AMLA final report: draft ITS on cooperation within the AML/CFT supervisory system for direct supervision
AML Agent page published: . Page updated: .
On 21 July 2026, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) published its final report containing draft Implementing Technical Standards (ITS) under Article 15(3) of Regulation (EU) 2024/1620 (the AMLA Regulation, or AMLAR). The draft would establish operational rules for cooperation between AMLA and national AML/CFT financial supervisors in the selection and direct supervision of certain high-risk cross-border financial-sector obliged entities.
The draft uses a sequential process. Home-state financial supervisors would collect eligibility information; AMLA and relevant supervisors would validate the cross-border perimeter; and supervisors would collect and quality-check detailed data from the provisionally eligible population. AMLA would receive the information through a secured, traceable channel, perform the periodic risk assessments, carry out the selection, notify selected entities and publish the selection list.
The text also addresses supervisory handovers between national and EU level, inventories of supervisory information, continuity of pending supervisory procedures and investigations, existing cooperation arrangements, and minimum rules for joint supervisory teams (JSTs). These arrangements are intended to prevent gaps in supervision as AMLA prepares to begin direct supervision in 2028.
The report finalises AMLA’s draft after public consultation; it does not itself make the ITS binding. The draft remains subject to European Commission adoption, publication in the Official Journal of the European Union and entry into force. Its wording and timetable may therefore change.
Key takeaways
- AMLA published the final report on 21 July 2026, finalising its draft ITS under Article 15(3) AMLAR after public consultation.
- The draft is not yet an adopted or binding Commission implementing regulation; Commission adoption and Official Journal publication remain pending.
- The scope is financial-sector direct supervision: eligible credit institutions, financial institutions and groups operating in at least six Member States, not non-financial obliged entities.
- Home supervisors would collect eligibility information, financial supervisors would validate and submit the necessary data, and AMLA would perform the periodic risk assessment and selection.
- A home supervisor could exempt a clearly non-eligible firm from providing eligibility information where objective, available, credible and verifiable evidence supports and documents that conclusion.
- The draft requires secure, traceable and versioned information exchange; AMLA has already published eligibility reporting templates and guidance, while the standardised supervisory handover inventory template remains to be issued.
- Selected entities would receive written notification and due-process information before AMLA publishes the list, including information about review and appeal rights.
- Supervisory handovers would use at least three years of supervisory history, case-by-case treatment of pending matters and joint supervisory teams, supporting AMLA’s planned start of direct supervision in 2028.
What changed
AMLA moved the development from consultation closed to final report published. The six-week consultation ended on 27 January 2026 and received 25 responses. Respondents broadly supported the structure and focused mainly on clarification, proportionality and operational detail.
The final draft clarifies the steps and timing of the periodic assessment and selection process. It retains a sequential model under which national supervisors collect and quality-check information while AMLA performs the risk assessment and selection.
To reduce unnecessary reporting, AMLA added an exemption allowing a home supervisor not to collect eligibility information from a firm that it can establish is non-eligible using objective, available, credible and verifiable data. The supervisor must document the basis, and AMLA may review it.
The generic timetable uses year X as the selection year. Eligibility information would be submitted by 15 August X-1, AMLA would circulate a preliminary list by 25 August X-1, and final eligibility information would follow by 30 September X-1. Detailed data collection would be completed by 31 March X and transmitted by 31 May X. AMLA would communicate its initial assessment outcome by 31 July X, with proposed control-quality adjustments due by 30 September X. For the first selection in 2027, AMLA has already published the 2026 eligibility reporting package and set 15 August 2026 for supervisors' submissions, with the provisional eligibility list expected by the end of September 2026; the draft ITS timetable remains subject to the Commission’s final act.
AMLA also added or clarified safeguards for data exchange. The secure channel must support traceability and versioning, and AMLA must publish and maintain non-binding technical documentation, standardised reporting templates and instructions. A separate standardised inventory template would support transfers of supervisory information. The final report itself contains no annexed reporting template.
For pending supervisory procedures and investigations, the final draft avoids automatically transferring every open matter. The incoming supervisor would determine the arrangements case by case after consultation, taking account of continuity, enforceability, the stage and complexity of the matter and available resources.
AMLA did not add detailed due-process rules, the additional-selection procedure used from the second selection round, or more prescriptive JST governance. Due-process safeguards are expected in a separate instrument, while more detailed IT and JST arrangements are left to future operational or internal procedures.
The text is now AMLA’s final draft, but the Commission has not adopted it. The Commission may adopt it in whole or in part, amend it following coordination with AMLA, or reject it.
Why it may matter
This development helps turn AMLA’s direct-supervision mandate into an operational EU supervisory process. It allocates responsibility between national supervisors and AMLA for eligibility screening, data quality, periodic risk assessment, selection, notification and supervisory transition.
For potentially eligible cross-border institutions and groups, the immediate practical issue is likely to be data readiness. Firms may need to provide eligibility information and, if provisionally eligible, the data points used to assess inherent and residual ML/TF risk under the related draft RTS under Article 12(7) AMLAR. Data lineage, consistent group perimeters, validation and explanations for estimates or revisions may therefore become important.
Selection would materially change the supervisory relationship. A selected entity would transition from national direct supervision to AMLA-led supervision through a JST, while relevant national supervisors remain involved. Firms may need to manage supervisory handover, secure information exchange, open procedures and investigations, and interaction with a new EU-level decision-making framework.
The required handover inventory—normally covering at least the previous three years—and the case-by-case treatment of pending matters increase the importance of complete supervisory records, clear ownership and preserved audit trails.
AMLAR requires the first selection process to begin by 1 July 2027 and conclude within six months of its actual start. Direct supervision begins six months after publication of the selected-entity list; AMLA describes the planned start as 2028. These dates create near-term implementation pressure, but firms should verify operational milestones against the eventual Commission act and communications from their supervisors.
Who may be affected
The principal institutional addressees are AMLA and national AML/CFT financial supervisors. Supervisors would carry most of the operational duties, including eligibility screening, data collection and quality assurance, cooperation with AMLA, notification and transfer arrangements, and participation in joint supervisory teams.
Private-sector entities potentially affected are credit institutions, financial institutions and groups that may meet Article 12 AMLAR’s cross-border eligibility conditions. Depending on business model, this includes banks, bureaux de change, collective investment undertakings, non-bank credit providers, e-money institutions, investment firms, payment institutions, life-insurance undertakings and intermediaries, crypto-asset service providers and other financial institutions. Operations through establishments or material cross-border services, as well as group structure, are relevant to eligibility.
Not every entity in those sectors will be selected. Firms may first be asked for eligibility information, while the detailed risk data would generally be collected only from provisionally eligible entities. Entities classified as having high residual ML/TF risk may qualify for selection under Article 13 AMLAR, subject to its selection rules.
Within affected firms, legal and compliance, regulatory reporting, data governance, risk, internal audit, technology, group governance, senior management and supervisory-relations teams may need to support submissions and prepare for a possible change in supervisor.
DNFBPs and other non-financial obliged entities, and FIUs acting in their FIU capacity, are not the target scope of these ITS.
Practical considerations
- Treat the report as AMLA’s final draft, not as binding EU law; monitor the Commission decision, the adopted act, Official Journal publication and the stated entry-into-force date.
- Assess whether each entity and group could satisfy the Article 12 AMLAR cross-border eligibility test, including operations through establishments and material freedom-to-provide-services activity in at least six Member States.
- Map the legal-entity and group perimeter, home and host Member States, relevant national AML/CFT financial supervisors and accountable supervisory-contact owners.
- Map eligibility information and the related Article 12(7) risk data points to data owners, source systems, definitions, reference dates and supporting evidence.
- Design validation, data-quality and plausibility checks and retain explanations for incomplete data, proxies, estimates, alternative methodologies and significant revisions.
- Prepare secure, traceable and version-controlled submission and resubmission processes that can align with AMLA’s future data-exchange specifications.
- Use AMLA’s published eligibility reporting template, interpretative note and FAQ; monitor updates and the forthcoming supervisory handover inventory template. Distinguish those tools from the binding requirements of any adopted act.
- Keep relevant records in the firm’s possession readily retrievable for a potential handover; under the draft ITS, the transferring supervisory authority must establish and maintain the inventory, covering at least the three years before publication of the selected-entity list, or its entire period of supervision if shorter.
- Identify pending supervisory procedures and investigations, their decision stage, case files, confidentiality constraints and possible handover arrangements.
- For entities that may be selected, prepare governance for notification, technical corrections, substantive review, access to the selection file, legal representation and judicial review.
- Plan for an AMLA-led joint supervisory team, including national-supervisor participation, information access, meeting governance, confidentiality and continuity during JST-coordinator rotation.
- Reconcile the draft year-X timetable with the first 2027 selection cycle directly with the relevant supervisor; do not assume a proposed milestone is fixed before Commission adoption.
These considerations support professional review and do not constitute legal advice.
Development timeline
-
Final report published
Publication of a final report does not itself establish adoption or entry into force of the instrument.
View supporting official sourceMilestone verified by AML Agent: .