Article 3 Legal effect of the classification of level of gravity of breaches


This is a draft act

This text has been parsed from the AMLA final report draft as published on 8 July 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (9 February 2026)

Summary What does Article 3 of the RTS on pecuniary sanctions and administrative measures say?

This is a notably brief but important bridging article that connects the classification framework established in Article 2 to the broader requirements of Directive (EU) 2024/1640.

It effectively translates the internal categorisation system into a legal threshold: any breach falling into category three or four automatically meets the standard of being "serious, repeated or systematic" as defined under that Directive.

Important points:

  • Supervisors must treat category three and four breaches as serious, repeated or systematic under Directive (EU) 2024/1640.
  • This article acts as a direct link between the internal classification system of Article 2 and the legal definitions in Directive (EU) 2024/1640, Article 55(1).
  • The threshold is clear-cut — only category three and four breaches trigger this designation, not category one or two.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

  1. A breach with a level of gravity classified as category three or four in accordance with Article 2 shall be deemed serious, repeated or systematic in the meaning of Article 55(1) of Directive (EU) 2024/1640.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod