Article 12
Assessment of obliged entities for the purposes of selection for direct supervision
1.

For the purposes of carrying out the tasks listed in Article 5(2), the Authority shall
carry out a periodic assessment of the following obliged entities, based on criteria and
following the process specified in paragraphs 2 3 to 6 7 of this Article and in Article
13, on credit institutions, financial institutions, groups of credit and financial
institutions and crypto asset service providers referred to in paragraph 4 where they
actively provide services either via establishments referred to in article 2 (8) of
[AMLD], free provision of services or via a network of representative agents in at least
7 Member states, including the Member State of establishment. The Authority shall
develop draft regulatory technical standards setting out criteria under which an obliged
entity would be considered to actively provide services for the purposes of the periodic
risk assessment.

(b)

other financial institutions that operate in at least ten Member States, including the
Member State of establishment, another Member State where they are operating via a
subsidiary or a branch, and all other Member States where they are operating by means
of direct provision of services or via a network of representative agents

2.

Where in a Member state no obliged entity meets the criteria referred to in the first
subparagraph, the periodic assessment shall be carried out based on the same criteria
and following the same process on all credit institutions, other financial institutions
and crypto asset service providers referred to in paragraph 4 which are established in
this Member state

3.

The risk profile of the assessed obliged entities referred to in paragraph 1, point (a) or
(b) shall be classified as low, medium, substantial or high in each jurisdiction they
operate in, based on the benchmarks and following the methodology set out in the
regulatory technical standard referred to in paragraph 5.

4.

The methodology for classifying the inherent risk profile shall be established
separately for at least the following categories of obliged entities that are legal persons:
(a)

credit institutions;

(b)

bureaux de change;

(c)

management company of undertaking for collective investment in transferable
securities and fund manager of alternative investment funds;

(d)

credit providers other than credit institutions;

(e)

e-money institutions;

(f)

investment firms;

(g)

payments service providers;

(h)

life insurance undertakings;

(i)

life insurance intermediaries;

(j)

other financial institutions;

(k)
5.

crypto asset service providers.

For each category of obliged entities referred to in paragraph 1, the benchmarks in the
assessment methodology shall be based on the risk factor categories related to
customer, products, services, transactions, delivery channels, and geographical areas.
The benchmarks shall be established for at least the following indicators of inherent
risk in any Member State they operate in:
(a)

with respect to customer-related risk: the share of non-resident customers, the
presence and share of customers identified as Politically Exposed persons
(‘PEPs’);

(b)

with respect to products and services offered:
(i)

the significance and the trading volume of products and services identified
as the most potentially vulnerable to money laundering and terrorist
financing risks at the level of the internal market in the supra-national risk
assessment or at the level of the country in the national risk assessment;

(ii)

the volume of the deposit and payment account services;

(iii) for money remittance service providers, the significance of aggregate
annual emission and reception activity of each remitter in a jurisdiction;
(c)

with respect to geographical areas:
(i)

the annual volume of correspondent banking services provided by Union
financial sector entities in third countries;

(ii)

the number and share of correspondent banking clients from third countries
with structural weaknesses in their AML systems identified by global
standard setting bodies;

(iii) the volume of activity of crypto assets service providers registered or
licensed in third countries and operating as financial institutions in the
Union;
The Authority shall also establish benchmarks to assess the residual risk.
6.

The Authority shall develop draft regulatory technical standards setting out the
methodology with the benchmarks referred to in paragraph 5 for classifying the risk
profile of any assessed credit institution, or financial institution or crypto asset service
providers at group level or, in case the entity does not belong to a group, at entity
level,in each Member State it operates in as low, medium, substantial or high. The
regulatory technical standards shall contain quantifiable characteristics that enable the
methodology to be applied effectively.
The Authority shall submit the draft regulatory technical standards to the Commission
by [1 January 2025].
The Commission is empowered to adopt the regulatory technical standards referred to
in the first subparagraph in accordance with Article 38 of this Regulation.

7.

The Authority shall review the benchmarks and methodology at least every three years,
also with a view to the resources required to apply the methodology by the Authority
and national supervisors and to keep these resources on an adequate level. Where

amendments are required, the Authority shall submit amended draft regulatory
technical standards to the Commission.
Article 13
The process of listing selected obliged entities
1.

The following obliged entities assessed pursuant to article 12 that have a high risk
profile shall qualify as a selected obliged entity.

2.

In any case, the Authority shall carry out the tasks listed in Article 5(2) in respect
of at least one obliged entity in each Member States. To that end, where in a
Member states no obliged entity has been selected pursuant to paragraph 1, the
obliged entity with the highest risk profile assessed pursuant to article 12 (2) shall
qualify as a selected obliged entity.
(a)

each credit institution assessed pursuant to Article 12 that has a high inherent
risk profile in at least four Member States and that has been under supervisory
or other public investigation for material breaches of the acts referred to in
Article 1(2) in at least one of those Member States in the previous three years;

(b)

each financial institution assessed pursuant to Article 12 that has a high inherent
risk in at least one Member States where it is established or operates via a
subsidiary or a branch, and at least five other Member States where it operates
via direct provision of services or via a network of representative agents.

2.3.

The Authority shall commence the first selection process on 1 July 2025 and shall
conclude the selection within one month. The selection shall be made every three years
after the date of commencement of the first selection, and shall be concluded within
one month in each selection period. The list of the selected obliged entities shall be
published by the Authority without undue delay upon completion of selection process.
The Authority shall commence the direct supervision of the selected obliged entities
five months after publication of the list.

4.

In case more than 40 obliged entities would be selected pursuant to paragraph 1, the
Authority shall carry out the tasks listed in article 5(2) in respect of the 40 obliged
entities with the highest total asset value.
As of the second selection process, the Authority shall ensure it carries out those tasks
on at least one obliged entity in each Member States, if necessary pursuant to paragraph
2. In case several obliged entities would be selected pursuant to paragraph 2, the
Authority shall carry out the tasks listed in article 5(2) in respect of the obliged entities
with the highest total asset value.
As of the third selection process, the scope of selected obliged entities may be
increased up to 10 % for each selection process. To that end the Commission shall
provide an impact assessment taking into account the budgetary impacts of this
increase.

3.5

A selected obliged entity shall remain subject to direct supervision by the Authority
until the Authority commences the direct supervision of selected obliged entities based
on a list established for the subsequent selection round which no longer includes that
obliged entity.