Given the definition of credit institution/financial institution, it appears that the RTS would only apply to subsidiaries of EU credit/financial institutions. The RTS does not seem to cover the situation where a non-EEA (financial) institution has an EEA subsidiary (credit institution / financial undertaking). If this position is correct this would mean that where an EEA financial undertaking is a subsidiary of a non-EEA company, the RTS will not cover such position. My point being that the RTS seems still leaves the situation open where a non EEA conglomerate enters the EEA market by establishing a credit/financial institution, the EEA credit/financial institution obviously would have to adhere to EEA AML requirements, but the non EEA parent (assuming it is not established in one of the FATF countries or countries adhering to its rules) could ignore such rules. If this is considered problematic, the only way of dealing with this seems to be via the EEA subsidiary, for example upon receiving authorization/license to operate, the authorization/license is 'subject to' parent / group undertaking in full adhering to AML rules based on (at the minimum) FAFT standards.

I am aware of situations where a large financial institution has to deal with various AML regulations which are contradicting each other, making it hard if not impossible, to put up group wide standards that can be applied generally throughout the group. In such case risk approach seems a good suggestion.

See my comment on Question 1. The measures that potentially can be taken against a branch or subsidiary cannot (obviously) be evoked against a parent company of an EEA holding/parent company. Hence the RTS has limitations in its coverage.

I am aware of situations where a large financial institution has to deal with various AML regulations which are contradicting each other, making it hard if not impossible, to put up group wide standards that can be applied generally throughout the group.