AMLA final report: draft RTS on group-wide AML/CFT requirements

Key takeaways

• The draft would require group arrangements to support consistent controls while preserving each obliged entity's responsibility for CDD, risk assessments and risk decisions.
• Relevant information sharing would include customer, beneficial-owner, transaction, risk and sanctions information, subject to need-to-know access, security, traceability and legal safeguards.
• Information concerning reported suspicions remains subject to FIU instructions and applicable restrictions; draft Article 6 preserves the carve-out for information covered by AMLR Article 70(2).
• Third-country legal impediments call for assessment, supervisory notification and proportionate additional measures. Customer consent is relevant only where legally compatible and effective.
• For qualifying groups headquartered outside the EU, the responsible EU parent is identified through prominence, understanding of operations and implementation responsibility, with supervisory assessment.
• Networks, partnerships and franchises may qualify where the defined common ownership, management or compliance-control conditions are met. A shared name alone does not establish scope.
• Permission to operate a qualifying structure without an obliged-entity head requires prior supervisory approval and continuing minimum common controls and information sharing.
• Draft Article 20 proposes application six months after entry into force. Notification transitions and the proposed repeal date for the existing RTS are separate provisions.

What changed

The final report follows the consultation opened on 16 April and closed on 15 June 2026. Both stages address the same combined Articles 16(4) and 17(3) instrument. The report cover is dated 30 September; AMLA announced the finalisation and submission on 1 October 2026.

Compared with the consultation text, the final draft retains a revised definition of structure and removes separate definitions for control functions, networks, partnerships and franchises. The scope assessment turns on the substantive criteria, including duration and common ownership, management or compliance controls. Draft Article 3 reorganises governance and risk requirements, emphasising the risks that significantly affect the group's overall exposure.

Information categories move into Annex I. Draft Articles 4-6 consolidate the sharing framework, including relevance, protected professional information and information flows to and from third countries. Each entity retains its individual responsibility; the framework does not turn group information into a substitute for its own CDD assessment. Article 4(3) would prevent group rules from making Annex I exchanges between obliged entities conditional on another group entity's prior approval, while preserving legal safeguards.

The consultation's seven articles on third-country impediments become three: minimum actions in Article 7, additional measures in Article 8 and supervisory actions in Article 9. This replaces scenario-specific prescriptions with a common framework whose response depends on the legal impediment and resulting risks.

Draft Articles 10-13 refine EU-parent identification. Articles 14-17 address qualifying structures and prioritise decision-making and control in identifying their head. The permission route in Article 17 is limited to cases where the head is not an obliged entity or Union or national law demonstrably prevents designation of a head. It requires prior supervisory approval, minimum common controls, information sharing and continuing monitoring. Where group and structure requirements conflict, Article 14(3) gives group requirements precedence.

Draft Article 20 replaces a fixed 10 July 2027 general application date with six months after entry into force, which would occur 20 days after Official Journal publication. Article 18 still proposes repeal of Delegated Regulation (EU) 2019/758 from 10 July 2027. Article 19 provides separate initial-notification transitions for existing structures. These dates and transitions must be checked against the adopted text.

Why it may matter

A group AML/CFT framework connects governance, risk assessment, compliance oversight and controlled information exchange across covered operations. The practical challenge is to show who can direct action, which risks reach group management and how local entities implement decisions. Consolidated policies should be tested against actual authority, data access and escalation routes.

When the AMLR applies, Article 16 requires a group risk assessment, group compliance functions and at least annual reporting by the group compliance manager. Article 17 addresses legal restrictions affecting third-country branches or subsidiaries. For credit and financial institutions within its third-country scope, Delegated Regulation (EU) 2019/758 already provides binding measures under the existing framework; AMLA's proposed repeal does not itself remove those current obligations.

Information sharing and third-country impediments need distinct assessments. Draft Article 5 can concern an overseas head office or another non-EU group entity even where it is not a branch or subsidiary of an EU entity. Articles 7-9 concern impediments affecting third-country branches or subsidiaries. A jurisdiction's law may create an impediment independently of its FATF or EU risk-listing status. Where additional measures cannot manage the risk, Article 9 provides for supervisory mitigation plans and corrective action, with further restrictions or closure where required. An impediment alone does not automatically require withdrawal.

For example, a shared group platform might make a foreign customer's CDD file technically accessible while local law restricts its transfer. Technology access does not resolve that legal restriction. Legal, privacy and AML teams should identify the affected data and lawful options, test compensating controls and document any residual risk. Group membership does not provide unrestricted permission to exchange personal or protected information.

Notification clocks also differ. Draft Articles 5(4) and 7(1) require notification without undue delay and within 28 calendar days after identifying the relevant restriction or impediment. Article 13(1) requires qualifying existing EU-parent arrangements to notify on the RTS application date. Article 19 gives existing structures six months after application for the specified head or permission notifications; it does not provide a blanket delay for group controls. The 60-calendar-day supervisory assessment period under Articles 13 and 16 runs from receipt of a complete notification; it is not the entity's notification deadline or automatic approval.

On 7 October 2026, Luxembourg's CSSF recommended that professionals complete gap analysis and take preparatory compliance and IT steps. Its notice expressly recognises that Commission adoption remains pending and amendments are possible. Preparation can be coordinated with the separate CDD and transaction-criteria RTS while retaining a distinct implementation register for this group-wide instrument.

Who may be affected

The proposal is relevant to obliged entities in financial and non-financial groups within the AMLR's definitions and scope. This includes covered banks, payment and e-money institutions, investment firms, insurers and crypto-asset service providers, as well as relevant professional, real-estate, gambling and other non-financial businesses. Insurance and legal-professional coverage remains activity-specific.

Qualifying networks, partnerships, franchises and cross-border branch structures also need assessment under draft Articles 2 and 14. The draft's definition of a structure requires at least two obliged entities, a durable common framework and common ownership, management or compliance control; the structure must not already be a group under the AMLR definition. Arrangements limited to referrals, shared branding or technical tools without the defined common ownership, management or compliance control generally fall outside that structure framework. The absence of subsidiaries does not by itself exclude a cross-border branch structure.

Third-country groups with at least two qualifying obliged entities in the EU need to assess EU-parent designation. Obliged entities with branches or subsidiaries in third countries need to assess the impediment provisions where local law restricts compliance. Group membership alone does not make every non-obliged affiliate directly subject to AML/CFT duties. Relevant teams include management, group and local compliance, legal, privacy, technology, risk, audit and supervisors.

Practical considerations

• Build an entity and jurisdiction map showing obliged-entity status, ownership, branches, activities, supervisory relationships and the powers actually exercised across the organisation.
• Assess group and structure scope separately. Record evidence of common ownership, management or compliance control instead of relying solely on a shared brand or an informal network label.
• For a qualifying foreign-headed group, document the proposed EU parent's prominence, operational understanding, resources and authority. Prepare the designation rationale and supporting group chart for supervisory review.
• Review governance approvals, reporting lines and the group compliance manager's access to management. Test how risk findings lead to actions and how unresolved local deficiencies are escalated.
• Assess significant group risks using local business assessments, outsourced activities and third-country operations. Preserve entity-level assessments and decisions, including when shared CDD information is used.
• Map information categories, recipients, purposes and restrictions. Test need-to-know access, secure exchange, data quality, logging, retention and applicable international-transfer requirements.
• Review handling of reported suspicions, FIU instructions and information protected under the professional-information provisions. Include legal checks in access rules and escalation procedures.
• Create a legal-impediment register identifying the jurisdiction, affected requirement, legal restriction, identification date, assessment owner and residual risk. Distinguish a legal prohibition from a technical failure or internal-policy restriction.
• Evaluate additional measures against the impediment and risk: independent CDD, enhanced monitoring, audits, senior-management approval or restrictions on activities. Confirm whether consent could lawfully and effectively address the problem before relying on it.
• Prepare notification workflows for impediments, EU-parent designation, structure-head designation and permission requests. Record each trigger separately and verify applicable limits, completeness requirements and material-change notices.
• For a proposed structure permission route, identify the coordinating obliged entity and demonstrate the minimum common systems, controls and information sharing. Obtain the required supervisory permission before relying on that route.
• Maintain an adoption and implementation register covering Commission changes, scrutiny, Official Journal publication, application, notification transitions and the proposed repeal. Allocate owners for policy, system, training and assurance work.

These considerations support professional review and do not constitute legal advice.

Legal basis and references

Official sources

• AMLA official source
• AMLA factsheet: group-wide minimum requirements
• AMLA factsheet: legal impediments in third countries
• AMLR: Regulation (EU) 2024/1624
• AMLAR: Regulation (EU) 2024/1620, consolidated 10 November 2025
• Delegated Regulation (EU) 2019/758: existing third-country RTS
• General Data Protection Regulation: Regulation (EU) 2016/679
• AMLA announcement of the final private-sector drafts, 1 October 2026
• AMLA group-wide RTS consultation history
• AMLA April 2026 consultation paper: earlier proposed text
• AMLA regulatory instruments register
• CSSF preparatory notice, 7 October 2026: Luxembourg supervisory context