Source: AMLA final report draft
- Anti-money laundering
AMLAR supplemental acts
- RTS on risk assessment to select institutions for direct supervision
Article 3 Assessment and classification of the quality of AML/CFT controls
This is a draft act
This text has been parsed from the AMLA final report draft as published on 16 December 2025. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.
Summary What does Article 3 of the RTS on risk assessment to select institutions for direct supervision say?
This article is the counterpart to Article 2, which deals with inherent risk.
Where Article 2 assesses the risks a credit or financial institution is exposed to, Article 3 focuses on the other side of the equation: how well the institution's AML/CFT controls actually work.
It lays out a sequential, scored methodology for supervisors to assess and qualify the quality of those controls, moving from scoring individual indicators through to a final classification of the institution on a four-tier scale from very good (A) to poor (D).
Notably, the methodology includes a supervisory override mechanism, allowing scores to be adjusted where the calculated result does not adequately reflect reality, provided any such adjustment is duly justified and recorded.
Important points:
- Supervisors are required to apply a structured, step-by-step scoring methodology to assess the quality of AML/CFT controls in place at credit and financial institutions, drawing on data points in Section B of Annex I.
- Supervisors are permitted to adjust a category score where a supervisory or external auditor's assessment indicates the calculated score does not adequately reflect the actual level of control quality, but every adjustment must be justified and recorded.
- The final controls quality score translates into one of four classifications — very good (A), good (B), moderate (C), or poor (D) — which feeds directly into the residual risk calculation set out in Article 4.
Springlex's summary of the article, a reading aid, not a substitute for the legal text.
The methodology for assessing and qualifying the quality of the AML/CFT controls put in place by a credit institution or financial institution to mitigate the inherent risks to which it is exposed shall consist of the following sequential steps:
identify all the controls quality indicators that apply to the credit institution or financial institution and allocate a score to each of these indicators, in accordance with paragraph 2;
calculate combined scores for all applicable categories of indicators listed in Section B of Annex I, in accordance with paragraph 3;
where supervisors have assessed that a combined score per category does not adequately reflect the level of quality of the controls falling within the relevant category, adjust the score accordingly, in accordance with paragraph 4;
calculate the controls quality score of the credit institution or financial institution, in accordance with paragraph 5;
classify the credit institution or financial institution in accordance with paragraph 6.
Each score allocated to a controls quality indicator shall be a numerical value without decimal places ranging from 1, that corresponds to the highest level of quality, to 4, that corresponds to the lowest level of quality. The controls quality indicators shall be established based on the data points listed in Section B of Annex I. The scores shall be calculated based on pre-determined thresholds.
Each combined score per category shall be a numerical value with two decimal places ranging from 1, that corresponds to the lowest level of risk, to 4, that corresponds to the highest level of risk. Each combined score per category shall be calculated from the scores allocated to its controls quality indicators, in accordance with paragraph 2. For this purpose, a weighted arithmetic average method shall be used. The weight applied to each indicator shall be based on its significance. The weights shall be expressed as a numerical value without decimal places ranging from 1, that corresponds to the lowest level of significance, to 5, that corresponds to the highest level of significance.
Each adjustment of a score per category shall be based on a supervisory assessment or an external auditors’ assessment available to the relevant supervisor. Each adjustment shall be duly justified and recorded. For the purposes of this paragraph:
a supervisory assessment shall mean any assessment of the effectiveness, or compliance with AML/CFT legal requirements, of all or part of a credit institution or financial institution’s AML/CFT governance, procedures, systems and controls carried out by a supervisor within the course of its supervisory activities. This includes, but is not limited, to full scope or targeted on-site inspections, thematic off-site reviews and other off-site analyses;
an external auditor’s assessment shall mean any assessment of the effectiveness, or compliance with AML/CFT requirements, of all or part of a credit institution or financial institution’s AML/CFT governance, procedures, systems and controls carried out by external auditors.
The controls quality score shall be a numerical value with two decimal places ranging from 1, that corresponds to the lowest level of risk), to 4, that corresponds to the highest level of risk. The controls quality score shall be calculated from the combined scores per category determined in accordance with paragraphs 3 and 4. For this purpose, a weighted arithmetic average method shall be used. The weight applied to each category shall be dependent on the score it received. Categories that received a higher score that corresponds to a lower level of quality shall have a greater weight than categories that received a lower score that corresponds to a higher level of quality.
The classification shall be based on the controls quality score attributed to the credit institution or financial institution in accordance with paragraph 5. The classification shall be made in accordance with the following conversion rules:
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
crypto-asset services
Definition
supervisor
Definition
financial mixed activity holding company
Definition
crypto-asset service provider
Definition
credit institution
- a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013;
- a branch of a credit institution, as defined in Article 4(1), point (17), of Regulation (EU) No 575/2013, when located in the Union, whether its head office is located in a Member State or in a third country;
Definition
crypto-asset
Definition
property
Definition
financial institution
- an undertaking other than a credit institution or an investment firm, which carries out one or more of the activities listed in points (2) to (12), (14) and (15) of Annex I to Directive 2013/36/EU of the European Parliament and of the Council(32), including the activities of currency exchange offices (bureaux de change), but excluding the activities referred to in point (8) of Annex I to Directive (EU) 2015/2366, or an undertaking the principal activity of which is to acquire holdings, including a financial holding company, a mixed financial holding company and a financial mixed activity holding company;
- an insurance undertaking as defined in Article 13, point (1), of Directive 2009/138/EC of the European Parliament and of the Council(33), insofar as it carries out life or other investment-related assurance activities covered by that Directive, including insurance holding companies and mixed-activity insurance holding companies as defined, respectively, in Article 212(1), points (f) and (g), of Directive 2009/138/EC;
- an insurance intermediary as defined in Article 2(1), point (3), of Directive (EU) 2016/97 where it acts with respect to life insurance and other investment-related insurance services, with the exception of an insurance intermediary that does not collect premiums or amounts intended for the customer and which acts under the responsibility of one or more insurance undertakings or intermediaries for the products which concern them respectively;
- an investment firm as defined in Article 4(1), point (1), of Directive 2014/65/EU of the European Parliament and of the Council(34);
- a collective investment undertaking, in particular:
- an undertaking for collective investment in transferable securities (UCITS) as defined in Article 1(2) of Directive 2009/65/EC and its management company as defined in Article 2(1), point (b), of that Directive or an investment company authorised in accordance with that Directive and which has not designated a management company, that makes available for purchase units of UCITS in the Union;
- an alternative investment fund as defined in Article 4(1), point (a), of Directive 2011/61/EU and its alternative investment fund manager as defined in Article 4(1), point (b), of that Directive that fall within the scope set out in Article 2 of that Directive;
- a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014 of the European Parliament and of the Council(35);
- a creditor as defined in Article 4, point (2), of Directive 2014/17/EU of the European Parliament and of the Council(36) and in Article 3, point (b), of Directive 2008/48/EC of the European Parliament and of the Council(37);
- a credit intermediary as defined in Article 4, point (5), of Directive 2014/17/EU and in Article 3, point (f), of Directive 2008/48/EC, when holding the funds as defined in Article 4, point (25), of Directive (EU) 2015/2366 in connection with the credit agreement, with the exception of the credit intermediary carrying out activities under the responsibility of one or more creditors or credit intermediaries;
- a crypto-asset service provider;
- a branch of a financial institution referred to in points (a) to (i), when located in the Union, whether its head office is located in a Member State or in a third country;
Definition
third country
Definition
funds