Article 9 Supervisory actions


This is a draft act

This text has been parsed from the AMLA final report draft as published on 30 September 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (16 April 2026)

Summary What does Article 9 of the RTS on group-wide minimum requirements and additional measures for third-country subsidiaries and branches say?

This article sits downstream of Article 8, which sets out the additional measures that parent undertakings and obliged entities can take when managing AML/CFT risks in third-country branches or subsidiaries.

Article 9 addresses what happens when those measures are not enough.

It grants supervisors the power to escalate, laying out a two-stage escalatory framework: first, requiring a risk mitigation plan or corrective measures; and if that still fails, triggering more serious supervisory actions referenced in Regulation (EU) 2024/1624.

The article also sets out the factors supervisors must weigh when deciding which actions to take, and includes a transparency requirement for self-regulatory bodies to keep their overseeing public authority informed throughout.

Important points:

  • Supervisors are required to escalate intervention when additional measures by the parent undertaking or obliged entity are deemed insufficient to manage third-country AML/CFT risks.
  • Supervisors must take into account the nature and gravity of identified risks, third-country legal or regulatory impediments, and existing governance and internal control arrangements when selecting supervisory actions.
  • Where the supervisor is a self-regulatory body, it must keep the overseeing public authority informed of legal impediments, measures taken, supervisory actions requested, and any subsequent developments.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. Where the supervisor determines that the additional measures implemented by the parent undertaking or the obliged entity pursuant to this Regulation are insufficient to ensure that it branches or subsidiaries located in the third country effectively manage the risks of money laundering or terrorist financing, the supervisor shall exercise one or more of the following additional supervisory actions:

      1. require the parent undertaking or the obliged entity to submit and implement, within a specified timeframe, a risk mitigation plan approved by the relevant management body, aiming to effectively address the identified risks, weaknesses or shortcomings;

      2. require the parent undertaking or the obliged entity to implement, within a specified timeframe, corrective measures available to the supervisors under Union law or national law to address identified weaknesses or mitigate risks.

    2. The supervisor shall monitor the implementation of the actions referred to in the first subparagraph points (a) and (b), where applicable, to satisfy itself that the risks of money laundering or terrorist financing are effectively managed.

    1. Where the supervisor determines that the parent undertaking or the obliged entity cannot effectively manage the risks of money laundering or terrorist financing connected with the operations or activities of the branches or subsidiaries established in the third country or that the parent undertaking or an obliged entity has failed to comply with supervisory actions taken pursuant to paragraph 1 within the specified time frame, it shall exercise one or more of the additional supervisory actions specified in the last sentence of Article 17(2) of Regulation (EU) 2024/1624.

    1. When determining which additional supervisory actions to apply under this Article, the supervisor shall take into account, where relevant:

      1. the nature and gravity of the identified risks, weaknesses or shortcomings;

      2. the extent to which relevant third-country legal or regulatory impediments affect the effective implementation or supervision of group-wide AML/CFT policies, procedures and controls; and

      3. existing governance arrangements, risk management frameworks and internal controls systems.

    1. Supervisors shall ensure the effective use of the mechanisms available to them in the exercise of their competences to enhance the effectiveness and efficiency of their supervisory activities, including by complying with Section 2 of Directive (EU) 2024/1640 on cooperation within AML/CFT supervisory colleges and with counterparts in third countries, where appropriate.

    1. In cases where the supervisor is a self-regulatory body, it shall keep the public authority overseeing it informed of any reported legal impediments, minimum actions, additional measures, any supervisory actions requested, and any subsequent developments.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod