AMLCO in Belgium: Article 9, Law of 18 September 2017

The Belgian AMLCO is the person designated under Article 9 §2 of the Law of 18 September 2017, and for a payment or e-money institution the role comes with a yearly report the National Bank of Belgium expects to receive. Article 9 creates two roles, not one: a senior manager accountable at the highest level, and one or more officers who run the AML/CFT framework day to day. The National Bank adds a fit and proper check, and an annual activity report on a fixed template with a deadline the Bank announces each year. This piece sets out who must appoint whom, what the law requires of the person, how the Bank’s template works, and three cases that come up for foreign payment firms in Belgium.

1. The texts

Four instruments carry the Belgian rules for institutions supervised by the National Bank:

• The Law of 18 September 2017 on the prevention of money laundering and terrorist financing and the restriction of the use of cash (Wet van 18 september 2017). Article 9 sets the two roles; Article 10 adds an anonymous internal reporting channel to the persons designated under Article 9; Article 11 covers staff awareness and training.
• The National Bank’s Regulation of 21 November 2017 on the prevention of money laundering and terrorist financing, approved by royal decree. Its Article 7 is the basis for the AMLCO’s annual activity report.
• Circular NBB_2022_04 of 15 February 2022 on the Bank’s prudential expectations for the AMLCO activity report, with a model template annexed.
• The Bank’s fit and proper framework, which since Circular NBB_2018_25 applies to heads of independent control functions as well as to directors and the management committee.

Above them sit the EBA Guidelines on AML/CFT compliance officers (EBA/GL/2022/05) and, from 10 July 2027, Article 11 of Regulation (EU) 2024/1624 (AMLR).

2. Article 9 §1: the senior manager

An obliged entity that is a legal person must designate, from among the members of its legal administrative body or, where applicable, its effective management, the person responsible at the highest level for ensuring that the law is implemented and complied with. The scope of that responsibility is wide. It covers the law itself, the royal decrees and regulations made under it, any administrative decisions taken on that basis, the EU Funds Transfer Regulation, and the financial sanctions and restrictive measures referred to in Article 8 §1, 3°.

The Bank’s fit and proper appointment form lists it as a function in its own right. The senior manager does not run the alerts queue, but answers for whether the framework works.

3. Article 9 §2: the AMLCO and the three conditions

Article 9 §2 requires the entity to designate, internally, one or more persons responsible for:

• implementing the policies, procedures and internal control measures required by Article 8;
• analysing atypical transactions and drawing up the written reports under Articles 45 and 46, so that the follow-up required by Article 47 is given where necessary;
• communicating the information referred to in Article 54;
• staff awareness and training and, where relevant, that of agents and distributors, under Article 11.

For a legal person, the AMLCO is designated by the legal administrative body or the effective management. Before the appointment, the entity must satisfy itself that the person has three things:

1. the professional integrity needed to exercise the function with integrity;
2. adequate expertise, knowledge of the Belgian legal and regulatory framework on AML/CFT, availability, hierarchical level and powers within the entity, so that the function can be exercised effectively, independently and autonomously;
3. the power to propose, on their own initiative, to the legal administrative body or the effective management any measure that is necessary or useful, including the resources needed, to make the internal AML/CFT measures compliant and effective.

Knowledge of the Belgian framework is named in the statute. A group AML head who knows only the home-state regime does not meet it on its face. Under Article 49, reports to CTIF-CFI also go through the AMLCO as a rule.

4. Article 9 §3 and §4: combining the roles, and the Belgian-presence rule

Combining (§3). Where it is justified by the nature or size of the entity, in particular its legal form, management structure or headcount, the AMLCO functions may be exercised by the senior manager designated under §1. This is an exception that needs a reason, not a default. The Bank’s template asks every year whether the entity applies Article 9 §3 and, if so, for confirmation that the circumstances that justified it have not changed.

Presence (§4). For payment institutions and e-money institutions from another Member State that provide services or distribute e-money in Belgium through one or more persons established there who represent them (the categories in Article 5 §1, 6°, d) and 7°, e) as originally enacted), the AMLCO must be established in Belgium. This catches passporting firms with agent or distributor networks.

5. The two roles side by side

6. Fit and proper and notifying the Bank

The Bank treats the AMLCO as the head of an independent control function. Its application guide for payment and e-money institutions states that board members, management committee members and heads of independent control functions are subject to a fit and proper assessment, that only natural persons are accepted in those roles, and that the Bank must receive the completed “new appointment” form well before the appointment takes effect. The form lists both the designated senior officer and the “person responsible for implementing the anti-money laundering policy (AMLCO)” as functions.

Supporting documents include a CV, a criminal record extract (model 596-1) under three months old, an ID copy, before-and-after organisation charts and a function profile. Separate forms cover exits, new elements and reappointments, so a departing AMLCO is also a notification event.

7. The annual activity report

Article 7 of the Bank’s regulation requires the AMLCO to draw up, at least once a year, an activity report for the effective management and the legal administrative body. Circular NBB_2022_04 adds that a copy goes to the Bank, where the prudential services use it in their AML/CFT supervision. The Bank intervened because reports often just restated internal policies.

The circular’s scope covers Belgian payment and e-money institutions, Belgian branches of institutions from other EEA countries and third countries, and EEA payment and e-money institutions that must appoint a central contact point in Belgium. The Bank invites institutions to adopt its model template and to send the copy as a .docx file. The deadline was moved to 31 May for 2022 and, from 2023, to 15 May each year for all AML/CFT reports due to the Bank, including the AMLCO report. The Bank can move it: in 2024 it aligned the report with the periodic questionnaire (Circular NBB_2024_05), both due 15 July.

The template has twelve sections: business model; global risk assessment under Article 16 of the law; individual risk assessment methodology; group organisation; resources, Article 9 §3 and outsourcing; policies and procedures; internal control measures, including KYC file reviews by risk category and the share of the portfolio reviewed; transaction monitoring; the AMLCO’s monitoring plan; requests from authorities and supervisory actions; training; and sanctions and embargo screening.

Section 8 asks for counts and euro amounts of first-line reports to the AMLCO, of those the AMLCO could not analyse, and of reports to CTIF-CFI. Section 10 counts CTIF-CFI information requests, judicial requests and CTIF-CFI oppositions under Article 80. A count of unanalysed reports is a capacity statement, and the Bank will read it as one.

8. How it ties to the periodic questionnaire

The AMLCO report and the periodic AML questionnaire, filed through OneGate, land on the same date and describe the same framework from two angles. Under the 2026 circular, effective management answers the questionnaire on the AMLCO’s proposal. If the questionnaire says monitoring is adequate and the activity report shows a backlog of unanalysed alerts, the inconsistency is the finding. Prepare both from one reconciled data set.

9. Worked case: an EEA EMI with Belgian distributors

Facts: an e-money institution authorised in another Member State distributes e-money in Belgium through a network of Belgian distributors. Its group MLRO sits at head office and has been named as AMLCO for every host country.

What the rule says: Article 9 §4 requires the AMLCO to be established in Belgium for EEA e-money institutions distributing in Belgium through persons established there. The institution falls in the scope of Circular NBB_2022_04 as one that must appoint a central contact point, so the activity report is also owed.

What the practitioner does: designates a Belgium-based AMLCO with knowledge of Belgian AML law, files the fit and proper appointment form, sets a reporting line to the group MLRO for group policy, and starts the activity report on the Bank’s template with section 4.b (compliance of group policies with Belgian law).

Outcome: one group framework, with a defensible Belgian layer.

10. Worked case: a small Belgian payment institution combining the roles

Facts: a Belgian payment institution with a dozen staff names its managing director as both senior manager and AMLCO.

What the rule says: Article 9 §3 allows the combination where nature or size justifies it, including headcount and management structure. The person still has to meet the §2 conditions, including availability.

What the practitioner does: records the justification in a board decision, checks that the director has the time and the Belgian AML knowledge the role needs, and arranges support such as an analyst or outsourced alert review. Answers “yes” at section 5.b of the activity report and confirms each year that the circumstances are unchanged.

Outcome: when the firm outgrows the justification, the yearly confirmation triggers the split before an inspection does.

11. Worked case: a branch that relies on head office

Facts: the Belgian branch of an EEA payment institution has head office run its onboarding checks, transaction monitoring and sanctions screening.

What the rule says: the template treats a branch’s transfer of AML/CFT tasks to its head office as outsourcing, subject to the prudential outsourcing requirements. Only the execution of the AMLCO’s tasks can be outsourced, with limited exceptions. The branch must still designate an AMLCO in its own organisation, who remains responsible for the Article 9 §2 tasks.

What the practitioner does: lists the outsourced processes in section 5.c, records the controls run on head office’s performance and the time spent on them, documents those controls, and reports any significant incidents.

Outcome: the branch can show that its AMLCO oversees the work rather than signing off on someone else’s.

FAQ

What to do, today

• Passporting firms: if you use Belgian agents or distributors, check that your AMLCO for Belgium is established in Belgium and has been through the Bank’s fit and proper process.
• Board secretary: keep the Article 9 §1 and §2 designations on file as board or management decisions, with the integrity, expertise and availability checks behind them.
• AMLCO: draft this year’s report on the Bank’s template, not a house format, and diary 15 May unless the Bank announces another date.
• Compliance reporting: run the activity report and the periodic questionnaire off one reconciled data set.
• Where roles are combined: re-test the Article 9 §3 justification against current headcount before you confirm it again.

Related: NBB periodic AML questionnaire · CTIF-CFI — reporting suspicions in Belgium · AMLR compliance manager and officer · Article 2d Wwft: the Dutch compliance function