Consultation on the draft RTS on the assessment of the inherent and residual risk profile of obliged entities in the non-financial sector
AML Agent page published: . Page updated: .
AMLA has opened a public consultation on draft Regulatory Technical Standards under Article 40(2) of Directive (EU) 2024/1640. The draft would establish a harmonised methodology for supervisors across the EU to assess and classify the inherent and residual money laundering and terrorist financing risk profiles of obliged entities operating in the non-financial sector.
The proposed methodology follows three steps: assessment of the entity’s inherent ML/TF risk, assessment of the quality of its AML/CFT controls, and classification of the residual risk remaining after controls are considered. It uses sector-specific data points and classifies risk as low, medium, substantial or high.
Although the methodology is principally addressed to supervisors, non-financial obliged entities may be required to provide structured information for the assessment. A simplified regime is proposed for entities with fewer than five full-time-equivalent employees and annual turnover below EUR 600,000, subject to both thresholds and certain supervisory exceptions.
The consultation closes on 27 September 2026. As drafted, the RTS would apply from 31 December 2028, or 31 December 2029 for football agents and covered professional football clubs; supervisors' first assessments would be due by 31 December 2029 and 31 December 2030, respectively. The final RTS may change these dates, data points and thresholds, and may introduce additional transitional arrangements for small entities.
Key takeaways
- AMLA is consulting on draft RTS under Article 40(2) AMLD; the text is not yet final or directly applicable.
- The proposal would introduce a common three-step, entity-level methodology: assess inherent ML/TF risk, assess AML/CFT controls, and classify residual risk.
- Inherent and residual risk would be classified as low, medium, substantial or high using weighted scores and sector-specific data points.
- The methodology covers non-financial obliged entities under Article 3(3) AMLR and may require them to supply structured data to supervisors.
- A proposed small-entity regime would apply only where an entity has fewer than five FTEs and annual turnover below EUR 600,000; both conditions must be met.
- Small entities would generally provide fewer Annex I inherent-risk data points and no controls data. Where the sectoral assessment indicates medium-high or high risk, supervisors may use the full Annex I inherent-risk indicators for that sector; they must adjust a small entity’s controls score if they hold relevant information about its controls.
- Assessments would generally be annual, with a three-year cycle available after an entity has been classified low risk; major developments would require supervisory adjustment within six months of becoming known.
- Consultation responses are due by 27 September 2026 at 23:59 CEST.
What changed
AMLA has published the proposed methodology for the non-financial-sector phase of its Article 40(2) AMLD mandate. The corresponding methodology for credit institutions and financial institutions was developed separately.
The draft introduces a common EU architecture for entity-level supervisory risk assessments while using sixteen sector-specific lists of inherent-risk data points. Supervisors would assess the entity’s inherent risk, the quality of its AML/CFT controls and its resulting residual risk.
The inherent-risk assessment would cover relevant entity, customer, product and service, geographical and distribution-channel indicators. Scores would be calculated through weighted averages and converted into low, medium, substantial or high-risk classifications. Supervisors could make documented adjustments where the calculated result does not adequately reflect the entity’s actual risk.
For entities outside the proposed small-entity regime, a limited set of AML/CFT controls data would inform the residual-risk calculation. The inherent-risk score would receive greater weight, limiting the extent to which reported controls could reduce the resulting residual-risk classification.
The draft also proposes a simplified regime for entities with fewer than five FTEs and annual turnover below EUR 600,000. These entities would generally provide a reduced set of inherent-risk data and would not ordinarily provide controls data. Supervisors could nevertheless require the full indicator set where a sector is assessed as presenting elevated ML/TF risk.
The proposal sets annual assessments as the general rule, permits assessment at least once every three years for entities previously classified as low risk, and requires adjustments following major changes in an entity’s operations or serious weaknesses in its AML/CFT controls.
Why it may matter
The final RTS could materially affect how non-financial obliged entities are assessed and prioritised for AML/CFT supervision across the EU. Under Article 40 AMLD, an entity’s risk profile informs the frequency and intensity of on-site, off-site and thematic supervision. A harmonised methodology could therefore lead to more consistent, data-driven supervisory treatment across Member States.
Although the principal methodological duties would fall on supervisors, obliged entities may need to provide the data required to calculate their risk profiles. This could create implementation work involving data mapping, system changes, reporting processes, governance, staff training and evidence of the design and effectiveness of AML/CFT controls.
The proposed dual threshold for small entities may substantially reduce reporting for qualifying firms, but both the FTE and turnover conditions must be satisfied. In a sector assessed as medium-high or high risk, supervisors may use the full Annex I inherent-risk indicators for small entities; this does not automatically require them to report controls data.
Entities operating across Member States may benefit from more consistent data definitions and supervisory methods. However, implementation could remain dependent on how national supervisors collect, validate and supplement information within the common framework.
The consultation gives obliged entities, professional bodies, supervisors and advisers an opportunity to provide evidence on data availability, proportionality, implementation costs, sector-specific issues and possible transitional arrangements before AMLA finalises the RTS.
Who may be affected
The primary implementers would be national supervisory authorities and, where applicable, self-regulatory bodies responsible for AML/CFT supervision of non-financial obliged entities.
The assessed population comprises the non-financial obliged entities listed in Article 3(3) of Regulation (EU) 2024/1624. This includes auditors, external accountants and tax advisers; in-scope notaries, lawyers and other independent legal professionals; trust and company service providers; estate agents and other in-scope real-estate professionals; traders in precious metals, precious stones and high-value goods; gambling service providers; crowdfunding service providers and intermediaries; in-scope art and cultural-goods market participants; certain mortgage and consumer-credit intermediaries; investment-migration operators; non-financial mixed-activity holding companies; football agents; and covered professional football clubs.
Compliance teams and management within these entities may be affected by supervisory data requests, data-quality expectations, controls assessments and the possible need to explain significant changes in the entity’s business model, structure, size or AML/CFT control environment.
FIUs, external auditors and other public authorities may also be relevant because the draft allows supervisors to obtain assessment information from sources other than the obliged entity itself. Legal, compliance, technology and data advisers may be engaged to support implementation and consultation responses.
Practical considerations
- Identify the Annex I data-point list applicable to the entity’s sector and map each requested field to an accountable owner, source system, definition and reference period.
- Test whether requested data can be produced accurately and repeatedly; document gaps, manual workarounds and data-quality limitations.
- Determine provisional eligibility for the small-entity regime using both thresholds: fewer than five FTEs and annual turnover below EUR 600,000.
- Do not assume small-entity treatment will always apply: supervisors could use the full indicator set for a sector assessed as medium-high or high risk.
- For entities outside the small-entity regime, assess readiness to evidence AML/CFT governance, systems, procedures and controls against Annex II.
- Compare likely supervisory submissions with the business-wide risk assessment and other regulatory reporting to identify inconsistent definitions or data.
- Estimate one-off and recurring costs, including systems, policies, training, reporting and staffing, and consider submitting supporting evidence before the consultation deadline.
- Establish monitoring for material changes in the business model, structure, nature or size of the entity and for significant AML/CFT control weaknesses.
- Retain an audit trail for data submissions, assumptions, data-quality decisions, adjustments and management approval.
- Track AMLA’s final report, Commission adoption and national implementation; the methodology, data points, thresholds and transitional arrangements may change.
These considerations support professional review and do not constitute legal advice.