Source: AMLA final report draft
- Anti-money laundering
AML 6 directive supplemental acts
- RTS on assessment of inherent and residual risk of obliged entities
Article 2 Assessment and classification of the inherent risk profile of credit institutions and financial institutions
This is a draft act
This text has been parsed from the AMLA final report draft as published on 16 December 2025. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.
Summary What does Article 2 of the RTS on assessment of inherent and residual risk of obliged entities say?
This article is the methodological core of the regulation, setting out the precise, step-by-step process that supervisors must follow to assess and classify the inherent risk profile of every credit institution and financial institution under their supervision.
It builds directly on the definitions established in Article 1 and feeds into Articles 3 and 4, which deal with controls quality and residual risk respectively.
The process moves through a structured sequence: scoring individual risk indicators, aggregating those scores through weighted averages at sub-category and category level, calculating an overall inherent risk score, and then — where necessary — adjusting that score to reflect national specificities or other supervisory findings.
The article concludes by mapping the final score onto one of four classifications: low, medium, substantial, or high risk.
Important points:
- Supervisors are required to follow a mandatory sequential scoring methodology, using weighted arithmetic averages, to arrive at an inherent risk score for each institution on a scale of 1 to 4.
- Supervisors may adjust the final inherent risk score, but any such adjustment is capped at one classification level up or down and must be duly justified and recorded.
- The four-tier classification — low, medium, substantial, and high risk — is determined by fixed numerical thresholds applied to the final inherent risk score.
Springlex's summary of the article, a reading aid, not a substitute for the legal text.
Supervisors shall assess and classify the inherent risk profile of each credit institution or financial institution under their supervision that has commenced its activities no later than during the year prior to the year that the assessment and classification takes place.
For the purposes of the assessment and classification mentioned in paragraph 1, supervisors shall apply the following sequential steps:
identify all the inherent risk indicators that apply to the credit institution or financial institution and allocate a score to each of these indicators, in accordance with paragraph 3;
identify all the sub-categories of indicators listed in Section A of Annex I, within the ‘products and services’ category, that apply to the credit institution or financial institution, and calculate a combined score for each of those sub-categories, in accordance with paragraph 4;
calculate combined scores for all categories of indicators listed in Section A of Annex I, in accordance with paragraph 5;
calculate the inherent risk score of the credit institution or financial institution, in accordance with paragraph 6;
where the inherent risk score does not adequately reflect the level of ML/TF risks to which the credit institution or financial institution is exposed, adjust the inherent risk score, in accordance with paragraph 7;
classify the inherent risk profile of the credit institution or financial institution in accordance with paragraph 8.
Each score allocated to an inherent risk indicator shall be a numerical value without decimal places ranging from 1, that corresponds to the lowest level of risk, to 4, that corresponds to the highest level of risk. The inherent risk indicators shall be established based on the data points listed in Section A of Annex I. The scores shall be calculated based on pre-determined thresholds.
A sub-category shall apply only if at least one of its indicators applies to the credit institution or financial institution. Each combined score per sub-category shall be a numerical value with two decimal places ranging from 1, that corresponds to the lowest level of risk, to 4, that corresponds to the highest level of risk. Each combined score per sub-category shall be calculated from the scores allocated to its inherent risk indicators, in accordance with paragraph 3. For this purpose, supervisors shall use a weighted arithmetic average method. The weight applied to each indicator shall be based on its risk significance. The weights shall be expressed as a numerical value without decimal places ranging from 1, that corresponds to the lowest level of risk significance, to 5, that corresponds to the highest level of risk significance.
Each combined score per category shall be a numerical value with two decimal places ranging from 1, that corresponds to the lowest level of risk, to 4, that corresponds to the highest level of risk. Each combined score per category shall be calculated from the scores allocated to its inherent risk indicators, in accordance with paragraph 3. By way of derogation, the combined score of the ‘products and services’ category shall be calculated from the combined scores attributed to its sub-categories, in accordance with paragraph 4. For this purpose, supervisors shall use a weighted arithmetic average method. The weight applied to each indicator or sub-category shall be based on its risk significance. The weights shall be expressed as a numerical value without decimal places ranging from 1, that corresponds to the lowest level of risk significance, to 5, that corresponds to the highest level of risk significance.
The inherent risk score shall be a numerical value with two decimal places ranging from 1, that corresponds to the lowest level of risk, to 4, that corresponds to the highest level of risk. The inherent risk score shall be calculated from the combined scores per category determined in accordance with paragraph 5. For this purpose, supervisors shall use a weighted arithmetic average method. The weight applied to each category shall be dependent on the score it received. Categories that received a higher risk score shall have a greater weight than categories that received a lower risk score.
The adjustment shall be based on either national specificities or any other circumstances identified by supervisors in the course of their supervisory activities. The adjusted score shall not lead to an increase or decrease by more than one level in accordance with paragraph 8. Where the risk is increased by one level, the adjusted score shall be set at the minimum value of the corresponding level. Where the risk is decreased by one level, the adjusted score shall be set at the maximum value of the corresponding level. The adjustment shall be duly justified and recorded.
The classification shall be based on the inherent risk score attributed to the credit institution or financial institution in accordance with paragraphs 7 and 8. Supervisors shall classify the inherent risk profile of the credit institution or financial institution, in accordance with the following conversion rules:
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
crypto-asset services
Definition
supervisor
Definition
financial mixed activity holding company
Definition
inherent risk
Definition
crypto-asset service provider
Definition
credit institution
- a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013;
- a branch of a credit institution, as defined in Article 4(1), point (17), of Regulation (EU) No 575/2013, when located in the Union, whether its head office is located in a Member State or in a third country;
Definition
crypto-asset
Definition
property
Definition
terrorist financing
Definition
money laundering
Definition
financial institution
- an undertaking other than a credit institution or an investment firm, which carries out one or more of the activities listed in points (2) to (12), (14) and (15) of Annex I to Directive 2013/36/EU of the European Parliament and of the Council(32), including the activities of currency exchange offices (bureaux de change), but excluding the activities referred to in point (8) of Annex I to Directive (EU) 2015/2366, or an undertaking the principal activity of which is to acquire holdings, including a financial holding company, a mixed financial holding company and a financial mixed activity holding company;
- an insurance undertaking as defined in Article 13, point (1), of Directive 2009/138/EC of the European Parliament and of the Council(33), insofar as it carries out life or other investment-related assurance activities covered by that Directive, including insurance holding companies and mixed-activity insurance holding companies as defined, respectively, in Article 212(1), points (f) and (g), of Directive 2009/138/EC;
- an insurance intermediary as defined in Article 2(1), point (3), of Directive (EU) 2016/97 where it acts with respect to life insurance and other investment-related insurance services, with the exception of an insurance intermediary that does not collect premiums or amounts intended for the customer and which acts under the responsibility of one or more insurance undertakings or intermediaries for the products which concern them respectively;
- an investment firm as defined in Article 4(1), point (1), of Directive 2014/65/EU of the European Parliament and of the Council(34);
- a collective investment undertaking, in particular:
- an undertaking for collective investment in transferable securities (UCITS) as defined in Article 1(2) of Directive 2009/65/EC and its management company as defined in Article 2(1), point (b), of that Directive or an investment company authorised in accordance with that Directive and which has not designated a management company, that makes available for purchase units of UCITS in the Union;
- an alternative investment fund as defined in Article 4(1), point (a), of Directive 2011/61/EU and its alternative investment fund manager as defined in Article 4(1), point (b), of that Directive that fall within the scope set out in Article 2 of that Directive;
- a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014 of the European Parliament and of the Council(35);
- a creditor as defined in Article 4, point (2), of Directive 2014/17/EU of the European Parliament and of the Council(36) and in Article 3, point (b), of Directive 2008/48/EC of the European Parliament and of the Council(37);
- a credit intermediary as defined in Article 4, point (5), of Directive 2014/17/EU and in Article 3, point (f), of Directive 2008/48/EC, when holding the funds as defined in Article 4, point (25), of Directive (EU) 2015/2366 in connection with the credit agreement, with the exception of the credit intermediary carrying out activities under the responsibility of one or more creditors or credit intermediaries;
- a crypto-asset service provider;
- a branch of a financial institution referred to in points (a) to (i), when located in the Union, whether its head office is located in a Member State or in a third country;
Definition
third country
Definition
funds