FantasticSearch

1. For the purposes of carrying out the tasks listed in Article 5(2), the Authority, in collaboration with financial supervisors, shall carry out a periodic assessment of credit institutions and financial institutions, and groups of credit institutions and financial institutions, where they operate, whether through establishments or under the freedom to provide services, in at least six Member States, including the home Member State, regardless of whether the activities are carried out through infrastructure on the territory concerned or remotely.

2. The supervisory authorities, and the obliged entities subject to periodic assessment, shall supply the Authority with any information necessary to carry out the periodic assessment referred to in paragraph 1.

3. The inherent and residual risk profiles of an obliged entity assessed pursuant to paragraph 1 shall be classified by the Authority as low, medium, substantial or high, based on the benchmarks and following the methodology set out in the regulatory technical standards referred to in paragraph 7. Where the assessed obliged entity is part of a group of credit institutions or financial institutions, the risk profile shall be classified at group-wide level.

4. The methodology for classifying inherent and residual risk profiles shall be established separately for at least the following categories of obliged entities:

(a) credit institutions;

(b) bureaux de change;

(c) collective investment undertakings;

(d) credit providers other than credit institutions;

(e) e-money institutions;

(f) investment firms;

(g) payment institutions;

(h) life insurance undertakings;

(i) life insurance intermediaries;

(j) crypto-asset service providers;

(k) other financial institutions.

5. For each category of obliged entities referred to in paragraph 4, the benchmarks for the assessment of inherent risk in the assessment methodology shall be based on the risk factor categories related to customers, products, services, transactions, delivery channels and geographical areas. The benchmarks shall be established for at least the following indicators of inherent risk in any Member State in which the obliged entities operate:

(a) with respect to customer-related risk: the share of non-resident customers from third countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624 and the presence and share of customers identified as politically exposed persons;

(b) with respect to products and services offered:

(i) the significance and the trading volume of products and services identified as the most vulnerable to ML/TF risks either at the level of the internal market, in the risk assessment at Union level, or at the level of the country, in the national risk assessment;

(ii) for money remittance service providers, the significance of the aggregate annual emission and reception activities of each remitter in the countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624;

(iii) the relative volume of products, services and transactions that offer a considerable level of protection of clients’ privacy and identity or other form of anonymity;

(c) with respect to geographical areas:

(i) the annual volume of correspondent banking services and correspondent crypto-asset services, provided by Union financial sector entities in third countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624;

(ii) the number and share of correspondent banking clients and crypto-asset clients in third countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624.

6. For each category of obliged entity referred to in paragraph 4, the assessment of residual risk in the assessment methodology shall include benchmarks for the assessment of the quality of internal policies, controls and procedures put in place by obliged entities to mitigate their inherent risk.

7. The Authority shall develop draft regulatory technical standards specifying:

(a) the minimum activities to be carried out by a credit institution or a financial institution under the freedom to provide services, whether through infrastructure or remotely, for it to be considered as operating in a Member State other than that where it is established;

(b) the methodology based on the benchmarks referred to in paragraphs 5 and 6 for classifying the inherent and residual risk profiles of credit institutions or financial institutions, or groups of credit institutions or financial institutions, as low, medium, substantial or high. The Authority shall submit those draft regulatory technical standards to the Commission by 1 January 2026. The Commission is empowered to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Article 49 of this Regulation.

8. The Authority shall review the benchmarks and methodology at least every three years. Where amendments are required, the Authority shall submit amended draft regulatory technical standards to the Commission.