforcement, and enhancements
- BORA reporting requirements for legal persons:
  - Identification and verification of BO, including obtaining appropriate certificates with respect to BOs, ownership and control.
  - Retention of copies of documents and information provided.
  - Review of information (CDD requirements) at least once a year.
  - Reporting of changes within four weeks.
  - For trusts and similar arrangements, trustee or comparable person responsible to report BOs.
- Access:
  - Obliged entities may inspect the BO register for due diligence duties; authorities may inspect for statutory purposes.
  - Starting on January 10, 2020, natural persons and organizations may consult the register without demonstrating a legitimate interest.
- Compliance and enforcement:
  - Automated coercive penalties (Art. 16 BORA) range from a "reminder letter" to financial penalties ranging from EUR 1,000 to EUR 4,000.
  - Registry Authority achieved a reporting rate of more than 95 percent as of September 2, 2019 using the automated system.
  - BORA also includes penal provisions for breaches of reporting obligation.
- Risk classification and supervisory powers:
  - A risk classification of all legal entities will be put in place by January 10, 2020 (very high/high/medium/low) to focus analysis and examinations.
  - BO Registry Authority’s supervisory powers and technical possibilities expanded, including sampling for examinations and complementary examinations on a sample basis.
- Scope extension and CDD integration:
  - BORA extends scope to trusts and trusts-like arrangements that have business in Austria or acquire property in Austria; new obligations for trustees enter into force on January 10, 2020.
  - When establishing a new business relationship with a legal person, obliged entities must inspect the BO Register as part of CDD obligations (previously optional).
  - For trusts/arrangements established in other EU member states or third countries, obliged entities must seek proof of registration from the national BO Register where those countries require registration fulfilling Art. 30 and 31 of Directive (EU) 2015/849 — entering into force on January 10, 2020.
- Compliance package:
  - Introduced by BORA; will enter into force on November 10, 2020.
  - Legal entities may submit documents necessary for identification and verification of BOs on a yearly basis together with the report (intended to reduce time required for due diligence and boost BO data quality).
  - Compliance package quality to be monitored and checked based on a risk-based approach by the BO Registry Authority.
- Obligations of obliged entities:
  - FIs and DNFBPs may use documents stored in BO Register as part of their risk-based approach, but remain responsible for CDD obligations and must ascertain with the customer whether documents in compliance package and other available information are sufficient to identify and verify the BO.
  - Submission of a compliance package permitted only if BOs have been verified and identified by a legal professional.

### Outstanding issues and recommendations
- Remaining vulnerabilities:
  - Consider further efforts to enhance transparency of foreign legal entities and arrangements, noting 2016 MER identification that companies established offshore with Austrian banks are vulnerable to ML/TF.
- Authorities recommended to:
  - Continue to pursue effective implementation of recent measures aimed at enhancing transparency of Treuhänd arrangements, including operation of legal arrangements.
  - Ensure a legal requirement for trustees (or equivalent persons) to hold information on regulated agents or service providers to the trusts.
  - Ensure proper and timely implementation of CDD obligations by lawyers, notaries, and accountants and implement mitigating measures to address potential ML/TF risks with respect to company formation and real estate transactions.
  - Ensure that associations are legally required to maintain a list of their members.

*AUSTRIA — INTERNATIONAL MONETARY FUND (excerpts).*

### 105.      The authorities are aware of   the ML/TF risks presented by crypto-based assets and

### 1autea2020005 - 105.      The authorities are aware of   the ML/TF risks presented by crypto-based assets and

### Risk assessment and empirical findings
- Authorities have undertaken a number of empirical studies to quantify and assess potential risks and criminal activities involving crypto-assets.
- Review concluded that crypto-asset mining is "strongly centralized and controlled by few real-world actors residing outside the EU."
- Austria considers the use of Bitcoin as a high ML risk; the 2015 NRA concluded that “Bitcoin poses a high-risk in terms of ML since the issue has come up during drug investigations and the authorities lack knowledge on the extent of the phenomenon”.
- Joint Austrian-German “Bitcrime” project (concluded in 2017) developed forensic methods and led to GraphSense, an open source transaction analysis platform for cryptocurrency transaction ledgers.
- International project “TITANIUM” (set up by the Ministry of Interior) focused on detecting criminal activities within the VA ecosystem (focus on currencies except Bitcoins) and darknet markets, and developing technical solutions and tools for transaction analysis in the VA system.
- National research initiatives investigate “criminal transactions in post-Bitcoin Cryptocurrencies (VIRTCRIME), such as Monero or ZCash”.
- FMA participated in workshops with the Austrian Institute of Technologies and the Research Institute for Cryptoeconomics; FMA is a cooperation partner of the Austrian Blockchain Center.

### Legal and regulatory framework
- VAs fall within the scope of ML/TF offences and existing provisions on seizing, freezing, and confiscation of assets (Criminal Code Arts. 165 and 278).
- Targeted financial sanctions related to TF and PF apply under the Criminal Code; authorities reported that VAs have been successfully seized, frozen, and confiscated.
- FM AML Act amended to transpose the 5AMLD into national legislation; the amendment will enter into force in January 2020.
- Amendment assigns the FMA responsibility over registration and monitoring of VA/VASPs; VASPs are obliged entities under the FMA AML Act and subject to all AML/CFT obligations.
- Art. 2 para. 21 and 22 define virtual currencies and providers in relation to virtual currencies in line with the FATF definition; providers in relation to virtual currencies are considered obliged entities pursuant to Article 1.
- FM AML Act requires VASPs to be registered at the FMA. Article 32: “where a provider pursuant to Article 2, para. 22 intends to carry out an activity in Austria, or to offer its activities from Austria, then it shall apply to the FMA for a registration and submit the required documents.”
- Registration period started on October 1 and will become mandatory on January 10, 2020.
- Administrative offence for operating without registration punishable with a fine of up to EUR 200,000.
- ZaDiG 2018 transposes the PSD II into Austrian law.
- Note: legal uncertainty exists on how registration/licensing requirements will operate across member states; no single license principle for VAs/VASPs analogous to EU passporting regime yet.

### FMA actions, supervision, and market observations
- FMA has been taking steps to assess the size of the VA industry and collect information on main types of VASPs operating in Austria.
- In 2018 there were a number of inquiries to the FMA regarding services related to VAs; compared to 2018, there was an increase in enquiries regarding Initial Coin Offerings (ICOs), Bitcoin trading, and mining models.
- FMA is aware of some VA-related activities conducted in Austria (e.g., “VA-ATMs” or “VA Exchange Platforms”).
- FMA issued a letter to banks to inform them of higher risks involved in VAs and risk factors to consider.
- A license in accordance with the Payment Services Act was granted to a company whose only customer is a VASP; the licensed company offers payment services and is a subsidiary of a future VASP that offers trading with VAs.
- Main VA-related activities in Austria: trading in crypto-assets from and to fiat money via VASPs inside and outside Austria; trades within the crypto-asset ecosystem; crowdfunding related to ICO and STO; VA-ATMs; VAs Exchange Platforms.

### International cooperation and mutual legal assistance
- Mechanisms for mutual legal assistance and international cooperation apply in the context of VAs.
- FMA provides international cooperation to the maximum extent possible where within its supervisory competence.
- International requests for cooperation have occurred regarding VASPs operating in Austria but licensed elsewhere.
- Law enforcement cooperation involves Europol and Interpol; international cooperation in cases involving VAs has been provided and requested.

### Data, capacity, and resource gaps
- There is currently a low level of data and no clarity on how many providers would apply for registration.
- FMA has knowledge that 12 local companies are providing VA related services, but no concrete data on VASPs licensed abroad but offering products and services in Austria.
- Authorities consider that VASPs licensed abroad are active in Austria; collecting reliable data on main players and activities is essential.
- FMA is stretched in terms of human resources allocated to AML/CFT supervision given the large number of FIs under its purview.
- Currently no information technology systems or tools to monitor developments in this area; complexity of transactions requires proper IT solutions and skilled staff.
- Skills of staff monitoring VA activities and VASPs will take time to build.

### Conclusions and policy recommendations (short term priorities)
- Significant progress has been made in strengthening the AML/CFT framework in line with the recently revised standard applicable to VAs and VASPs. Efforts should continue to ensure proper implementation.
- Short term recommended focus:
  - Monitor developments closely, specifically on the growth of the VAs/VASPs to ensure that ML/TF risks are properly considered and addressed on time. When updating the 2015 NRA, further consideration should be given to further understanding the ML/TF risks associated with VAs and VASPs.
  - Foster close cooperation and dialogue with the industry to understand their concerns and challenges in adjusting their systems and/or developing the necessary controls to ensure compliance with the AML/CFT obligations.
  - Allocate sufficient resources both human and technological, to enable timely and effective monitoring of VAs/VASPs and provide the necessary support to build in-house knowledge and expertise to properly monitor VASPs.
  - Ensure a thematic focus on VASPs during the next inspection plan for 2020 in order to monitor the implementation of the new AML/CFT obligations.

*Source: IMF staff report excerpt (AUSTRIA).*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2020/english/1autea2020005.pdf_