AML reform progresses with final RTS on risk assessments and direct supervision selection

In March 2026, the EU’s Anti-Money Laundering Authority (AMLA) published two final reports on draft regulatory technical standards (RTS) on:

1. the assessment of the inherent and residual risk profiles of obliged entities in the financial sector (see final report here)
2. the assessment for the purpose of selecting obliged entities for direct supervision by AMLA (see final report here)

The two sets of draft RTS will be submitted to the European Commission for adoption before being published in the Official Journal of the EU.

The finalisation of these RTS marks a significant step in the EU’s objective of creating a consistent, risk‑based supervisory framework across the EU. By harmonising how money laundering or terrorist financing (ML/TF) risk is assessed and how high‑risk entities are identified for direct supervision, the RTS will give financial sector firms much greater clarity on supervisory expectations. This will ensure a more predictable and level playing field. As AMLA moves towards assuming its supervisory powers, these standards will form a critical foundation for both national supervisors and financial sector firms in navigating the new EU anti-money laundering/counter-terrorist financing (AML/CFT) landscape.

ALG’s Financial Regulatory Advisory Team has extensive experience in advising on AML/CFT matters. If your bank or financial institution is planning up-lifts to its internal AML/CFT policies, procedure and controls, please contact your usual ALG contact to discuss how we can help.

RTS on inherent and residual risk profiles of obliged entities in the financial sector

AMLA is mandated under Article 40(2) of Directive (EU) 2024/1640 (AMLD 6) to prepare draft RTS to develop a common methodology for national supervisors to use for assessing the level of ML/TF risk to which obliged entities are exposed.

The draft RTS specify:

• a common risk-based methodology for assessing and classifying the inherent and residual ML/TF risk profiles of obliged entities in the financial sector
• how often the inherent and residual risk profiles must be reviewed by national supervisors, taking into account the nature and size of obliged entities

The draft RTS do not apply to non-financial sector obliged entities. AMLA will prepare a separate set of draft RTS for the non-financial sector.

RTS on the risk assessment for selecting obliged entities for direct supervision

AMLA is mandated under Article 12(7) of Regulation 2024/1620 (AMLA Regulation) to prepare draft RTS on the risk assessment for the purpose of selecting up to 40 obliged entities (specifically, credit institutions and financial institutions) for direct supervision by AMLA.

From 1 January 2028, AMLA will directly supervise ‘selected obliged entities’ or groups of ‘selected obliged entities’ that are deemed to pose the highest risk of ML/TF and operate in at least six EU Member States through establishments or under the freedom to provide services. AMLA must begin the selection process by 1 July 2027 and determine the selection within six months. Where more than 40 obliged entities or groups would qualify for direct supervision based on their high-risk profile, AMLA may, in consultation with the relevant national supervisors, agree to directly supervise a larger number (AMLA has discretion in this regard). 

The draft RTS set out:

• materiality thresholds for determining if an obliged entity operates in an EU Member State via the freedom to provide services for the purposes of assessing if the obliged entity operates in at least six EU Member States
• benchmarks and methodology for classifying an obliged entity’s inherent and residual risk profiles for the purposes of assessing the obliged entity’s ML/TF risk
• a group-wide risk scoring method based on a weighted average of entity-level residual risk scores (this weighted averaging method ensures that high-risk obliged entities and significant operations are appropriately reflected in a group’s risk score)

AMLA’s data collection exercise to test risk assessment models

As previously signposted, AMLA recently published a reporting package for its data collection and testing exercise for calibrating its risk assessment models and methodologies. The exercise aims to:

• ensure that ML/TF risks of obliged entities in the financial sector are assessed consistently by national supervisors across the EU
• inform the selection of up to 40 obliged entities for AMLA's direct supervision

All obliged entities selected to take part in AMLA’s exercise have been notified by their national supervisor.  Participating entities are invited to download the excel template and refer to the accompanying interpretative note and submit their data by 22 April 2026. If you have not been notified of the exercise, you are not required to participate.

For further information on the EU’s new AML/CFT framework and how it impacts your firm, please contact Eoin O’Connor, Partner, Patrick Brandt, Partner, Eimear O’Brien, Partner, Louise Hogan, Partner, Sarah Lee, Senior Practice Development Lawyer or your usual ALG contact.

Date published: 31 March 2026