--- title: "AMLA — Report — Draft RTS under Articles 16(4) and 17(3) [final draft submitted]" shortTitle: "AMLA — Report — Draft RTS under Articles 16(4) and 17(3) [final draft submitted]" type: final_report instrument_type: final_report authority: AMLA binding: false binding_character: non_binding legal_status: pending regulation: AMLR amlr_level3: true mica_level2: false reference: "Final Report – Draft RTS under Articles 16(4) and 17(3) of Regulation (EU) 2024/1624" legal_basis: "Articles 16(4) and 17(3) AMLR" date: 30 September 2026 source_link: "https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en" source_pdf: "https://www.amla.europa.eu/document/download/ffcb26fd-0a0e-4f4f-9c3d-9f3ce0a283b5_en?filename=Final%20Report%20-%20draft%20RTS%2016%284%29%20and%2017%283%29%20AMLR.pdf" lifecycle: "final draft submitted" text_version: "AMLA publication" source_url: "https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the AMLA publication" source: prepared_by: "AMLA" published_by: "AMLA" evidence: prepared_by: "through cross-reference obligations and complementary requirements. AMLA therefore proposes to" locator: "PDF, first line naming AMLA (page 1 names no issuer) (https://www.amla.europa.eu/document/download/ffcb26fd-0a0e-4f4f-9c3d-9f3ce0a283b5_en?filename=Final%20Report%20-%20draft%20RTS%2016%284%29%20and%2017%283%29%20AMLR.pdf)" document_type: "final_draft_rts" legal_nature: "not_adopted_draft" addressees: "not stated in the document" dates: document_date: "2026-09-30" locators: document_date: "PDF page 1: \"30/09/2026\"" adoption: status: "not_adopted" checked_on: "2026-10-28" method: "CELLAR: no regulation based on 32024R1624 dated on/after 2026-09-30" lifecycle_label: "final draft submitted" --- **Final draft RTS by AMLA, submission date not stated in the source · not adopted as of 28 Oct 2026 · not binding · dated 30 Sep 2026 [final draft submitted]** *Final draft submitted · AMLA publication · Checked against the AMLA publication on 26 Oct 2026 · [Official source](https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en)* | | | |---|---| | **Full title** | AMLA — Report — Draft RTS under Articles 16(4) and 17(3) \[final draft submitted\] | | **Prepared by** | AMLA | | **Published by** | AMLA | | **Reference** | Final Report – Draft RTS under Articles 16(4) and 17(3) of Regulation (EU) 2024/1624 | | **Document type** | Report | | **Legal nature** | Not binding | | **Adoption** | Not adopted as of 28 October 2026 (CELLAR search) | | **Addressees** | Not stated in the document | | **Dates** | Dated 30 September 2026 | | **Legal basis** | Articles 16(4) and 17(3) AMLR | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the AMLA publication | ## Final Report Draft Regulatory Technical Standards under Articles 16(4) and 17(3) of Regulation (EU) 2024/1624 Frankfurt am Main – 30/09/2026 ## 1 Executive Summary In order to strengthen the Union’s framework for anti-money laundering and countering the financing of terrorism (AML/CFT), Regulation (EU) 2024/1624 (AMLR) aims to harmonise the preventative measures to be put in place at Union level. Articles 16 and 17 AMLR cover the regulatory obligations regarding the design and implementation of group-wide AML/CFT frameworks, including their application across cross-border group structures and in situations where branches or subsidiaries operate in third countries. The purpose of the mandates under Articles 16(4) and 17(3) AMLR is to clarify further these obligations in draft Regulatory Technical Standards (RTS). The draft RTS contain requirements that specify further the framework and content of group-wide requirements. In addition to minimum general requirement, the draft RTS define provisions related to information sharing among entities of a group. Furthermore, they provide criteria for identifying the parent undertaking in the Union in cases of two or more obliged entities in the Union belonging to a head office in a third country and they are not in a parent/subsidiary relationship. They also provide conditions to apply group-wide requirements to structures other than groups and criteria to identify the head of the structure in these cases. This extension represents a significant development, particularly for the non-financial sector where such arrangements are common. The draft RTS ensure a proportionate and risk-based approach, ensuring applicability across both financial and non-financial sector groups. The mandates under Articles 16(4) and 17(3) AMLR are inherently interlinked, reinforcing each other through cross-reference obligations and complementary requirements. AMLA therefore proposes to draft a single set of draft RTS to address both mandates in a cohesive and simplified manner. Such a single instrument ensures regulatory coherence, avoids duplication between related provisions and provides obliged entities with a clearer and more consistent framework for implementing group-wide AML/CFT requirements across the Union. In preparing this final report, AMLA sought and considered input from national supervisors across both financial and non-financial sectors and engaged with private sector representatives. AMLA further enhanced the final report by considering the responses provided by respondents collected through the public consultation conducted between 16 April and 15 June 2026. These draft RTS are part of a broader set of AMLA instruments that will be delivered and that will touch upon the AML/CFT requirements of obliged entities. AMLA will continue its endeavors to place proportionality and the risk-based approach at the heart of this work and ensure the effectiveness of the instruments to be delivered while simplifying AML/CFT compliance for obliged entities where possible. ### 1.1 Next steps The draft RTS will be submitted to the European Commission for adoption before being published in the Official Journal of the European Union. ## 2 Background and rationale ### 2.1 General provisions Article 16 AMLR establishes the core obligations for group-wide AML/CFT frameworks, requiring parent undertakings to implement uniform policies, controls and procedures across all entities under their responsibility. It also mandates the establishment of a group compliance function and the adoption of an annual report on the implementation of these group-wide policies. Finally, it requires effective sharing of information within entities of a group. Article 16(4) AMLR requires AMLA to develop draft RTS specifying: * the minimum requirements of group-wide policies, procedures and controls, including minimum standards for information sharing within the group; * the criteria for identifying the parent undertaking in the cases covered by Article 2(1), point (42)(b) of Regulation (EU) 2024/1624. * the conditions under which the provisions of Article 16 AMLR apply to entities that are part of structures which share common ownership, management or compliance control, including networks or partnerships, as well as the criteria for identifying the parent undertaking in the Union in those cases. Article 17 AMLR complements the group-wide framework established under Article 16 AMLR by addressing situations where branches or subsidiaries located in third countries cannot fully implement group-wide AML/CFT policies, procedures and controls due to restrictions in local laws applicable in a third country. Article 17 AMLR requires parent undertakings or obliged entities to implement additional measures where legal or regulatory restrictions in a third country prevent compliance with the AMLR and to inform the supervisor of the home Member State of such impediments. Where those measures are insufficient to effectively manage the risk of ML/TF, supervisors of the home Member State may require the implementation of further supervisory actions, including restrictions on business relationships, the termination of transactions, or the closure of operations in the relevant third country. Article 17(3) AMLR therefore mandates AMLA to develop RTS specifying: * the type of additional measures to be taken by obliged entities where the law of a third country prevents compliance with the AMLR, * the minimum actions that must be implemented in such circumstances, and * the additional supervisory actions that may be applied by supervisors where the measures taken are insufficient. The provisions in the draft RTS fulfil the mandates in Articles 16 and 17 AMLR and establish high-level balanced group-wide requirements, which are compatible with existing (financial sector) requirements and guidelines. ### 2.2 AMLA’s approach - focus on simplification F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 In developing these RTS and taking into account the feedback received during the public consultation, AMLA sought to establish a simplified, proportionate and risk-based framework under the AMLR whenever possible. In particular, AMLA aimed to reduce unnecessary complexity, regulatory burden and compliance costs by establishing a single horizontal framework applicable across obliged entities in both the financial and non-financial sectors. To achieve this objective, AMLA: * refrains from sector-specifying requirements where the AMLR already provides sufficient detail; * maintains flexibility by setting out measures and options that obliged entities may consider when determining the most effective and proportionate approach to compliance; * streamlines closely related requirements falling within AMLA's regulatory mandate; * seeks to ensure consistency with existing supervisory expectations and established standards while reflecting AMLA's mandate under the AMLR and the feedback received from stakeholders * establishes a transitory regime for the first application of notifications set in Sections 5 and 6 to supervisors. In preparing these draft RTS, AMLA assessed the relevant provisions of the AMLR, the EBA's advice to the European Commission, as well as inputs received from public and private sector stakeholders. This assessment was undertaken to identify areas where further clarification, simplification or refinement was necessary to support the effective and consistent application of the AMLR. AMLA also engaged with national competent authorities from the financial and non-financial sectors, the European Commission, EBA and representatives of obliged entities. AMLA furthermore considered the feedback received through the public consultation conducted between 16 April and 15 June 2026 and refined the draft RTS where appropriate in light of the responses received. #### Definitions (Section 1) The draft RTS introduce a definition of the term ‘structure’ for the purposes of ensuring a consistent interpretation and application of the requirements set out in the draft RTS. Following the public consultation and AMLA’s further assessment of the draft RTS, several definitions included in the Consultation Paper have been removed. AMLA considered that these definitions were not necessary to achieve the objectives of the draft RTS, taking into account stakeholders’ feedback and the need to avoid unnecessary regulatory complexity. #### Minimum requirements regarding group-wide policies, procedures and controls (Section 2) The draft RTS further specify the group-wide requirements referred to in Article 16 AMLR. Article 16 AMLR requires parent undertakings in the Union to ensure that policies, procedures and controls are implemented consistently across all branches and subsidiaries within the group. The draft RTS provide rules setting out a clear governance framework, including the allocation of responsibilities, reporting lines and arrangements between relevant functions to ensure that relevant information is shared effectively across the group. To support the effective implementation of these obligations, the draft RTS also clarify that group-wide policies and procedures should be appropriately documented, kept up to date and made available to supervisors upon request. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 In light of the feedback received during the public consultation, AMLA streamlined and simplified this application of group-wide AML/CFT policies, procedures and controls. #### Information sharing within a group (Section 3) Effective information sharing is a cornerstone of the draft RTS, reflecting the principles outlined by the EBA as part of its response to the Commission’s call for advice issued in October 2025. The draft RTS set a broad list of information that when relevant under the AML/CFT framework may be shared within groups, enabling obliged entities to detect and mitigate cross-border ML/TF risks more effectively. The draft RTS nonetheless make clear that such sharing must be conducted in line with certain standards such as on a “need to know” basis, with appropriate safeguards to ensure compliance with data protection regulation and ensuring confidentiality and security. Additional provisions clarify the approach to the sharing of information to and from third countries when information sharing takes place from the perspective of obliged entities of the group in the Union. Following the public consultation, AMLA revised this section and moved the specific pieces of information to Annex I setting out the categories and types of information to be shared within a group. AMLA also amended the drafting of Section 3 to improve clarity and further reflect the principles of simplification and proportionality in the text, also in view of stakeholders’ comments. #### Legal impediments affecting branches and subsidiaries in third countries (Section 4) Groups subject to the AMLR frequently operate through branches or subsidiaries established in third countries. In some jurisdictions, local legal or regulatory frameworks may restrict the ability of OEs to implement group-wide AML/CFT policies, procedures and controls. Such impediments may arise, for example, from national data protection rules, banking secrecy provisions, restrictions on the sharing of suspicious transaction information, or limitations on access to customer or beneficial ownership information. Article 17 AMLR establishes a harmonised Union-level framework for managing such situations. Where the law of a third country does not permit compliance with the AMLR, parent undertakings or obliged entities are required to implement minimum actions, including additional measures, to ensure that branches and subsidiaries effectively manage ML/TF risks. The draft RTS build on the framework established by Commission Delegated Regulation (EU) 2019/758, while extending its scope to all obliged entities under the AMLR, including the non-financial sectors. This approach ensures continuity with the existing regulatory framework while updating it to reflect the broader scope and supervisory architecture introduced by the AMLR. However, the previous structure has been simplified and the mention to specific legal impediments has been removed along with the prescriptive additional measures for each one of those scenarios. The draft RTS introduce provisions on additional supervisory actions and establish a structured escalation framework to be applied where supervisors determine, following a supervisory assessment, that the measures taken are insufficient to effectively manage the risk. Where risks arising from third-country impediments are considered remediable, supervisors may require corrective measures, including the submission and implementation of risk-mitigation plans, and monitor their F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 implementation. Where risks are deemed unmanageable, the framework provides for stronger supervisory interventions, including restrictions on business relationships or occasional transactions, and ultimately the closure of some or all operations in the affected jurisdiction. Following the public consultation, AMLA simplified and streamlined Section 4 by reducing the number of articles from seven to three and removing the mention to specific legal impediments with rigid requirements. The revised structure aligns the provisions more closely with the AMLR mandate, with separate articles addressing minimum actions, additional measures and supervisory actions. This approach improves clarity, reduces complexity and further reflects the principles of simplification and proportionality underpinning the draft RTS. #### Criteria for identifying the parent undertaking in the Union in cases of two or more obliged entities whose head office is located outside of the Union (Section 5) The draft RTS introduce criteria for identifying the parent undertaking in the Union in cases where two or more obliged entities established in the Union have a common head office located outside of the Union and where there is no parent-subsidiary relationship among the obliged entities (sister or affiliate entities). The draft RTS provide a clear methodology for determining which obliged entity should be identified as parent undertaking and assume responsibility for group-wide requirements. The quantitative and qualitative criteria set in the draft RTS focus on decision-making powers, controls and risk management capacity, ensuring that the identified obliged entity is the best positioned obliged entity to enforce AML/CFT measures across the group as a parent undertaking. This also ensures that the identified obliged entity has the necessary resources and influence to implement and monitor compliance effectively. To prevent regulatory uncertainty, the draft RTS introduce a notification obligation and supervisory assessment, requiring the obliged entity identified as the parent undertaking to notify its role to the relevant supervisor. This mechanism ensures transparency and allows supervisors to identify and address potential gaps in compliance oversight. In light of the feedback received during the public consultation, AMLA streamlined and simplified this section of the draft RTS, while retaining the elements necessary to ensure the consistent and effective identification of the parent undertaking in the Union in the cases where there is no parent-subsidiary relationship among the obliged entities in the Union belonging to the same head office in a third country. #### Conditions for the application of group-wide requirements to structure sharing common ownership, management or compliance controls (Section 6) The draft RTS clarify the extension of the scope of group-wide requirements from traditionally defined groups under accounting or prudential regimes to structures that, while not formally organised as groups, exhibit characteristics that warrant similar AML/CFT requirements. This includes networks, partnerships, or franchises where the structure has two or more obliged entities that operate under common ownership, management, or compliance controls or a combination of them. The recitals, definitions, and criteria set out in the draft RTS are specifically designed to provide obliged entities, particularly those in the non-financial sector, with clear, actionable guidance to determine F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 whether they fall within the scope of these provisions. The objective is to effectively target structures where the application of group-wide AML/CFT measures is both necessary and proportionate. In addition to defining the scope of application, the draft RTS also provide criteria for identifying the head of the structure for these structures. The criteria are built mainly to recognise the powers and controls of one entity in the structure. To maintain regulatory clarity, the draft RTS introduce a notification requirement to the supervisors and supervisory assessment. This mechanism ensures that supervisors are aware of the identified entity acting as head of the structure and can monitor compliance of group-wide requirements effectively in such structures. First notification to supervisors shall take place no later than six months after the application of the RTS. Under justified circumstances and to recognise proportionality, the draft RTS address situations in structures where obliged entities identify a non-obliged entity as the head or where there are legal impediments for the identification of the head. The draft RTS introduce a supervisory mechanism that allows obliged entities not to identify the head of the structure under certain conditions to ensure that certain minimum group-wide requirements still apply to them. In case the permission is granted, the application of group-wide requirements would be limited to certain minimum group-wide requirements that obliged entities would mutually comply with without requiring group-wide steering of one designated obliged entity acting as head of the structure. First notification to supervisors shall take place no later than six months after the application of the RTS. In light of the feedback received during the public consultation, AMLA clarified the provisions in this section of the draft RTS, while retaining the elements necessary to ensure the consistent and effective application of group-wide requirements to structures other than groups having common ownership, management, compliance control or a combination of them. In addition, AMLA recognized proportionality in the application of group-wide requirements to structure other than groups in the absence of a head of the structure being an obliged entity, while still ensuring minimum application of certain group-wide requirements in this situation. ## 3 Draft regulatory technical standards ### COMMISSION DELEGATED REGULATION (EU) .../... ### of XXX supplementing Regulation (EU) 2024/1624 of the European Parliament and of the Council with regard to regulatory technical standards on group-wide requirements, on additional measures and additional supervisory actions related to obliged entities’ branches or subsidiaries in third countries (Text with EEA relevance) ### THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing[^1], and in particular Articles 16(4) and 17(3) thereof, Whereas: (1) Regulation (EU) 2024/1624 aims for the harmonisation of the measures to be put in place to prevent money laundering, its predicate offences, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions at the Union level, including when such measures are designed and implemented in groups or in structures other than groups when such structures fulfil the conditions set out in this Regulation. Minimum requirements for group-wide policies, procedures and controls should be developed, implemented and applied at the group level in an adequate and consistent manner, while avoiding any risks of compromising anti-money laundering, counterterrorism financing as well as preventing the risk of the non-implementation or evasion of targeted financial sanctions. (2) Group-wide policies, procedures and controls should be designed to ensure consistency in the implementation of the group-wide requirements mentioned in Regulation (EU) 2024/1624, for example by enhancing governance arrangements; the standing and role of the compliance manager and, where applicable, those of the compliance officer at the level of the group; the relations between the parent undertaking and the subsidiaries and branches in the Union and in third countries; and the development and implementation of group-wide risk assessments. In this context, internal controls should be understood in line with the terms used in Regulation (EU) 2024/1624 and other applicable sectoral Union rules. (3) At the same time, group-wide policies, procedures and controls should not result in a derogation for the parent undertaking in the Union from implementing the entity-level policies, procedures and controls, including its entity-level risk assessment. (4) Information sharing within groups is a key element of ensuring an appropriate understanding of money laundering risks, terrorist financing risks and risks of the non-implementation and evasion of targeted financial sanctions. Information sharing should mitigate these risks, especially when they are associated with customers and transactions. (5) A list of information that, when considered relevant for the purposes of the prevention of money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions, can be shared is provided in Annex I to this Regulation. The type of information to be shared within the group should include, among other types, information on customers, transactions, services and activities, risk assessments, internal controls, independent audit functions, external audits, suspicious transactions or activity reporting, group-wide policies, procedures and controls, and interactions with supervisors and competent authorities. In any case, information sharing should take into account the requirements set out in Regulation (EU) 2024/1624, Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849[^2] and any administrative act of the supervisors. (6) Obliged entities should use the information shared by other entities in the group to make, among other things, informed decisions on customers, transactions and risk assessments, and to potentially restrict or refuse to enter into a new relationship, terminate existing business relationships or restrict or refuse to carry out the execution of occasional transactions in accordance with Regulation (EU) 2024/1624. Furthermore, the information shared within the group should be used to prevent and mitigate money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions and to inform the parent undertaking in the Union of the group-wide-level risk assessment. (7) Information sharing should also include ad hoc sharing of newly identified relevant information related to the risk of the non-implementation or evasion of targeted financial sanctions. (8) The Union anti-money-laundering / countering the financing of terrorism (AML/CFT) framework applies to a wide variety of obliged entities. Some obliged entities perform transactions; other obliged entities, such as real estate agents, lawyers and notaries, provide services or activities connected to transactions. For these obliged entities, information-sharing requirements should include sharing of information related to the provision of services or activities under the AML/CFT framework. (9) Certain aspects of the implementation of the AML/CFT framework involve the collection, analysis, storage and sharing of data, including personal data. The processing of personal data should be permitted only for the purposes of the prevention and management of money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions. In addition, information sharing should be subject to sufficient guarantees in terms of confidentiality, secure channels and data protection in line with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation[^3]) regarding the use of information and should fully respect fundamental rights. (10) Sharing of information should be implemented in a manner proportionate to the relevancy of the request and be based on a need-to-know assessment. In any case, obliged entities should not be prevented from sharing any relevant information related to risks of money laundering, terrorist financing or the non-implementation or evasion of targeted financial sanctions as deemed appropriate. (11) Obliged entities in the Union may share information with other entities of the group outside the Union. In such cases, the Regulation clarifies that in cases where there are restrictions or prohibitions on the sharing of information to third countries, the parent undertaking in the Union and the other obliged entities of the group in the Union need to assess the restrictions and prohibitions and communicate them to the supervisors in the Union. Similarly, in cases where restrictions or prohibitions on the sharing of information exist from third countries to the Union, including to supervisors in the Union, obliged entities in the Union need to assess restrictions or prohibitions and communicate them to the supervisors in the Union. In any case, obliged entities should take appropriate measures to address such restrictions or prohibitions on sharing information. (12) There are circumstances where a group or an obliged entity operates branches or subsidiaries in a third country whose law does not permit the implementation of group-wide policies, procedures and controls on AML/CFT. This can be the case, for example, where the third country's data protection, banking secrecy or professional secrecy law limits the group's ability to access, process or exchange information related to customers of branches or subsidiaries in the third country. In such cases, the parent undertaking in the Union or the obliged entity should communicate these legal impediments to its supervisor and may notify the supervisor of multiple impediments within a single notification. (13) In those circumstances, and in situations where the ability of supervisors to effectively supervise the group's compliance with the requirements of Regulation (EU) 2024/1624 is impeded because supervisors do not have access to relevant information held at branches or subsidiaries in third countries, additional policies, procedures and controls are required to manage money laundering and terrorist financing risks effectively. These additional policies, procedures and controls may include obtaining consent from customers, which can serve to overcome certain legal obstacles to the implementation of group-wide AML/CFT policies, procedures and controls in third countries where other options are limited. (14) The need to ensure a consistent Union level response to legal obstacles to the implementation of group-wide policies, procedures and controls justifies the imposition of specific minimum actions that obliged entities are required to take in those situations. However, the extent of such additional policies, procedures and controls should be proportionate and risk based. (15) Parent undertakings and obliged entities should inform their supervisors that the extent of the additional measures they have taken is appropriate in view of the money laundering and terrorist financing risk. However, should the supervisor consider that the additional measures an obliged entity has taken are insufficient to manage that risk, the supervisor should be able to direct the obliged entity to take specific additional measures to ensure the obliged entity's compliance with its obligations regarding AML/CFT requirements. In order to ensure effective oversight and coordination, where a supervisor is a self-regulatory body, the public authority overseeing that body should be informed of legal impediments reported by obliged entities, the steps taken to address those impediments, any supervisory actions requested and any relevant developments arising thereafter. (16) The additional supervisory actions described in this Regulation are specific to situations where, in the context of operations or activities carried out in a third country, including through branches or subsidiaries forming part of the group, the parent undertaking in the Union or the obliged entity do not put in place adequate systems and controls to manage the money laundering and terrorist financing risks where the law of that third country does not permit the application of group-wide AML/CFT systems and controls that comply with Union law. The assessment of whether such third-country legal or regulatory impediments prevent effective compliance should not depend on the internal allocation of functions within the group. Where operations or activities are carried out in a third country through a branch or subsidiary, such assessment should be made irrespective of whether specific AML/CFT functions are performed locally or at the group level. (17) Following a supervisory assessment, where the policies, procedures, systems and controls put in place do not ensure that the associated money laundering and terrorist financing risks are effectively managed, supervisors should apply the additional supervisory actions provided for in this Regulation. Those additional supervisory actions complement other supervisory actions and measures that supervisors may apply under Union or national law, including enforcement measures available under those legal frameworks. The actions supervisors take should be proportionate and risk based, taking into account the specific circumstances of the case. (18) The provisions of this Regulation should also be without prejudice to the enhanced due diligence measures obliged entities are required to take when dealing with natural persons or legal entities established in countries identified by the Commission as having significant strategic deficiencies in their national AML/CFT regimes, weaknesses in their national AML/CFT regimes or posing a specific and serious threat to the Union’s financial system pursuant to Articles 29, 30 and 31 of Regulation (EU) 2024/1624. (19) For groups whose head office is located outside of the Union, where at least two subsidiaries are obliged entities established in the Union and they are not in a relationship of control with each other pursuant to Article 2(1), point (42)(b), of Regulation (EU) 2024/1624, one parent undertaking in the Union, responsible for the implementation of the AML/CFT framework and the prevention to the risk of the non-implementation or evasion of targeted financial sanctions, should be identified. (20) In the situation covered by Article 2(1), point (42)(b) of Regulation (EU) 2024/1624, before notifying the supervisor, obliged entities in the Union should assess their role, taking into account certain criteria such as the prominence of activities, the understanding of operations and the responsibility of implementing group-wide requirements. Sufficient prominence of the obliged entities should be based on elements such as the type of obliged entity, cross-border establishments of any kind, the customer base, the amount of transactions when these are performed. In case such criteria are not enough to determine sufficient prominence of the obliged entities, other criteria should be the total annual turnover or the balance sheet or the average number of staff of the identified obliged entity in the group. Sufficient understanding of operations of the obliged entities should be based on qualitative criteria showing the types of powers and influence of the identified obliged entities in the group in the Union. In case such criteria are not enough to determine sufficient understanding of operations, an additional criterion should be the number of staff in the compliance functions referred to in Article 11 of Regulation (EU) 2024/1624. (21) To ensure that supervisors are aware of the identified obliged entity as parent undertaking in the Union for groups whose head office is located outside of the Union and that have two or more obliged entities in the Union which are not a subsidiary of another undertaking that is an obliged entity established in the Union, a notification and approval mechanism to supervisors should be established. (22) The identified obliged entity in the Union pursuant to Article 2(1), point (42)(b) of Regulation (EU) 2024/1624 should submit a notification to the supervisor. The supervisor should be able to request, where necessary, specific clarifications or additional information regarding the parent undertaking assessment performed by the identified obliged entity. The assessment should be based on whether the identified obliged entity fulfils the criteria set out in Article 2(1), point (42)(b) of Regulation (EU) 2024/1624. (23) All the supervisors and the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (´the Authority´) should be fully informed in any case on the notification procedure to identify the parent undertaking in the Union pursuant to Article 2(1), point (42)(b) of Regulation (EU) 2024/1624. This is to ensure that appropriate information sharing and good cooperation between supervisors take place and that the supervisor adopts effectively and timely the decision on the identification of the parent undertaking in the Union. In cases of disagreement between supervisors on the assessment of the parent undertaking performed by the supervisor, one or more supervisors may ask the Authority to settle the disagreement between supervisors in cross-border situations. (24) In addition to groups, structures exist, such as networks or partnerships or franchises, in which obliged entities might share common ownership, management, compliance control or a combination of them, which should be subject to group-wide requirements. To ensure a level playing field across the sectors whilst avoiding overburdening the affected sectors, this Regulation identifies situations where group-wide policies, procedures and controls, including information sharing requirements, should apply to those structures, taking into account the principle of proportionality. (25) Given the different types of structures that could exist in different sectors and jurisdictions, especially in the non-financial sector, the conditions for the qualification of structures that share common ownership, management, compliance control or a combination of them should be designed in a general and comprehensible manner to ensure harmonisation at Union level. Furthermore, such conditions should be designed broadly to allow a wide application of the group-wide requirements. For instance, common compliance control should not be limited to compliance under the AML/CFT framework, but include other types of compliance such as any prudential, product and service compliance in place. (26) Structures other than groups under the scope of this Regulation could be identified in specific forms such as networks, partnerships or franchises comprising two or more obliged entities. Networks are common arrangements for auditors, external accountants, lawyers and other professionals. These arrangements are established for specific purposes and can have common ownership, common management, common compliance control or a combination of them. Partnerships are also common arrangements for auditors, external accountants, lawyers and notaries. They can include obliged entities belonging to different categories and share common ownership, common management, common compliance control or a combination of them. Further, franchises are common arrangements for instance for professionals in sectors such as real estate (e.g. real estate agents) and gambling. Arrangements put in place under a common franchise may share certain elements of common management, common compliance control or a combination of them for the purposes of marketing specific types of goods and/or services. Under the conditions set out in this Regulation these structures should be subject to group-wide requirements. (27) In addition, given the close operational and organisational links between legal entities and their branches, the application of group-wide requirements to such forms of structures is necessary to ensure a consistent and comprehensive approach to AML/CFT risk management throughout the Union. For instance, an obliged entity authorised in one Member State that operates in other Member States through one or more branches, even when it has no subsidiaries, should be subject to this Regulation. Similarly, when an entity in a third country operates only through branches as obliged entities established or located in the Union or through a combination of legal entities and independent branches as obliged entities, all these obliged entities should be subject to this Regulation. In these cases, such structures have in place common ownership, common management or common compliance control. (28) Differently, there can be structures other than groups that do not share any elements of common ownership, common management or common compliance control, such as structures aiming exclusively to establish customer referral arrangements, to share common technical tools, facilities or knowledge or to exchange best practices or similar without any power of management or control by any entity sharing them, including marketing or distribution strategies; structures sharing the same name, franchise or branding without any power of management or control on the name, branding or franchise by any entity; or structures set up for a specific customer relationship or transaction without any power of management or control between obliged entities. To ensure proportionality in the application of the requirements, these structures should not be considered as falling in the scope of this Regulation. (29) Furthermore, the relationship between an agent and its principal and between a distributor and its principal does not fall within the scope of this Regulation when it is subject to specific provisions stated in Articles 8(5) and 12 of Regulation (EU) 2024/1624. (30) For arrangements other than groups that share common ownership, common management or common compliance control or a combination of them, obliged entities in the structure should identify the head of the structure in the Union. The criteria to determine the head of the structure in the Union in these cases should be the position, powers, control and services provided by such entity on the obliged entities in the structure. In case these criteria do not allow the proper identification of the head of the structure in the Union, obliged entities should identify the entity acting as head of the structure based on its balance sheet or annual turnover or the average number of staff. (31) In case the identified entity is an obliged entity, such obliged entity should notify the supervisor its role to ensure clarity and effectiveness in the identification of the head of the structure in the Union. The supervisor should be able to request, where necessary, specific clarifications or additional information regarding the head of the structure assessment performed by the obliged entity in the Union. The assessment should be based on the criteria set out in this Regulation to determine the head of the structure. (32) Obliged entities of the structure should identify one obliged entity that has sufficient powers and controls to ensure that group-wide requirements apply to the obliged entities of the structure. In duly justified circumstances and to ensure a proportionate application of the requirements set out in this Regulation, obliged entities of the structure should be able to ask for a permission to the supervisors not to identify a head of the structure. Obliged entities should appoint a coordinating obliged entity in charge of the notification to the supervisor. In case the permission is granted, the application of group-wide requirements should be limited to certain minimum group-wide requirements provided in this Regulation that do not necessitate an obliged entity acting as head of the structure. Obliged entities in the structure should adopt common policies, procedures, and controls for managing the money laundering, terrorist financing, and targeted financial sanctions risks, including risks arising from the non-implementation, circumvention, or evasion of targeted financial sanctions and mutually ensure compliance with these minimum group-wide requirements. Certain conditions should be attached to such request to ensure that obliged entities do not abuse of such permission and that supervisors can still conduct risk-based monitoring activities or take other adequate measures. (33) To allow obliged entities sufficient time to adapt, where necessary their systems, policies, controls and procedures, including training of staff, to the requirements laid down in this Regulation, and thereby facilitate their effective implementation, this Regulation should apply six months after its entry into force. (34) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (the ‘Authority’). (35) The Authority has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based and analysed the potential related costs and benefits, HAS ADOPTED THIS REGULATION: ## SECTION 1 ### GENERAL PROVISIONS ### Article 1 ### Subject and scope This Regulation lays down rules concerning: (a) group-wide requirements in accordance with Article 16(4) of Regulation (EU) 2024/1624; (b) additional measures and supervisory actions to effectively handle the risk of money laundering and terrorist financing to which branches or subsidiaries of obliged entities in third countries may be exposed in accordance with Article 17(3) of Regulation (EU) 2024/1624. ### Article 2 ### Definitions For the purpose of this Regulation, in addition to the definitions set out in Article 2(1) of Regulation (EU) 2024/1624, Article 2(1) of Regulation (EU) 2024/1620 of the European Parliament and of the Council and Article 2 of Directive (EU) 2024/1640 of the European Parliament and of the Council, the following definition shall apply: (1) ‘structure’ means any form of organisation, agreement or similar that: (a) includes at least two obliged entities; (b) is not a group within the meaning of Article 2(1), point (41) of Regulation (EU) 2024/1624; (c) has the objective of establishing a common framework of business, professional or commercial relationships having an element of duration connecting two or more obliged entities regardless of the legal form used; (d) has common ownership, management, compliance controls or a combination of these elements. ## SECTION 2 MINIMUM GROUP-WIDE REQUIREMENTS ### Article 3 Minimum requirements regarding group-wide policies, procedures and controls 1\. The parent undertaking in the Union shall ensure that it complies with: (a) the organisational requirements for the application of Section 1 of Chapter II of Regulation (EU) 2024/1624 by: (i) setting up, implementing and maintaining an organisation and coordination framework at the group level with sufficient decision-making powers for the compliance manager at the level of the group and compliance officer appointed where justified by the activities carried out at the group level pursuant to Article 16(2) of Regulation (EU) 2024/1624. This framework shall ensure a proper allocation of functions, responsibilities and reporting lines and shall be clearly documented; (ii) ensuring that the management body, internal controls and independent audit function have the necessary information at the group level to be able to carry out their functions under the applicable AML/CFT framework and to address and implement any administrative act issued by any supervisor for the oversight and management of entities and branches of the group in Member States and in third countries as applicable; (iii) identifying and mitigating conflicts of interests between the prevention and management of risks related to money laundering, terrorist financing and the non-implementation or evasion of targeted financial sanctions and the tasks of the commercial functions of groups, including at the entity and branch level as applicable as part of the risk management framework; (b) the requirement to perform group-wide risk assessment by: (i) ensuring that the group-wide risk assessment pursuant to Article 16(1) of Regulation (EU) 2024/1624 is commensurate to the complexity and the risk profile of the group; (ii) putting in place a holistic assessment of risks to which branches and entities of the group as applicable are exposed, focussing on those that may have a significant impact on the group-wide risk exposure, including outsourcing, reliance on other obliged entities or other third-party arrangements. In this respect, particular attention shall be paid to the risks to which the entities and branches of the group established in third countries as applicable are exposed; (c) the duty of proper functioning of group compliance functions by: (i) ensuring that the group compliance functions referred to in Article 16(2) of Regulation (EU) 2024/1624 have regular and documented information exchanges with the management body of the parent undertaking, commercial functions, other compliance functions established at entities and branches of the group as applicable, other internal controls and independent audit functions, and external auditors; * ensuring that information exchanges under point (i) cover, at a minimum, relevant information on identified risks, significant compliance issues, and measures adopted to address them; (d) with the requirements to have in place group-wide policies, procedures and controls that: (i) ensure that they are adequate to the actual organisation, composition and operations of the group and are appropriately designed to take into account the individual situation of the entities and branches of the group as applicable by including all the elements listed in Articles 9 and 10 of Regulation (EU) 2024/1624; (ii) ensure that they take into account group-specific risks in their design, execution and application and include group-wide measures to address non-compliance; (iii) ensure that the compliance functions referred to in Article 16(2) of Regulation (EU) 2024/1624 and the internal controls: (1) regularly review the effectiveness of the group-wide policies, procedures and controls; (2) inform relevant stakeholders; and (3) address deficiencies. (iv) ensure that the group-wide policies, procedures and controls and the group-wide risk assessments are implemented consistently in all entities and branches of the group and in their subsidiaries and branches in third countries as applicable; (v) establish, implement and maintain group-wide whistle-blowing policies, procedures and controls, including secure reporting, escalation channels and appropriate safeguards for whistleblowers as part of the risk management framework; (vi) establish, implement and maintain group-wide policies, procedures and controls related to incident reporting and notification as part of the risk management framework. Such policies, procedures and controls shall clearly define the handling of material breaches and include adequate communication protocols and tools necessary to duly and adequately protect all the relevant information; (vii) establish, implement and maintain group-wide training policies, procedures and controls with adequate minimum standards covering the frequency, categories and performance of the training, including for the management body and senior management as part of the risk management framework; (viii) establish, implement and maintain group-wide policies, procedures and controls that are designed and implemented in such a way so that entities that are not obliged entities do not prevent the parent undertakings and obliged entities of the group from complying with the requirements set out in Regulation (EU) 2024/1624; (ix) ensure that group-wide policies, procedures and controls are communicated to relevant staff, including staff employed in subsidiaries and branches established in Member States or third countries as applicable. * Group-wide internal policies shall be approved by the management body of the parent undertaking in the Union in its management function. Group-wide procedures and controls shall be approved at least by the compliance manager at the level of the group referred to in Article 16(2) of Regulation (EU) 2024/1624. 3\. Group-wide policies, procedures and controls shall be recorded in writing, kept up to date and made available to supervisors upon request. ## SECTION 3 INFORMATION SHARING ### Article 4 ### Information sharing within a group 1\. For the purposes of the prevention of money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions, the parent undertaking and the obliged entities within a group shall enable the sharing of the information listed in Annex I when relevant as referred to in Article 16(3) of Regulation (EU) 2024/1624. 2\. The sharing of information listed in Annex I within the group shall be provided to any obliged entity that is part of the group, taking into account the availability and quality of the information. 3\. The parent undertaking shall define and maintain policies and procedures for information sharing within the group. Group-wide requirements shall not impose a requirement of the approval of the parent undertaking or any other obliged entity to share the information listed in Annex I to any obliged entity within the group. Obliged entities within the group shall set up appropriate technical and organisational means through which such sharing can take place, taking into account size, complexity and risks. 4\. Information shall be up to date, readily accessible, provided in an adequate and comprehensible form, provided on a need-to-know basis and be shared in line with the requirements stipulated by the applicable data protection legislation and in line with fundamental rights, through secure channels and respecting the requirements of security, integrity and confidentiality. Information-sharing policies, procedures and controls shall include appropriate records of information exchanges to ensure the traceability and accountability of such information and to ensure effective supervision. 5\. Information sharing within the group shall not affect the individual responsibility of each obliged entity to comply with AML/CFT requirements and to prevent the risk of the non-implementation or evasion of targeted financial sanctions. Each obliged entity of the group shall remain fully responsible for complying with due diligence requirements and performing its own risk assessments and making its own risk-related decisions, even when such decisions are based on information shared at the group level and taking into account any outsourcing, reliance on other obliged entities or other third-party arrangement in place. ### Article 5 Information sharing with entities established or located outside of the Union * Without prejudice to the measures set out in Section 4 of this Regulation, obliged entities established in or with a head office located in the Union shall be able to share any information as set out in Article 4 with entities or branches of the group that are established in third countries or with their head office located in third countries, subject to any restrictions or prohibitions on such sharing as set out in Union law or any national laws of the Member States. 2\. Without prejudice to the measures set out in Section 4 of this Regulation, obliged entities established or located in the Union shall be able to receive the information as set out in Article 4 from entities of the group that are established in third countries or from their head office outside the Union, subject to any restrictions or prohibitions on the sharing of information under the law of the third country. 3\. In cases of restrictions or prohibitions to information sharing from obliged entities in the Union to a third country under Union law or any national laws of the Member States as provided for in paragraph 1 or from third countries to obliged entities in the Union as provided for in paragraph 2, the parent undertaking and the obliged entities in the Union shall assess the reasons for such restrictions or prohibitions and take appropriate measures to address them. The parent undertaking shall provide such assessment to the relevant obliged entities within the group whenever needed. 4\. The parent undertaking and obliged entities of the group shall notify such assessment and, where appropriate, indicate alternative methods to address the abovementioned restrictions or prohibitions to the appropriate supervisor. Such notification shall be done without undue delay and in any case no later than 28 calendar days after identifying the restrictions or prohibitions. In cases of groups, the parent undertaking shall submit the notification to the supervisor. If a single notification is inappropriate, the parent undertaking may allow obliged entities within the group to submit the relevant notification to their supervisors. Obliged entities may also decide to have only one notification at the group or obliged entity level submitted to the supervisor, including for cases covered in Section 4 of this Regulation. 5\. The supervisor shall immediately inform all the supervisors of the other obliged entities of the group in the Union of such restrictions or prohibitions. If the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. ### Article 6 Information sharing concerning the reporting of suspicions by certain categories of obliged entities By way of derogation from this Section, the obligations set out in this Section shall not apply to information referred to in Article 70(2) of Regulation (EU) 2024/1624. ## SECTION 4 MINIMUM ACTIONS AND ADDITIONAL MEASURES FOR BRANCHES OR SUBSIDIARIES IN THIRD COUNTRIES OF OBLIGED ENTITIES AND PARENT UNDERTAKINGS IN THE UNION, AND SUPERVISORY ACTIONS ### Article 7 ### Minimum Actions 1\. Where the parent undertaking in the Union or an obliged entity with branches or subsidiaries located in third countries identifies that the law of a third country does not permit or restricts the application of Regulation (EU) 2024/1624, it shall at least perform the following minimum actions: (a) inform the supervisor without undue delay, and, in any case no later than 28 calendar days from the identification of the legal impediment, of the following: (i) the name of the country concerned; (ii) how the application of the law of the third country concerned does not permit or restricts the application of Regulation (EU) 2024/1624 (b) ensure that those branches or subsidiaries require their customers and, where applicable, their customers’ beneficial owners, to provide consent to overcome the restrictions or prohibitions referred to in point (a), to the extent that this is compatible with the law of the third country and Regulation (EU) 2024/1624. 2\. In cases where the consent referred to in point (b) of paragraph 1 is not feasible, the parent undertaking or the obliged entity shall ensure that the branch or subsidiary established in the third country applies additional measures as set out in points (a) to (l) of Article 8 of this Regulation. 3\. Where the parent undertaking in the Union or an obliged entity cannot effectively manage the money laundering and terrorist financing risks by applying the measures referred to in paragraph 2, it shall ensure that the branch or subsidiary established in the third country implements such additional measures as necessary, appropriate and proportionate to effectively manage those legal impediments. 4\. The parent undertaking in the Union or the obliged entity shall select and determine the extent of the additional measures referred to in paragraphs 2 and 3 using a risk-based approach, shall without undue delay inform the supervisor of the additional measures taken and shall provide an assessment of their appropriateness in view of the money laundering risks, terrorist financing risks and the risk of the non-implementation or evasion of targeted financial sanctions. ### Article 8 ### Additional Measures Without prejudice to any measures taken under Articles 16 of Regulation (EU) 2024/1624 and under this Regulation, the parent undertaking or an obliged entity shall take one or more of the following additional measures pursuant to Article 7 of this Regulation: (a) ensure that its branch or subsidiary established in the third country restricts the nature and type of products and services provided by the branch or subsidiary in the third country to those that present a low money laundering and terrorist financing risk and have a low impact on the group's risk exposure; (b) ensure that other obliged entities of the same group do not rely on customer due diligence measures carried out by a branch or subsidiary established in the third country, but instead carry out customer due diligence on any customer of a branch or subsidiary established in the third country who wishes to be provided with products or services by any other branch or subsidiary of the same group; (c) carry out enhanced reviews, including, where this is commensurate with the money laundering and terrorist financing risks associated with the operation of the branch or subsidiary established in the third country, carry out on-site checks or order the performance of independent audits, to be satisfied that the branch or subsidiary effectively identifies, assesses and manages the money laundering and terrorist financing risks; (d) ensure that their branches or subsidiaries established in the third country seek prior approval from the senior management of the parent undertaking or the obliged entity for the establishment and maintenance of higher-risk business relationships, or for carrying out of higher-risk occasional transactions; (e) ensure that it branches or subsidiaries established in the third country determine and document the source of funds and wealth and, where applicable, the destination of funds to be used in the business relationship or occasional transaction; (f) ensure that it branches or subsidiaries established in the third country carry out enhanced ongoing monitoring of the business relationship including enhanced transaction monitoring, until the branches or subsidiaries are reasonably satisfied that they understand the money laundering and terrorist financing risks associated with the business relationship and enhanced ongoing monitoring is no longer needed in view of the risk situation; (g) ensure that it branches or subsidiaries established in the third country share with the parent undertaking or the obliged entity the underlying suspicious transaction report information that gave rise to the knowledge, suspicion or reasonable grounds to suspect that money laundering and terrorist financing was attempted or occurred, such as the facts, transactions, circumstances and documents on which the knowledge or suspicions are based, including personal data to the extent permissible under the law of the third country; (h) carry out enhanced ongoing monitoring of any customer and, where applicable, beneficial owner of a customer of a branch or subsidiary established in the third country who is known to have been the subject of a suspicious transaction report filed by another entity within the same group; (i) ensure that it branches or subsidiaries established in the third country keep the risk profile and due diligence information related to a customer of a branch or subsidiary established in the third country up to date and secure as long as legally possible, and in any case for at least the duration of the business relationship; * require the branch or subsidiary established in the third country to regularly provide relevant information to the obliged entity’s or parent undertaking’s senior management, so that it is able to assess the money laundering risk, terrorist financing risk and the risk of non-implementation or evasion of targeted financial sanctions associated with the operation of such a branch or subsidiary and the impact this has on the obliged entity and the group, such as: (i) the number of high-risk customers and aggregated statistical data providing an overview of the reasons why customers have been classified as high risk; (ii) the number of suspicious transactions identified and reported and aggregated statistical data providing an overview of the circumstances that gave rise to suspicion; (iii) other relevant internal metrics that are used by the parent undertaking or obliged entity to monitor the level of risk present in the third country and its impact on the group. (k) require the branch or subsidiary to terminate the relationship(s) or to not carry out the occasional transaction(s); (l) close down or ensure the divestment of some or all of the operations or activities provided by the branch or subsidiary established in the third country. ### Article 9 ### Supervisory actions 1\. Where the supervisor determines that the additional measures implemented by the parent undertaking or the obliged entity pursuant to this Regulation are insufficient to ensure that it branches or subsidiaries located in the third country effectively manage the risks of money laundering or terrorist financing, the supervisor shall exercise one or more of the following additional supervisory actions: (a) require the parent undertaking or the obliged entity to submit and implement, within a specified timeframe, a risk mitigation plan approved by the relevant management body, aiming to effectively address the identified risks, weaknesses or shortcomings; (b) require the parent undertaking or the obliged entity to implement, within a specified timeframe, corrective measures available to the supervisors under Union law or national law to address identified weaknesses or mitigate risks. The supervisor shall monitor the implementation of the actions referred to in the first subparagraph points (a) and (b), where applicable, to satisfy itself that the risks of money laundering or terrorist financing are effectively managed. 2\. Where the supervisor determines that the parent undertaking or the obliged entity cannot effectively manage the risks of money laundering or terrorist financing connected with the operations or activities of the branches or subsidiaries established in the third country or that the parent undertaking or an obliged entity has failed to comply with supervisory actions taken pursuant to paragraph 1 within the specified time frame, it shall exercise one or more of the additional supervisory actions specified in the last sentence of Article 17(2) of Regulation (EU) 2024/1624. 3\. When determining which additional supervisory actions to apply under this Article, the supervisor shall take into account, where relevant: * the nature and gravity of the identified risks, weaknesses or shortcomings; * the extent to which relevant third-country legal or regulatory impediments affect the effective implementation or supervision of group-wide AML/CFT policies, procedures and controls; and (c) existing governance arrangements, risk management frameworks and internal controls systems. 4\. Supervisors shall ensure the effective use of the mechanisms available to them in the exercise of their competences to enhance the effectiveness and efficiency of their supervisory activities, including by complying with Section 2 of Directive (EU) 2024/1640 on cooperation within AML/CFT supervisory colleges and with counterparts in third countries, where appropriate. 5\. In cases where the supervisor is a self-regulatory body, it shall keep the public authority overseeing it informed of any reported legal impediments, minimum actions, additional measures, any supervisory actions requested, and any subsequent developments. ## SECTION 5 ### CRITERIA FOR IDENTIFYING THE PARENT UNDERTAKING IN THE UNION IN CASES OF TWO OR MORE OBLIGED ENTITIES WHOSE HEAD OFFICE IS LOCATED OUTSIDE THE UNION ### Article 10 ### Determination of sufficient prominence within the group 1\. Obliged entities belonging to groups whose head office is located outside the Union and that are not a subsidiary of another undertaking that is an obliged entity established in the Union shall determine sufficient prominence as stipulated in Article 2(1), point (42)(b)(iii) of Regulation (EU) 2024/1624 by any of the following factors: (a) whether an obliged entity has the status of (i) financial mixed activity holding company as defined in Article 2(1), point (10) of Regulation (EU) 2024/1624; (ii) non-financial mixed activity holding company as defined in Article 2(1), point (13) of Regulation (EU) 2024/1624; (iii) an undertaking the principal activity of which is to acquire holdings, including a financial holding company, a mixed financial holding company, a financial mixed activity holding company as provided in the definition in Article 2(1), point (6)(a) of Regulation (EU) 2024/1624; (iv) an insurance holding company or a mixed-activity insurance holding company as defined in Article 212(1), points (f) and (g) respectively, of Directive 2009/138/EC. at the highest level of consolidation in accordance with Union law for accounting purposes, if the head office in a third country has established such undertaking in the Union for most of the group´s obliged entities in the Union. (b) the number of cross-border establishments, including agents or distributors, or under the freedom to provide services in another Member State through agents or distributors, or through other types of infrastructures located in other Member States; * the average number of customers on 31 December of the two calendar years immediately preceding the current calendar year, in particular those classified as high risk; (d) the average mount in euro or the equivalent in national currency at the official exchange rate with the euro available on 31 December of the reference calendar year of incoming and outgoing transactions carried out in the two calendar years immediately preceding the current calendar year, where applicable. 2\. Where paragraph 1 does not conclusively determine sufficient prominence, obliged entities mentioned in paragraph 1 shall determine sufficient prominence based on the following additional factors: (a) the total annual turnover according to the latest available accounts approved by the management body; (b) the balance sheet size calculated on the basis of the latest audited consolidated financial statements or, where consolidated financial statements are not required to be prepared in accordance with the applicable accounting framework, the latest audited individual financial statement of the obliged entity; (c) the average number of employees during the financial year. ### Article 11 ### Determination of sufficient understanding of operations within the group 1\. Obliged entities that belong to groups whose head office is located outside the Union and are not subsidiaries of another undertaking that is an obliged entity established in the Union shall determine sufficient understanding of operations as stipulated in Article 2(1), point (42)(b)(iii) of Regulation (EU) 2024/1624 by any of the following circumstances: (a) the obliged entity having the right or ability to decide on the strategy or to direct the activities of most obliged entities established or located in the Union; (b) the obliged entity having the right or ability to decide on important transactions, including the transfer of profits or losses of most obliged entities established or located in the Union; (c) the obliged entity having the right or ability to coordinate the management, or decide on the internal controls of, or impose remediation measures on most obliged entities established or located in the Union; (d) the obliged entity having material outsourcing, reliance on other obliged entities or other third-party arrangements in place for most obliged entities established or located in the Union. Consideration shall be given to the nature of business, including risks and complexity, and size of the obliged entities established or located in the Union. 2\. Where paragraph 1 does not determine sufficient understanding of operations, the obliged entities mentioned in paragraph 1 shall determine sufficient understanding of operations based on the number of full-time equivalent staff members of the compliance functions referred to in Article 16(2) of Regulation (EU) 2024/1624 in the Union. ### Article 12 ### Determination of the entity that shall have the responsibility of implementing group-wide requirements 1\. Obliged entities in a group that determine they have sufficient prominence within the group pursuant to Article 10 and have sufficient understanding of operations in the group pursuant to Article 11 shall identify one obliged entity amongst them as the parent undertaking within the group. 2\. The obliged entity identified as the parent undertaking in the Union shall have the responsibility and oversight of implementing group-wide requirements as referred to in Article 16(1) of Regulation (EU) 2024/1624 and Sections 2, 3 and 4 of this Regulation. ### Article 13 ### Article Supervisory notification and assessment 1\. The obliged entity identified as the parent undertaking in accordance with Article 12 shall notify its role as parent undertaking in the Union to the supervisor and all the other obliged entities in the Union of the group whose head office is located outside of the Union without undue delay and in any case no later than 28 calendar days after the day when two or more obliged entities belonging to the same head office located outside of the Union are established in the Union and they are not in a parent/subsidiary relationship. Obliged entities in the situation set out in Article 2(1), point (42)(b) of Regulation (EU) 2024/1624 at \[the day of application of this Regulation\] shall notify the supervisor on that date. The notification shall be accompanied by the information specified in paragraph 2 in order to justify why the obliged entity meets the requirements to be the parent undertaking in the Union. 2\. The notification specified in paragraph 1 shall include all the following information: (a) a summary overview and explanations of the organisation, roles and responsibilities of the identified obliged entity as the parent undertaking in the Union and those of all the other obliged entities of the group in the Union; (b) a detailed chart of the group, information on the shareholdings in the form of capital or voting rights in the obliged entities of the group and an overview of the activities performed by the obliged entities within the group together with the related geographical outreach; (c) detailed reasons for the determination of sufficient prominence in the Union; (d) detailed reasons for the determination of sufficient understanding of operations in the Union; (e) detailed reasons of the fulfilment of the responsibility to implement group-wide requirements; (f) any other information considered necessary for evaluating the adequacy of the identification of the obliged entity as the parent undertaking in the Union. Upon receipt of the notification, the supervisor of the identified obliged entity in the Union shall confirm receipt of the notification to the identified obliged entity and inform all the supervisors of the other obliged entities of the group in the Union and the Authority of such notification. If the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. * The supervisor shall approve the identification of the parent undertaking in the Union within 60 calendar days from receipt of the complete notification. The supervisors of the obliged entities of the group in the Union shall, without undue delay and in any case within 28 calendar days from receipt of the complete notification from the supervisor, provide each other with any information that is essential or relevant for the assessment. The assessment of the identification of the parent undertaking shall be based on whether the identified obliged entity fulfils the criteria set out in Article 2(1), point (42)(b) of Regulation (EU) 2024/1624. The supervisor may determine that the identified obliged entity in the Union should be a different one and shall provide reasons for this assessment. It shall then transmit the notification mentioned in paragraphs 1 and 2 immediately, and in any case within 28 calendar days from the date of receipt of the complete notification, to the appropriate supervisor. The appropriate supervisor shall apply the procedure provided in the first subparagraph of this paragraph accordingly. In case of disagreements between two or more supervisors on the identification of the parent undertaking in the Union, supervisors may refer the matter to the Authority and request its assistance in accordance with Article 33 of Regulation (EU) 2024/1620 for the financial sector or in accordance with Article 38 of Regulation (EU) 2024/1620 for the non-financial sector. Subparagraph 5 shall not apply in cases where the identified obliged entity is a selected obliged entity under the direct supervision of the Authority. 4\. The supervisor shall notify the decision mentioned in paragraph 3 to the identified obliged entity in the Union without undue delay. It shall also inform all the other supervisors of the other obliged entities of the group in the Union and the Authority of the decision and, if the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. 5\. The identified obliged entity in the Union shall immediately inform all the other obliged entities of the group in the Union of the decision mentioned in paragraph 3. 6\. In the event of any material change to the identified parent undertaking approved pursuant to this Article, the parent undertaking shall notify this change to the supervisor that received the initial notification at least 28 calendar days before implementing the change. If this is not possible due to objective and extraordinary circumstances, the notification of such change shall be made as soon as possible and, in any case, no later than 28 calendar days after the change in designation. The supervisor shall inform all the supervisors of the obliged entities within the group established in the Union and the Authority of such notification and shall review the notification in accordance with this Article. If the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. A material change shall be a significant event that could impact the designation of the parent undertaking such as a change of business, services or activities; acquisition, merger, division, dissolution, removal, disaffiliation or deconsolidation; review of sufficient prominence of the activities or sufficient understanding of operations or any other consideration relevant to the identification of the parent undertaking. ## SECTION 6 CONDITIONS FOR THE APPLICATION OF GROUP-WIDE REQUIREMENTS TO STRUCTURES SHARING COMMON OWNERSHIP, MANAGEMENT OR COMPLIANCE CONTROL ### Article 14 Conditions for the application of group-wide requirements to structures sharing common ownership, management or compliance control 1\. Obliged entities within structures identified in this Section shall apply group-wide requirements as set out in Article 16(1), (2) and (3) of Regulation (EU) 2024/1624 and in this Regulation that are proportionate to the nature of the business, the risks and complexity of the structure and its size. Criteria for such application shall comprise: (a) the number of obliged entities; (b) the powers and responsibilities of obliged entities; (c) the level of centralisation or decentralisation of decision-making; (d) the type, amounts and risk levels of services and activities covered by Regulation (EU) 2024/1624. 2\. Structures shall fulfil at least one of the following conditions: (a) common ownership by any of the following: (i) two or more obliged entities sharing any common majority shareholder(s) or partner(s) exercising ownership rights or control of their activities in the structure, including situations where the head of the structure in the Union is not an obliged entity; (ii) two or more obliged entities sharing the ownership or control of the structure. (b) common management by any of the following: (i) two or more obliged entities that are places of business that form legally dependent parts of an entity in the Union or an entity in a third country and carry out all or some of the transactions, activities or services inherent in the business of an obliged entity as referred to in Article 3 of Regulation (EU) 2024/1624. (ii) one or more obliged entities that are places of business that form legally dependent parts of entities with a head office in a third country and carry out all or some of the transactions, activities or services inherent in the business of an obliged entity as referred to in Article 3 of Regulation (EU) 2024/1624, when the head office has established one or more additional obliged entities as separate legal entities in the Union; (iii) two or more obliged entities that have a common management body or the majority of members thereof and are subject to a homogeneous business strategy and/or business model; (iv) two or more obliged entities that have a common arrangement or mechanism in place to share profits, revenues, results, losses or to transfer remunerations, revenues or costs for services or activities provided; (v) two or more obliged entities that have a level of reporting similar to those of groups such as obliged entities required to report to the management body or senior management of one of them, another obliged entity or another entity or person; (vi) two or more obliged entities that have in place arrangements requiring them to implement and operate activities and operations based on common policies and procedures. (c) common compliance control by any of the following: (i) two or more obliged entities that operate under common policies, procedures or controls managed by internal controls; (ii) two or more obliged entities that are required to periodically report to a connected obliged entity, or legal or natural person on internal controls matters such as compliance or risk management; (iii) two or more obliged entities that have in place a system of periodic central compliance operations or compliance costs managed by one of them, another obliged entity or a common natural or legal person; (iv) two or more obliged entities that share audit or reporting functions overseeing the implementation of controls, policies and procedures; (v) two or more obliged entities that have common branding, marketing or franchising arrangements and share the same audits, reviews, risk assessments or internal controls related to such branding, marketing or franchising arrangements. 3\. The group-wide requirements of structures shall not prevent the application of the group-wide requirements of groups when both apply to the same obliged entity. In cases of conflicts between requirements applicable to the structure and requirements applicable to the group, the latter shall prevail. ### Article 15 Criteria for identifying the head of the structure for obliged entities that are part of a structure that shares common ownership, management or compliance control 1\. For the purpose of the application of this Section the term ´head of the structure´ shall be understood as parent undertaking of structures mentioned in the last sentence of Article 16(4) of Regulation (EU) 2024/1624. 2\. Obliged entities shall identify the head of the structure in the Union based on any of the following criteria: (a) the entity has the right or ability to decide on the strategy or to direct the activities of most obliged entities in the structure; (b) the entity has the right or ability to decide on important transactions, including the transfer of profits or losses of most obliged entities in the structure; (c) the entity has the right or ability to coordinate the management of most obliged entities in the structure; * the entity develops, manages, distributes or reviews branding, marketing, franchising, partnership or network arrangements for most obliged entities in the structure; (e) the entity has the power to exclude obliged entities from the structure where necessary. 3\. Where the application of paragraph 2 does not lead to a conclusive identification of the head of the structure in the Union, such an entity shall be identified by any of the following criteria: (a) the entity provides essential technical information or material services to most obliged entities in the structure which cannot be replaced in a timely fashion without excessive costs and are not ancillary to the services covered; (b) the entity manages the compliance control or system of most obliged entities in the structure; (c) the entity manages the costs of operational and compliance activities of most obliged entities in the structure. 4\. Where the application of paragraph 3 does not lead to a conclusive identification of the head of the structure in the Union, such an entity shall be identified by any of the following factors: (a) the total annual turnover according to the latest available accounts approved by the management body; (b) the balance sheet size calculated on the basis of the latest audited consolidated financial statements or, where consolidated financial statements are not required to be prepared in accordance with the applicable accounting framework, the latest audited individual financial statement of the obliged entity; (c) the average number of employees during the financial year. ### Article 16 ### Supervisory notification and assessment if the head of the structure is an obliged entity 1\. Obliged entities that are part of a structure shall ensure that only one obliged entity is identified as the head of the structure as provided for in this Section. This obliged entity shall have sufficient powers and responsibilities to ensure that the group-wide requirements apply to all obliged entities of the structure, taking into account the criteria set out in Article 14(1) of this Regulation. If the identified head of the structure in the Union is an obliged entity, this obliged entity shall notify its role as head of the structure in the Union to the supervisor and all the obliged entities in the Union without undue delay and in any case no later than 28 calendar days after the day when the structure is established. Obliged entities in a structure existing on \[the day of application of this Regulation\] shall notify the supervisor in accordance with Article 19(1). The notification shall be accompanied by the information specified in paragraph 2 in order to justify why the obliged entity meets the requirements to be the head of the structure in the Union. 2\. The notification by the identified obliged entity shall include all the following information: * a summary overview and explanations of the role, responsibilities and activities of the identified obliged entity as the head of the structure and those of all the other obliged entities of the structure in the Union; (b) a detailed chart of the structure and an overview of the activities performed by the obliged entities within the structure together with the related geographical outreach; (c) any other information considered necessary for evaluating the adequacy of the identification of the obliged entity as the head of the structure. Upon receipt of the notification, the supervisor of the identified obliged entity in the Union shall confirm receipt of the notification to the identified obliged entity in the Union and inform all the supervisors of the other obliged entities of the structure in the Union and the Authority of such notification. If the supervisor is a self-regulatory body, the self-regulatory body inform shall also the public authority overseeing it. 3\. The supervisor shall approve the identification of the head of the structure in the Union within 60 calendar days from receipt of the complete notification. The supervisors of the obliged entities of the structure in the Union shall, without undue delay and in any case within 28 calendar days from receipt of the complete notification from the supervisor, provide each other with any information that is essential or relevant for the assessment. The assessment of the identification of the head of the structure shall be based on the criteria set out in Article 15 of this Regulation. The supervisor may determine that the identified obliged entity in the Union should be a different one and shall provide reasons for this assessment. It shall then transmit the notification mentioned in paragraphs 1 and 2 immediately, and in any case within 28 calendar days from the date of receipt of the complete notification to the appropriate supervisor. The appropriate supervisor shall apply the procedure provided in the first subparagraph of this paragraph accordingly. In cases of disagreements between two or more supervisors on the identification of the head of the structure in the Union, supervisors may refer the matter to the Authority and request its assistance in accordance with Article 33 of Regulation (EU) 2024/1620 for the financial sector or in accordance with Article 38 of Regulation (EU) 2024/1620 for the non-financial sector. Subparagraph 5 shall not apply in cases where the identified obliged entity is a selected obliged entity under the direct supervision of the Authority. 4\. The supervisor shall notify the decision mentioned in paragraph 3 to the identified head of the structure in the Union without undue delay. It shall also inform all the other supervisors of the other obliged entities of the structure in the Union and the Authority of the decision and, if the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. 5\. The identified head of the structure in the Union shall immediately inform all the other obliged entities of the structure in the Union of the decision mentioned in paragraph 3. 6\. In the event of any material change to the identified head of the structure approved pursuant to this Article, the obliged entity shall notify this change to the supervisor that received the initial notification at least 28 calendar days before implementing the change. If this is not possible due to objective and extraordinary circumstances, the notification of such change shall be as soon as possible and, in any case, no later than 28 calendar days after the change in designation. The supervisor shall inform all the supervisors of the obliged entities in the Union and the Authority of such notification and shall review the notification in accordance with this Article. If the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. A material change shall be a significant event that could impact the designation of the head of the structure such as a change of business, services or activities; acquisition, merger, division, dissolution, exclusion from the structure; or any other consideration relevant to the identification of the head of the structure. ### Article 17 ### Conditions for the application of group-wide requirements to structures other than groups without the obligation to identify the head of the structure 1\. In duly justified circumstances and to ensure a proportionate application of group-wide requirements, obliged entities of the structure may choose not to identify one obliged entity as the head of the structure subject to the prior permission of supervisors and where all the following conditions are met at all times: (a) the head of the structure is not an obliged entity or there are proven legal impediments under Union legal acts or national laws to appointing a head of the structure; (b) the structure puts in place minimum common systems for the monitoring and classification of money laundering, terrorism financing and targeted financial sanctions risk situations of the obliged entities and the structure as a whole; (c) obliged entities in the structure put in place minimum common policies, procedures and controls that include at least: (i) the carrying out and updating of the business-wide risk assessment; (ii) customer due diligence to implement Chapter III of Regulation (EU) 2024/1624; (iii) the reporting of suspicious transactions; (iv) outsourcing, reliance on customer due diligence performed by other obliged entities and other third-party arrangements; (v) record retention and policies in relation to the processing of personal data; (vi) the internal communication of internal policies, procedures and controls; (vii) a policy on the training of employees and, where relevant, agents and distributors; (d) obliged entities in the structure comply with information-sharing requirements for AML/CFT and targeted financial sanctions purposes in accordance with Article 16(3) of Regulation (EU) 2024/1624 and Section 3 of this Regulation; (e) the structure is approved and monitored at regular intervals by the supervisors through risk-based monitoring activities or other adequate measures to ensure that the permission granted pursuant to this paragraph is not abused. 2\. Obliged entities of the structure seeking the permission set out in this Article shall appoint a coordinating obliged entity that notifies the supervisor of the request for permission without undue delay and in any case no later than 28 calendar days after such intention, including the reasons thereof. If the supervisor is a self-regulatory body, the self-regulatory body shall also inform the public authority overseeing it. The coordinating obliged entity in a structure existing on \[the day of application of this Regulation\] shall notify the supervisor in accordance with Article 19(2). * The request by the coordinating obliged entity shall include all the following information: * summary overview and explanation of the permission not to identify a head of the structure, including detailed information concerning whether the identified head of the structure is not an obliged entity and/or there are any legal impediments under Union law or national laws; (b) a detailed chart of the structure, and overview of the activities performed by the obliged entities within the structure together with the related geographical outreach; (c) any other information considered necessary for evaluating the adequacy of the permission not to identify a head of the structure. 4\. Article 16 shall apply mutatis mutandis to the submission of the request by the coordinating obliged entity. The supervisor may determine that the permission under this Article is not appropriate and shall provide reasons for this assessment. It may indicate appropriate measures, including requiring obliged entities in the structure to notify under Article 16. ## SECTION 7 FINAL PROVISIONS ### Article 18 ### Repeal Commission Delegated Regulation (EU) 2019/758 is repealed with effect from 10 July 2027. ### Article 19 ### First application on notification to supervisors 1\. The obliged entity identified as the head of the structure in the Union in accordance with Article 15 shall notify its role to the supervisor no later than 6 months after the Regulation applies. 2\. Obliged entities within a structure shall request permission not to identify a head of the structure in accordance with Article 17 from the supervisor no later than 6 months after the Regulation applies. 3\. During the transitional period referred to in paragraphs 1 and 2, supervisors shall have all the necessary supervisory powers conferred on them by Directive (EU) 2024/1640 with regard to the obliged entities under their scope of their supervision. ### Article 20 ### Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 6 months after its entry into force, except in relation to obliged entities referred to in Article 3, points (3)(n) and (o) of Regulation (EU) 2024/1624, to which it shall apply from 10 July 2029. This Regulation shall be binding in its entirety and directly applicable in all Member States. ### Done at Brussels, For the Commission The President ## Annex I Information subject to information sharing requirements when relevant for the purposes of the prevention of money laundering, terrorist financing and of the risk of the non-implementation or evasion of targeted financial sanctions. 1\. Information obtained in the process of fulfilling obligations in accordance with Article 20 of Regulation (EU) 2024/1624: (a) the identity and characteristics of a customer, including any information and documents obtained in the course of identifying and verifying the identity of the customer; (b) information regarding the beneficial owner of a customer, including any information and documents obtained in the course of identifying and verifying the identity of the beneficial owner(s); (c) the identity and characteristics of any person purporting to act on behalf of the customer' and the natural persons on whose behalf a transaction is conducted, including any information and documents obtained in the course of identifying and verifying the identity of that person; (d) the customer’s expected transactional behaviour or business profile, where such information has been established as part of customer due diligence; (e) the purpose and intended nature of the business relationship or occasional transactions between the customer and the obliged entity, as well as the source of wealth and source of funds of the customer; (f) the customer’s ownership and control structure, including complex ownership arrangements, where relevant for risk assessment purposes; (g) verification on whether the customer or the beneficial owners are subject to targeted financial sanctions and, in the case of a customer or party to a legal arrangement who is a legal entity, whether natural or legal persons subject to targeted financial sanctions control the legal entity or have more than 50 % of the proprietary rights of that legal entity or majority interest in it, whether individually or collectively; (h) information on the restrictive measures implementing targeted financial sanctions applied to customers, their transactions and their assets; (i) basic information on legal entities and legal arrangements as referred to in Article 2(1), point (33) of Regulation (EU) 2024/1624; (j) outsourcing, reliance on other obliged entities and other third-party arrangements related to customer due diligence performed by other entities within the group; (k) material changes in the customer’s risk profile or status, including changes in beneficial ownership, business activity or risk classification; (l) any information that has been collected and verified, whenever applicable, under the Delegated Regulation \[XXX\] on Customer Due Diligence under Article 28 paragraph 1 of Regulation (EU) 2024/1624. 2\. Information obtained in the process of fulfilling ongoing monitoring obligations in accordance with Article 26 of Regulation (EU) 2024/1624: * where a transaction, service or activity is being conducted on behalf of or for the benefit of natural or legal persons other than the customer, information on the identification and verification of the identity of those natural or legal persons; * information on customer or counterparties to transactions, provision of services, or activities, including minimum information to identify the persons, the nature, the location, the origin and destination of such transactions, activities or provision of services and their due diligence, where applicable; (c) information on occasional transactions, or provision of services; (d) cash transactions volumes and amounts, where applicable; (e) payment methods and accounts, where applicable. 3\. Risk assessments to fulfil obligations in accordance with Articles 9 and 10 of Regulation (EU) 2024/1624: (a) the business-wide risk assessment, including typologies and risk indicators related to customers, products, geographies, delivery channels identified by the obliged entity or to which the obliged entity is exposed; (b) money laundering, terrorist financing and targeted financial sanctions internal controls, independent audit functions reviews performed at group level and at obliged entity level as well as external audit reviews related to these risks, including findings, remediation measures, actions, recommendations, results and any other corrective measure as deemed relevant; (c) individual risk assessments, including information on higher and lower risk factors associated with individual customers and the entity´s analysis of the risks associated with the customer; (d) individual risk assessments of occasional transactions; (e) information on politically exposed persons, their close family members or closely associated persons including their risk levels and assets under management, where applicable; (f) information on the risk assessment to prevent and mitigate the risk of the non-implementation or evasion of targeted financial sanctions; (g) information on blocked accounts for reasons related to money laundering, terrorist financing and/or the risk of non-implementation or evasion of targeted financial sanctions; (h) information on breaches in the group related to AML/CFT and prevention and management of the risk of the non-implementation or evasion of targeted financial sanctions; (i) information on customers whose entry into business relationship was declined or whose business relationship was terminated or information on refusal to carry out an occasional transaction for reasons related to money laundering, terrorist financing or targeted financial sanctions, including the grounds of such decisions; (j) negative or adverse reports from independent and reliable sources concerning customers or beneficial owners, including analysis of their potential impact on risks related to money laundering, terrorist financing and the non-implementation or evasion of targeted financial sanctions. 4\. Suspicious transaction and activity reporting: (a) the suspicions or reasonable grounds to suspect that funds or activities are the proceeds of criminal activity or are related to terrorist financing or criminal activity reported to the financial intelligence unit (FIU) pursuant to Article 69 of Regulation (EU) 2024/1624, accompanied by the underlying analyses, unless otherwise instructed by the competent FIU; * number and typologies of suspicious transactions and activity reporting. 5\. Other relevant information: (a) information on the implementation of group-wide policies, procedures and controls pursuant to Article 9 of Regulation (EU) 2024/1624, including outsourcing and reliance on other obliged entities and other third-party arrangements; (b) information on training or incidents related to risks of money laundering, terrorist financing or the risk of the non-implementation or evasion of targeted financial sanctions as deemed appropriate; (c) information on interactions with supervisors or competent authorities, including information on on-site inspections; (d) information held by the obliged entity of the group pursuant to the obligation of data retention. ## 4 Accompanying documents ### 4.1 Impact assessment with cost-benefit analysis #### Introduction As per Article 49(1) of Regulation (EU) 2024/1620, before submitting draft regulatory technical standards (RTS) to the European Commission, AMLA shall conduct open public consultations and analyse the potential related costs and benefits. This analysis presents the Impact assessment with cost-benefit analysis (IA/CBA) of the main policy options included in the Consultation Paper (CP) on the draft RTS under Articles 16(4) and 17(3) of Regulation (EU) 2024/1624. This IA/CBA is qualitative in nature and the policy choices have been taken primarily in accordance with qualitative considerations, taking into account the experience and professional judgment of competent authorities from the financial and the non-financial sector, self-regulatory bodies (SRBs), and AMLA, as well as input provided by the European Banking Authority (EBA) in its response to the European Commission’s Call for Advice and feedback received during the public consultation. Moreover, quantitative figures in relation to these mandates are currently unavailable and performing a targeted collection would impose a disproportionate burden on obliged entities. Where quantitative evidence is lacking, the analysis is supported by structured qualitative reasoning and professional judgement informed by supervisory experience and wider stakeholders’ input. #### Background Article 16(4) of Regulation (EU) 2024/1624 (AMLR) mandates AMLA to draft RTS specifying minimum standards for group-wide policies and procedures, including: * minimum standards for information-sharing within the group; * the criteria for identifying the parent undertaking for groups whose head office is located outside of the Union; and * the conditions under which the provisions of Article 16 of Regulation (EU) 2024/1624 apply to entities that are part of structures which share common ownership, management or compliance control, including networks or partnerships, as well as the criteria for identifying the parent undertaking in the Union in those cases. On 12 March 2024, the European Commission issued a Call for Advice to the EBA on certain draft RTS under the new EU anti-money laundering and countering the financing of terrorism (AML/CFT) framework, to inform AMLA’s work. As part of it, the EBA was requested to provide technical advice and set out options for AMLA to consider when developing the draft RTS on group-wide policies and procedures under Article 16(4) of Regulation (EU) 2024/1624. In preparing these options, EBA drew on information from its prudential work and AML/CFT guidelines or standards where applicable. Within the scope of the mandate under Article 16(4) of Regulation (EU) 2024/1624, EBA focused solely on minimum standards for information sharing within groups that are F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 financial institutions. Although the EBA’s remit is limited to financial institutions, it noted that its advice would be applicable to the non-financial sector as well. Under Article 17(3) of Regulation (EU) 2024/1624, AMLA is required to develop draft RTS specifying: * the minimum actions to be taken by obliged entities where the law of a third country does not permit the implementation of the measures required under Article 16 of Regulation (EU) 2024/1624; * the type of additional measures that the parent undertaking shall take to ensure that branches and subsidiaries in third countries, where the law of that third country does not permit compliance with Regulation (EU) 2024/1624, effectively handle the money laundering and terrorist financing (ML/TF) risks; and * the additional supervisory measures required in such case. * In the context of mandate under Article 17(3) of Regulation (EU) 2024/1624, the draft RTS are intended to replace the framework currently set out in Commission Delegated Regulation (EU) 2019/758, supplementing Directive (EU) 2015/849. Delegated Regulation (EU) 2019/758 was based on joint draft RTS developed by the European Supervisory Authorities. ### A. Problem identification The previous EU AML/CFT framework relied largely on the national transposition by Member States of the requirements set out in Directive (EU) 2015/849 and its subsequent amendments. This approach proved to be insufficient to effectively tackle the cross-border nature of financial crime, which requires an integrated and harmonised framework at Union level. To strengthen the effectiveness of the Union’s AML/CFT efforts, group-wide requirements for obliged entities are an essential part in ensuring adequate risk assessment, overview of activities, risks, and controls at group level. By applying such requirements, obliged entities formed in groups or structures other than groups, are required to implement a minimum level of group-wide or group-wide equivalent policies, procedures and controls to prevent and manage ML/TF risks and the risks of non-implementation or evasion of targeted financial sanctions. To bring AML/CFT rules to an efficient and uniform level across the Union, Article 16 of Regulation (EU) 2024/1624 introduces harmonised rules on group-wide requirements. This provision also refers explicitly to Articles 9 and 10 of Regulation (EU) 2024/1624, which contain requirements on internal policies, procedures and controls, as well as on business-wide risk assessment. Supervisory experience, however, shows that obliged entities structured in groups often face challenges in designing, implementing and reviewing group-wide policies, procedures and controls. Additionally, a fragmented approach to the scope of minimum group-wide requirements has been identified in some cases, particularly in the non-financial sector. To ensure a more consistent and effective application of group-wide policies, procedures and controls, clearer rules at EU level are needed. Regulation (EU) 2024/1624 does not address critical parts of group-wide requirements, in particular: * minimum requirements on the scope of group-wide policies, procedures and controls; * the type of information that could be shared within a group; F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 * the criteria to identify a parent undertaking in the Union in the cases of two or more obliged entities in the Union not in a parent/subsidiary relationship and that belong to a head office in a third country; * the conditions for the application of group-wide requirements to structures other than groups that share common ownership, management or compliance controls. To ensure minimum requirements for group-wide policies, procedures and controls and clarify certain aspects related to rules on groups and structures other than groups, Article 16(4) of Regulation 2024/1624 mandates AMLA to develop a draft RTS on the above aspects. To prevent the misuse of the Union’s financial system for the purposes of ML/TF and to ensure the highest standard of protection for personal data of Union citizens, Article 17(1) of Regulation (EU) 2024/1624 requires parent undertakings to ensure that their branches and subsidiaries located in third countries comply with requirements laid down in that Regulation. However, there may be circumstances in which the law of a third country prevents compliance with those requirements, for example due to limitations on a group’s ability to access, process or exchange information, resulting from insufficient level of data protection or banking secrecy law in that third country. In such cases, the parent undertaking or obliged entity shall take additional measures to ensure that branches and subsidiaries located in the third country effectively manage the ML/TF risks, associated with the obliged entity’s operations in that country. Where the implementation of such additional measures is insufficient to effectively manage those risks, supervisors shall, following a supervisory assessment, apply one or more additional supervisory actions to ensure adequate risk mitigation and safeguard the integrity of the Union’s financial system. While the Regulation does not specify those additional measures and supervisory actions, Article 17(3) of Regulation (EU) 2024/1624 requires AMLA to develop draft RTS specifying them. ### B. Policy objectives The objective of the mandate under Article 16(4) of Regulation (EU) 2024/1624 is to contribute to the strengthening of the harmonised AML/CFT framework applicable to obliged entities formed in groups or structures other than groups as provided in Regulation (EU) 2024/1624, while adhering to the risk-based approach and the principle of proportionality. To achieve this objective, the draft RTS specify minimum requirements for group-wide policies, procedures and controls and establish the conditions under which group-wide requirements apply to obliged entities forming part of structures other than groups that share common ownership, management or compliance controls. For such structures, the application of those requirements ensures a level-playing field, while taking into account the need for their proportionate application to the nature of the business, risks, complexity and size of the structure. By establishing such minimum requirements, the draft RTS aim to address deficiencies in the application of group-wide requirements that could lead to the inconsistent application, or non-application, of group-wide requirements across the Union as well as to clarify certain situations applicable structures other than groups. In addition, the draft RTS address the minimum level of information sharing within groups, to ensure compliance with the obligations to mitigate ML/TF risks and the risks of evasion or circumvention of targeted financial sanctions (TFS). Since group-wide policies, processes and controls are expected to F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 address the type of information that can be shared, it is essential to identify a list of information that can be shared and provide standards on the way in which such information can be shared to the greatest extent. Given the evolving nature of ML/TF risks and the risks of non-implementation and evasion of TFS, the information-sharing framework should also remain sufficiently adaptive to ensure that relevant and emerging risk-related information can be effectively exchanged within groups. Closely related to the mandate under Article 16(4) of Regulation (EU) 2024/1624 is the mandate under Article 17(3) of that Regulation. In this context, the draft RTS aim to ensure that ML/TF risks arising from operations of obliged entities with subsidiaries and branches in third countries are effectively identified, assessed and managed at group level, even where the legal framework of the third country prevents the full application of group-wide AML/CFT policies, procedures and controls. The draft RTS seek to address potential regulatory and supervisory gaps that may otherwise be exploited when branches or subsidiaries operate in jurisdictions with legal impediments related to data protection, banking secrecy, or supervisory access, thereby safeguarding the integrity of the Union’s financial system. To support this objective, the draft RTS promote a consistent and convergent approach to be applied by obliged entities across the Union. By specifying the types of minimum actions and additional measures, and establishing a common framework for supervisory actions, it seeks to minimize divergent interpretations and uneven application of risk mitigation requirements by obliged entities, while preserving the risk-based nature of the AML/CFT framework and ensuring proportionate implementation. Further, the draft RTS aim to enhance supervisory effectiveness. By defining a framework of supervisory actions that may be applied where additional measures prove insufficient, the draft RTS support supervisors in responding in a timely, proportionate and risk-based manner to situations where ML/TF risks are not effectively managed. This includes enabling supervisors to require submission and implementation of a risk mitigation plan, enhanced monitoring, or, where risks are no longer manageable, restrictive or exit-type measures, thereby ensuring that supervisory intervention is aligned with the severity of the risks identified. The draft RTS also address the identification of the parent undertaking in the Union in situations where two or more obliged entities are not in a parent-subsidiary relationship and have their head office in a third country. For such cases, Regulation (EU) 2024/1624 introduces a definition of parent undertaking in the Union by reference to qualitative criteria, namely the determination of sufficient prominence of activities of one obliged entity over the other(s), the sufficient understanding of activities of one obliged entity over the other(s) and if the obliged entity is given the responsibility to implement the group-wide policies, procedures and controls. The draft RTS therefore seek to substantiate these qualitative criteria by specifying how they should be assessed and applied in practice. They also provide for a notification and supervisory assessment process to support the consistent identification of the parent undertaking in the Union in those cases. Furthermore, the draft RTS establish the conditions under which certain obliged entities organised in structures other than groups, such as networks, partnerships or franchises, and having common ownership, management or compliance controls, shall adopt, implement and apply group-wide requirements, taking into account the principle of proportionality. The draft RTS specify alternative minimum conditions for determining whether such structures fall within scope of common ownership, management or compliance control and provide that the group-wide requirements are applied F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 proportionately to the nature of the business, risks, complexity and size of the structure. The draft RTS establish also a framework for the identification of the obliged entity that shall act as the head of the structure to ensure compliance with group-wide requirements applicable to the structure. In justified circumstances a mechanism of supervisory notification and approval is put in place to ensure proportionate application of group-wide requirements to certain structures, in particular when an entity that is not an obliged entity is identified as the head of the structure or there are legal impediments in Union or national laws for such appointment. ### C. Baseline scenario Under the baseline scenario, obliged entities would apply group-wide requirements solely under Articles 9, 10 and 16 of Regulation (EU) 2024/1624, without any additional provisions specifying those group-wide requirements. In particular, no additional provisions would clarify the type of information to be shared within a group, the identification of the parent undertaking in the Union in the case of Article 2(1)(42)(b) of Regulation (EU) 2024/1624, or the conditions under which group-wide requirements apply to entities forming part of structures other than groups that share common ownership, management or compliance control. The lack of regulatory provisions in this context might lead to divergent design and implementation of group-wide requirements across sectors and Member States. It may also create uncertainty regarding the type of information to be shared within a group, the identification of the parent undertaking in the Union in the situation covered by Article 2(1)(42)(b) of Regulation (EU) 2024/1624, and the determination of the structures other than groups to which group-wide requirements apply and the proportionate application of those requirements. All these aspects would ultimately undermine the consistent application of group-wide requirements and create a risk of for regulatory arbitrage, as criminals might exploit jurisdictions with more permissive interpretations. In addition, obliged entities would be required to apply minimum actions and additional measures to ensure that their branches and subsidiaries located in third countries where local law does not permit compliance with Regulation (EU) 2024/1624 effectively manage ML/TF risks, solely on the basis of Article 17 of Regulation (EU) 2024/1624, without any further specification of the types of additional measures and minimum actions to be taken. This might lead parent undertakings or obliged entities to take divergent approaches across different sectors and jurisdictions, thereby undermining the harmonisation objective pursued by the Union’s AML/CFT framework. Similarly, competent authorities would assess the adequacy of the measures implemented by obliged entities and decide on the application of additional supervisory actions exclusively on the basis of Article 17 of Regulation (EU) 2024/1624 and the provisions of Directive (EU) 2024/1640 as transposed into national law. However, no further harmonised Union-level framework would exist to define common supervisory actions. This might undermine supervisory convergence and create potential supervisory gaps that might be exploited for ML/TF purposes. ### D. Options considered, cost-benefit analysis, and preferred option This section describes the main policy options considered and the decisions taken as part of the development of the draft RTS under Articles 16(4) and 17(3) of Regulation (EU) 2024/1624. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 This section starts by outlining the overarching principles guiding the policy decisions. Then, it presents the main policy options considered for each policy issue addressed by the draft RTS, followed by a qualitative analysis of the potential costs and benefits of each option, and concludes by identifying the preferred option resulting from the analysis. #### Policy issue 1: level of granularity of minimum requirements for group-wide policies, procedures and controls Article 16(4) of Regulation (EU) 2024/1624 requires AMLA to specify minimum requirements for group-wide policies, procedures and controls. In determining the appropriate level of granularity of those requirements, AMLA considered the following options. * A. Adopting detailed minimum requirements for group-wide policies, procedures and controls. * B. Adopting principle-based minimum requirements for group-wide policies, procedures and controls. #### Option A Under Option A, the draft RTS would specify minimum requirements for group-wide policies, procedures and controls at a highly detailed level. The draft RTS would prescribe in a granular manner the elements to be included in group-wide policies, procedures and controls, including detailed governance arrangements, internal roles and reporting requirements. Such approach would aim to minimise interpretative differences by setting out comprehensive and prescriptive expectations applicable across all groups. This option would contribute to a high degree of harmonisation and supervisory clarity, as obliged entities and competent authorities would rely on a common and detailed set of requirements. It could strengthen consistency of group-wide frameworks, particularly in complex cross-border groups, and facilitate supervisory assessments by reducing discretion in implementation. However, this option would entail higher compliance and implementation costs, especially for smaller or less complex groups and for obliged entities operating across different sectors with diverse organisational structures and business models. Moreover, such approach could create unnecessary complexity, reduce the proportionate application of the draft RTS, limit obliged entities' ability to adapt group-wide arrangements to their organisational structures, business models and risk profiles, and increase the risk of regulating matters already addressed in Regulation (EU) 2024/1624 or potentially extending beyond the scope of the mandate under Article 16(4) of that Regulation. #### Option B Under Option B, the draft RTS would specify minimum requirements for group-wide policies, procedures and controls at a more principle-based level, focusing on essential elements necessary to ensure effective group-wide AML/CFT risk management. The draft RTS would set out the objectives and main components to be covered by group-wide frameworks, while leaving obliged entities sufficient flexibility to determine the level of detail and operational arrangements in light of their size, internal organisation, and risk exposure, subject to supervisory oversight. By establishing minimum requirements for group-wide policies, procedures and controls, rather than prescribing detailed operational rules, this option would ensure a consistent regulatory baseline across F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 different sectors while allowing obliged entities to implement those requirements in a manner proportionate to their size, organisational structure and ML/TF risk profile. This approach would define the regulatory outcome to be achieved without prescribing detailed implementation measures, thereby reducing unnecessary complexity and avoiding requirements that could potentially extend beyond the framework of Regulation (EU) 2024/1624. It would also accommodate the diversity of groups and structures across sectors. The public consultation, subsequent discussions with the European Commission and feedback from supervisors confirmed the appropriateness of this approach. In response, the draft RTS were further simplified, streamlined and reorganised into broader thematic areas by removing unnecessary definitions and provisions and improving the clarity and consistency of the drafting. These revisions strengthened alignment with Regulation (EU) 2024/1624, reinforced proportionality, and reduced implementation complexity, while preserving the effectiveness of the minimum group-wide requirements. The main drawback associated with this option is that a lower level of granularity may result in some variation of implementation practices across obliged entities. Sectoral variations may also entail additional supervisory costs, as they would require increased reliance on supervisory judgment and coordination to ensure consistent outcomes. However, such sectoral variations are considered acceptable, given the need to provide a sufficient degree of flexibility to the wide range of obliged entities subject to Regulation (EU) 2024/1624. #### Preferred option Based on the considerations outlined above, Option B has been chosen as the preferred option, as it provides an appropriate balance between harmonisation, proportionality and flexibility in the specification of the minimum requirements for group-wide policies, procedures and controls. By specifying those minimum requirements in a principle-based manner, rather than through detailed operational rules, Option B ensures the consistent application of the minimum requirements across all sectors, while allowing obliged entities to implement those requirements in a manner proportionate to their size, organisational structure and ML/TF risk profile. The revisions made following the public consultation further strengthened this approach by simplifying the framework, reorganising the minimum requirements into broader thematic areas to improve clarity and facilitate their application, and reinforcing its alignment with Regulation (EU) 2024/1624. #### Policy issue 2: the scope of information-sharing within a group Article 16(4) of Regulation (EU) 2024/1624 requires AMLA to specify minimum standards for information sharing within a group. The policy issue concerns how broadly the obligation to share information within groups and structures other than groups should apply and general standards on such sharing, in particular with regard to the type of information covered, the entities involved, and the legal and practical limits to information sharing, including data protection and confidentiality. For the specification of the scope of information that shall be shared, AMLA considered the following options: * A. A restrictive approach, defining a limited and exhaustive list of information that may be shared, accompanied by strict limitations on information sharing. * B. A broader approach, establishing a minimum non-exhaustive list of information that may be shared, complemented by specific safeguards for such sharing. Under Option A, the draft RTS would define the scope of information sharing within groups and structures other than groups through a closed and exhaustive list of information that obliged entities are permitted to share within a group or structures other than groups. It would also introduce limitations on the sharing of information, such as requiring information to be shared through the parent undertaking or restricting the circumstances in which information can be shared. The underlying logic of this approach would be to enhance legal certainty and uniformity by precisely delineating the information flows allowed for AML/CFT purposes, thereby limiting discretion at group level and reducing the risk of unlawful data processing. The main benefit of this option is legal certainty. It would reduce instances of inconsistent interpretation and litigation, particularly in sensitive areas such as data protection and confidentiality. However, this option would introduce significant limitations to information sharing within groups. An exhaustive list would be inherently rigid and would not adequately reflect the evolving nature of ML/TF risks, limiting the ability of groups and structures to respond effectively to emerging threats, new typologies or specific group-level risk exposures. The draft RTS would need to be regularly amended to reflect emerging risks, resulting in additional implementation costs for obliged entities and reducing regulatory agility. Moreover, information that is materially relevant for AML/CFT purposes could fall outside the predefined scope, thereby weakening risk identification and mitigation. For instance, it could expose obliged entities within the groups or structures to the risk of reopening business relationships outside the group risk appetite or failing to identify suspicious activities due to lack of relevant information. Restrictions on the circumstances or channels through which information could be shared could also delay or prevent relevant information from reaching the obliged entity that needs it for AML/CFT purposes. #### Option B Under Option B, the draft RTS would establish a minimum, non-exhaustive list of information that may be shared within groups, while allowing for additional information sharing where relevant for the prevention of ML/TF and the risk of non-implementation or evasion of targeted financial sanctions. This approach would be complemented by explicit safeguards, including compliance with data protection rules, confidentiality and the application of a need-to-know principle, as well as appropriate requirements concerning the security and integrity of information sharing. The overall objective of this approach would be to facilitate the timely and effective flow of relevant information within groups, with the aim of supporting the effective mitigation of ML/TF risk and the risk of non-implementation or evasion of targeted financial sanctions, while avoiding disproportionate information sharing. The benefits of Option B are threefold. First, it would support effective and timely group-wide risk identification and mitigation by ensuring that relevant information can be shared within the group if needed, without the constraints of an overly rigid framework. More specifically, obliged entities belonging to the group or structures other than groups would be allowed to share information among themselves, without limiting the sharing of information only through the parent undertaking or the head of the structure in the Union. Second, by linking the information-sharing framework directly to F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 Regulation (EU) 2024/1624 and providing in Annex I a minimum list of information, this option would improve legal certainty while maintaining sufficient flexibility to address evolving ML/TF risks. Third, by embedding clear safeguards based, among others, on relevance, proportionality, the need-to-know principle, data protection and confidentiality, this approach would mitigate the risk of unlawful data sharing. In addition, by clarifying that each obliged entity remains individually responsible for complying with its obligations under Regulation (EU) 2024/1624, the draft RTS would ensure that information sharing supports, rather than replaces, entity-level AML/CFT compliance. Compared with Option A, this approach would require obliged entities to exercise greater judgment in determining what information is relevant for AML/CFT purposes and in designing information-sharing arrangements appropriate to their organisational structure and risk profile. This may entail some initial implementation costs associated with reviewing or adapting internal policies, procedures, governance arrangements and information-sharing systems to ensure that the minimum requirements and safeguards are applied consistently across the group or structure. However, these implementation costs are expected to be offset by the legal certainty and adequacy in designing information-sharing arrangements appropriate to the organisational structure and ML/TF risk profile of groups and structures. While this option may result in some variation in information sharing practices across groups or structures other than groups in different sectors and require greater supervisory judgment in assessing compliance with the minimum requirements, it would ensure that at least the essential scope of relevant information is shared within groups and structures across all sectors. Moreover, the draft RTS recognise a certain degree of flexibility in the way information sharing may take place to ensure that obliged entities can adapt the application of the draft RTS to their specific business models, as well as situational needs. This flexibility is reflected in the use of general standards rather than an exhaustive determination of the information that may be shared, or the circumstances and manners in which such sharing may take place. At the same time, this flexibility would not affect the individual responsibility of each obliged entity for compliance with its AML/CFT obligations. Information received within the group may support customer due diligence, risk assessment and other AML/CFT decisions, but each obliged entity would remain responsible for complying with its own due diligence requirements and taking its own risk-based decisions. #### Preferred option This analysis recognises that both options might entail financial and administrative costs for groups of obliged entities to ensure compliance with the new provisions of the draft RTS. In both cases, groups of obliged entities would need to set up policies and procedures for information sharing within the group and the structure, build appropriate safeguards, possibly modify their information-sharing infrastructure, and potentially adapt their compliance and governance functions to the new provisions. The exact costs would depend on the actual size and organisational structure of each obliged entity. Considering the costs and benefits described above, policy Option B was selected as the preferred option. This option provides a sufficiently structured baseline to support harmonisation and ensure effective information sharing, while remaining flexible in the way in which information sharing may take place to reflect the size, complexity, and risk profile of individual groups and structures in line with the F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 risk-based approach. The revisions introduced following the public consultation further strengthened this approach by linking the information-sharing framework more closely to the Regulation (EU) 2024/1624, simplifying the drafting by moving the list of information to Annex I, clarifying further the minimum operational standards for information sharing, keeping the accountability of individual obliged entities and improving operational feasibility. Overall, this approach better aligns with the objectives of Regulation (EU) 2024/1624 by balancing effectiveness, proportionality, and legal certainty. #### Policy issue 3: degree of prescriptiveness of additional measures and supervisory actions In line with the mandate under Article 17(3) of Regulation (EU) 2024/1624, the draft RTS should define a Union-level response to legal impediments in third countries, including the definition of minimum actions and additional measures to be applied by the parent undertakings or obliged entities, as well as the additional supervisory actions to be applied by the supervisors of the home Member State where those additional measures prove insufficient to effectively manage ML/TF risks of subsidiaries and branches in third countries. Under both policy options, the minimum actions are considered to provide a common baseline response to legal impediments. The policy choice therefore concerns the degree of prescriptiveness of the additional measures to be applied where those minimum actions are insufficient, and of the supervisory actions to be applied where the additional measures prove insufficient. Against this background, two policy options are considered. * A. Defining a prescriptive set of additional measures and supervisory actions. * B. Defining a set of additional measures and supervisory actions to be applied proportionately and on a risk-based basis. #### Option A Under Option A, the draft RTS would define a prescriptive set of additional measures to be implemented by parent undertakings or obliged entities in the presence of legal impediments in third countries that could not be addressed by the minimum actions, accompanied by a prescriptive list of supervisory actions to be applied by supervisors once the additional measures are determined to be insufficient. The main benefit of this approach would be stronger harmonisation and enhanced supervisory convergence. A prescriptive set of additional measures would ensure harmonisation of regulatory expectations across Member States and reduce the risk of regulatory arbitrage, by ensuring that obliged entities facing similar legal impediments apply the same mitigating measures. Similarly, prescriptive supervisory actions would promote consistency in supervisory escalation and create a predictable supervisory response across the Union. This approach would also reduce interpretative uncertainty for obliged entities at the implementation stage and facilitate compliance planning and internal governance decisions when operating in third countries where legal impediments affect the implementation of group-wide AML/CFT policies. However, these benefits would come with notable costs. First, legal impediments vary significantly across third countries. Restrictions may concern sharing and processing of customer data within the group, suspicious transaction reporting information, or supervisory access to data. Because these impediments differ in scope and severity, applying the same prescribed set of additional measures across all situations would not always be justified or proportionate. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 Second, a rigid set of measures could impose disproportionate compliance costs on parent undertakings or obliged entities whose risk profile or operational footprint in the affected jurisdiction is limited. A prescriptive approach could therefore lead to inefficient allocation of compliance resources and undermine the risk-based approach underpinning the AML/CFT framework. Third, prescriptive rules risk encouraging “checklist behaviour”, where parent undertakings or obliged entities focus on formally implementing required measures rather than selecting those that most effectively mitigate the risks associated with a specific legal impediment. Fourth, rigid prescriptions may also be impractical in situations where certain measures cannot legally be implemented in the third country concerned. This could lead to situations where obliged entities are formally required to apply measures that are themselves restricted by local law. In practice, this could encourage conservative business decisions such as de-risking or withdrawal from certain markets, even where risks could effectively be managed through alternative additional measures. Finally, prescriptive supervisory actions could unduly constrain supervisory judgement, potentially leading to rule-based, rather than risk-based, supervisory outcomes. #### Option B Under Option B, where the common minimum actions are insufficient, the draft RTS would establish a common set of additional measures from which parent undertakings or obliged entities would apply one or more measures, taking into account the nature of the legal impediment and the associated ML/TF risks. Where those additional measures prove insufficient, the draft RTS would provide for a common set of supervisory actions whose application would similarly reflect the circumstances of the case and the risks identified. This approach would therefore harmonise the range of measures available while preserving flexibility as regards the measures to be applied in individual cases. The main benefit of Option B is that harmonisation of regulatory expectations and convergence in supervisory practices would be achieved through a common set of additional measures and supervisory actions, which can be applied proportionately and in a manner that remains workable across diverse third-country legal impediments and different group operating models. Unlike Option A, harmonisation would therefore be achieved by defining a common framework and range of available measures, rather than by prescribing the same response irrespective of the circumstances. This flexibility would avoid unnecessary compliance costs in lower-risk situations and align with the principle of proportionality embedded in the Union’s AML/CFT framework. It would also reduce the likelihood that parent undertakings or obliged entities respond to legal impediments by withdrawing entirely from certain jurisdictions where ML/TF risks could otherwise be effectively managed through alternative mitigating measures. From a supervisory perspective, this approach would preserve supervisory discretion, while ensuring a consistent escalation logic across supervisors in the home Member States. Supervisors would apply supervisory actions within a harmonised framework, taking into account the nature and gravity of the identified risks and the impact of the relevant third-country legal or regulatory impediments. This would allow supervisory intervention to escalate until the risks are adequately addressed. The main costs of Option B would arise from the potential risk of divergent application of group-wide requirements, as parent undertakings or obliged entities may select different combinations of F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 additional measures in similar situations. Obliged entities may also incur some implementation costs when assessing legal impediments, documenting the proportionality of the additional measures selected and demonstrating to supervisors of the home Member State that those measures are appropriate in light of the identified ML/TF risks. This would also result in higher supervisory effort, as supervisors would need to assess whether the measures selected are sufficient to effectively mitigate the identified ML/TF risks. However, this supervisory effort would be partially mitigated by the design of the draft RTS itself, as the list of additional measures and the requirement to demonstrate to the supervisors of home Member States that the extent of the additional measures is appropriate would provide a structured reference point for supervisory assessment. In addition, the supervisory actions would provide safeguards against ineffective risk mitigation by parent undertakings or obliged entities, by ensuring that supervisors can require risk mitigation plans or corrective measures and, where the risks cannot otherwise be effectively managed, apply more restrictive measures, including restrictions on business relationships or transactions and, ultimately, the closure of some or all operations or activities in the third country. #### Preferred option On balance, Option B is preferred because it best reconciles the objectives of harmonisation and supervisory convergence with the principles of proportionality, risk-based approach and operational feasibility across different third-country legal impediments. It preserves the flexibility necessary for parent undertakings, obliged entities and supervisors, to address the specific characteristics of different legal impediments in a proportionate and risk-based manner. The revisions introduced following the public consultation further strengthen the rationale for the preferred option. By consolidating the framework into minimum actions, additional measures and supervisory actions, the revised draft RTS provides a clearer and more coherent escalation framework while retaining the flexibility underlying Option B. In particular, it preserves flexibility in the application of additional measures and provides for a proportionate supervisory response where those measures prove insufficient. #### Policy issue 4: timing of the notification to supervisors Under the mandate in Article 17(3) of Regulation (EU) 2024/1624, one of the policy issues concerned the appropriate reporting obligation referred to in Article 17(2) of that Regulation when a parent undertaking or obliged entity identifies that the law of a third country prevents or restricts the application of group-wide AML/CFT policies, procedures and controls. In particular, the question arose whether the draft RTS should maintain the existing approach requiring notification to the supervisor within a fixed timeframe of 28 calendar days after identifying the impediment, or whether it should introduce a more flexible or staged reporting model, recognising that the legal analysis of third-country impediments may require additional investigation. This issue was particularly relevant given that the existing framework established under Commission Delegated Regulation (EU) 2019/758 already requires obliged entities to notify their competent authorities within 28 calendar days when they identify an impediment to the application of group-wide policies. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 Maintaining or adapting this approach therefore required careful consideration of both supervisory effectiveness and regulatory continuity and consistency with notification timelines applied in other parts of the draft RTS. The design of the notification framework also needed to take account of the potential administrative burden arising from multiple notifications concerning related legal impediments. Two policy options were considered. * A. Maintaining the fixed 28-calendar-day notification requirement foreseen under Commission Delegated Regulation (EU) 2019/758 as the maximum timeframe for notification. * B. Introducing a flexible or staged reporting framework. #### Option A Under Option A, the draft RTS would maintain the notification requirement established under Commission Delegated Regulation (EU) 2019/758, which requires parent undertakings or obliged entities to notify the supervisor of the home Member State without undue delay and in any case no later than 28 calendar days after identifying a legal impediment in a third country. This approach preserves the existing reporting framework, which is already familiar to both obliged entities and supervisors. The main benefits of this option lie in its predictability and timely supervisory awareness. Establishing a clear notification deadline would ensure that supervisors are promptly informed when legal impediments arise, enabling early supervisory engagement and effective monitoring of the mitigating measures implemented by parent undertakings or obliged entities. A uniform notification deadline would also enhance legal certainty and ensure greater consistency in reporting practices across Member States. Furthermore, by building on an existing reporting framework, this approach would reduce implementation complexity for obliged entities and avoid the introduction of new reporting requirements. However, a fixed deadline may be perceived as rigid in situations where identifying and characterising a legal impediment requires complex legal analysis. In such cases, obliged entities may face difficulties in submitting a sufficiently substantiated notification within the 28-day timeframe. This limitation could be mitigated through the supervisory process, as supervisors may request follow-up information as part of their ongoing supervisory activities. #### Option B Under Option B, the draft RTS would introduce a more flexible reporting framework, for example by establishing a two-step reporting process consisting of an initial notification followed by a more detailed notification once the legal impediment has been fully analysed. The main benefit of this approach would be the potential to improve in the quality and completeness of the information provided to supervisors. Allowing additional time for internal analysis could enable parent undertakings or obliged entities to submit more comprehensive and substantiated notifications. This could reduce the number of incomplete or preliminary submissions and limit the need for subsequent corrections or withdrawals. A staged reporting approach could also better accommodate situations where the identification and assessment of third-country legal impediments require complex legal analysis or internal escalation within the group. However, this approach would also entail certain drawbacks. While supervisors would receive an initial notification at an earlier stage, the substantive assessment of the legal impediment and the proposed mitigating measures would only become available once the internal analysis has been completed. As a result, the practical effect of a two-stage reporting process would be to extend the period before supervisors receive the information necessary to assess the legal impediment and the adequacy of the proposed response, without necessarily improving supervisory effectiveness. This could also lead to inconsistencies in reporting practices across sectors and Member States if the timing of notifications becomes more open to interpretation. Furthermore, introducing a staged reporting process could create uncertainty regarding the appropriate timing of notifications and potentially lead to delayed reporting. This could weaken the clarity, predictability, and enforceability of the reporting obligation compared with the current framework, which establishes a clear and uniform notification deadline. A formal two-stage process could also increase administrative complexity by requiring multiple submissions concerning the same legal impediment. #### Preferred option Option A was identified as the preferred option. Maintaining the fixed 28-calendar-day notification requirement ensures continuity with the framework established under Commission Delegated Regulation (EU) 2019/758 and preserves a clear and predictable reporting obligations. It also ensures timely supervisory awareness of legal impediments, enabling early engagement by competent authorities and effective monitoring of mitigating measures. Further, it promotes supervisory convergence across Member States through a common reporting standard, while allowing supervisors to request additional information where necessary and is aligned with the timeline introduced in other parts of the draft RTS. While stakeholders raised concerns during the public consultation regarding the operational feasibility of the fixed 28-calendar-day deadline, the revised draft RTS addresses those concerns without departing from the underlying policy choice. Rather than introducing a staged reporting framework, the revised draft retains a single notification requirement while simplifying the overall notification framework, including by allowing, where appropriate, a single notification at group or obliged-entity level for related notifications. This reduces unnecessary administrative burden without delaying supervisory awareness of legal impediments. Overall, the revisions introduced following the public consultation strengthen the implementation of Option A by simplifying the notification framework while preserving the benefits of a clear, predictable and timely reporting obligation. #### Policy issue 5: specification of criteria for identifying the parent undertaking in the Union in cases of two or more obliged entities whose head office is located outside the Union Article 16(4) of Regulation (EU) 2024/1624 requires AMLA to specify the criteria for identifying the parent undertaking in the Union in the cases covered by Article 2(1), point (42)(b) of that Regulation. In particular, AMLA is required to specify the criteria for determining whether an obliged entity has sufficient prominence within the group, sufficient understanding of the operations of the group, and responsibility for implementing the group-wide requirements. In specifying those criteria, AMLA considered the following two options. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 * A. Adopting principle-based criteria for the identification of the parent undertaking. * B. Specifying structured, sequential and objective criteria for the identification of the parent undertaking, including a supervisory framework for such identification. #### Option A Under Option A, the draft RTS would only provide principle-based criteria for the identification of the parent undertaking in the situation of Article 2(1)(42)(b) of Regulation (EU) 2024/1624. The main benefit of this option lies in its flexibility for groups whose head office is located outside the Union to self-assess their structure and designate the parent undertaking based on their internal governance arrangements. However, this option would create a risk that obliged entities in comparable situations may reach divergent conclusions regarding which entity qualifies as the parent undertaking. Moreover, the lack of structured criteria and a supervisory framework would reduce legal certainty and limit supervisory authorities’ ability to assess, challenge, or validate the designation of the parent undertaking, thereby weakening supervisory convergence and increasing the risk of regulatory arbitrage. #### Option B Under Option B, the draft RTS would set out structured, sequential and objective criteria for the identification of the parent undertaking under Article 2(1)(42)(b) of Regulation (EU) 2024/1624, ensuring that the concepts of sufficient prominence, sufficient understanding of operations, and responsibility for implementing group-wide requirements are assessed in a coherent and sequential manner. Those criteria would be based on qualitative and quantitative factors, already available to obliged entities, using additional factors only where the primary criteria do not lead to a conclusive outcome. In addition, this option would introduce a notification and supervisory assessment to support the structured and objective application of the criteria and the consistent identification of the parent undertaking by obliged entities. The main benefits of this option would include enhanced legal certainty, supervisory convergence and operational effectiveness by facilitating a consistent, transparent and predictable identification of the parent undertaking across Member States. The sequential application of the factors would also provide obliged entities with a clear methodology for carrying out the assessment, while retaining sufficient flexibility to account for differences in group structures and operating models. This option would entail some additional costs. It would require obliged entities to perform a structured assessment to identify the obliged entity to act as parent undertaking in the Union in the situation of Article 2(1)(42)(b) of Regulation (EU) 2024/1624 and would require a notification process to the supervisors. However, these costs would be limited and proportionate, as they would rely on information already available to obliged entities and would be offset by the increased legal certainty. Furthermore, the structured criteria would reduce the likelihood of missing or divergent designations requiring subsequent supervisory intervention. In addition, the notification and supervisory assessment process would provide a key safeguard for the consistent application of the criteria. Supervisors would ensure that they have a key role in assessing the appropriate identification of the obliged entity acting as parent undertaking. Based on the considerations above, Option B is preferred. By defining structured, sequential and objective factors for identifying the parent undertaking and providing for a notification and supervisory assessment process, Option B enhances legal certainty, supervisory convergence and ensures that the identified parent undertaking is both prominent and operationally capable of implementing group-wide AML/CFT requirements. In addition, this approach remains proportionate by combining qualitative and quantitative factors and using additional ones only where the primary assessment does not produce a conclusive outcome. Although some additional costs are expected, those would be justified by the objective pursued and by the additional legal certainty provided. The revisions introduced following the public consultation further strengthened this approach by streamlining and clarifying the application of the criteria and simplifying the notification and supervisory assessment process. In response to stakeholders´ concerns during the public consultation regarding the excessively rigid application of the criteria for identifying the parent undertaking, the revised draft RTS simplify the identification rules. This reduces unnecessary rigidity without undermining the framework to identify the parent undertaking. Further, these changes enhance the operational application of the criteria without altering the underlying policy choice. Overall, the Option B strikes an appropriate balance between flexibility and the benefits of a structured, sequential and objective framework. Policy issue 6: extent to which conditions for the application of the group-wide equivalent requirements to structures other than groups that share common ownership, management or compliance controls should be specified Article 16(4) of Regulation (EU) 2024/1624 requires AMLA to specify the conditions under which group-wide requirements apply to entities that are part of structures that share common ownership, management or compliance controls and do not fall under the definition of the group under Article 2(1)(41) of Regulation (EU) 2024/1624. In specifying the extent of those conditions, AMLA considered the following two options. * A. Introducing high-level conditions for the application of group-wide equivalent requirements. * B. Introducing more specific alternative minimum conditions for the application of group-wide equivalent requirements. #### Option A Under Option A, the draft RTS would only introduce high-level conditions for the application of group-wide requirements to structures that share common ownership, management or compliance controls but do not meet the definition of a group under Article 2(1)(41) of Regulation (EU) 2024/1624. The conditions would focus solely on core elements, such as common ownership, management and common compliance controls without specifying further elements such as identifying the entity that designs, implements and controls such requirements or leaving other aspects to be determined by obliged entities in the structure using a risk-based approach. As a result, this option could lead to greater variation in determining which structures are subject to group-wide equivalent requirements, how those requirements should apply in practice and to what extent obliged entities would comply with them. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 In terms of benefits, this option would provide flexibility to obliged entities, allowing them to take into account the specific features, complexity and risk profile of the structures concerned. It would also limit implementation and compliance costs, as it would avoid the need to put in place extensive formalised governance or documentation or supervisory correspondence solely to meet regulatory specifications. However, the high-level nature of the conditions could result in divergent interpretations and supervisory practices across Member States. This may lead to legal uncertainty for obliged entities, uneven application of group-wide requirements applicable to structures, and potential gaps in AML/CFT coverage where structures are assessed inconsistently, especially in cross-sectoral situations. Significant variations in the application of group-wide level requirements might result in uneven levels of safeguards against ML/TF risks, potentially creating incentives for regulatory arbitrage. #### Option B Under Option B, the draft RTS would provide a more structured, sequential and objective framework based on specific alternative minimum conditions for determining when structures sharing common ownership, management or compliance controls are subject to group-wide requirements. These conditions would provide a clear basis for determining whether the relevant degree of common ownership, management or compliance control exists, while allowing for different forms of structures. In addition, the framework would require the identification of an entity as the head of the structure or put in place a supervisory permission to minimum group-wide requirements to be applied within structures without identifying the head. The main benefit of this option would be greater legal certainty and consistency in determining which structures fall within the scope of the group-wide requirements. Compared with the high-level approach under Option A, more specific conditions would provide obliged entities with a clearer basis for assessing their arrangements and would facilitate a more consistent supervisory assessment across Member States. Further, it would enhance legal certainty by having a clear identification process for identifying the head of the structure and a supervisory framework to ensure that supervisors are aware of existing structures and conduct adequate supervision on them. The main cost of this option is that more detailed conditions provide less flexibility than the principle-based approach under Option A. Obliged entities would need to assess their arrangements against the specified conditions, which may entail some initial compliance and assessment costs. In addition, structures meeting the same condition may differ significantly in their size, complexity, organisation and risk profile, meaning that the application of the same group-wide requirements in the same manner to all qualifying structures could result in disproportionate requirements. Furthermore, additional arrangements might need to be set up to identify the head of the structure or to ask the supervisors not to identify such head. This drawback would be mitigated by requiring the group-wide requirements to be applied proportionately to the nature of the business, risks, complexity and size of the structure. In particular, conditions such as the number of obliged entities, their powers and responsibilities, the level of centralisation or decentralisation of decision-making, and the type, amounts and risk levels of the relevant services and activities would be taken into account when obliged entities in the structure implement group-wide requirements. This would combine greater certainty as to which structures fall within scope with sufficient flexibility as to how the requirements apply to them. Furthermore, the option F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 to ask supervisors not to identify a head of the structure would include a proportionate mechanism to avoid overburdening the affected sectors. While policy Option B entails higher compliance and implementation costs, these are outweighed by the benefits of enhanced legal certainty, a structured, sequential and objective framework, supervisory convergence and a more consistent and effective application of group-wide equivalent requirements across the Union. The specification of alternative minimum conditions provides obliged entities and supervisors with a clearer and more predictable framework for determining whether structures sharing common ownership, management or compliance controls fall within the scope of the group-wide equivalent requirements, thereby reducing the risk of divergent interpretations and supervisory practices. At the same time, the specific nature of the conditions does not require that group-wide requirements are applied uniformly to all qualifying structures. Their application would remain proportionate to the nature of the business, risks, complexity and size of the structure, allowing differences between structures to be appropriately taken into account. The revisions introduced following the public consultation further strengthened this approach by streamlining and clarifying the application of the criteria and simplifying the notification and supervisory assessment process. Following the stakeholders´ concerns during the public consultation regarding the application of a full set of group-wide requirements to structures other than groups, the revised draft RTS introduce more flexibility and proportionality considerations. These reduce unnecessary strictness, risks of application of the framework to entities other than obliged entities and overburdening structures within scope. Further, these changes enhance the operational application of the criteria without altering the underlying policy choice. Overall, the revisions introduced following the public consultation introduce more flexibility under Option B by clarifying further the conditions for the application of group-wide requirements to structures, simplifying the identification criteria, recognising proportionality for certain types of structures while preserving the benefits of a structured, sequential and objective framework. Option B combines greater legal certainty as to which structures fall within scope with sufficient flexibility as to how the requirements apply to them. For these reasons, policy Option B is the preferred option. #### Further assessments The policy choices set out in this impact assessment were further assessed in light of the feedback received during the public consultation on the draft RTS. Overall, the consultation did not identify a need to fundamentally revise the preferred policy choices, but provided additional evidence on their proportionality, legal certainty and operational feasibility. The draft RTS was therefore refined, where appropriate, to address issues identified through the consultation, including by simplifying or clarifying certain requirements and improving their practical implementation. The practical application of the draft RTS may nevertheless be monitored following its implementation to assess whether further clarification or adjustment may be needed. #### Methodology F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 For all policy options, the analysis drew primarily on targeted exchanges with national competent authorities responsible for supervising obliged entities in both the financial and non-financial sectors, as well as on comparative legal analysis. Regarding the minimum standards for information sharing within groups, AMLA also took into account the technical advice provided by the EBA as part of its response to the European Commission’s Call for Advice. The analysis was further informed by the feedback received during the public consultation on the draft RTS, which provided additional evidence on the expected practical implications, proportionality and operational feasibility of the proposed requirements. #### Limitations The analysis is largely qualitative and based on supervisory experience and expert judgment. While this assessment provides valuable insights into the practical applicability of the proposed provisions, it may not fully capture all sector-specific impacts, particularly for newly designated obliged entities. In addition, the diversity of obliged entities, groups and structures covered by the draft RTS, including differences in their size, organisational complexity, business models and risk profiles, limits the extent to which implementation and compliance costs can be quantified or generalised across sectors. These limitations were partly mitigated by the feedback received through the public consultation and by reflecting proportionality and risk-based considerations in the final provisions, where appropriate. ### 4.2 Feedback on the public consultation On 16 April 2026 AMLA launched a public consultation on the Draft Regulatory Technical Standards under Articles 16(4) and 17(3) of Regulation 2024/1624. The consultation lasted 2 months and ended on 15 June 2026. A total of 125 responses were received. In terms of stakeholder representation, 27% of responses were submitted by industry associations representing the financial sector and 21% originated from industry associations representing the non-financial sector, followed by 23% from obliged entities of the financial sector, 11% from obliged entities of the non-financial sector, and the remainder from SRBs and others. This section presents the summary of the key issues and views raised by the respondents and details AMLA’s assessment of the responses which includes any actions taken by AMLA. ## Section 1: definitions and proportionality ### Feedback received Stakeholders raised comments on both the definitions included in the draft RTS and the application of the principle of proportionality. With regard to definitions, stakeholders from the financial sector, particularly the banking sector, considered the proposed definition of "control function" overly broad and requested greater clarity regarding the functions covered by the term. Stakeholders also questioned the formulation of the specific definitions for “networks”, “partnerships”, and “franchises”, noting that the criteria for determining whether entities fall within the scope of the draft RTS are already set out in Section 6 and that separate definitions could therefore be redundant or unclear. In addition, a broad range of stakeholders called for the inclusion of an overarching proportionality provision. They expressed concerns that certain requirements could impose significant compliance burdens without necessarily enhancing the effectiveness of AML/CFT controls. Stakeholders emphasised that the draft RTS should reflect a risk-based and proportionate approach, taking into account the nature, size, complexity, and risk profile of the obliged entities concerned. ### AMLA’s response AMLA carefully considered the feedback received and amended key aspects of the draft RTS. Regarding definitions, AMLA removed the definition of "control function", as providing a standalone definition was not considered practical and could have created potential inconsistencies with Level 1 terminology while introducing unnecessary complexity. AMLA considers that defining specific organisational structures such as networks, partnerships, and franchises would provide limited added value, given that the applicability of the draft RTS depends on the criteria set out in Section 6. References to these types of structures have nevertheless been retained in the recitals and relevant provisions to reflect the terminology used in the AMLR and to clarify that such structures may fall within the scope of the draft RTS where the relevant criteria are met. In addition, the definition of "structure" was revised to better reflect the underlying policy intent by incorporating the concepts of common ownership, common management, and common compliance controls. The revised definition also clarifies that the legal form of the structure is not determinative and that it shall have an element of duration. With respect to proportionality, AMLA acknowledges the importance of ensuring that the draft RTS can be applied in a manner that is proportionate and risk-based. Rather than introducing a standalone overarching provision, AMLA concluded that the principle is more effectively reflected within the specific requirements where it is relevant. This approach allows proportionality to be applied in a targeted manner, taking into account the specific context and objectives of each provision while maintaining the effectiveness of the framework. ## Section 2: minimum group-wide requirements ### Feedback received Stakeholders raised concerns regarding both the practical implementation of the group-wide risk assessment and the potential application of the draft RTS to non-obliged entities as part of the minimum group-wide requirements. Several stakeholders, particularly from the financial sector but also from the legal and gambling sectors, noted that the proposed requirements for the group-wide risk assessment could be overly burdensome for groups or structures. They were concerned that the draft wording could be interpreted as requiring parent undertakings to assess and consolidate the individual risk profile of every entity within the group or structure, irrespective of its relevance to the overall risk exposure. In addition, stakeholders from both the financial and non-financial sectors questioned whether the draft RTS could be interpreted as imposing requirements on non-obliged entities within a group or structure. Concerns were raised regarding the legal basis for such an approach under the Level 1 framework and the extent to which supervisory authorities could exercise powers in relation to entities that are not themselves subject to AML/CFT obligations. AMLA carefully considered the feedback received and amended the draft RTS to provide greater clarity on both issues. With regard to the group-wide risk assessment, AMLA revised the relevant provision in Article 3 to clarify that the assessment should be conducted from a holistic group-wide perspective. Rather than requiring a detailed assessment of every individual entity, the risk assessment shall take into account the risks arising across the group or structure and focus on those that have a significant impact on its overall risk exposure. Regarding non-obliged entities, AMLA reviewed the relevant provisions to ensure full alignment with the Level 1 mandate. As a result, provisions that could have been interpreted as imposing direct obligations on non-obliged entities were removed. The final draft RTS make clear that the requirements apply only to obliged entities within the group or structure, while ensuring that the objectives of effective group-wide AML/CFT arrangements are maintained. ## Section 3: information sharing requirements ### Feedback received Stakeholders raised concerns regarding the information-sharing framework, particularly in relation to the scope of information to be shared, compliance with data protection requirements, the protection of legal professional privilege, and the treatment of information exchanges involving third countries. Many stakeholders considered there would be a tension between the principle of sharing information on a strict need-to-know basis and the drafting of Article 4, which provided that information sharing shall cover at least a broad range of information categories. Stakeholders argued that this approach could lead to excessive or insufficiently targeted exchanges of information without a clear or proportionate link to the objective of preventing money laundering and terrorist financing. Several stakeholders also highlighted the need to ensure that the draft RTS are fully compatible with the requirements of the GDPR, noting that broad information-sharing obligations could create uncertainty regarding the lawful processing and exchange of personal data. In addition, stakeholders, particularly from the legal profession and other non-financial sectors, expressed concerns that the information-sharing requirements could conflict with legal professional privilege and professional secrecy obligations protected under Union and national law. Finally, stakeholders sought greater clarity regarding information exchanges involving third-country entities. In particular, some questioned whether separate provisions were necessary for information sharing to and from third countries and requested further clarification regarding the interaction of these provisions with Section 4 of the draft RTS. ### AMLA’s response AMLA carefully considered the feedback received and substantially revised the information-sharing provisions to ensure that they are targeted, proportionate, and consistent with the legal framework. To address concerns regarding the scope of information sharing, Article 4 was amended to make clear that information should be shared only where relevant and on a need-to-know basis. The list of F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 information categories was removed from the body of the draft RTS and placed in Annex I. Moreover, references to common customers and common beneficial owners were removed to avoid uncertainty regarding the scope of the information sharing obligations. AMLA also clarified of the key information-sharing minimum standards in the draft RTS and simplified the overall drafting of Article 4. Regarding data protection, AMLA emphasises that the draft RTS have been developed in full consideration of the requirements of the GDPR. The draft RTS specify that personal data may only be processed for the purposes of preventing money laundering, terrorist financing, and the non-implementation or evasion of targeted financial sanctions, and that such processing must be subject to appropriate safeguards, including those relating to data protection and fundamental rights. The information categories set out in Annex I were also reviewed to ensure that they are comprehensive, clearly defined, and compatible with applicable data protection requirements. AMLA recognises the importance of safeguarding legal professional privilege and professional secrecy within the limits established by the Level 1 framework. To address stakeholders' concerns, the draft RTS expressly refer to Article 70(2) of the AMLR, which sets out the limits on information sharing applicable to certain categories of obliged entities. With regard to third-country information sharing, AMLA simplified the framework by consolidating the relevant provisions into a single article. The revised Article 5 clarifies the scope, operation, and supervisory implications of information sharing involving third-country entities. AMLA also clarifies that the provision applies to entities located in third countries that form part of the same group or structure, even where they are not branches or subsidiaries of Union obliged entities, and that the framework in Article 5 operates without prejudice to the specific measures set out in Section 4 of the draft RTS. ## Section 4: minimum actions and additional measures for branches and subsidiaries in third countries ### Feedback received Stakeholders from both the financial and non-financial sectors emphasised that the framework should be applied in a proportionate and risk-based manner, taking into account the nature and severity of the risks, the size and complexity of the obliged entity, and existing mitigating measures. Respondents also stressed that supervisory assessments should distinguish between compliance deficiencies and situations where compliance is prevented by genuine legal restrictions in third countries, such as data protection, banking secrecy, professional secrecy, legal privilege, or other local legal requirements. Stakeholders sought clarification on the interaction between the draft RTS and existing notification frameworks, including whether previously submitted notifications and assessments could continue to be relied upon. They also requested greater clarity on the identification and assessment of legal impediments, particularly given the complexity of legal analyses and concerns regarding the 28-day notification deadline. Many respondents commented on the use of customer and beneficial owner consent, noting that it may not always be available or sufficient to overcome local legal restrictions. They considered consent should be only one of several possible mitigating measures. Stakeholders also highlighted duplication across the different scenarios covered in Section 4 and suggested a more streamlined framework. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 Finally, respondents requested greater flexibility regarding the application of additional mitigating measures and stressed that restrictions on activities, termination of relationships, and closure of operations should remain measures of last resort. ### AMLA’s response AMLA carefully considered the feedback received and revised Section 4 to improve proportionality, clarity, and operational effectiveness. The draft RTS now place greater emphasis on a risk-based and proportionate approach. The recitals clarify that additional policies, procedures, and controls should reflect the specific risks identified, while Article 9 requires supervisors to take account of the particular circumstances of each case when determining supervisory actions. AMLA also clarified that supervisors should consider the extent to which third-country legal or regulatory restrictions affect the implementation and oversight of group-wide AML/CFT controls. To improve clarity and reduce duplication, the structure of Section 4 was simplified. The draft RTS now establish a common set of minimum actions, complemented by tailored additional measures where necessary. The specific legal impediment scenarios have been removed from the draft RTS and the prescriptiveness of additional measures for each one of these have also been removed. This approach aims to ensure a consistent minimum level of AML/CFT protection while preserving flexibility to address different legal and risk environments. The notification framework was also streamlined. Multiple legal impediments may be reported through a single notification, and the draft RTS provide additional clarification regarding the identification and assessment of legal impediments. Notifications must be submitted without undue delay and no later than 28 calendar days after the impediment has been identified. With regard to consent, AMLA considered the comments made in regard to the practical limitations highlighted by stakeholders. The draft RTS retain consent-exploration as one of the minimum actions because it may help overcome legal obstacles in certain jurisdictions. However, the framework recognises that consent may not always be feasible or sufficient and therefore provides for a broader range of additional mitigating measures where appropriate. AMLA also retained a range of additional risk mitigation measures while clarifying that their application should be proportionate and risk-based. The draft RTS therefore maintain a graduated escalation framework under which the most severe measures are considered where legal impediments have been identified and the available mitigating actions are insufficient to address the resulting risks. Supervisors are expected to take account of the specific circumstances of each case, including existing risk mitigation measures, governance arrangements, and the nature and severity of the risks before resorting to more restrictive supervisory actions. Section 5: identification of the parent undertaking in the Union in cases where two or more obliged entities not in a relationship of parent and subsidiary belong to a head office in a third country Feedback received F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 Stakeholders from both the financial and non-financial sectors provided feedback on the criteria for identifying the parent undertaking in the Union in cases where two or more obliged entities not in a relationship of parent and subsidiary belong to a head office in a third country. Many respondents especially from the financial sector considered the framework for determining which obliged entity has sufficient prominence within the Union to be complex and overly prescriptive and requested a simpler and more flexible approach. In addition, some stakeholders questioned the use of annual turnover as a quantitative criterion to identify the obliged entity with sufficient prominence within the Union. Stakeholders also commented on the criteria used to assess whether an obliged entity has sufficient understanding of operations in the Union. While respondents generally supported the qualitative approach, some suggested introducing a clearer hierarchy or prioritisation of the relevant criteria to facilitate the identification of the obliged entity with sufficient understanding of operations. In addition, several respondents raised concerns regarding the supervisory notification requirements. Some considered the 28-working-day notification period to be too restrictive and sought greater flexibility, while others requested clarification on the circumstances that would trigger a reassessment or a new notification. Stakeholders from the financial sector also proposed allowing the designation of more than one parent undertaking in the Union in order to reflect complex organisational structures. ### AMLA’s response AMLA carefully considered the feedback received and revised the framework to provide greater flexibility while preserving legal certainty and the objective of ensuring effective implementation of group-wide requirements. With regard to sufficient prominence, AMLA concluded that the original criteria could be too rigid in certain circumstances and set out rules that give more discretion to obliged entities. The draft RTS therefore place the principal quantitative indicators of the legal form of the obliged entity, the number of cross-border establishments, the number of customers and transactions at the same level for the identification and kept the tie-break criteria of annual turnover, balance sheet size or number of staff as additional criteria. Furthermore, AMLA removed the provision that automatically prioritised sufficient prominence over sufficient understanding of operations. This change gives obliged entities greater discretion to identify the most appropriate obliged entity to carry out the role of parent undertaking in the Union and places greater emphasis on factors such as operational control, decision-making authority, and the capacity to ensure compliance with group-wide requirements. Regarding sufficient understanding of operations, AMLA made targeted amendments to the qualitative criteria to improve clarity while maintaining their flexibility. AMLA considers that establishing a fixed hierarchy among the qualitative criteria could limit the ability of obliged entities to identify the most suitable obliged entity to act as parent undertaking based on the specific circumstances of the group. The revised framework therefore gives enough discretion to obliged entities to identify the most appropriate obliged entity to act as parent undertaking in cases where two or more obliged entities not in a relationship of parent and subsidiary belong to a head office in a third country. F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 As regards supervisory notifications, AMLA recognises the concerns raised about the notification timeline but considers the timely identification of a parent undertaking to be essential for compliance with the AMLR. To facilitate implementation, the draft RTS provide further clarity on the trigger event of the notification and the types of material changes that would require a reassessment and a new notification. On the identification of more than one parent undertaking in the Union, AMLA concluded that such an approach would not be consistent with the AMLR and could undermine the objective of establishing a single obliged entity responsible for the implementation of group-wide requirements within the Union. AMLA made it clearer in the text that there shall only be one obliged entity acting as parent undertaking. ## Section 6: application of group-wide requirements to structures other than groups ### Feedback received Stakeholders from both the financial and non-financial sectors provided extensive feedback on the application of group-wide requirements to structures other than groups. Respondents requested greater proportionality, including the introduction of thresholds or de minimis exemptions for smaller entities, and expressed concerns that some obliged entities could be required to apply both group and structure requirements simultaneously. Clarifications were also sought on concepts such as “group-equivalent policies, procedures and controls”, the extent to which common policies, procedures and controls apply across the structure, and the role of non-obliged entities within a structure. Furthermore, stakeholders from the financial and non-financial sector requested greater legal certainty regarding the scope of the structure in the draft RTS, including whether common ownership, common management, and common compliance controls operate as alternative or cumulative criteria, whether structures based solely on shared branding or quality standards fall within scope, and how common compliance controls should be interpreted in practice. In addition, stakeholders also commented on the identification of the entity responsible for acting as “parent undertaking” within a structure. Concerns were raised regarding the absence of a clear hierarchy among the criteria, the interaction between the identification of a structure and the identification of the responsible “parent undertaking”, and the ability of coordinating obliged entities to effectively fulfil the related obligations when the “parent undertaking” of the structure is not an obliged entity. Some respondents suggested more flexibility to obliged entities to allow them to designate the responsible obliged entity as “parent undertaking” subject to supervisory approval. Finally, respondents questioned the treatment of situations where the identified “parent undertaking” is not an obliged entity, highlighting concerns regarding legal basis, governance powers, access to information, and interactions with supervisors. ### AMLA’s response AMLA carefully considered the feedback received and introduced key amendments to improve clarity, proportionality, and the practical application of the draft RTS. As a general matter, AMLA considers that introducing thresholds or de minimis exemptions would be inconsistent with the objective of extending group-wide AML/CFT requirements to structures other than groups within the scope of the AMLR. At the same time, AMLA recognises that structures may differ significantly from traditional groups and has therefore further emphasised that policies, procedures, F I N A L R E P O R T – D R A F T R T S U N D E R A R T I C L E S 1 6 ( 4 ) A N D 1 7 ( 3 ) O F R E G U L A T I O N ( E U ) 2 0 2 4 / 1 6 2 4 and controls should be tailored to the nature of the relevant structure. The draft RTS also clarify that group-wide requirements take precedence when an obliged entity is subject to both group and structure AMLA understands that common ownership, common management, and common compliance controls operate as alternative criteria, meaning that the presence of any one of them may be sufficient for a structure to fall within scope. Additional clarifications have been introduced regarding the application of these concepts. AMLA also clarified that common compliance controls should not be interpreted narrowly as referring only to AML/CFT controls. In response to comments regarding the appointment of the “parent undertaking” in the Union, AMLA understands that the term “parent undertaking” in Level 1 is the “head of a structure”. The draft RTS require obliged entities to identify such entity as the “head of the structure”. Consequently, the revised framework places greater emphasis on qualitative criteria of decision-making authority, management, and control, while leaving compliance frameworks, third-party management and common costs as secondary criteria. AMLA also recognised that some structures may not include an obliged entity as head of the structure with sufficient responsibility and powers to impose AML/CFT requirements across the structure. To address this, the draft RTS introduce a supervisory mechanism allowing flexibility and proportionality where the head of a structure lacks the necessary responsibility and powers or where legal constraints prevent the application of group-wide requirements. Under such mechanism, the application of group-wide requirements would be limited to certain minimum group-wide requirements that obliged entities would mutually comply with without requiring group-wide steering of one designated obliged entity acting as head of the structure. Finally, AMLA understands that group-wide requirements cannot be imposed directly on non-obliged entities. References that could have implied such obligations have therefore been removed from the draft RTS. In case the permission not to identify the head of the structure is granted, obliged entities within the structure shall designate a coordinating obliged entity to act as the main point of contact with the relevant supervisory authority, thereby ensuring effective supervision. [^1]: OJ L, 2024/1624, 19.6.2024. [^2]: OJ L 150, 9.6.2023, p. 1. [^3]: OJ L 119, 4.5.2016, p. 1. ## Related Level 1 articles - [Article 16 — Group-wide requirements](../articles/16.md) - [Article 17 — Branches and subsidiaries in third countries](../articles/17.md)