The first tranche of RTS is with the Commission: what happens next
10 July 2026 was the statutory deadline for the first tranche of technical standards: AMLA delivered some of them and rescheduled the rest. How adoption, scrutiny and publication work, and what obliged entities can already do.
21 September 2026. Correction: two RTS (risk assessment for financial supervisors, selection for direct supervision) reached the Commission in December 2025 and the sanctions RTS followed in July 2026; the RTS on customer due diligence and on thresholds are scheduled for a final draft in the third quarter of 2026. Statuses and dates in this article were aligned with AMLA's publications (regulatory instruments overview of 4 September 2026, Single Programming Document 2026-2028). AMLA has published no final guideline yet; where an EBA guideline exists on a topic it continues to apply until AMLA replaces it.
The AMLR gave AMLA until 10 July 2026 to deliver the first tranche of Regulatory Technical Standards to the European Commission. Of the four RTS that the EBA consulted on in spring 2025, two reached the Commission in December 2025 (the risk-assessment methodology for financial supervisors and the selection of entities for direct supervision) and the sanctions RTS was approved for transmission on 1 July 2026. The RTS on customer due diligence, re-consulted by AMLA until 8 May 2026, is scheduled for a final draft in the third quarter of 2026: AMLA adjusted that deadline in its programming document. The AMLR Monitor dashboard shows each one at its current stage.
From draft to delegated regulation
Submission is not adoption. Under the AMLA Regulation the Commission decides within three months of receipt whether to adopt a draft RTS as a delegated regulation, and must tell Parliament and the Council when it cannot meet that period. It can adopt the draft as it is, adopt it with amendments after informing AMLA, or send it back with reasons. In practice the Commission rarely rewrites a technical standard from scratch, but it does check consistency with the Level-1 text and with other EU law, which is where changes tend to appear.
Once adopted, the delegated regulation goes to the European Parliament and the Council, which have a scrutiny period in which they may object. Only after that period ends without objection is the act published in the Official Journal and given a date of application. For the CDD standards that date is expected to line up with 10 July 2027.
What can still change
The text that obliged entities read in the final drafts is the text AMLA stands behind, and it already reflects the consultation responses. Changes at Commission level typically concern legal drafting, cross-references and the boundaries between what an RTS may specify and what the regulation itself decides. The substance of the CDD data set, the sources for verification and the triggers for simplified and enhanced measures should not move much.
What to do while you wait
- Work from the final drafts. Treat the submitted texts as the design basis for onboarding data models, verification sources and periodic-review frequencies. Note where you rely on a provision that could still be redrafted.
- Map the dependencies. The CDD RTS drives the customer data model; the risk-assessment RTS shapes how supervisors will judge you; the selection RTS decides whether AMLA becomes your supervisor in 2028. Assign an owner to each.
- Prepare a change log. When the delegated regulations are published, compare them with the final drafts and record the differences. That log becomes evidence for your supervisor of a controlled implementation.
What to expect this autumn
Adoption decisions on the first tranche and the consultations that are open now: the ITS on the suspicious transaction report template (until 20 September 2026), the Guidelines on ongoing monitoring (until 3 September) and the Guidelines on the business-wide risk assessment (until 15 July). All are tracked on the dashboard with their consultation windows.