Art. 2 Classification of the level of gravity of breaches | RTS on pecuniary sanctions and administrative measures | AML

This article is the operational core of the classification framework, translating the indicators established in Article 1 into a concrete four-tier severity scale for breaches.

Supervisors are required to apply this scale — running from category one (least severe) to category four (most severe) — by evaluating how far the Article 1 indicators are met.

Each category has defined threshold conditions, covering factors such as the duration and impact of the breach, its repetitive nature, and whether it has facilitated criminal activity or caused structural failures.

A notable feature is the cumulative assessment rule: breaches that individually fall below category three or four may still be elevated to those categories when considered together.

Important points:

Supervisors are required to classify every breach into one of four severity categories, using the indicators from Article 1 as the basis for that determination.
Category one is only available for minor, short-lived, non-repetitive breaches with limited impact; the presence of certain aggravating indicators automatically excludes this classification.
Breaches that appear less severe in isolation can be escalated to category three or four when assessed in combination with one another.

1. When classifying the level of gravity of a breach, supervisors shall use four categories as follows, by increased order of severity: category one, category two, category three, category four.
1. To classify the breaches into one of the four categories listed in paragraph 1, supervisors shall assess whether and to what extent all the applicable indicators of Article 1 of this Regulation are met.
1. Supervisors may classify under those categories breaches other than those described in paragraphs 4 to 7.
1. Supervisors shall classify the breach under category one breaches where there is no direct impact or the impact is minor on the obliged entity when assessing the indicators specified in Article 1, points (d) and (e), and, at the same time:
  1. the indicator specified in Article 1, point (a), the breach has lasted for a short period of time, and
  2. the indicator specified in Article 1, point (b), the breach has been committed on a non-repetitive basis.
2. Supervisors shall not classify a breach as category one if indicators specified in Article 1, points (g) to (k) are met.
1. Supervisors shall classify the breach as category two where, for the indicators specified in Article 1, points (d) or (e), the impact is moderate and none of the indicators (g) to (k) of Article 1 are met.
1. Supervisors shall classify the breach as at least category three where:
  1. one of the indicators specified in Article 1 points (b) or (k), is met, or
  2. the indicators specified in Article 1, point (d) or point (e), the impact is significant, and at the same time:
    the indicator specified in Article 1, point (a), the breach has persisted over a significant period of time.
1. Supervisors shall classify the breach as category four where:
  1. the indicators specified in Article 1, point (d) or point (e), the impact is very significant, or
  2. when indicator specified in Article 1, point (h), is met, or
  3. the indicator specified in Article 1, point (g), the breach has facilitated or otherwise led to significant criminal activities as defined in Article 2(1), point (3), of Regulation (EU) 2024/1624, or
  4. the indicators specified in Article 1, point (i) or (j), the breach has a significant impact.
1. Breaches that would not be classified as category three or category four when assessed in isolation could amount to a breach of category three or four when assessed in combination.

Article 2 Classification of the level of gravity of breaches

Tag

Tags