AMLA risk-assessment reporting and EBA Reporting Framework 4.4

A guide to preparing for AMLA risk-assessment reporting under EBA Reporting Framework 4.4.

Regnology header banner

The EU Anti-Money Laundering Authority (AMLA) is set to begin directly supervising up to 40 financial institutions with the highest residual ML/TF risk from 2028. To prepare for this shift, the European Banking Authority (EBA) first released a DPM 4.3.1 technical package so institutions could map and test their data. On 12 October 2026, the EBA published the final technical package for Reporting Framework 4.4 Phase 1, which includes AMLA eligibility templates and a revised version of the risk-assessment templates for the 2027 data collection. This provides a harmonized path for the first AMLA risk-assessment data collection in 2027 under the EU single rulebook AML package.

For financial institutions, this is a critical readiness exercise. The first AMLA reporting reference date remains 31 December 2026. Institutions should prepare against the templates published in Reporting Framework 4.4 Phase 1 for the 2027 data collection.

What is AMLA risk-assessment data collection, and why now?

Until now, large, cross-border institutions navigated a complex web of fragmented national requirements for AML/CFT risk reporting, making it difficult to create a consistent, EU-wide view of systemic risk.

With AMLA stepping in to provide direct supervision, a common standard is essential. The new data collection exercise is the mechanism to gather this standardized data. The collaboration between the EBA and AMLA on the technical package, codified in the EBA AMLA Service Level Agreement, ensures that both supervisors and institutions work from the same playbook. It harmonizes the AMLA direct supervision selection methodology, templates, and data definitions via the EBA taxonomy 4.3 AMLA to conduct a calibrated EU-wide risk assessment, enabling a fair and consistent selection of institutions for direct supervision.

For financial institutions, this is a critical readiness exercise. The first AMLA reporting reference date remains 31 December 2026. Institutions should prepare against the templates published in Reporting Framework 4.4 Phase 1 for the 2027 data collection.

AMLA risk-assessment reporting and EBA Reporting Framework 4.4

Who is in scope for AMLA supervision?

An institution is considered part of the initial eligibility pool for AMLA direct supervision if it is a credit or financial institution (or group) that is:

  • Active in at least six EU Member States, including its home country.
  • This presence can be through physical establishments or by providing services on a material cross-border basis (the "freedom-to-provide-services" or FPS).
  • Material FPS is defined per host country as having over 20,000 resident customers or more than €50 million in annual incoming and outgoing transactions in the relevant host Member State.

From this pool, AMLA will ultimately select up to 40 high-risk financial institutions with the highest residual ML/TF risk for direct supervision beginning in 2028. Crucially, the operational trigger is a direct notification from a National Competent Authority (NCA) confirming that an institution is required to report for a specific collection exercise. By 2030, the "one-per-country" AMLA rule will also ensure that at least one institution from every EU state falls under this direct oversight.

Who is impacted by the framework?

Beyond the institutions that meet the technical scope, this preparatory regime impacts the broader financial ecosystem. The key groups who need to pay close attention are:

  • Large, cross-border banking and payment groups that are potentially in the eligibility pool and need to assess their readiness.
  • Compliance and regulatory reporting functions within these institutions, as they are responsible for bridging the gap between operational AML systems and the new regulatory data hubs.
  • National Competent Authorities (NCAs) who are tasked with coordinating the notification process and national sampling for calibration exercises.
  • Any financial entity explicitly included by an NCA for a given risk-assessment collection, even if it falls below the six-country threshold.

The required data spanning KYC platforms, transaction monitoring systems, and compliance dashboards often resides in disconnected silos. Integrating these sources into a coherent AMLA data reporting package is a major data architecture challenge.

AMLA risk-assessment reporting and EBA Reporting Framework 4.4

Understanding the changes and challenges

The EBA AMLA templates, first published under DPM 4.3.1 and revised in Reporting Framework 4.4 Phase 1, cover 31 reporting worksheets including customer types, products, services, geographies, internal controls, and governance. However, not all worksheets apply to every institution: product and service flags determine which reporting blocks must be completed.

While comprehensive, it presents several challenges for institutions:

  • Fragmented data sources

    The required data spanning KYC platforms, transaction monitoring systems, and compliance dashboards often resides in disconnected silos. Integrating these sources into a coherent AMLA data reporting package is a major data architecture challenge.

  • Conditional reporting logic

    The applicability of many templates is driven by product and service flags. Incorrectly setting these flags can lead to significant over- or under-reporting, requiring close collaboration between business and IT teams.

  • Complex template structures

    The framework includes "open-row" templates for reporting on geographies and distribution channels, which require a more dynamic reporting capability than traditional fixed-row formats.

  • A two-speed process

    Institutions that began preparation on Reporting Framework 4.3.1 should now align to Reporting Framework 4.4 Phase 1 for the 2027 data collection. A flexible architecture remains important as the EBA may issue a targeted hotfix in January 2027 if early implementation issues arise.

Key dates and milestones

Navigating the transition to AMLA supervision and data collection requires a clear understanding of the timeline. Institutions that may be in scope should complete gap analysis and data remediation against the Reporting Framework 4.4 Phase 1 AMLA templates ahead of the 31 December 2026 reference date.

  • 12 October 2026

    EBA released the final technical package for Reporting Framework 4.4 Phase 1, including AMLA eligibility templates and the revised risk-assessment templates for 2027 submissions.

  • 31 December 2026

    First AMLA reporting reference date. Institutions that may be in scope should be able to map and test the relevant data by this date against the Reporting Framework 4.4 Phase 1 templates.

  • Throughout 2027

    First AMLA risk-assessment data collection, using the revised Reporting Framework 4.4 templates. National Competent Authorities notify the institutions required to report for each collection.

  • From 2028

    AMLA begins direct supervision of the selected high-risk institutions.

Regnology solutions for AMLA risk-assessment readiness

The shift to EU-level AMLA risk assessment rewards institutions that industrialize AML data before selection pressure intensifies. Regnology Reporting Hub (RRH)  reduces manual reconciliation across 31 worksheets, conditional product blocks, and open-row geographies. With RRH, your team can:

  • Master the new framework with out-of-the-box support for the EBA AMLA risk-assessment templates under DPM 4.3.1.
  • Enable flexible data capture, validation of fixed and row-dynamic templates, and compliant XBRL submission.
  • Build with confidence on a platform that separates preparation (4.3.1) from submission (4.4), ensuring a smooth transition without costly rebuilds.
  • Stay ahead of regulatory changes with integrated intelligence that tracks all DPM and validation rule updates from the EBA and AMLA.

Use our preparation checklist to guide your institution’s readiness efforts for the December 2026 reference date.

AMLA Reporting Checklist

  • Confirm your obligation: Verify your institution's participation status for the data collection exercise with your National Competent Authority (NCA).
  • Assign data ownership: Designate clear business ownership for the accuracy of product and service flags, as these drive the scope of your report.
  • Map your data sources: Systematically map all required data points from your disparate AML, KYC, and transaction systems to the new EBA templates.
  • Handle dynamic templates: Ensure your reporting solution can manage the "open-row" templates required for geographic and distribution channel data.
  • Validate in a Sandbox: Test and validate your reporting outputs against the EBA 4.3.1 XBRL taxonomies in a non-production environment to ensure accuracy before the DPM 4.4 framework is released.

Related resources

  • IReF timeline is here: From roadmap to implementation reality

    Insight

    IReF timeline is here: From roadmap to implementation reality

    The ECB’s IReF timeline is officially here, moving the industry from roadmap to implementation reality.

    Read more
  • The next era of Regulatory Risk and Reporting powered by Agentic AI

    Insight

    The next era of Regulatory Risk and Reporting powered by Agentic AI

    The future of regulatory risk and reporting isn’t just automation: it’s intelligent orchestration. In our new whitepaper with Chartis, we detail how financial institutions can build a true strategic capability.

    Read more
  • EU Supervisory Reporting: Why the EBA’s simplification agenda is really a data architecture story

    Insight

    EU Supervisory Reporting: Why the EBA’s simplification agenda is really a data architecture story

    The EBA’s simplification package is not a reduction exercise; it is a structural shift. Our new discussion paper analyzes the move from fragmented reports to an integrated data architecture.

    Read more

Contact us

© 2026 Regnology Group GmbH All Rights Reserved