Responsabile antiriciclaggio and SOS delegate in Italy

An Italian payment or e-money institution fills three separate AML roles: the responsabile antiriciclaggio, the responsabile delle segnalazioni di operazioni sospette and the esponente responsabile per l’antiriciclaggio. Each has its own appointing body and notification route. The AML head is notified to the Banca d’Italia within 20 days. The SOS delegate is registered with the UIF on Infostat-UIF, and a change must reach the UIF within 30 days. Since June 2026 the board member responsible for AML is notified too. Branches of EU institutions follow special rules that many groups miss.

1. The texts

• Legislative Decree 231/2007. Article 35 sets the duty to report suspicious transactions. Article 36 says who assesses and sends the report: the head of the competent function, the legal representative or a delegate, or the head of the central contact point. Article 43(3) covers the central contact point.
• Banca d’Italia, Disposizioni in materia di organizzazione, procedure e controlli interni of 26 March 2019, amended on 1 August 2023 (transposing EBA/GL/2022/05 and adding the esponente), 26 and 27 November 2024, 23 July 2025 and 16 June 2026. The consolidated text of 13 March 2026 does not yet include the June 2026 change.
• Banca d’Italia clarification note of 9 January 2024 on the 2023 amendments, which answers the branch question.
• UIF instructions on detecting and reporting suspicious transactions, 18 December 2025. They apply from 1 July 2026 and replace the UIF Provvedimento of 4 May 2011.

Payment institutions, e-money institutions and Italian branches of foreign intermediaries are all addressees. EU institutions that must appoint a central contact point are addressees too, but Part Two of the Disposizioni (governance bodies and the esponente) does not apply to them.

2. The minimum set-up

Part One, Section III of the Disposizioni sets four controls that every addressee needs, however small:

1. an AML control function, the funzione antiriciclaggio;
2. a formal allocation of responsibility for suspicious transaction reports (segnalazioni di operazioni sospette, SOS);
3. an internal audit function that tests the AML set-up on an ongoing basis;
4. a management-body member named as esponente responsabile per l’antiriciclaggio.

The board-approved AML policy explains the choices made, including whether the SOS responsibility is delegated.

3. The responsabile antiriciclaggio

The head of the AML function (Part Three, Section I, para. 1.3) is a natural person who meets requirements of independence, competence, professional standing and reputation, and has enough time for the role.

• Appointment. The strategic supervision body appoints and revokes the AML head, with reasons, after hearing the control body. The minutes must show in detail how the requirements were checked.
• Position. The AML head has no direct responsibility for operational areas and does not report to anyone who has. The role may be combined with the compliance head, or with the risk manager where proportionate, but never with internal audit.
• Combining with the esponente. Allowed if the esponente holds no other delegated powers that compromise their autonomy (a sole director is the exception), with the proportionality reasons stated.
• Several entities. One person can head the AML function of several addressees only within a group.
• Continuity and outsourcing. Firms plan for the head’s absence; a deputy is one option, not the only one. Tasks may be outsourced, but the firm stays responsible and the AML head monitors the provider.

Filing: the appointment or revocation goes to the Banca d’Italia within 20 days of the board resolution (para. 1.6). Where applicable, it is filed through Or.So., the procedure for reporting members of corporate bodies under the Communication of 7 June 2011. The annual AML report, including the self-assessment, is due by 30 April.

4. The responsabile delle segnalazioni di operazioni sospette

Under Article 36 of the decree and Part Three, Section II, the SOS responsible is the legal representative or a delegate, who may be the AML head. The strategic supervision body resolves on the delegation after hearing the control body.

• Who cannot be delegate: the head of internal audit, and anyone outside the firm or its group.
• Requirements: independence, authority and professionalism; autonomy of judgement; strict confidentiality, including towards directors; no direct operational responsibility.
• Tasks: assess first-line reports promptly; send well-founded reports to the UIF without naming the people in the internal chain; record every assessment, including decisions not to report; answer UIF requests promptly.
• Several delegates are allowed at large firms. The UIF still requires one person to be named as referente SOS on the portal. Others are registered as authorised users.

Filing: the Disposizioni require appointment and revocation to be notified promptly to the UIF, as the UIF specifies. The UIF instructions set the deadline: a change of referente SOS is notified within 30 days.

5. Registering on Infostat-UIF

All dealings with the UIF run through Infostat-UIF. For a legal entity, the UIF’s access pages describe this sequence:

1. The Amministratore (portal administrator) and the Referente each register personal credentials.
2. The Amministratore completes the richiesta di iscrizione in the Anagrafe dei Partner UIF.
3. The receipt goes by certified email (PEC) to uif.registrazione@pec.bancaditalia.it.
4. After approval, the Amministratore requests access through Adesione alle survey, and the Referente can then file.

A new referente is entered through Comunicazione del nuovo Referente, and a new administrator through Subentro Amministratore. Credentials are personal. The referente reviews portal users at least every six months and whenever the referente changes. Dealings are normally in Italian; English is accepted only in exceptional, reasoned cases. For filing mechanics, see how to file an SOS in Italy.

6. The esponente responsabile per l’antiriciclaggio

Part Two, Section III-bis, added in 2023, requires each addressee to name a member of its management body as esponente, without prejudice to the board’s collective responsibility. The role is executive. In justified cases it may go to the general manager.

• Requirements: knowledge of ML risk, AML controls and the business model, and enough time and resources. The AML policy covers conflicts of interest.
• Role: the main link between the AML head and the board. The esponente monitors the adequacy of policies, escalates breaches and checks that the AML head has access and resources.
• The 2024 note: the CEO may hold the role. A non-executive director who takes it becomes executive. The tasks cannot be delegated. Every group entity that is an addressee needs its own esponente.
• Deadline: the first renewal of the corporate bodies, and no later than 30 June 2026.

Filing (new in 2026): under the Provvedimento of 16 June 2026, the appointment and any later suspension or end of office are notified to the Banca d’Italia within 20 days of acceptance, suspension or cessation, through Or.So. where applicable. Newly authorised firms file within 30 days of authorisation. Esponenti already in office had to be notified within 20 days of the measure’s entry into force.

Groups: Italian group companies may delegate SOS to the SOS head of the parent or another Italian group company (Part Four, Section III). Each delegation is formalised and notified promptly to the UIF.

7. Branches and central contact points

For an Italian succursale of an EU PI or EMI, three rules change.

• SOS: the SOS responsible is the branch’s legal representative, who may delegate only to a member of the branch staff. The role attaches by rule; the UIF must still know who the referente is.
• Esponente: Part Two applies to the branch’s own managers, so the role falls on a branch manager. Without a local management body, the appointment procedure and requirements do not apply. A parent board member can never hold it.
• AML function: the branch is an addressee in its own right, with its own AML function, annual report and periodic AML returns.

An EU PI or EMI operating through agents that must appoint a central contact point (Part Six) gives the role to its own organisational unit or a company in Italy, never to a natural person. If it has a branch, the branch is the contact point. The head of the contact point meets the AML-head requirements and is notified to both the Banca d’Italia and the UIF. Under Article 36(6), that person is also the SOS head.

8. Side by side

9. Worked case: a new branch in Milan

Facts: an EU e-money institution opens a branch in Milan with a general manager as legal representative and no local board. The parent wants its group MLRO abroad to decide Italian SOS.

What the rule says: the branch’s SOS responsible is its legal representative, and the role can be delegated only to branch staff. The esponente role falls on branch managers, never on a parent director.

What the compliance officer does: keeps the general manager as SOS responsible, or delegates to an AML officer employed by the branch, and registers that person as referente SOS. Records the esponente in the branch AML policy. Gives the group MLRO an advisory line, without the decision to report.

Outcome: the person who decides each SOS can be named and reached by the UIF.

10. Worked case: a small Italian payment institution

Facts: an Italian PI’s board has one executive director, the CEO. The compliance head is to run the AML function and take the SOS delegation.

What the rule says: AML may sit with compliance, the SOS delegation may go to the AML head, and the CEO may be the esponente. Each appointment needs a board resolution after hearing the control body.

What the compliance officer does: prepares one board pack with three resolutions. Files the AML head and the esponente with the Banca d’Italia within their 20-day windows. Updates the referente SOS on Infostat-UIF and reviews portal users.

Outcome: three roles, three filings, one consistent record.

11. Worked case: the SOS delegate leaves

Facts: the delegated SOS officer of an Italian EMI resigns. A replacement starts a month later.

What the rule says: without a delegate, the legal representative is the SOS responsible. A change of referente reaches the UIF within 30 days, and portal users are reviewed when the referente changes.

What the compliance officer does: has the legal representative take over on the portal at once and revokes the leaver’s access. Brings the new delegation to the board, then enters the new referente.

Outcome: no gap in filing capacity, and an audit trail that matches the portal.

FAQ

What to do, today

• Compliance: check that the board minutes, Banca d’Italia filings and Infostat-UIF referente name the same people.
• Branches: confirm the SOS responsible is the branch legal representative or a branch employee.
• Company secretary: confirm the esponente notice under the June 2026 measure was filed.
• Referente SOS: run the six-monthly portal user review now.
• Planning: map these roles to the AMLR compliance manager and officer, which apply from July 2027.

Related: Italy’s AML framework beyond the UIF · Annual AML report and self-assessment in Italy · Infostat, the Banca d’Italia reporting channel