A key pillar of the new European AML Package, which entered into force in 2024 (see our client briefing for an overview) was the establishment of the EU Anti-Money Laundering Authority (AMLA). AMLA will be competent for the direct AML supervision of selected obliged entities.
The new AMLA Regulation (AMLAR) already sets out in broad terms how AMLA shall select the 40 obliged entities that will be under its direct supervision. The European Banking Authority (EBA) has now published draft regulatory technical standards (the Draft RTS), which, among others, further specify the assessment methodology for determining which obliged entities will be in scope of the AMLA’s supervision.
This blogpost is the first of a series tracking the implementation of the European AML Package.
I. How does the selection process look like?
Article 5(2) AMLAR requires AMLA to directly supervise selected obliged entities (credit institutions, financial institutions and groups of credit and financial institutions). The selection process is outlined in Article 12(7) AMLAR and includes the determination of the:
- number of Member States in which an obliged entity operates; and
- level of risk of each eligible entity.
All entities operating in at least six Member States and whose residual risk profile is “high” are eligible for direct AMLA supervision. The rationale behind this approach is that it would allow AMLA to focus on the entities with the highest ML/TF risk and the largest geographic footprint.
1. Determining the number of Member States
Credit institutions, financial institutions and groups of credit and financial institutions that are active in at least six Member States, including the home Member State, are eligible to be directly supervised by AMLA (cf. Article 12(1) AMLAR).
The Draft RTS specify what it means “to be active” in a Member State and clarifies that only “material” activities in a Member State will be considered. EBA proposes to only consider activities as material where the
- number of customers that are resident in a Member State is above 20,000; or
- total value of incoming and outgoing transactions generated by the customers in a Member State is above EUR 50 million.
The EBA does currently not provide further guidance on, for example, (i) how the EUR 50 million threshold is to be calculated (ii) which services are counted towards this threshold and (iii) how transactions are to be attributed to a jurisdiction.
As a result, non-material activities in a Member State to which obliged entities have passported their licences will be disregarded. In doing so, the EBA recognises that obliged entities often passport their licences but are not or only barely making use of them.
Institutions that do not exceed either of the above-mentioned threshold will therefore not be supervised by AMLA.
2. Determining the level of risk of each eligible entity
The AML/CTF risk profiles of obliged entities that have passed the first step will be benchmarked in a second step, based on a risk score that will be calculated in accordance with the methodology set out in the Draft RTS, which provides for a four-step approach:
- Assessment of the inherent risk at the entity level, which is the risk that an entity may be used for ML/TF. As part of this assessment, the quantitative indicators set out in Annex I Section A, such as the number of customers, the total value of payment transactions, the total value of outstanding loans and the number of high-net worth clients. The outcome of the assessment will be a numerical score ranging from 1 (lowest level of risk) to 4 (highest level of risk).
- Assessment and classification of the quality of AML/CFT controls: The assessment focusses on qualitative aspects, such as the number of deficiencies pending at the end of the calendar year, the total number of outsourced AML activities, or the number of dedicated AML/CFT staff. The outcome of the assessment will be a numerical score, on the basis of which a controls quality score will be attributed to the obliged entity, ranging from A (very good quality of controls) to D (poor quality of controls).
- Assessment and classification of the residual risk at the entity level, which is the risk that an entity may be used for money laundering and terrorist financing, given the inherent risks to which it is exposed and the quality of the AML/CFT controls put in place. The third assessment therefore considers the net risks. Depending on the residual risk score, obliged entities will again be classified into low, medium, substantial or high-risk categories.
- Group-wide risk assessment: The group-wide risk is generally calculated by aggregating the entity-level residual risk scores of the group’s components. The result of the aggregation shall be converted into a numerical group-wide residual risk score, ranging between 1 (lowest risk) to 4 (highest risk).
The risk classification will be based on the very extensive list of data points listed in the annex to the Draft RTS. Interestingly, the Draft RTS does not address how AMLA will obtain this data.
In essence, the risk classification will therefore depend on the scope of business activities on the one hand and the appropriateness of corresponding AML/CFT controls on the other. High-risk business activities in themselves will not automatically result in direct AMLA supervision but only if the AML/CFT controls are not commensurate to the business activities.
II. What’s next?
It will be some time before the above-proposed criteria are applied in practice: The Draft RTS is part of an EBA consultation and stakeholders can respond to the consultation by 6 June 2025. The Draft RTS will be submitted to the Commission by 1 January 2026. AMLA will commence the first selection process on the basis of the final RTS on 1 July 2027, which is to be concluded in six months. AMLA is expected to start directly supervising select obliged entities in January 2028.
