AMLA ¦ Final Report on Draft RTS on the Risk Assessment for the Selection of Institutions for Direct Supervision

How AMLA will choose the institutions it supervises directly

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has finalised draft regulatory technical standards (RTS) under Article 12(7) of the AMLA Regulation (AMLAR), Regulation (EU) 2024/1620, that define how it will select the credit institutions, financial institutions and groups it supervises directly. The RTS sets materiality thresholds for cross-border activity under the freedom to provide services and a risk methodology, including a group-wide score, to identify high-risk entities. The first selection is due in 2027, with direct supervision starting in 2028.

A two-stage selection

Under Articles 12 and 13 AMLAR, selection happens in two stages. First, AMLA identifies every credit institution, financial institution or group that operates in at least six Member States, including its home Member State, either through establishments or through relevant activity under the freedom to provide services. Second, it classifies the money laundering and terrorist financing (ML/TF) risk profile of those eligible entities. Entities with a high residual risk profile qualify for direct supervision.

The aim is for AMLA to supervise the most complex entities with the largest EU footprint and a high ML/TF risk exposure, driven primarily by inherent risk. Weaknesses at such institutions can affect the financial system in several Member States at once, which makes them hard to supervise from any single national vantage point. All other obliged entities remain under national supervision.

Bastian Schwind-Wagner _Follow

"AMLA has chosen a mechanical, hard-to-game selection model: fixed thresholds for passported activity, no national adjustment of inherent risk, and a group score that a large high-risk subsidiary cannot hide behind smaller low-risk ones. That is the right design for an authority whose credibility depends on picking the right institutions from the start.

For institutions close to the six-Member-State line, the work starts with their own data: resident customers and transaction volumes per country, aggregated across the group. Recent on-site inspection findings also matter more than usual, because they are the only lever that can move the controls score in the first selection round."

When cross-border services count

Many institutions notify their supervisor that they intend to provide services in other Member States, but never do so in practice, or do so only marginally. Counting every notification would make large numbers of entities eligible on paper. The RTS therefore treats activity under the freedom to provide services in a Member State as material only where the institution had more than 20,000 customers resident there at 31 December of the previous year, or where those customers generated more than €50 million in incoming and outgoing transactions over the year.

The two thresholds are alternatives. The customer count covers retail-heavy business models, while the transaction threshold captures cases with few customers but high volumes, which are often the more relevant ones from a laundering perspective. Resident customers are used as a proxy because institutions may not be able to identify which customers were onboarded under the freedom to provide services.

All activity in the Member State counts, whether carried out directly or through branches, agents or distributors, and the activity of group entities in the same Member State is aggregated. The thresholds were set with the institution’s size and financial capacity in mind, since eligibility carries a supervisory fee. They apply only for selection purposes and do not define the freedom to provide services for any other purpose.

The same risk model as national supervisors

For the risk assessment, the RTS uses the methodology that national supervisors will apply under Article 40(2) of the Anti-Money Laundering Directive (AMLD). Inherent risk indicators covering customers, products and services, geography and distribution channels are scored from 1 to 4 and combined by weighted average into an inherent risk score. Controls quality is scored in the same way, and the residual risk score is derived from both. Each is classified as low, medium, substantial or high using the same thresholds of 1.75, 2.5 and 3.25.

Aligning the two methodologies reduces the reporting burden, because the same datapoints serve both purposes, and it means that an institution’s rating for national supervision and for AMLA’s selection rests on the same foundations.

No national adjustment of inherent risk

Under the national methodology, supervisors may adjust an inherent risk score by one level to reflect national specificities or other supervisory findings. For selection purposes, that option is excluded to prevent arbitrage and keep a level playing field. If national supervisors could lower inherent risk scores, they could keep institutions out of AMLA’s direct supervision, or push them in. Removing the adjustment makes the inherent risk element of the selection fully mechanical. Supervisors can still adjust controls quality scores on the basis of supervisory or external audit assessments, subject to justification and recording, though that option is limited in the first selection round.

A group-wide score that resists dilution

Most candidates for direct supervision are groups, so the RTS defines how entity-level residual risk scores are aggregated. AMLA, working with national supervisors, calculates the group-wide profile from the residual scores of all credit and financial institutions in the group established in the Union. The same approach applies to institutions outside a group that operate through branches.

The aggregation uses a weighted average with an exponent of at least 1 that increases the contribution of riskier entities. Each entity’s weight reflects its relevance within the group, measured by its number of customers, the value of its incoming and outgoing transactions and the assets it holds or manages. A high-risk group therefore cannot look safer simply because it also contains many low-risk entities, and a large, high-risk subsidiary will drive the group score even if most of its sister companies are low risk.

The result is converted into a group-wide residual risk score from 1 to 4 and classified on the same four-level scale. A high classification makes the group a candidate for direct supervision.

Transitional rules for the first selection

Supervisors have so far assessed residual risk in very different ways, so the first selection round follows simplified rules to keep outcomes comparable. Two datapoints will not be used: the number of customers with high-risk activities, and the number of customers whose CDD data is not yet in line with Article 20 of the Anti-Money Laundering Regulation (AMLR). Both are hard to obtain in time, or depend on rules not yet in force, and will be required in later rounds.

The general option to adjust controls scores based on supervisory or audit assessments does not apply in the first round. Instead, supervisors may move the controls quality score up or down by one level only on the basis of on-site inspections carried out in the two calendar years before the assessment starts, where those findings are relevant to the entity’s risk profile. Each adjustment must be justified and recorded.

For institutions likely to be in scope, recent inspection results therefore carry extra weight. Findings from inspections in the two years before the 2027 selection can move the controls score and, through it, the residual risk classification that decides whether AMLA becomes the supervisor.

What Luxembourg institutions should consider

Luxembourg hosts many banks, payment and e-money institutions, investment firms and fund managers that serve customers across the EU, often through passported services rather than local establishments. For these institutions, the materiality thresholds will determine whether their cross-border activity counts towards the six-Member-State criterion. Groups headquartered elsewhere with significant Luxembourg entities should also expect those entities’ residual risk scores to feed into the group-wide assessment.

Institutions near the thresholds should check their customer numbers by country of residence and the related transaction volumes, including activity through agents and distributors, and aggregate them across group entities. Those that are likely to be eligible should treat the quality of their datapoint reporting and the remediation of recent inspection findings as priorities, since both feed directly into the score that decides whether they move to AMLA’s direct supervision in 2028.

From the EBA’s draft to AMLA’s final text

The text is based on the draft prepared by the European Banking Authority (EBA), which consulted on it between March and June 2025 and submitted its advice to the Commission in October 2025. AMLA adopted the proposals as its own, with minor clarifications on groups and on institutions operating through branches, and did not consult again. The draft RTS will now be submitted to the Commission for adoption, and its application date has yet to be set.

Dive deeper

• AMLA ¦ Final Report ¦ Draft RTS on the risk assessment for selecting credit institutions, financial institutions and groups for direct supervision (RTS AMLAR 12(7)) (pdf) ¦ Link