Article 17 Conditions for the application of group-wide requirements to structures other than groups without the obligation to identify the head of the structure


This is a draft act

This text has been parsed from the AMLA final report draft as published on 30 September 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (16 April 2026)

    1. In duly justified circumstances and to ensure a proportionate application of group-wide requirements, obliged entities of the structure may choose not to identify one obliged entity as the head of the structure subject to the prior permission of supervisors and where all the following conditions are met at all times:

      1. the head of the structure is not an obliged entity or there are proven legal impediments under Union legal acts or national laws to appointing a head of the structure;

      2. the structure puts in place minimum common systems for the monitoring and classification of money laundering, terrorism financing and targeted financial sanctions risk situations of the obliged entities and the structure as a whole;

      3. obliged entities in the structure put in place minimum common policies, procedures and controls that include at least:

        1. the carrying out and updating of the business-wide risk assessment;

        2. customer due diligence to implement Chapter III of Regulation (EU) 2024/1624;

        3. the reporting of suspicious transactions;

        4. outsourcing, reliance on customer due diligence performed by other obliged entities and other third-party arrangements;

        5. record retention and policies in relation to the processing of personal data;

        6. the internal communication of internal policies, procedures and controls;

        7. a policy on the training of employees and, where relevant, agents and distributors;

      4. obliged entities in the structure comply with information-sharing requirements for AML/CFT and targeted financial sanctions purposes in accordance with Article 16(3) of Regulation (EU) 2024/1624 and Section 3 of this Regulation;

      5. the structure is approved and monitored at regular intervals by the supervisors through risk-based monitoring activities or other adequate measures to ensure that the permission granted pursuant to this paragraph is not abused.

    1. Obliged entities of the structure seeking the permission set out in this Article shall appoint a coordinating obliged entity that notifies the supervisor of the request for permission without undue delay and in any case no later than 28 calendar days after such intention, including the reasons thereof. If the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. The coordinating obliged entity in a structure existing on [the day of application of this Regulation] shall notify the supervisor in accordance with Article 19(2).

    1. The request by the coordinating obliged entity shall include all the following information:

      1. summary overview and explanation of the permission not to identify a head of the structure, including detailed information concerning whether the identified head of the structure is not an obliged entity and/or there are any legal impediments under Union law or national laws;

      2. a detailed chart of the structure, and overview of the activities performed by the obliged entities within the structure together with the related geographical outreach;

      3. any other information considered necessary for evaluating the adequacy of the permission not to identify a head of the structure.

    1. Article 16 shall apply mutatis mutandis to the submission of the request by the coordinating obliged entity.

    2. The supervisor may determine that the permission under this Article is not appropriate and shall provide reasons for this assessment. It may indicate appropriate measures, including requiring obliged entities in the structure to notify under Article 16.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod