AMLA consults on the central AML/CFT database RTS: what supervisors will share

On 7 October 2026 AMLA published a consultation paper on the draft RTS that will set up its central AML/CFT database, the EU-wide repository in which every AML/CFT supervisor, financial and non-financial, will record what it knows about the entities it supervises. The mandate sits in Article 11(6) of the AMLA Regulation (Regulation (EU) 2024/1620, AMLAR). Unlike most of AMLA's consultations so far, this one runs through a single public hearing on 3 November 2026 (14:00 to 16:00 CET) rather than a written response window. The press release is at https://www.amla.europa.eu/press-release-amla-consults-draft-standards-eu-wide-amlcft-database_en and the consultation page at https://www.amla.europa.eu/policy/public-consultations/consultation-public-hearing-draft-rts-establishing-central-amlcft-database_en.

Obliged entities will not report to this database themselves. They are nonetheless its subject matter. This article sets out what AMLA proposes, how it differs from the EBA's EuReCA, and why an MLRO or compliance manager should read it as a description of the file that supervisors across the EU will hold on their institution.

What AMLA published on 7 October

Article 11 AMLAR requires AMLA to establish and maintain a central database with information transmitted by supervisory authorities, to analyse it and to share it, on a need-to-know and confidential basis, with the authorities that form the EU AML/CFT supervisory system. Article 11(6) asks AMLA to draft RTS specifying the information to be transmitted, its scope and level of detail, the reporting formats and timelines, and the conditions under which AMLA may ask supervisors for additional information.

According to the consultation paper and press release, the draft RTS would require national supervisors and, for the non-financial sector, self-regulatory bodies to transmit two families of information:

Information about the supervisors themselves: their powers and tasks, statistics on resources and staffing, and the supervisory activities they have performed.
Information about individual obliged entities: their ML/TF risk, sanctions, administrative measures and periodic penalty payments imposed on them, authorisations and withdrawals of authorisation, and the outcome of fit and proper assessments.

Three design choices stand out. First, the draft sets a materiality threshold above which a breach must be reported, so that the database does not fill up with minor findings. Second, AMLA says the standards draw first on data supervisors already hold or will collect anyway, so that the database creates no new reporting costs for obliged entities, with automated transmission where possible. Third, entry into force is staged for some elements, because supervisors need time to adapt their own systems.

AMLA's Single Programming Document had scheduled this consultation for Q2 2026 and the final draft for Q3 2026; both slipped. On the AMLR Monitor dashboard the instrument was listed as 'Announced, no draft yet' at the 6 October status date and is being updated to 'In consultation' with the hearing on 3 November 2026 as the date for input. AMLA has not announced a new date for the final draft; the dashboard expectation remains end-2026, and the hearing-only format suggests AMLA intends to move quickly.

From EuReCA to the AMLA database

The EU already has a central AML/CFT database. The EBA launched EuReCA in January 2022 under Article 9a of the EBA Regulation, with the detail in Commission Delegated Regulation (EU) 2024/595, which defines 'material weaknesses' in financial institutions and the measures taken in response. EuReCA transferred to AMLA on 1 January 2026 together with the EBA's other AML/CFT mandates and keeps operating until the new rules apply.

The Article 11 database is broader in three ways:

Scope of entities: EuReCA covers credit and financial institutions only. The AMLA database covers the whole population of obliged entities under the AMLR, including lawyers, notaries, accountants, estate agents, TCSPs, dealers in goods and gambling operators, and the self-regulatory bodies that supervise some of them.
Scope of data: EuReCA is built around weaknesses and measures. The AMLA database adds risk profiles, authorisation decisions, fit and proper outcomes and, on the supervisory side, resources and activity statistics. It is as much a tool for AMLA's oversight of supervisors as a record of entities.
Purpose: AMLA will use the data for its risk assessments, for the thematic reviews and peer reviews it performs on national supervisors, and as one input into the methodology for selecting entities for direct supervision from 2028.

Until the new RTS applies, Delegated Regulation 2024/595 remains the operative text for financial institutions. The staged application in the draft RTS is meant to bridge the two regimes without a reporting gap.

Why it matters for obliged entities

An institution never sees the database, so why read the RTS? Because it describes the supervisory file that follows the institution around the EU.

Findings travel. A material breach identified by one supervisor becomes visible to every other supervisor with a legitimate interest, including the home and host supervisors of a group. Read alongside the RTS on home-host cooperation (status: 'Final text, awaiting publication'), which allows onward disclosure within the EU supervisory system without prior consent, this means a finding in one subsidiary can shape the risk rating and inspection planning for the whole group.
Risk ratings travel. The risk-profile data points come from the RTS on the inherent and residual risk profile of financial-sector entities ('Final text, awaiting publication') and the non-financial-sector equivalent ('In consultation' until 27 September 2026, now being finalised). The database is where those ratings are stored and compared.
Sanctions travel. Sanctions, administrative measures and periodic penalty payments graded under the RTS on sanctions ('Final text, awaiting publication') will be recorded per entity. Where the AMLD6 requires publication of sanctions, the database adds a confidential, structured layer on top.
People travel. Fit and proper outcomes for senior managers and, where national law requires it, for beneficial owners, will be retrievable by other supervisors. A refused or withdrawn assessment in one Member State is unlikely to stay local.
Selection depends on it. For credit and financial institutions operating in six or more Member States, the data AMLA uses to confirm eligibility and residual risk for direct supervision overlaps heavily with what the database holds.

The practical consequence is that the quality of your supervisory record now matters across borders. Remediation that is complete but not evidenced, or a finding closed informally without a written confirmation from the supervisor, risks remaining on file as an open weakness.

Questions worth raising at the hearing

AMLA has invited stakeholders to the hearing, and obliged entities and their associations have a legitimate interest even though they are not the reporting parties. Points to raise:

The materiality threshold: how it aligns with the four gravity levels in the RTS on sanctions, and whether a breach classified at the lowest level is excluded.
Whether an entity will be told when a finding, measure or risk rating about it is entered, and whether there is a route to correct inaccurate entries, which also matters under the GDPR for information on natural persons such as managers and beneficial owners.
Retention periods for entries, especially for closed findings and expired measures.
How self-regulatory bodies with limited IT capacity will meet the formats and timelines, and whether the staged application gives them enough room.
How the database interacts with the confidentiality and professional-secrecy regime of AMLD6, in particular for the legal professions.

These are open points in a draft; nothing here is settled until AMLA publishes its final draft and the Commission adopts it.

What to do now

Read the consultation paper and register for the 3 November 2026 hearing if your institution or trade body wants to comment; it is the only channel for feedback.
Reconcile your own list of open supervisory findings with the supervisor's view. Ask for written closure of remediated items.
For groups, map which supervisors hold findings on which entities and assume all of them will be visible to the lead supervisor and to AMLA.
Check that fit and proper documentation for board members and the compliance manager is complete and consistent across the entities where they hold roles.
Keep the database in mind when planning the 2027 selection data submission if you operate in six or more Member States.

The AMLR Monitor dashboard tracks the RTS on the central database together with the RTS on risk profiles, sanctions and home-host cooperation discussed above, and will record the status change once AMLA publishes the final draft.