EBA Reporting Framework 4.3: TCB and AMLA Reporting From 2027

ByOfficer

On 9 July 2026 the European Banking Authority published the final technical package for version 4.3 of its supervisory reporting framework, and with it two build deadlines that reporting teams can no longer treat as roadmap items. The EBA reporting framework 4.3 package carries the standard specifications for two separate obligations: supervisory reporting by third-country branches under the Capital Requirements Directive, with a first reference date of 31 March 2027, and a risk-assessment data collection that feeds the Anti-Money Laundering Authority’s selection of entities for direct supervision, with a first reference date of 31 December 2026.

The word that matters here is final. A draft version of the same package went out on 17 April 2026, and many teams parked their mapping work until the specifications settled. They have now settled. The 4.3 package ships the validation rules, the data point model, the XBRL taxonomies, the annotated templates and a new glossary companion, which means the data-mapping, taxonomy-build and validation-testing work can start against artefacts that will not move again before implementation, subject to one narrow exception the EBA has flagged for the end of September.

This article walks through what the package contains, who each obligation binds, the calendar you are now building to, and the places where the two reporting streams look similar enough to be confused and are governed by entirely different legal texts.

Related reading: our guide to the EBA 4.3 draft technical package, which mapped the scope when the specifications were still in consultation.

The 4.3 calendar reporting teams are now building to

The dates below are reporting reference dates; separate remittance dates govern when a branch must actually submit. The draft ITS sets those remittance dates according to the annex and reporting frequency: for a 31 March reference date, quarterly Annex I information is due on 12 May, quarterly Annex II information is due on 11 June, and monthly Annex I information is generally due on the fifteenth calendar day following the reference date.

  • 5 March 2026: the EBA published its final Report on the draft ITS for third-country branch supervisory reporting, reference EBA/ITS/2026/01, and submitted the draft standards to the European Commission for adoption.
  • 17 April 2026: the draft 4.3 technical package was published for stakeholder feedback.
  • 9 July 2026: the final 4.3 technical package was published, incorporating the feedback received on the draft.
  • End of September 2026: the EBA has reserved the option of a targeted update, described as a hotfix, if early implementation feedback surfaces critical clarifications or adjustments.
  • 31 December 2026: first reference date for the AMLA risk-assessment data collection.
  • 31 March 2027: first reference date for third-country branch supervisory reporting.

Article 48l(2) sets minimum frequencies, but the draft ITS prescribes higher frequencies for several templates. Both classes report liquidity information monthly and selected branch and head-undertaking templates quarterly. Class 1 branches report the remaining recurring templates mainly semi-annually, while Class 2 branches report them mainly annually. The return is therefore a template-specific production cycle spanning monthly, quarterly, semi-annual and annual tracks, distinct from a single semi-annual or annual submission.

What the EBA reporting framework 4.3 package delivers, and what it is not

The final package provides the standard specifications for both obligations: the validation rules, the data point model, and the XBRL taxonomies. Alongside those, the release includes the updated annotated templates, the common data points, the glossary and the related XBRL taxonomy needed to implement the two reporting streams. The EBA also published a new Glossary Usage Exploration file, a structured view of the glossary content and how each concept is used across the framework, so that a mapping analyst can trace a definition to every template that consumes it, which is faster than reading the annexes in isolation.

A technical package is a set of build specifications. The substantive TCB reporting obligation arises under Articles 48k and 48l of the CRD as transposed into national law; CRD VI required Member States to apply those provisions from 11 January 2026. The future Commission Implementing Regulation will make the uniform formats, definitions, template frequencies and related technical requirements directly applicable. As at mid-July 2026, the EBA regulatory page continued to show the ITS as a final draft submitted to the Commission and not yet applicable. The EBA submitted the final draft standards to the Commission after its 5 March 2026 final Report; adoption is the Commission’s step. Reporting teams should build to the 31 March 2027 reference date the EBA has set while treating the formal legal citation as a Commission Implementing Regulation still to come. That sequencing matters for anyone whose sign-off process requires an in-force Official Journal reference before a project is funded.

Scope is the other place to be precise. Version 4.3 of the framework covers the third-country branch reporting and the AMLA data-collection support, and those two obligations only. The broader step-two amendments that reporting teams associate with CRR3 and CRD VI, including the COREP own funds, FINREP and market-risk changes, belong to the separate version 4.4 release, not to 4.3. Anyone reading 4.3 as a COREP or FINREP change is reading the wrong release. For the DPM mechanics that do change between framework versions, the earlier walkthrough of the DPM changes across framework 4.3 sets out how the model versions and taxonomies are staged.

Third-country branch reporting under CRD VI

The branch obligation is a genuinely new supervisory return, introduced by the sixth Capital Requirements Directive, Directive (EU) 2024/1619, which inserted a dedicated title on the prudential supervision of third-country branches into the CRD. A third-country branch, for these purposes, is a branch established in a Member State by an undertaking or a credit institution whose head office sits in a third country and which carries on banking activities that would require authorisation if performed by an EU institution. Our overview of third-country branch reporting sets out the perimeter in more detail.

Two articles carry the reporting rules, and keeping them apart avoids a common citation error. Article 48k sets the substantive reporting obligation: it is the article that requires branches to report regulatory and financial information on themselves and on their head undertaking. Article 48l(1) is the article that mandates the EBA to develop the implementing technical standards specifying the uniform formats, definitions, frequency and IT solutions for that information, and it is the article the EBA cites as the legal basis for the ITS in the 4.3 package. Article 48l(1) also carries the proportionality principle, requiring the reporting to be proportionate to a branch’s classification as class 1 or class 2. Article 48l(2) fixes the frequency, at least twice a year for class 1 and at least annually for class 2.

For branches subject to the CRD VI minimum-harmonisation TCB regime, classification follows Article 48a(1) to (3). Article 48a(4) is a material exception: a Member State may instead apply the requirements applicable to authorised credit institutions to all or specified categories of TCBs, in which case the applicable classification and reporting treatment must be confirmed under the Member State’s implementing law. A branch is class 1 where any one of three conditions is met: the total value of assets booked or originated by the branch in the Member State is equal to or greater than EUR 5 billion, as reported for the immediately preceding annual period; the branch is authorised to take deposits or other repayable funds from retail customers and those funds are equal to or greater than 5 percent of the branch’s total liabilities or exceed EUR 50 million; or the branch is not a qualifying third-country branch within the meaning of Article 48b. A branch that meets none of those conditions is class 2. Reclassification is asymmetric: a class 1 branch that drops below the thresholds becomes class 2 immediately, while a class 2 branch that crosses a threshold becomes class 1 only after four months. That four-month lag is a deliberate stability feature, and it is worth wiring into the classification logic instead of reassessing the class at every reporting reference date.

The ITS divides the harmonised reporting between two annexes. Annex I covers branch-level financial and regulatory information under Article 48k(1), including booked and originated assets and liabilities, off-balance-sheet items, concentrations, internal transactions, capital-endowment information and liquidity information. Annex II covers information about the head undertaking under Article 48k(2). Additional national reporting imposed under Article 48k must be checked separately with the competent authority because it is not necessarily standardised by the ITS. Balance-sheet information follows the applicable international accounting standards under Regulation (EC) No 1606/2002 or the generally accepted accounting principles applicable in the Member State.

The head-undertaking templates and the waiver most teams miss

The head undertaking data is where mapping gets hard, and where the first real relief valve sits. Article 48k(2) requires a branch to report a set of information about its parent: aggregated assets and liabilities booked by the group’s subsidiaries and other branches in the Union, the head undertaking’s compliance with prudential requirements on an individual and consolidated basis, significant supervisory reviews conducted on the parent, the parent’s recovery plans and its business strategy for the branch, and the services the head undertaking provides to Union clients under reverse solicitation as referenced in Article 21c. Much of that data lives in the parent’s home systems, in a home-country accounting and regulatory dialect, and pulling it into an EU branch return is the part of the build that tends to slip.

The relief valve is in Article 48l(3). A competent authority may waive all or part of the head-undertaking reporting requirements under Article 48k(2) for a qualifying third-country branch, provided the authority can obtain the relevant information directly from the supervisory authorities of the relevant third country. The waiver is conditional and it is the supervisor’s to grant, not a self-service exemption a branch can assume. It is a conversation worth having early with the host supervisor for any branch whose head undertaking sits in an equivalent-regime jurisdiction, because the difference between reporting the full Annex II set and reporting a waived subset is a material build decision.

Proportionality on the head undertaking templates works differently from what teams expect. For the Annex II templates, the EBA’s final Report applies proportionality at the level of frequency, with the data points applying to class 1 and class 2 branches alike and no reduced data set for class 2. A class 2 branch therefore should not assume its head-undertaking dataset is lighter than a class 1 branch’s; the lighter treatment shows up as a less frequent submission, and the templates themselves carry both quantitative and qualitative information for the parent. Reading class 2 as a smaller dataset for the parent templates is the kind of assumption that produces an under-scoped build.

AMLA’s risk-assessment data collection

The second obligation in the 4.3 package has nothing to do with prudential returns and everything to do with who supervises whom for anti-money-laundering purposes. The Anti-Money Laundering Authority, established by Regulation (EU) 2024/1620 and based in Frankfurt, will directly supervise a set of the highest-risk cross-border financial entities. To pick that set, it needs comparable risk data, and the 4.3 package provides the data point model and taxonomy components that support the methodology used to identify the entities that will fall under AMLA’s direct supervision.

The selection mechanics sit in Regulation (EU) 2024/1620. Article 12 requires AMLA, working with national supervisors, to run a periodic assessment of credit institutions and financial institutions, and groups, that operate in at least six Member States, classifying each entity’s inherent and residual risk profile as low, medium, substantial or high. Article 13(1) provides that an entity with a high residual risk profile qualifies as a selected obliged entity. For the first selection process, Article 106(2) applies a transitional cap: if more than 40 entities would qualify, AMLA is to supervise 40, selected using the statutory cross-border and third-country-transaction criteria. The Article 13(2) mechanism for setting a number above 40 applies only from the second selection cycle onward. Our note on which obliged entities face direct AMLA supervision works through the identification process from the entity’s side.

Article 12 of Regulation (EU) 2024/1620 governs the population for AMLA’s periodic assessment. It covers credit institutions, financial institutions and groups operating in at least six Member States, and Article 12(2) requires both supervisory authorities and obliged entities subject to the assessment to provide the information necessary for it. AMLA’s statement that entities not notified by their national competent authority were not part of the exercise applied to the separate March-April 2026 testing and calibration exercise. Firms should confirm the operational population, reporting instructions, submission route and timetable for the selection data collection with AMLA or the relevant national supervisor.

It helps to keep the timeline straight, because AMLA ran more than one data exercise in 2026. An earlier testing and calibration exercise, whose reporting package the authority published on 16 March 2026 with a submission deadline of 22 April 2026, was a calibration run for the risk-assessment models that selected no one. The data collection that the 4.3 taxonomy components support is the one that feeds the identification of entities for direct supervision, with the 31 December 2026 reference date. The EBA frames the AMLA components in version 4.3 as supporting reporting agents in preparing for that 2027 selection exercise, so teams should treat the 4.3 AMLA taxonomy as preparation infrastructure and confirm the exact submission channel and timing with their national supervisor.

Why TCB and AMLA reporting should not share a project plan

The two obligations arrive in one technical package and share one DPM and taxonomy toolchain, and that shared plumbing is exactly what leads teams to run them as one workstream. They are different obligations in almost every dimension that matters to a reporting build.

The branch obligation is a prudential supervisory return, owned by a bank’s regulatory reporting function, filed to the national competent authority under CRD VI, with a 31 March 2027 first reference date and a frequency that depends on class 1 or class 2 status. The AMLA stream is a financial-crime risk data collection, closer in operational form to a supervisory questionnaire than to COREP and normally owned by the AML or compliance function. Its statutory assessment population consists of credit institutions, financial institutions and groups operating in at least six Member States; residual risk classification subsequently determines which entities qualify for direct supervision. The legal bases do not overlap: the branch return runs on Directive (EU) 2024/1619, the AMLA collection on Regulation (EU) 2024/1620. The only thing they genuinely share is the reporting-framework machinery the EBA uses to publish both.

Treating them as one project tends to produce two failures. The prudential team assumes the AML data is somebody else’s problem until the December reference date is close, and the AML team assumes the branch templates are a prudential build it can ignore, when a third-country branch that is also a cross-border obliged entity can be touched by both. Mapping the two populations against your own entity list early is cheaper than discovering the overlap in the last quarter of 2026.

Turning final artefacts into a build backlog

With final specifications in hand, the work stops being analysis and starts being engineering. For the branch obligation, that means loading the DPM 4.3 model and the branch and head-undertaking taxonomies, mapping each Annex I and Annex II data point to a source system, and running the validation rules against test instances before there is any live data to file. The validation rules are the artefact that most often exposes a mapping gap, because a rule that ties two templates together will fail the moment a field is sourced inconsistently; the earlier explainer on how EBA validation rules work is a useful refresher before that testing starts. The Glossary Usage Exploration file earns its place here, because tracing a contested definition to every template that uses it is faster than reconciling the annexes by hand.

Two build habits reduce late surprises. First, hold a slot in the plan for the end-September update. The EBA has told the market a hotfix may land if early implementation feedback surfaces critical issues, so a taxonomy build that assumes the 9 July artefacts are the last word could face a re-test in the fourth quarter. Second, treat the head-undertaking waiver as a live decision rather than a default. Whether a qualifying branch reports the full Article 48k(2) set or a waived subset is the host supervisor’s call under Article 48l(3), and confirming that position before the Annex II mapping is finalised avoids building templates that a waiver would have made unnecessary.

For the AMLA stream, confirm with the national competent authority whether the entity is subject to the selection data collection and obtain the governing reporting instructions, submission route and timetable. The notification wording in AMLA’s 16 March 2026 notice applies to the separate testing and calibration exercise and should not be treated as the legal scope test for the selection collection. An auditor reviewing this in early 2027 will expect to see the two obligations tracked separately, each against its own legal basis and reference date, and never merged into a single 4.3 line item.

Frequently Asked Questions

Is the third-country branch ITS legally in force now that the 4.3 package is published?

No. The 4.3 technical package is the set of build specifications. The ITS becomes binding law when the European Commission adopts it as a Commission Implementing Regulation and it is published in the Official Journal, and that adoption had not occurred as at mid-July 2026. The EBA submitted the final draft standards to the Commission following its 5 March 2026 final Report. Teams should build to the 31 March 2027 first reference date the EBA has set, while noting the formal legal citation will be a Commission Implementing Regulation issued later.

Which article is the correct legal basis to cite for the branch reporting ITS?

The EBA cites Article 48l(1) of the CRD as the basis for the implementing technical standards, while the underlying reporting obligation is in Article 48k. Article 48l(2) sets minimum reporting frequencies of at least twice a year for Class 1 and at least annually for Class 2, but the draft ITS requires monthly and quarterly reporting for specified templates in both classes, with other templates generally reported semi-annually by Class 1 and annually by Class 2.

How do we know whether our branch is class 1 or class 2?

Article 48a sets the test. A branch is class 1 if the assets it books or originates in the Member State are at least EUR 5 billion, or it takes retail deposits or other repayable funds of at least 5 percent of total liabilities or exceeding EUR 50 million, or it is not a qualifying third-country branch under Article 48b. A branch meeting none of those is class 2. A class 2 branch that crosses a threshold moves to class 1 only after four months, while a class 1 branch that falls below moves to class 2 immediately.

Can a branch avoid reporting the full set of head-undertaking data?

Possibly. Article 48l(3) lets a competent authority waive all or part of the head-undertaking reporting under Article 48k(2) for a qualifying third-country branch, provided the authority can obtain the relevant information directly from the third country’s supervisory authorities. The waiver is granted by the supervisor and is conditional, so it is a position to confirm with the host authority rather than an exemption a branch can apply on its own.

Does framework 4.3 change our COREP or FINREP submissions?

No. Version 4.3 covers third-country branch reporting and the AMLA data-collection support only. The COREP own funds, FINREP and market-risk amendments linked to CRR3 and CRD VI sit in the separate version 4.4 release. A COREP or FINREP change should be tracked against 4.4, not 4.3.

Who has to take part in the AMLA data collection?

Article 12 covers credit institutions, financial institutions and groups operating in at least six Member States. Supervisory authorities and obliged entities subject to the periodic assessment must provide the information necessary for that assessment. The statement that an unnotified entity was not part of the exercise applied to AMLA’s March-April 2026 testing exercise and does not automatically extend to the later selection data collection. The applicable operational population, instructions and timetable should be confirmed against AMLA’s selection-collection materials or the relevant national supervisor’s instructions.

What is the Glossary Usage Exploration file for?

It is a companion to the reporting framework that presents the glossary content and shows how each concept is used across the templates and the data point model. For a mapping analyst, it turns definition traceability into a lookup, letting you see every template that consumes a given concept, which supports both interpretation and impact assessment.

Should we wait for the possible September hotfix before building?

Building can start now. The 9 July artefacts are final, and the EBA has only reserved the option of a targeted update at the end of September if early implementation feedback surfaces critical issues. The practical stance is to build against the current package and keep a re-test slot in the fourth quarter in case a hotfix lands, instead of pausing the work until the option lapses.

Related Articles

Key Takeaways

  • The EBA published the final 4.3 reporting-framework technical package on 9 July 2026, carrying the validation rules, data point model and XBRL taxonomies for two obligations: third-country branch reporting and AMLA risk-assessment data collection.
  • Third-country branch reporting has a first reference date of 31 March 2027; the AMLA data collection has a first reference date of 31 December 2026.
  • The branch reporting obligation is in Article 48k, while Article 48l provides the mandate for the ITS and minimum frequencies. The draft ITS applies monthly and quarterly frequencies to specified templates for both classes, with other templates generally reported semi-annually by Class 1 and annually by Class 2.
  • Class 1 or class 2 status follows the mechanical thresholds in Article 48a, and a class 2 branch that crosses a threshold moves up only after four months.
  • A competent authority may waive part or all of the head-undertaking reporting for a qualifying branch under Article 48l(3) where it can obtain the data from the third-country supervisor, so the waiver is a decision to confirm with the host authority.
  • Version 4.3 covers TCB and AMLA reporting only; the COREP, FINREP and market-risk step-two amendments belong to the separate version 4.4 release.
  • Article 12 covers credit institutions, financial institutions and groups operating in at least six Member States, and requires supervisory authorities and obliged entities subject to the periodic assessment to provide the information necessary for it. The notification condition applied to AMLA’s separate March-April 2026 testing exercise, not to the statutory Article 12 assessment population. The first selection process must begin by 1 July 2027, with direct supervision commencing six months after publication of the selected-entity list.
  • The ITS is not yet a Commission Implementing Regulation, so build to the EBA reference dates and keep a fourth-quarter re-test slot for the possible end-September hotfix.

Sources and References

  • European Banking Authority, press release, “The EBA releases the final technical package for its 4.3 reporting framework to support Third-Country Branches reporting and AML Authority risk assessment data collection”, 9 July 2026: eba.europa.eu
  • European Banking Authority, “Reporting framework 4.3”: eba.europa.eu
  • European Banking Authority, press release, “The EBA sets out harmonised reporting standards to enhance oversight of third-country branches”, 5 March 2026: eba.europa.eu
  • European Banking Authority, Final Report on draft ITS on the supervisory reporting of third country branches under CRD VI, EBA/ITS/2026/01, 5 March 2026: eba.europa.eu (PDF)
  • European Banking Authority, ITS on the supervisory reporting of Third Country Branches (regulatory activity page): eba.europa.eu
  • European Banking Authority, press release, “The EBA seeks feedback on 4.3 draft technical package of its reporting framework”, 17 April 2026: eba.europa.eu
  • Directive (EU) 2024/1619 (CRD VI), Articles 2, 47, 48a, 48b, 48k and 48l, EUR-Lex: eur-lex.europa.eu
  • Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority, Articles 12, 13 and 106, EUR-Lex: eur-lex.europa.eu
  • Anti-Money Laundering Authority, “AMLA launches data collection exercise to test risk assessment models”, 16 March 2026: amla.europa.eu

Building to the 4.3 reference dates with confidence

The signal in the 9 July release is that the specifications have stopped moving. For a third-country branch, the work now is to classify the branch, map Annex I and Annex II to source systems, settle the head-undertaking waiver question with the host supervisor, and validate against the DPM before the 31 March 2027 reference date. For an institution potentially within Article 12, the work is to confirm with the national supervisor whether it is included in the operational selection data collection and to obtain the applicable reporting instructions, submission route and timetable. Two obligations, two legal bases, two reference dates, one technical package, and a clear reason to run them as separate builds that happen to share a toolchain.

Last updated: July 2026

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts