AMLA direct supervision: the 2026 data exercise that drives the 2027 selection

Most teams are reading AMLA direct supervision as a 2028 problem. The decision that matters is being made on 2026 data, through a Luxembourg leg of a Union-wide collection that the CSSF launched on 1 June 2026 against AMLA's reporting package of 12 May 2026. Feed it poor data and a firm can be misclassified: pulled into scope it could have avoided, or left out of remediation it should have started.

A few things the CSSF communication does and does not do.

It does point relevant Luxembourg entities to AMLA's two documents, including the updated reporting template (v1.1) and the interpretative note, and asks them to prepare for a CSSF-organised data collection. It does not publish a list of named institutions. There is no Luxembourg selection list yet; AMLA expects to finalise the provisional eligibility list by end of September 2026, having collected the data from national supervisors by 15 August 2026.

The eligibility gate under Article 12(1) of Regulation (EU) 2024/1620 is geographic reach, not size. The perimeter is credit institutions, financial institutions and groups operating in at least six Member States including the home Member State, by establishment or under the freedom to provide services, and that activity counts whether delivered through local infrastructure or remotely. A Luxembourg firm passporting services into five other Member States without a branch in any of them still operates in six. The Article 12(7) draft RTS tie freedom-to-provide-services activity to materiality thresholds: more than 20,000 customers resident in the Member State as at 31 December of the previous year, or more than EUR 50 million of annual incoming and outgoing transactions generated by those customers.

Eligibility is not selection. Article 13(1) provides that an entity whose residual risk profile is classified as high qualifies as a selected obliged entity, with no discretion at that stage. Article 13(2) lets AMLA hold the cohort to a number greater than 40 where more than 40 qualify, prioritising those operating in the most Member States, with a tie-break on the ratio of third-country transactions to total transactions. Article 13(4) sets the operational sequence: first selection by 1 July 2027, concluded within six months, list published, direct supervision begins six months after publication.

Two practical implications. A firm rated medium risk at home can still surface as high on AMLA's group-wide benchmarks because the two methodologies are aligned but not identical, so the interpretative note should be read before populating the template. Non-selected entities stay with the CSSF; AMLA's reach over a non-selected firm is the narrow Article 14 exception for serious, repeated or systematic breaches that national supervision has failed to address.

The work this summer is the data submission through the CSSF. Read the interpretative note first, count Member States honestly against the FPS materiality thresholds, and treat the template as a submission that will be reconciled, not a survey.

Source basis: Regulation (EU) 2024/1620, Articles 12 to 14 and Article 106(2); AMLA reporting package and interpretative note (12 May 2026); CSSF communication "Identification of obliged entities that will be eligible for direct supervision by AMLA" (1 June 2026); AMLA final report on draft RTS under Article 12(7) (16 December 2025).

Full article: https://regreportingdesk.com/amla-direct-supervision-luxembourg-eligible-entities/