AMLA final report: draft RTS on Home-Host supervisory cooperation

Key takeaways

• The draft addresses supervisors of cross-border groups in both financial and non-financial sectors and preserves the specific arrangements governing AML/CFT supervisory colleges.
• Home and host supervisors would proactively share information that could significantly influence another Member State's assessment of an entity's inherent or residual risk.
• Before requesting information, supervisors would check whether it is already available and accessible through relevant registers or databases, supporting targeted and proportionate requests.
• Justified onward disclosure to the EU supervisory recipients specified in Article 9 would not require prior originator consent, but would require notification. Third-country-origin information remains subject to consent restrictions.
• Secure channels, access controls, logs and cooperation records would support information exchange. Article 4(3) excludes information protected within the meaning of AMLR Article 70(2).
• Cross-border inquiries require agreed arrangements, advance notification and respect for the requested supervisor's powers. Direct inquiries by the requesting supervisor retain the relevant consent and authorisation requirements.
• An exceptional request made through an alternative channel would need secure resubmission within 72 hours. The draft does not set that period as a general response deadline.
• Draft Article 10 proposes application from 10 July 2027 and entry into force 20 days after Official Journal publication. The final draft is not yet binding technical standards.

What changed

The final report advances the proposal discussed at AMLA's public hearing on 28 May 2026. AMLA announced publication on 1 October 2026. The consultation paper and final report concern the same Article 46(4) supervisory-cooperation instrument, rather than separate regulatory requirements.

Compared with the consultation text, final draft Article 3 removes references to the proposed request and acknowledgement templates. It instead specifies the minimum content, including the reason, object and justification of a request and the intended use of the information or inquiry. For duly justified exceptional requests made through another channel, it adds confidentiality and security conditions and secure resubmission within 72 hours.

Article 4 retains the check for information already available and accessible. The final text describes obtaining missing information through the supervisor's powers and retains the AMLR Article 70(2) privilege exclusion. Removing the earlier express procedure for jointly resolving doubts about privilege does not remove that exclusion.

Articles 5 and 6 retain proactive sharing of information relevant to another Member State's risk assessment. They expressly link additional relevant information, including planned or recent supervisory activities and risk reports, to AMLD Article 46(3). The proposed early exchange of intended sanctions or administrative measures remains tied to notification before the entity is informed of the procedure.

Final draft Article 7 specifies facilitation through the requested supervisor's powers and adds coordination of subsequent supervisory action where inquiry findings could seriously affect other parts of a group. Article 8 replaces the consultation's common-approaches formulation with coordination where necessary and recorded arrangements for activities, timelines, information exchange and follow-up.

Article 9 now expressly links onward disclosure to justified supervisory purposes and the specified recipients. The consultation's separate paragraph on other Union-law disclosure routes is absent from the operative final article; those routes must be assessed under the applicable legislation, which the final recitals also reference.

Article 10 adds a proposed application date of 10 July 2027, alongside entry into force on the twentieth day after Official Journal publication. This instrument's timetable must be checked in its own adopted text rather than inferred from another AMLA RTS.

Why it may matter

AMLD Article 2 defines the home Member State by an entity's registered office, or head office where it has no registered office; a host Member State has another establishment or relevant services infrastructure. Under Article 46(2), the home supervisor oversees implementation of group-wide policies, procedures and controls, subject to the exception where AMLA acts as supervisor, while host supervisors oversee compliance of establishments in their territories. The proposed procedures connect these responsibilities so that local findings can inform group supervision and risks affecting several entities can receive coordinated attention.

A group should be able to reconcile its parent and local risk assessments, supervisory findings, audit evidence and remediation records. For example, a host supervisor's finding of weaknesses at a subsidiary could materially change the assessment of group controls or risks at another group entity. Clear ownership and consistent evidence help explain both the local issue and its wider significance.

For supervisors, the draft's check of existing data, use of protected channels and documented requests would support proportionate cooperation. Firms can prepare accurate evidence and coordinate responses to lawful requests while preserving local responsibilities. Supervisory information-sharing procedures do not provide a general permission for a private group to share customer information.

The simplified consent approach has defined limits. Draft Article 9 covers justified supervisory disclosure to the specified supervisors, AMLA when acting as supervisor, and the public authorities overseeing self-regulatory bodies under AMLD Article 52. Originating supervisors would be told the information, recipient and rationale, where possible before disclosure and at the latest when it occurs. A third-country-origin report in an EU authority's file still requires its applicable consent restrictions to be checked.

The framework complements AML/CFT colleges and the separate RTS on group-wide requirements under AMLR Articles 16(4) and 17(3). It does not itself replace college procedures or resolve every difference between national supervisory positions. AMLD and AMLAR provide separate routes for referring failures to cooperate or disagreements to AMLA.

The EBA's October 2025 review found that information exchange through colleges had improved but coordinated action on issues affecting several group entities still needed work. Responsibility for monitoring AML/CFT colleges transferred to AMLA from 1 January 2026. That supervisory development supports preparation for more systematic cooperation, while the final draft remains subject to Commission adoption.

Who may be affected

The operative duties address home and host AML/CFT supervisors of credit institutions, financial institutions and obliged entities in the non-financial sector that belong to a group and operate in different Member States. Relevant supervisory bodies include authorities and, where permitted, self-regulatory bodies with AML/CFT supervisory functions. Article 9 also concerns the public authorities overseeing those self-regulatory bodies.

Affected businesses include covered banking, payment, e-money, investment, insurance and crypto-asset groups, as well as non-financial groups involving relevant professional services, real estate, gambling and other obliged activities. Insurance and professional-service coverage remains activity-specific. EU operations of third-country-headed groups can be relevant; EU-parent and home-supervisor identification must follow the applicable definitions and separate group-wide provisions.

AMLA explains that supervisors of non-financial networks or partnerships sharing common ownership, management or compliance control may use these procedures voluntarily; the underlying duty to cooperate remains distinct. Article 1 targets group supervision. Non-group cross-border entities and services without local infrastructure require separate assessment under the relevant AMLD provisions, including Articles 46(6)(b) and 47. A branch or remote service should not be classified solely by its physical form.

For groups, the practical audience includes management, group and local compliance, legal, privacy, audit, regulatory affairs and technology teams. The proposed 72-hour rule is addressed to supervisors resubmitting exceptional requests; firms should track the deadlines in the lawful requests addressed to them.

Practical considerations

• Map the group's legal entities, subsidiaries, branches, activities and home/host AML/CFT supervisors. Record which authorities oversee group controls and which oversee local establishments.
• Assess group supervision, standalone cross-border activity and non-financial network or partnership arrangements separately. Identify any applicable supervisory college and its specific cooperation procedures.
• Maintain a coherent evidence pack covering group and local risk assessments, governance, policies, audit findings, supervisory issues and remediation, with dates, owners and explanations for local differences.
• Assign group and local owners for supervisory requests. Record the requesting authority, legal basis, scope, intended use where provided, deadline and any agreed clarification or extension.
• For supervisory teams, document checks of accessible registers and databases before requesting information from counterparts. Verify access entitlements and whether the existing information is current and sufficient.
• Review secure communications, authentication, access permissions and exchange logs. Supervisors should preserve records of requests, decisions and information exchanged, including agreed language arrangements.
• Identify information subject to AMLR Article 70(2) and other applicable protections before disclosure. Involve legal and privacy teams where necessary and keep the basis for any restriction documented.
• For supervisory disclosure workflows, record information provenance, the authorised recipient and purpose, any third-country consent condition, and the originating supervisor's notification.
• For supervisory teams, distinguish the preferred response deadline from the 72-hour secure-resubmission rule for exceptional requests. Build prompt acknowledgement, clarification and delay-notification steps into the workflow.
• Prepare for cross-border inquiries by identifying local contacts, lawful access arrangements, language support, required permissions and resources. Preserve findings and coordinate relevant remediation across group entities.
• Where supervisors agree coordinated action, record activities, responsibilities, timelines, information flows and follow-up. Groups can align evidence and remediation planning with the confirmed supervisory arrangements.
• Track Commission adoption, scrutiny, Official Journal publication and the final application provisions. Coordinate preparation with group-wide and college requirements while retaining a separate record for this instrument.

These considerations support professional review and do not constitute legal advice.

Legal basis and references

Official sources

• AMLA official source
• AMLD: Directive (EU) 2024/1640
• AMLAR: Regulation (EU) 2024/1620, consolidated 10 November 2025
• AMLR: Regulation (EU) 2024/1624
• AMLA Home-Host final-report announcement, 1 October 2026
• AMLA Home-Host public hearing, 28 May 2026
• AMLA Home-Host consultation announcement, 11 May 2026
• AMLA May 2026 Home-Host consultation paper: earlier proposed text
• AMLA regulatory instruments register
• Joint AML/CFT Colleges Guidelines: JC 2019 81
• EBA review of AML/CFT colleges, 22 October 2025
• AMLA group-wide final draft: separate related instrument