AMLA Direct Supervision: Which Obliged Entities the CSSF Will Identify

ByOfficer

Last updated: June 2026

The most expensive scoping mistake a Luxembourg compliance team can make right now is assuming someone else will flag it for AMLA direct supervision. The Authority for Anti-Money Laundering and Countering the Financing of Terrorism picks its first set of directly supervised firms in 2027, and the data that feeds that decision is being collected through 2026. By the time a firm appears on the published list, the window to clean up its risk data has closed.

The CSSF has started preparing Luxembourg obliged entities for this. In June 2026 it issued a communication pointing firms to the AMLA reporting package, and it is the CSSF, the national financial supervisor, that feeds Luxembourg data into the model. That makes the identification process a Luxembourg operational problem before it becomes a Frankfurt one.

Related reading: our guide to AML reporting in Luxembourg.

What AMLA direct supervision actually means

AMLA is the new EU authority for anti-money laundering, established by Regulation (EU) 2024/1620 and seated in Frankfurt. Most obliged entities stay with their national supervisor. A small group does not. Those firms become what the regulation calls selected obliged entities, and AMLA supervises them directly.

Direct does not mean the CSSF leaves the file. Article 16 of Regulation (EU) 2024/1620 builds the regime around joint supervisory teams led by an AMLA coordinator, with national supervisor staff appointed to the team. A selected Luxembourg firm deals with AMLA as the lead, with CSSF specialists inside the same team. The reporting line changes; the local knowledge does not.

One point teams get wrong early: the periodic selection covers credit institutions and financial institutions only. A notary, a real estate agent, or a gambling operator is an obliged entity under the AML rules, but it is not in line for periodic AMLA direct supervision through this route. For the wider picture of who counts as an obliged entity, see what the AMLR changes for Luxembourg.

The two-part test: cross-border footprint plus risk profile

Selection runs on two filters that both have to be cleared.

The first is reach. Article 12(1) brings a firm into the assessment only where it operates in at least six Member States, including its home Member State. That count includes activity under the freedom to provide services, not only branches or subsidiaries. A payment institution or e-money institution serving customers across the EU on a services passport can clear the six-Member-State threshold without a single foreign branch.

The second is risk. Under Article 12(3), AMLA classifies each assessed firm’s inherent and residual risk profile as low, medium, substantial, or high, using a methodology set out in regulatory technical standards developed under Article 12(7). Article 13(1) then makes the rule mechanical: a firm whose residual risk profile is classified as high qualifies as a selected obliged entity. There is no discretion to spare a high-risk cross-border firm.

Where the firm sits in a group, Article 12(3) requires the risk profile to be assessed at group-wide level, and the whole group is treated as the selected entity. A Luxembourg subsidiary is not judged on its standalone book.

Which entity types the methodology covers

Article 12(4) requires the risk-classification methodology to be built separately for at least eleven categories: credit institutions, bureaux de change, collective investment undertakings, credit providers other than credit institutions, e-money institutions, investment firms, payment institutions, life insurance undertakings, life insurance intermediaries, crypto-asset service providers, and other financial institutions. The list names collective investment undertakings and crypto-asset service providers directly, so a Luxembourg fund vehicle or CASP with genuine cross-border activity is an explicit category, not a side case.

Inherent risk is scored against benchmarks in Article 12(5) covering customers, products and services, transactions, delivery channels, and geography. Named indicators include the share of non-resident customers from high-risk third countries, the presence of politically exposed persons, and the volume of correspondent banking and correspondent crypto-asset services with those countries. Residual risk, under Article 12(6), measures the quality of the controls a firm puts in place to mitigate that inherent risk. A firm with high inherent exposure but demonstrably strong controls can land below the high band.

How the 2026 identification process works

The selection is a 2027 event, but the data that drives it is being gathered now. AMLA published a standardised reporting template and an interpretative note on 12 May 2026, setting out what national supervisors must collect to identify which firms meet the criteria. AMLA is running a public webinar on 10 June 2026 from 10:00 to 12:00 CEST to walk through that package; for Luxembourg firms, access runs through a login password disseminated by the CSSF, with connections capped at 3,000.

The deadlines that bite are national. Supervisors are to collect the data by 15 August 2026, and AMLA expects the provisional list of eligible obliged entities to be finalised by the end of September 2026. For Luxembourg firms, the CSSF is the channel, so the CSSF timetable for requesting and validating data is the one to track. Firms that have worked through the CSSF AML/CFT data collection exercise will recognise the data-readiness problem.

A common misreading: this exercise is not the selection. AMLA ran an earlier testing round in spring 2026 to calibrate its risk models, and this collection feeds the eligibility list, not the final selection decision. Being asked for data means a firm is in the population being measured, not that it has been selected.

The 40-entity cap and the one-per-Member-State rule

Article 13(2) sets a working ceiling. Where more than 40 entities qualify on high residual risk, AMLA may, in consultation with supervisors, agree a number greater than 40 sized to the staff it can realistically deploy. Where the cap still bites, the tie-break favours the firms operating in the highest number of Member States, then those with the highest ratio of third-country transaction volume to total volume.

Article 13(3) pulls the other way. Where no high-risk cross-border firm qualifies in a given Member State, AMLA runs an additional selection there so that at least one entity per Member State is covered. A Luxembourg firm could therefore be selected not because it is among the riskiest in the EU, but because it is the highest-scoring eligible firm in its own jurisdiction. The final list is neither a pure top-40 nor a fixed quota.

The timeline and the three-year lock-in

Article 13(4) sets the clock. AMLA is to commence the first selection process by 1 July 2027, conclude it within six months, publish the list, and begin direct supervision six months after publication. That sequencing is why AMLA describes direct supervision as starting in 2028. The selection then repeats every three years.

What teams should not assume is that a bad year can be reversed quickly. Once selected, a firm stays under AMLA direct supervision for at least three years, even if its cross-border footprint or risk score later drops below the thresholds. A firm only leaves when a later selection list no longer includes it.

The exceptional route, and what Luxembourg firms should prepare

The periodic test is not the only way in. Article 14 lets a national supervisor ask AMLA to take over a non-selected firm in exceptional circumstances, for example where serious, repeated, or systematic breaches are not being addressed effectively, or where the supervisor temporarily lacks capacity to deal with a heightened risk. AMLA assesses such a request within two months. A firm comfortably below the six-Member-State line is not immune if its compliance record deteriorates badly. The mechanics sit in the AMLA home-host supervisory cooperation framework.

The practical preparation is data, not lobbying. The selection is mechanical once the numbers are in, so the only thing a firm can influence is the quality of what it reports through the CSSF: an accurate Member-State count including services-basis activity, clean non-resident and PEP figures, correspondent relationships mapped to high-risk third countries, and a control framework it can evidence.

Frequently Asked Questions

Does AMLA direct supervision replace CSSF supervision entirely?

No. For a selected firm, AMLA becomes the lead supervisor through a joint supervisory team built with national supervisor staff appointed to it. The CSSF continues to supervise the large majority of Luxembourg obliged entities that are not selected.

Which entity types can be selected for direct supervision?

The periodic selection under Article 12 applies to credit institutions and financial institutions. The methodology is built for at least eleven categories, including credit institutions, payment institutions, e-money institutions, investment firms, collective investment undertakings, and crypto-asset service providers. Non-financial obliged entities are not in scope for this periodic route.

What does the six Member States test actually count?

Article 12(1) brings a firm into the assessment where it operates in at least six Member States including its home Member State. The count includes activity under the freedom to provide services, not only branches and subsidiaries.

Can a non-selected firm still be pulled into AMLA supervision?

Yes. Under Article 14, a national supervisor can request that AMLA take over a non-selected firm in exceptional circumstances, such as unaddressed serious breaches or a temporary capacity gap. AMLA assesses the request within two months.

How long does a selected firm stay under AMLA?

At least three years. A selected firm remains under direct supervision until a later selection list no longer includes it, even if its risk score falls below the thresholds in the meantime.

Related Articles

Key Takeaways

  • AMLA selects its first directly supervised firms in 2027, with direct supervision starting in 2028, under Regulation (EU) 2024/1620.
  • Selection has two filters: operating in at least six Member States including the home state, and a residual risk profile classified as high.
  • The six-Member-State count includes freedom-to-provide-services activity, so a services passport can put a Luxembourg firm in scope without any foreign branch.
  • Only credit institutions and financial institutions are in the periodic selection; the methodology covers eleven categories, including CASPs and collective investment undertakings.
  • Up to 40 entities in the first round, with a one-per-Member-State coverage rule that can select a firm even if it is not among the EU’s riskiest.
  • Selected firms stay under AMLA for at least three years, and Article 14 lets supervisors escalate a non-selected firm in exceptional cases.

Sources and References

  • Regulation (EU) 2024/1620 establishing AMLA (AMLAR), Articles 12, 13, 14 and 16 – EUR-Lex
  • Directive (EU) 2024/1640 (AMLD6), supervision and risk-profile provisions – EUR-Lex
  • Regulation (EU) 2024/1624 (AMLR), the EU single AML rulebook – EUR-Lex
  • AMLA, “AMLA takes next step toward 2027 selection of entities for direct supervision” (12 May 2026) – amla.europa.eu
  • AMLA, webinar on identification of entities eligible for direct supervision (10 June 2026) – amla.europa.eu
  • AMLA, “AMLA launches data collection exercise to test risk assessment models” (16 March 2026) – amla.europa.eu
  • CSSF, communication on identification of obliged entities eligible for direct supervision by AMLA (June 2026) – cssf.lu

What a Luxembourg compliance team should do this summer

The selection is mechanical, the data is collected in 2026, and the list lands in 2027. A firm cannot argue its way off the list after publication, but it can make sure the numbers it reports through the CSSF this summer reflect a control framework it can evidence.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts