Source: AMLA final report draft
RTS on risk assessment to select institutions for direct supervision
COMMISSION DELEGATED REGULATION (EU) .../...
of XXX
supplementing Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 with regard to regulatory technical standards specifying the methodology for assessing credit institutions, financial institutions and groups of credit and financial institutions for the purposes of the selection for direct supervision by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism
This is a draft act
This text has been parsed from the AMLA final report draft as published on 16 December 2025. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024, establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, and in particular Article 12(7) thereof,
Whereas:
Recital 1
In accordance with Regulation (EU) 2024/1620, certain obliged entities in the financial sector shall be directly supervised by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (the Authority). The selection of these obliged entities takes place in two stages. In the first stage, the Authority identifies all credit institutions, financial institutions or groups of credit and financial institutions that are operating in at least six Member States, including the home Member State, either via establishment or by conducting relevant operations under the freedom to provide services. In the second stage, the ML/TF risk profile of these entities is classified, to identify those that present a high residual risk.
Recital 2
The ability to provide services in different Member States without having to create an establishment in those Member States is a key feature of the freedom to provide services. In the current context of digitalisation of financial services, a growing number of institutions use this ability to provide their services in other Member States. In some instances, however, entities notify their financial supervisors of their intention to exercise this freedom but do not start this activity in practice. In other instances, entities exercise this freedom, but it does not represent a major part of their overall operations. Considering the above, materiality thresholds should be established to qualify as eligible for the selection of entities whose operation under the freedom to provide services is material. The thresholds and criteria developed in this Regulation should not be used to define the activity under the freedom to provide services principle for any other purposes.
Recital 3
All entities operating in at least six Member States through establishments or by conducting relevant operations under the freedom to provide services and whose residual risk profile is ‘high’ should qualify for direct supervision in accordance with Article 13(1) of Regulation (EU) 2024/1620.
Recital 4
To reduce the operational burden on obliged entities and financial supervisors and to ensure alignment between national and EU-level AML/CFT supervision, the assessment of the minimum activities to be carried out by a credit institution or financial institution to be considered as operating in a Member State other than that where it is established, should be based on data points collected for the purpose of the methodology for assessing the risk profiles of obliged entities in line with Article 40(2) of Directive (EU) 2024/1640. For the same reason, the methodology for the selection of directly supervised entities should build on the methodology for assessing the risk profiles of obliged entities in line with Article 40(2) of Directive (EU) 2024/1640. These risk profiles should be aggregated for the classification of the group risk profile, at the level of the highest parent company in the European Union which is a credit or financial institution.
Recital 5
To avoid that, as an effect of the aggregation of the entity-level score, the ML/TF risk profile of a high ML/TF risk group being unduly reduced because some of its components have a low risk profile, the group-wide methodology for the purposes of selection should reflect the relative importance of each entity within the group, in terms of size and risk, and attribute a higher weight to the most important entities.
Recital 6
It is essential to ensure full comparability of the outcomes of the selection process. Given the diversity of approaches adopted by financial supervisors, under the preceding AML/CFT regime which had been established by Directive (EU) 2015/849, to the evaluation of the residual risk profile of obliged entities, the methodology applied for the first round of selection should have different features from the one applied for the subsequent rounds, where a higher degree of harmonisation is envisaged. Some transitional rules should therefore be set, with the objective of limiting the possibility of adjusting the controls quality score based on qualitative assessments of the effectiveness of the entities’ controls. This would ensure a smoother transition to the application of the full methodology, when the Authority will have been able to foster, and then ensure, the consistency of supervisory practices.
Recital 7
This Regulation is based on the draft regulatory technical standards submitted to the Commission by the Authority.
HAS ADOPTED THIS REGULATION:
- Section 1Minimum activities to be carried out under the freedom to provide services
- Section 2Risk assessment
- Section 3Final provisions
The annex below has not yet been parsed into Springlex. You can read it in the original source PDF.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels,
For the Commission
The President
[For the Commission
On behalf of the President]
[Position]
Definition
crypto-asset services
Definition
supervisor
Definition
financial mixed activity holding company
Definition
crypto-asset service provider
Definition
credit institution
- a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013;
- a branch of a credit institution, as defined in Article 4(1), point (17), of Regulation (EU) No 575/2013, when located in the Union, whether its head office is located in a Member State or in a third country;
Definition
parent undertaking
- for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;
- for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:
- is an obliged entity;
- is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;
- has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; and
- is given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation;
Definition
crypto-asset
Definition
establishment
- a branch or subsidiary;
- in the case of credit institutions and financial institutions, an infrastructure qualifying as an establishment under prudential regulation;
Definition
property
Definition
group
Definition
financial institution
- an undertaking other than a credit institution or an investment firm, which carries out one or more of the activities listed in points (2) to (12), (14) and (15) of Annex I to Directive 2013/36/EU of the European Parliament and of the Council(32), including the activities of currency exchange offices (bureaux de change), but excluding the activities referred to in point (8) of Annex I to Directive (EU) 2015/2366, or an undertaking the principal activity of which is to acquire holdings, including a financial holding company, a mixed financial holding company and a financial mixed activity holding company;
- an insurance undertaking as defined in Article 13, point (1), of Directive 2009/138/EC of the European Parliament and of the Council(33), insofar as it carries out life or other investment-related assurance activities covered by that Directive, including insurance holding companies and mixed-activity insurance holding companies as defined, respectively, in Article 212(1), points (f) and (g), of Directive 2009/138/EC;
- an insurance intermediary as defined in Article 2(1), point (3), of Directive (EU) 2016/97 where it acts with respect to life insurance and other investment-related insurance services, with the exception of an insurance intermediary that does not collect premiums or amounts intended for the customer and which acts under the responsibility of one or more insurance undertakings or intermediaries for the products which concern them respectively;
- an investment firm as defined in Article 4(1), point (1), of Directive 2014/65/EU of the European Parliament and of the Council(34);
- a collective investment undertaking, in particular:
- an undertaking for collective investment in transferable securities (UCITS) as defined in Article 1(2) of Directive 2009/65/EC and its management company as defined in Article 2(1), point (b), of that Directive or an investment company authorised in accordance with that Directive and which has not designated a management company, that makes available for purchase units of UCITS in the Union;
- an alternative investment fund as defined in Article 4(1), point (a), of Directive 2011/61/EU and its alternative investment fund manager as defined in Article 4(1), point (b), of that Directive that fall within the scope set out in Article 2 of that Directive;
- a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014 of the European Parliament and of the Council(35);
- a creditor as defined in Article 4, point (2), of Directive 2014/17/EU of the European Parliament and of the Council(36) and in Article 3, point (b), of Directive 2008/48/EC of the European Parliament and of the Council(37);
- a credit intermediary as defined in Article 4, point (5), of Directive 2014/17/EU and in Article 3, point (f), of Directive 2008/48/EC, when holding the funds as defined in Article 4, point (25), of Directive (EU) 2015/2366 in connection with the credit agreement, with the exception of the credit intermediary carrying out activities under the responsibility of one or more creditors or credit intermediaries;
- a crypto-asset service provider;
- a branch of a financial institution referred to in points (a) to (i), when located in the Union, whether its head office is located in a Member State or in a third country;
Definition
third country
Definition
funds