How Your Supervisor Will Score You: AMLA's Draft RTS on Risk Profile Assessment

Until now, each national supervisor in the EU scored the ML/TF risk of its supervised entities on its own methodology. Directive (EU) 2024/1640 (“AMLD6”) replaces those national systems with a single methodology applied by every supervisor.

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (“AMLA”) was mandated to draft the Regulatory Technical Standard (Article 40(2) AMLD6) setting the benchmarks, the methodology and the review frequency, with a submission deadline of 10 July 2026. AMLA published its final report in December 2025. The Commission has not yet adopted the RTS or published it in the Official Journal, which is why we call it the “Draft RTS” here.

One scoping point: this instrument covers obliged entities in the financial sector only. A separate draft RTS under the same Article 40(2) mandate covers the non-financial sector. Fund managers, AIFMs and UCITS management companies fall under the financial-sector instrument discussed here.

The methodology does not run on supervisory judgement alone. It runs on data, collected from obliged entities in a standardised form. To test the models behind it, AMLA announced a data collection exercise in January 2026, starting that March, covering two groups: financial institutions potentially eligible for AMLA’s direct supervision, and a representative sample of entities expected to remain under national supervision. The workbook used in that exercise is the clearest indication so far of the datapoints your supervisor will ask for.

TL;DR

• One methodology replaces 27. AMLD6 ends national scoring systems. The Draft RTS sets the benchmarks, the methodology and the review frequency every EU supervisor will use.
• Fund managers are in scope. The financial-sector instrument covers AIFMs and UCITS management companies. A separate instrument covers the non-financial sector.
• The same models decide who AMLA supervises directly. AMLA will select up to 40 entities for direct supervision in 2027, starting in 2028. Everyone else stays with their national supervisor, scored on the same methodology.
• Two dates to plan around. National supervisors collect datapoints from entities eligible for direct supervision in early 2027. The Draft RTS is set to apply from 31 December 2027, after which supervisors have nine months to complete the first assessment round.
• Three scores, calculated in sequence. Inherent risk and controls quality are assessed separately on their own datapoints. Residual risk is derived from the two, and residual risk is what your supervisor acts on.
• The score is built from investor data you already hold. PEP status, beneficial owners, risk classification, geography, review dates. Whether you can produce them on request is a readiness question you can answer now.
• You do not calculate your own score. Supervisors apply the methodology. What you control is what the indicators measure: how you onboard, review, monitor and document.
• Annual review is the default. A low residual risk classification opens a three-year cycle.

Who Does What

• Supervisors apply the RTS. They collect the data from each obliged entity, calculate the inherent risk, controls quality and residual risk scores, classify and decide how often to review it.
• You, as obliged entity, provide data when your supervisor asks. The RTS doesn’t set how or in what format, and supervisors may also use other sources.
• You don’t calculate or self-assess your score. AMLA sets the weights and thresholds each cycle, and the assessment doesn’t rely on self-assessments.
• What you do control is what the indicators measure: how you onboard, review, monitor and document. That’s where preparation counts.

Why This Matters Even Before Your Supervisor Asks

A high ML/TF score means more frequent and more intensive supervision. Where that supervision finds breaches of AML law, pecuniary sanctions and administrative measures follow. Understanding the methodology is the cheapest way to prevent that outcome. It sets out, indicator by indicator, which figures you will be asked for and what the EU legislator treats as a functioning AML framework.

There is a second reason, and it is the one most commentary has missed. In April 2026 AMLA opened its consultation on draft guidelines on the business-wide risk assessment (“BWRA”) under Article 10(4) AMLR. Paragraph 23 of those draft guidelines instructs obliged entities, when identifying their inherent risks, to refer at minimum to the datapoints listed in the RTS under Article 40(2) AMLD6.

The two instruments have different purposes. The BWRA is your self-assessment; Article 40(2) AMLD6 is the supervisory assessment. But the dataset is shared.

According to the Annex of the Draft RTS, asset management companies (“AMCs”) are assessed on up to 100 data points. The limit applies to this exercise alone and leaves a supervisor’s right to request data for on-site and off-site supervision untouched.

The Three Scores Behind Your Risk Profile as Obliged Entity

First Input: Inherent Risk

Inherent risk means the risk of money laundering and terrorist financing to which a credit institution or financial institution is exposed, because of the products, services and type of transactions it offers, the customers it serves, the jurisdictions in which it operates and the distribution channels it uses to serve its customers, before any mitigating measures have been applied by that credit institution or financial institution (Art. 1(1)(a) Draft RTS).

Put simply, this is your exposure as it would stand if you had no AML controls at all. What moves it is the shape of the business: who you accept as investors, where they are based, and what you manage for them. The indicators fall into four categories and read as a structured description of the firm.

Customers: Totals split into natural persons and legal entities by country, PEPs among them and their beneficial owners, complex corporate structures, investors engaged in high-risk activities, and those who have been the subject of an FIU request.

Products and services: Retail and professional investor counts, reported separately for UCITS and AIF management, the number of open-ended and closed-ended funds, total assets under management, and assets under management in unlisted assets.

Geographies: Investors by country, assets under management by country, the value of the funds themselves by country, plus branches, subsidiaries and the location of the parent company.

Distribution channels: The indicators count investors onboarded remotely and through third parties, but none of them applies to AMCs. The category is closed for scoring purposes, which does not stop a supervisor asking the question in the course of ordinary supervision.

Note the asymmetry in that last point. Remote and third-party onboarding does not score on the inherent risk side, but outsourcing customer due diligence to a fund administrator is captured on the controls side. A manager who treats investor KYC as the administrator’s problem is still the entity being scored.

Example: a mid-sized private equity manager. Take an AIFM headquartered in Germany managing three closed-ended buyout funds. It reports one set of figures covering all three. Illustratively, and not exhaustively, the inherent risk datapoints could look like this.

Second Input: Control Quality

Supervisors shall assess and classify the quality of the AML/CFT controls put in place by each credit institution or financial institution under their supervision […] (Art. 3(1) Draft RTS).

Controls quality is the second input, scored independently on its own indicators. It assesses whether your governance, procedures, systems and controls actually work, and it is the score your compliance function builds.

Governance, culture and compliance function: Supervisors record the date your AML/CFT procedures were last checked as compliant with applicable law, how many full-time dedicated compliance staff you employ, and what share of each staff group received AML training last year. The groups are broken out: compliance and non-compliance staff, agents and distributors, board members and non-executive directors.

Internal controls and outsourcing: How frequently your AML compliance officer reports to the management body. Which tasks are outsourced, named individually: Customer Due Diligence, training, transaction monitoring, suspicious transaction reports, sanctions screening, PEP detection, compliance monitoring, and whether any of it has been outsourced to a third-country provider. And the dates specific control areas were last audited internally or externally.

Risk assessment: The last approval date of your BWRA, whether senior management approved that version, when your customer risk methodology was last updated, and how your customers distribute across the risk categories.

Customer due diligence and monitoring: Legal entities and trusts whose beneficial owners have not been identified, and separately, those whose beneficial owners have been identified but not verified. Customers with no identification or verification documentation, customers whose CDD data does not yet meet the requirements of Article 20 AMLR, and customers with no risk profile assigned. Finally, customers whose periodic update fell due last year under your own policies, and customers whose information was actually reviewed and updated.

Transaction monitoring and suspicious activity reporting: Whether a transaction monitoring system exists at all, and whether it is automated. Manual systems report average number of days to analyse a transaction. Automated systems report whether the system flags inconsistencies against the customer’s CDD profile, plus alerts left unanalysed at year end, average days to close an alert, and the alert-to-STR ratio. Two indicators apply either way: the average days from identifying a suspicion to reporting it, and the total number of STRs filed.

Targeted financial sanctions: The maximum time between publication of a listing and its implementation in your screening tools. The rest covers outbound transfers under the Fund Transfers Regulation and applies to other sectors.

Group-wide framework: Only relevant where the manager is part of a group, and answered by the parent undertaking alone: the share of group entities that reported to group AML compliance last year, broken down by CDD, ongoing monitoring, STRs, high-risk customer data and deficiencies. The share of jurisdictions covered by group compliance reviews over three years and the number of group entities where supervisors identified deficiencies, split EU/EEA and outside.

Across both inputs, the RTS leaves the source of the data open. Supervisors may take it from you, from an external auditor, from the FIU or from a prudential supervisor.

Same manager, controls side:

The Output: Residual Risk

Residual risk means the risk of money laundering and terrorist financing to which a credit institution or financial institution remains exposed, after it has put in place policies, procedures, systems and controls to mitigate inherent risk (Art. 1(1)(b) Draft RTS).

Residual risk is calculated from the inherent risk and controls quality score, and it is the number your supervisor acts on. All three run on the same 1 to 4 scale, with controls quality inverted: a score of 1 means very good controls, a score of 4 means poor ones.

The calculation is mechanical.

• Where controls are worse than inherent risk, residual risk equals inherent risk, with no mitigation credit at all.
• Where controls are equal to or better, residual risk is the plain arithmetic average of:
  • inherent risk score, and
  • controls quality score.

Example: A fund manager with high inherent risk at 3.50 and very good controls at 1.00 still lands at 2.25, medium residual risk. Excellent controls mitigate the exposure, but they do not turn a high-risk business into a low-risk one. In the other direction, poor controls above 3.50 have no mitigating effect at all: inherent and residual risk both stay at 3.50.

Two further mechanics: worse-scoring categories on both the inherent risk and control quality are weighted more heavily, so a single weak control area does not get averaged away. And supervisors can adjust either input score where the calculated figure does not reflect reality, provided the adjustment is justified and recorded.

How AMLA tested the model: the 2026 data collection exercise

In March 2026 AMLA launched a data collection exercise to test and calibrate its risk assessment models. It serves two purposes:

1. informing the 2027 selection of up to 40 entities for direct AMLA supervision, and
2. making sure supervisors assess the risk of credit and financial institutions consistently.

About 5,000 institutions took part, drawn from a targeted sample and a 5% random sample per category and authority. Participation was mandatory for sampled entities, which reported through an Excel workbook to their national supervisor. The supervisor checked the files and forwarded them to AMLA.

AMLA published the workbook, a webinar and an interpretative note that turns the draft RTS datapoints into definitions and counting rules. This is the first concrete view of how the datapoints will be requested: https://www.amla.europa.eu/amla-launches-data-collection-exercise-test-risk-assessment-models_en.

AMLA describes the exercise as methodological rather than supervisory. Participants received no risk rating, only a data-quality status, though national supervisors could still ask for clarifications or resubmission. That framing is accurate, but it is worth reading alongside what the models are for: the exercise did not score anyone, and the methodology it calibrates will.

Run your own readiness dry run

You can’t submit anything to AMLA, and this won’t produce a risk score. It tests whether you can produce the data.

1. Fix your reporting entity. In the case of a private equity fund manager, the unit is the asset management company, aggregated across all funds it manages (AMLA interpretative note).

2. Set the period. Use the last closed calendar year. AMLA used 2025. Stock datapoints use the year-end position, flows use the full year, and year-end ECB rates apply to stocks.

3. Basic information (AML.01.01). Select “Asset management companies” and the flags for managing AIFs and/or UCITS. Add other flags only for activities you really perform. The flags decide which pages apply.

4. Work through the datapoints. Customers (AML.02.01), funds managed (AML.04.11), geographies (AML.05.01) and controls (Section B) follow the categories described above. Three counting rules are easy to get wrong:

• New subscriptions by existing investors are not “new customers”.
• “Non-EEA” includes non-EEA SEPA countries.
• “Active customers” looks customer-initiated. Decide how capital calls and distributions count, and document your assumption in the Comments template.

5. Validate. Errors block, warnings need review, and “0” means zero while blank means not applicable or unavailable. Every unavailable datapoint needs an “Unable to report:” comment. That list is your readiness gap list.

6. Rate each datapoint. Rate it as automatic, manual or missing, with a source system and owner. Reconcile totals, for example that natural persons plus legal entities equal total customers.

The Supervision Cycle

As a rule, supervisors assess every entity once a year, with the assessment completed by 30 September. For the first round they have nine months from the date the RTS starts to apply, which the draft sets at 31 December 2027.

The draft RTS allows a longer cycle of three years in the following cases:

• The entity has five or fewer full-time employees in the Member State concerned.
• The entity is a branch that an AIFM or UCITS management company has set up in another Member State.
• The entity was classified as low residual risk (< 1.75) in its last assessment.

The cycle also breaks. Where a major event or development occurs, the supervisor must reassess within four months of learning about it. Major events or developments could be significant changes to the business model or the supervisor identifying significant weaknesses in your AML/CFT procedures, systems or controls. A controls failure therefore does two things at once: it worsens the score and it pulls forward the next assessment.

Talk to Us

When supervisors assess your controls, much of the evidence comes from what you have recorded about your investors: who is a PEP, which risk category each investor falls into, and when each was last reviewed. Producing those figures is straightforward if the information was captured in a structured way, and slow if it was not.

In Vestlane, the subscription itself is where that data is collected. The AML questionnaire, beneficial owners, PEP status, business profile and source of wealth are all recorded digitally as part of the investor’s subscription and stay retrievable afterwards. Risk classification and the level of due diligence are set by the reviewer, supported by automated country, sector and name screening checks, and each review is documented.

If your readiness gap list has more manual entries than you would like, get in touch and we will go through which of those datapoints Vestlane captures at source.