AML: EBA Publishes Draft RTS for New EU Framework

The European Union’s AML/CFT regime has entered its implementation phase. Following the adoption of the EU’s Anti-Money Laundering Regulation (AMLR (EU) 2024/1624), the 6th AML Directive (AMLD6 – Directive (EU) 2024/1640) and the establishment of the European Anti-Money Laundering Authority (AMLA), the European Banking Authority (EBA) has now delivered the first detailed Regulatory Technical Standards (RTS) that will make the new framework operational.

These RTS form the technical backbone of the Single AML Rulebook, standardising how financial institutions and other obliged entities assess risk, perform customer due diligence (CDD), implement internal controls, apply sanctions and interact with supervisors. While EBA refers to five headline RTS, the package actually contains seven detailed draft RTS, each corresponding to specific articles under AMLR or AMLD6.

Why it matters: This distinction ensures that obligations are both risk-based in principle and operationally detailed, providing clear guidance to institutions while still allowing flexibility in certain areas, like CDD, where a principle-based drafting style preserves operational choice.

Current Situation: EBA Submits First RTS Package

On 31 October 2025, the EBA submitted to the European Commission a comprehensive package of five draft RTS for adoption under the AMLR and AMLD6. The RTS together define how institutions must assess risk, perform due diligence, design internal controls, comply with restrictive measures and how supervisors, including AMLA, must exercise oversight.

Detailed Overview of the Draft RTS

1. Draft RTS on the Assessment of the Inherent and Residual Risk Profile of Obliged Entities (Article 40(2) AMLD6)

Article 40 of AMLD6 requires supervisory authorities to apply a risk-based approach to AML/CFT supervision, considering both the broader Member State risk and the specific risks of individual institutions.
To enable a consistent approach, the EBA proposes a three-step methodology for supervisors:

1. Assessing each obliged entity’s inherent ML/TF risk based on factors such as customer types, products, services and geographical exposure.

2. Evaluating the quality of AML/CFT controls implemented to mitigate these risks, covering governance, risk assessment, policies, procedures and group oversight.

3. Determining the residual ML/TF risk, combining inherent risk and control quality into a single risk profile.

The RTS introduces a numerical scoring system (1–4) to quantify inherent and residual risk, enabling supervisors to classify entities consistently. The system relies on weighted indicators (defined in Annex I, Sections A and B of the RTS) allowing supervisors to incorporate both quantitative data and qualitative judgment.

Under Article 5, supervisors must review each entity’s risk profile annually, or every three years for low-impact sectors such as small intermediaries, unless triggered by major events. This standardised approach is expected to bring objectivity and comparability to AML supervision across the EU.

2. Draft RTS on Risk Assessment for Selecting Entities for Direct Supervision by AMLA (Article 12(7) AMLR)

Under Articles 12 and 13 of the AMLR, AMLA will assume direct supervisory authority over approximately 40 obliged entities identified as posing the highest residual ML/TF risk. The EBA’s draft RTS sets the criteria for this selection.

An entity is considered eligible if it operates materially in at least six Member States and its residual risk profile (as determined using the methodology in the RTS under Article 40) is classified as high.
Material activity in another Member State exists when the entity has more than 20,000 customers resident there or EUR 50 million in incoming/outgoing transactions linked to that jurisdiction.

The RTS defines how entity-level residual risk scores are aggregated group-wide through weighted averaging, resulting in a final classification of low, medium, substantial or high. This ensures AMLA focuses its direct supervision on cross-border entities with genuine operational presence and systemic relevance in the EU financial landscape.

3. Draft RTS on Customer Due Diligence (Article 28(1) AMLR)

The draft RTS on Customer Due Diligence (CDD) specify which information must be collected and verified for standard, simplified and enhanced due diligence,and which sources may be used for verification. The RTS take a principle-based approach, listing information types and verification sources rather than prescribing exact document forms, allowing flexibility while ensuring minimum data quality.

Identification & Verification (ID&V)

Obliged entities must obtain key identification data such as names, addresses, date and place of birth and nationalities. Verification should normally rely on original identity documents in face-to-face settings. For non-face-to-face onboarding, Article 6 allows the use of electronic identification means compliant with eIDAS Regulation (substantial or high assurance levels). Where eIDAS verification is not feasible, remote verification tools may be used if stringent safeguards are met, such as encrypted video communication, integrity checks, timestamping and secure retention of all records.

Beneficial Ownership and Senior Managing Officials

The RTS reinforce transparency on ownership structures. Entities must map all intermediary entities or arrangements between the customer and beneficial owner, collecting information on legal form, jurisdiction, nominee shareholders, ownership percentage and voting rights. Where a beneficial owner cannot be identified, information on senior managing officials must be collected and verified using equivalent rigor.

Purpose and Nature of the Business Relationship

Institutions must gather information on the purpose and economic rationale of each relationship, including expected transaction volumes, sources of funds and intended use of products. For low-risk customers, simplified due diligence may be applied, provided minimum information on product use, source of funds and transaction expectations is still obtained.

Simplified and Enhanced Due Diligence

The RTS outline minimum CDD elements under simplified measures (SDD) and additional information requirements under enhanced due diligence (EDD). Under EDD, obliged entities must collect deeper information on source of wealth, transactional purpose and the reputational and business background of customers and beneficial owners. EDD also mandates ongoing sanctions screening (Article 29 RTS) using automated tools or manual checks, integrated into the CDD lifecycle.

EBA acknowledges that applying the new standards to all existing customers by 10 July 2027 (the AMLR application date) is a major challenge. Accordingly, it proposes a risk-based five-year transition period for updating non-high-risk relationships, prioritising high-risk customers first.

4. Draft RTS on Internal Policies, Controls and Procedures (Article 19 AMLR)

This RTS defines how obliged entities must design and maintain robust internal AML/CFT frameworks. It covers governance arrangements, compliance functions, employee training, independent audits and record-keeping. It also specifies expectations for integrating transaction monitoring and suspicious activity reporting into the broader AML control architecture. Senior management accountability is a recurring theme: boards must formally approve AML frameworks and ensure clear allocation of responsibilities. Together, these provisions set the minimum governance standard for institutions under the AMLR.

5. Draft RTS on Supervisory Methodology and Cooperation (Article 38 AMLD6)

This RTS establishes how national competent authorities and AMLA will coordinate supervisory efforts, conduct risk-based inspections, and exchange information.
It introduces harmonised templates and cooperation mechanisms to support consistent supervision across Member States.
The RTS also operationalises AMLA’s oversight of NCAs, ensuring that supervision quality converges across the EU.

6. Draft RTS on Restrictive Measures Implementation (Article 51 AMLR)

This RTS clarifies how obliged entities must implement EU restrictive measures and financial sanctions within their AML frameworks. It prescribes rules for sanctions screening, escalation procedures, governance accountability and the maintenance of reliable screening data. Entities must ensure their systems can identify sanctioned persons in real time, with defined escalation and decision paths. The RTS bridges sanctions compliance and broader AML monitoring, closing a long-standing operational gap between the two regimes.

7. Draft RTS on Sanctions and Administrative Measures (Article 53(10) AMLD6)

The final RTS harmonises how AML/CFT supervisors determine and apply pecuniary sanctions, administrative measures and periodic penalty payments. It introduces a catalogue of indicators to classify the severity of breaches, including duration, frequency, intent and cooperation level. It also provides a methodology for setting fine amounts proportionate to the gravity and duration of the breach, as well as guidance on applying remedial or corrective measures. By defining these criteria, the RTS aims to ensure consistent enforcement practices and level the playing field for institutions across all Member States.

Next Steps

The European Commission will review the EBA’s RTS package and, following stakeholder consultation, adopt it as Delegated Acts under the AML Regulation. Once approved, the RTS will be directly applicable across all EU Member States, replacing divergent national rules. Final publication is expected in 2026, aligning with the broader application of the AMLR in mid-2027.

Further RTS packages are anticipated, covering beneficial ownership transparency, data exchange protocols and AMLA’s operational procedures.

Risk-Based vs. Principle-Based: A Key Clarification

All RTS are fundamentally risk-based as they aim to ensure that resources, processes, and supervisory intensity are proportionate to the ML/TF risk of the entity, its customers, products and jurisdictions.

• Risk-based: Applies to all RTS in terms of supervisory assessment, entity classification and compliance priorities. Supervisors and obliged entities must assess inherent and residual risks and adapt oversight accordingly.

• Principle-based drafting: Applies notably to the CDD RTS (Article 28 AMLR). It defines what must be achieved but leaves institutions flexibility in how to implement these processes, including the use of technological solutions or non-standard verification methods.

cleversoft Compliance Commitment

The new EU AML framework introduces extensive obligations around risk-based supervision, enhanced CDD, internal governance and sanctions compliance. In the coming months, cleversoft will explore product enhancements while keeping clients informed of ongoing regulatory developments. Once the RTS are formally confirmed and published by the European Commission, we will communicate our product updates and enhancements aligned with the final RTS, ensuring clients are fully prepared ahead of the July 2027 application date.

Sources:

The EBA advises the European Commission on the foundations of the new anti-money laundering/countering the financing of terrorism regime | European Banking Authority

Regulation – EU – 2024/1624 – EN – EUR-Lex

Directive – EU – 2024/1640 – EN – EUR-Lex