FantasticSearch

1. Member States shall ensure that supervisors apply a risk-based approach to supervision. To that end, Member States shall ensure that they:

(a) have a clear understanding of the risks of money laundering and terrorist financing present in their Member State;

(b) assess all relevant information on the specific domestic and international risks associated with customers, products and services of the obliged entities;

(c) base the frequency and intensity of on-site, off-site and thematic supervision on the risk profile of obliged entities, and on the risks of money laundering and terrorist financing in that Member State. For the purposes of point (c) of the first subparagraph of this paragraph, supervisors shall draw up annual supervisory programmes, which shall take into account the timing and resources needed to react promptly in the event of objective and significant indications of breaches of Regulations (EU) 2024/1624 and (EU) 2023/1113.

2. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall set out the benchmarks and a methodology for assessing and classifying the inherent and residual risk profile of obliged entities, as well as the frequency at which such risk profile shall be reviewed. Such frequency shall take into account any major events or developments in the management and operations of the obliged entity, as well as the nature and size of the business. Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.

3. By 10 July 2028, AMLA shall issue guidelines addressed to supervisors on:

(a) the characteristics of a risk-based approach to supervision;

(b) the measures to be put in place within supervisors to ensure adequate and effective supervision, including to train their staff;

(c) the steps to be taken when conducting supervision on a risk-sensitive basis. Where relevant, the guidelines referred to in the first subparagraph shall take into account the outcomes of the assessments carried out pursuant to Articles 30 and 35 of Regulation (EU) 2024/1620.

4. Member States shall ensure that supervisors take into account the degree of discretion allowed to the obliged entity, and appropriately review the risk assessments underlying this discretion, and the adequacy of its internal policies, procedures and controls.

5. Member States shall ensure that supervisors prepare a detailed annual activity report and that a summary of that report is made public. That summary shall not contain confidential information and shall include:

(a) the categories of obliged entities under the supervision and the number of obliged entities per category;

(b) a description of the powers with which the supervisors are entrusted and the tasks assigned to them and, where relevant, of mechanisms referred to in Article 37(4) in which they participate and, for the lead supervisor, a summary of the coordination activities carried out;

(c) an overview of the supervisory activities carried out.