On 25 May 2020, a cooperation agreement was concluded between the Financial Supervision Office (BFT) and the Netherlands Authority for the Financial Markets (AFM) on the exchange of supervisory-confidential data or information within the framework of the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft) and the Dutch Audit Firms (Supervision) Act (Wta).
Supervisory tasks of the BFT and AFM
For audit firms, the BFT supervises compliance with the Wwft and the AFM supervises compliance with the Wta. Both acts deal with combating and preventing money laundering and terrorist financing and ensuring the integrity of the financial system. Both the BFT and the AFM have a derived task in this respect. This connection is particularly evident in Section 21 of the Wta (detailed in Article 32 of the Dutch Audit Firms (Supervision) Decree (Besluit toezicht accountantsorganisaties), which stipulates that audit firms must organise their business in such a way that a managed and ethical operation is guaranteed. This includes procedures and policies to prevent money laundering and terrorist financing.
Legislative amendment to the Wwft
Previously, the BFT could provide information to the AFM only within the framework of the Wwft supervision task, but not within the framework of the Wta supervision task. According to legislative history, it has become clear that the secrecy regime of the Wwft can obstruct effective Wta supervision. By way of illustration, two examples are given:
- "Suppose the AFM has indications that a licensed audit firm may not be properly managing integrity risks with regard to one or more specific audit files or one or more specific clients due to integrity risks of these clients. In order to verify these indications, the AFM wishes to investigate whether the audit firm in question has made adequate Wwft reports with regard to these audit files or clients. This relates to whether reports have been made in all cases and whether the reports were timely and complete. Based on the confidentiality provision in the Wwft, the BFT may not provide that information to the AFM. The AFM is therefore not able to verify whether an audit firm complies with its statutory obligation to make Wwft reports."
- "A second example is the situation in which the BFT discovers a violation of the Wwft at a licensed audit firm or external auditor working for it or associated with it. This is relevant information for the AFM's Wta supervision. After all, this may involve an incident that must be reported to the AFM without delay, and if a decision-maker is involved, this may impact the reliability of this person. If licensed audit firms do not report these incidents, they will remain oblivious to the AFM, as a result of which the AFM's supervision of the managed and ethical business operations of audit firms (Section 21 of the Wta) is limited. It is therefore in the interests of Wta supervision if the BFT can inform the AFM of these breaches of the Wwft."
In order to facilitate more effective supervision, the exchange of information has been made possible by the introduction of a new Wwft section (Section 22a at the introduction on 1 January 2020 and Section 22c since 21 May 2020) stating that the BFT may, subject to conditions, provide data or information to the AFM. Since 1 July 2018, the AFM was already authorised under Section 63cc of the Wta to provide data or information to the BFT under certain conditions in the context of strengthening the integrity of the financial markets or audit firms (including compliance with the Wwft).
The cooperation agreement implements Articles 22c of the Wwft and 63cc of the Wta. The starting point is that the BFT and the AFM will endeavour to support and strengthen each other as much as possible by acting together in situations where the cooperation reinforces the effectiveness of the supervision of one or both organisations. They will do so by, for instance, exchanging supervisory-confidential data or information rapidly and carefully. The individual powers and responsibilities of the BFT and the AFM will continue to be safeguarded.
In order to implement the cooperation agreement, further working arrangements will be made between the BFT and the AFM regarding the exchange of data or information. The examples stated in the legislative history make it clear in which situations data will be shared, i.e. mainly in the context of any breaches of the Wwft that have been identified by the BFT in the context of the Wta supervision by the AFM. Information from the AFM to the BFT seems to be provided less frequently.
The supervisors are individually responsible for acting in accordance with the GDPR. If a data breach does occur, one supervisor must report this to the other supervisor within 24 hours. This does not prejudice the obligation to report to the Dutch Data Protection Authority.
The agreement has been entered into for an indefinite period of time, but will be evaluated jointly every two years (or sooner if there is reason to do so). The BFT and the AFM each have the possibility to terminate the agreement in writing, with a notice period of six months.
A breach of the Wwft by audit firms – for example, failure to conduct a client due diligence investigation or failure to report an unusual transaction – may lead to an additional investigation by the AFM (at an earlier date) in relation to, for example, Section 21 of the Wta, i.e. failure to have managed and ethical business operations. This is important for audit firms, as they are increasingly investing in compliance with the Wwft, as evidenced by a growing number of Wwft reports in 2019. If both supervisors are able to take enforcement action, they will contact each other on the basis of the cooperation agreement about the way in which they should act.