The Guidelines on the business-wide risk assessment: what the consultation asks of you
AMLA consulted on Guidelines for the business-wide risk assessment under Article 10 AMLR until 15 July 2026 and is finalising them. The structure they expect, the link to the supervisory methodology and what changes for institutions with a SIRA.
21 September 2026. Correction: the consultation had closed on 15 July 2026 when this article appeared; AMLA is finalising the guidelines for the fourth quarter of 2026. Statuses and dates in this article were aligned with AMLA's publications (regulatory instruments overview of 4 September 2026, Single Programming Document 2026-2028). AMLA has published no final guideline yet; where an EBA guideline exists on a topic it continues to apply until AMLA replaces it.
Article 10 of the AMLR requires every obliged entity to identify and assess the money-laundering and terrorist-financing risks it is exposed to, to document the assessment, to keep it up to date and to make it available to the supervisor. AMLA's draft Guidelines on the business-wide risk assessment, consulted until 15 July 2026 and now being finalised for the fourth quarter of 2026, describe how that is expected to be done. For Dutch institutions this is the successor of the SIRA that DNB has asked for since 2015; for institutions elsewhere it may be new.
The shape the Guidelines expect
The draft follows a familiar logic: inherent risk per risk factor, the controls that address it, and the residual risk that remains. The risk factors are the ones the AMLR names: customers, countries and geographic areas, products and services, transactions and delivery channels, plus the findings of the supranational and national risk assessments. What the Guidelines add is precision on granularity (per business line, per entity in a group, per country) and on evidence: which data supports each rating and who approved it.
The link with supervision
The risk-assessment RTS for financial supervisors, sent to the Commission in December 2025, sets the methodology supervisors use to rate obliged entities; a separate draft for the non-financial sector is in consultation until 27 September 2026. The Guidelines are its mirror image on the entity side. Where your own assessment and the supervisor's risk profile diverge, expect questions. A well-documented business-wide assessment is therefore also your best argument in a supervisory dialogue.
What changes for institutions that already have a SIRA
- Frequency becomes event-driven. An annual refresh remains the minimum, but a new product, a new market or a material change in the customer base triggers an update.
- Group perspective. Parent undertakings must be able to show a group-wide view alongside the entity views.
- Traceability to controls. Each residual risk must point to the policies, procedures and controls of Article 9 that mitigate it, and to the monitoring that proves the controls work.
- Management body involvement. The compliance manager presents the assessment; approval is recorded.
What to do now
- Compare your current SIRA structure with the draft: same risk factors, same granularity, same evidence?
- Build the link table between residual risks and controls if you do not have one; it is the piece supervisors ask for first.
- Decide the group-level view now if you are a parent undertaking; it drives the reporting lines of the compliance function.
- The consultation has closed; if you are a small entity, check the final text on proportionality, as the draft expects the same logic at every size, with less depth.
The dashboard tracks these Guidelines under Strategy & Risk; the workspace lets you record where the assessment stands.