Art. 2 Classification of the level of gravity of breaches | RTS on pecuniary sanctions and administrative measures | AML

Building directly on the indicators established in Article 1, this article sets out the four-category classification system that supervisors must use to grade the severity of a breach, running from category one (least severe) to category four (most severe).

The article gives supervisors concrete decision rules for assigning each category based on the level of impact, duration, repetition, and the presence of more serious aggravating factors such as structural failure or facilitation of criminal activity.

Notably, the article also includes a combination rule, meaning that breaches which individually fall below category three or four can still be elevated to those categories when assessed together.

Important points:

Supervisors are required to apply the indicators from Article 1 to place every breach into one of four severity categories, with each category having defined threshold conditions that must be met.
Supervisors cannot classify a breach as category one if certain aggravating indicators from Article 1 are present, regardless of how minor the impact or duration appears in isolation.
Breaches that appear less severe when assessed individually can be combined to reach a category three or four classification, meaning the cumulative picture matters.

1. When classifying the level of gravity of a breach, supervisors shall use four categories as follows, by increased order of severity: category one, category two, category three, category four.
1. To classify the breaches into one of the four categories listed in paragraph 1, supervisors shall assess whether and to what extent all the applicable indicators of Article 1 of this Regulation are met.
1. Supervisors may classify under those categories breaches other than those described in paragraphs 4 to 7.
1. Supervisors shall classify the breach under category one breaches where there is no direct impact or the impact is minor on the obliged entity when assessing the indicators specified in Article 1, points (d) and (e), and, at the same time:
  1. when assessing the indicator specified in Article 1, point (a), the breach has lasted for a short period of time, and
  2. when assessing the indicator specified in Article 1, point (b), the breach has been committed on a non-repetitive basis.
2. Supervisors shall not classify a breach as category one if indicators specified in Article 1, points (g) to (k) are met.
1. Supervisors shall classify the breach as category two where, for the indicators specified in Article 1, points (d) or (e), the impact is moderate and none of the indicators (g) to (k) of Article 1 are met.
1. Supervisors shall classify the breach as at least category three where, for the indicators specified in Article 1, point (d) or point (e), the impact is significant and at the same time:
  1. when assessing the indicators specified in Article 1, point (a), the breach has persisted over a significant period of time, or
  2. one of the indicators specified in Article 1 points (b) or (k), is met.
1. Supervisors shall classify the breach as category four where:
  1. when assessing the indicators specified in Article 1, point (d) or point (e), the impact is very significant, or
  2. when indicator specified in Article 1, point (h), is met, or
  3. when assessing the indicator specified in Article 1, point (g), the breach has facilitated or otherwise led to significant criminal activities as defined in Article 2(1), point (3), of Regulation (EU) 2024/1624, or
  4. when assessing the indicators specified in Article 1, point (i) or (j), the breach has a significant impact.
1. Breaches that would not be classified as category three or category four when assessed in isolation could amount to a breach of category three or four when assessed in combination.