Who will AMLA supervise directly in 2028? The selection methodology explained
The RTS on the selection of obliged entities for direct AMLA supervision, submitted to the Commission, sets the method: cross-border activity and a high residual risk. What the first selection round means for candidate institutions.
24 September 2026. Correction: selection turns on the residual risk profile, not on the inherent risk alone. Institutions whose residual risk is classified as high qualify, and when more qualify than AMLA supervises, those active in the most Member States are selected (Article 13 AMLAR); the sections concerned were corrected. The selection RTS was sent to the Commission in December 2025; AMLA selects up to 40 entities from 1 July 2027 on data with reference date 31 December 2026. Statuses and dates in this article were aligned with AMLA's publications (regulatory instruments overview of 4 September 2026, Single Programming Document 2026-2028). AMLA has published no final guideline yet; where an EBA guideline exists on a topic it continues to apply until AMLA replaces it.
From 2028 AMLA directly supervises a first group of up to forty cross-border financial institutions. The AMLA Regulation sets the principle; the RTS on selection, sent to the European Commission in December 2025, sets the method. For the institutions concerned, selection changes who their supervisor is, how inspections are run and how sanctions are imposed.
Two tests
The methodology works in two steps. First, an activity test: the institution operates in at least six Member States, including its home Member State, through establishments or under the freedom to provide services (Article 12(1) AMLAR); the RTS sets the minimum activity that counts as operating in another Member State. Second, a risk test: AMLA classifies the inherent risk, built from the customers, products, services, transactions, delivery channels and countries of the institution, and the residual risk that remains after its controls, each as low, medium, substantial or high, using data supervisors already collect for their own risk profiling. Institutions whose residual risk profile is high qualify. When more qualify than the number AMLA decides to supervise, those active in the most Member States are selected (Article 13 AMLAR).
Why controls count
Selection turns on the residual risk: the inherent risk after the effect of the institution's internal policies, controls and procedures, which the methodology assesses against its own benchmarks (Article 12(6) AMLAR). An institution with high inherent risk and effective controls can therefore stay with its national supervisor, while one whose controls do not bring its risk down is a candidate. The data an institution reports on its controls matters as much as the data on its customers and products.
What selection means in practice
- A joint supervisory team led by AMLA with staff from the national supervisors, and a single point of contact.
- Supervisory decisions, including fines and periodic penalty payments, taken by AMLA under the sanctions RTS.
- Group-wide supervision where the group is selected, including branches and subsidiaries outside the home Member State.
- Information requests on a Union-wide standard rather than national templates.
Who should prepare
Banks, payment institutions, e-money institutions and crypto-asset service providers with activity in several Member States are the obvious candidates; the thresholds are set so that mid-sized cross-border firms can qualify, not only the largest groups. The first selection starts on 1 July 2027 on data with reference date 31 December 2026, collected in early 2027 from the institutions identified as provisionally eligible in 2026, so the risk profile that decides selection is being formed now.
What to do now
- Run the activity test yourself: in how many Member States do you have establishments or material cross-border activity?
- Ask your national supervisor which data feed the risk-profile calculation and check its quality; errors in reported data can push an institution over the line.
- If selection is likely, plan governance for a supervisory relationship with AMLA: one owner, one information hub, group-wide coordination.
The dashboard tracks the selection RTS under Governance; the company profile in the workspace records whether you expect to be selected, and the AI assessment takes it into account.