Article 9 Supervisory actions


This is a draft act

This text has been parsed from the AMLA final report draft as published on 30 September 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (16 April 2026)

    1. Where the supervisor determines that the additional measures implemented by the parent undertaking or the obliged entity pursuant to this Regulation are insufficient to ensure that it branches or subsidiaries located in the third country effectively manage the risks of money laundering or terrorist financing, the supervisor shall exercise one or more of the following additional supervisory actions:

      1. require the parent undertaking or the obliged entity to submit and implement, within a specified timeframe, a risk mitigation plan approved by the relevant management body, aiming to effectively address the identified risks, weaknesses or shortcomings;

      2. require the parent undertaking or the obliged entity to implement, within a specified timeframe, corrective measures available to the supervisors under Union law or national law to address identified weaknesses or mitigate risks.

    2. The supervisor shall monitor the implementation of the actions referred to in the first subparagraph points (a) and (b), where applicable, to satisfy itself that the risks of money laundering or terrorist financing are effectively managed.

    1. Where the supervisor determines that the parent undertaking or the obliged entity cannot effectively manage the risks of money laundering or terrorist financing connected with the operations or activities of the branches or subsidiaries established in the third country or that the parent undertaking or an obliged entity has failed to comply with supervisory actions taken pursuant to paragraph 1 within the specified time frame, it shall exercise one or more of the additional supervisory actions specified in the last sentence of Article 17(2) of Regulation (EU) 2024/1624.

    1. When determining which additional supervisory actions to apply under this Article, the supervisor shall take into account, where relevant:

      1. the nature and gravity of the identified risks, weaknesses or shortcomings;

      2. the extent to which relevant third-country legal or regulatory impediments affect the effective implementation or supervision of group-wide AML/CFT policies, procedures and controls; and

      3. existing governance arrangements, risk management frameworks and internal controls systems.

    1. Supervisors shall ensure the effective use of the mechanisms available to them in the exercise of their competences to enhance the effectiveness and efficiency of their supervisory activities, including by complying with Section 2 of Directive (EU) 2024/1640 on cooperation within AML/CFT supervisory colleges and with counterparts in third countries, where appropriate.

    1. In cases where the supervisor is a self-regulatory body, it shall keep the public authority overseeing it informed of any reported legal impediments, minimum actions, additional measures, any supervisory actions requested, and any subsequent developments.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod