Who will AMLA supervise directly in 2028? The selection methodology explained
The RTS on the selection of obliged entities for direct AMLA supervision, submitted to the Commission, sets the criteria: cross-border activity and inherent risk. What the first selection round means for candidate institutions.
From 2028 AMLA directly supervises a first group of around forty cross-border financial institutions. The AMLA Regulation sets the principle; the RTS on selection, submitted to the European Commission with the first tranche in July, sets the method. For the institutions concerned, selection changes who their supervisor is, how inspections are run and how sanctions are imposed.
Two tests
The methodology works in two steps. First, an activity test: the institution operates in a minimum number of Member States through establishments or under the freedom to provide services, with material activity in each. Second, an inherent-risk test: a risk score built from the customers, products, channels and countries of the institution, using data supervisors already collect for their own risk profiling. Institutions that pass both tests are ranked; the highest-risk ones up to the cap are selected.
Why "inherent" risk
Selection looks at inherent risk, not residual risk, deliberately. An institution with strong controls and high inherent risk is still the kind of institution AMLA wants to supervise itself. Good controls influence the supervisory dialogue afterwards, not the selection.
What selection means in practice
- A joint supervisory team led by AMLA with staff from the national supervisors, and a single point of contact.
- Supervisory decisions, including fines and periodic penalty payments, taken by AMLA under the sanctions RTS.
- Group-wide supervision where the group is selected, including branches and subsidiaries outside the home Member State.
- Information requests on a Union-wide standard rather than national templates.
Who should prepare
Banks, payment institutions, e-money institutions and crypto-asset service providers with activity in several Member States are the obvious candidates; the thresholds are set so that mid-sized cross-border firms can qualify, not only the largest groups. The first selection takes place in 2027 on data from the years before, so the risk profile that decides selection is being formed now.
What to do now
- Run the activity test yourself: in how many Member States do you have establishments or material cross-border activity?
- Ask your national supervisor which data feed the risk-profile calculation and check its quality; errors in reported data can push an institution over the line.
- If selection is likely, plan governance for a supervisory relationship with AMLA: one owner, one information hub, group-wide coordination.
The dashboard tracks the selection RTS under Governance; the company profile in the workspace records whether you expect to be selected, and the AI assessment takes it into account.