Article 9 Permissible uses of information


This is a draft act

This text has been parsed from the AMLA final report draft as published on 1 October 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Summary What does Article 9 of the RTS on home-host supervisory cooperation say?

This article governs how information that has been exchanged between supervisors under the broader cooperation framework can be further disclosed.

Building on the information-sharing obligations established in Articles 5 and 6, it clarifies that exchanged information may be passed on to other supervisors or relevant public authorities without needing prior consent from the supervisor that originally provided it — provided the disclosure is justified for supervisory purposes.

A notable exception exists where the information originates from a third-country counterparty, in which case this freedom to disclose without consent does not apply.

The article also sets a transparency requirement, ensuring the originating supervisor is kept informed of any such disclosure.

Important points:

  • Supervisors may disclose exchanged information to other supervisors or public authorities without prior consent of the originating supervisor, as long as it is duly justified for supervisory tasks.
  • The consent-free disclosure does not apply where the information originates from a third-country counterparty.
  • The originating supervisor must be notified — where possible in advance, but at the latest at the time of disclosure — of what was shared, with whom, and why.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. Information exchanged pursuant to Article 46 of Directive (EU) 2024/1640 shall, where duly justified for the exercise of supervisory tasks, be disclosed to supervisors specified in Article 1, including the Authority when acting as a supervisor or to public authorities as referred to in Article 52 of Directive (EU) 2024/1640 without prior consent of the supervisor from which the information originated, except in those cases where the information originates from a third-country counterparty.

    1. The supervisor that originated the information shall be notified of the following to the extent possible before or at the latest at the time of disclosure:

      1. the information shared;

      2. the recipient of the information;

      3. the rationale of the disclosure.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod