Understanding the EBA's New Framework
The European Banking Authority (EBA) has released Reporting Framework 4.3, transforming AMLA's risk-assessment templates into a machine-readable Data Point Model and XBRL taxonomy. While not yet a live reporting requirement, this preview highlights significant control weaknesses in the industry. Two data exercises occurred in 2026: a March-April test with sampled institutions and a May exercise for firms within AMLA's cross-border selection perimeter. National supervisors must submit cross-border data to AMLA by August 15, with error correction continuing through September.
This framework outlines what AMLA will measure when formal submissions begin in 2027 for year-end 2026 positions. Institutions will submit data through national supervisors by March 31, 2027, with validated data reaching AMLA by May 31. AMLA will then select up to 40 institutions for direct supervision starting in 2028.
Key Dates to Remember
- Earlier this month: EBA releases Reporting Framework 4.3
- March-April 2026: Sampled institutions test the methodology
- May 2026: Cross-border perimeter identification begins
- 15 August 2026: National supervisors submit cross-border data to AMLA
- End of September 2026: Finalize in-scope population post-error correction
- September 2026: Framework 4.4 revisions expected
- 31 December 2026: Reference date for assessment data
- 31 March 2027: Institutions submit data to national supervisors
- 31 May 2027: National supervisors deliver validated data to AMLA
- Second half 2027: AMLA conducts risk assessments and selects institutions
- 2028: Direct AMLA supervision begins
Identifying Control Failures
The framework's data model reveals four common control failures:
Unverified beneficial ownership. AMLA requires counts of unverified beneficial owners. If your system can't provide this, you're likely tracking verification inconsistently. The Capital Requirements Directive VI mandates beneficial ownership verification as part of Customer Due Diligence.
Overdue periodic reviews. The model asks for overdue customer reviews. Firms treating periodic reviews as batch processes rather than continuous obligations can't accurately track overdue reviews.
Alert backlogs and processing times. AMLA wants average review times for transaction monitoring alerts and the proportion escalating to suspicious transaction reports. If you're using email workflows or spreadsheets, this data isn't easily accessible.
Sanctions implementation lag. The framework measures the time between a financial sanction's publication and its implementation in screening systems. Manual or weekly updates fail to meet FATF Recommendation 6.
Meeting Regulatory Standards
FATF Recommendation 6 requires immediate implementation of targeted financial sanctions. Your screening system must update and check new designations the same day they're published.
Capital Requirements Directive VI requires verifying beneficial ownership as part of Customer Due Diligence. An unverified beneficial owner indicates incomplete CDD.
FATF Recommendation 10 mandates ongoing due diligence, including timely periodic reviews. Overdue reviews violate this requirement.
The EBA's framework measures compliance with these existing standards using metrics many firms can't currently produce.
Action Steps for Your Team
Identify data gaps now. Download the v4.3 Data Point Model and try to fill every field using your current systems. Document gaps and manual processes, as these represent control weaknesses AMLA will evaluate.
Improve alert workflows. Implement case timestamps for transaction monitoring alerts to track metrics AMLA requires and enhance your alert management.
Automate sanctions updates. Develop or acquire an automated feed for sanctions list updates. Run retroactive screenings and document update timestamps.
Track beneficial ownership verification. Your CDD system should record verification status for each beneficial owner and drive workflow based on this status.
Make periodic reviews continuous. Shift from batch reviews to a daily queue, assigning reviews daily and tracking overdue counts.
Monitor cross-border materiality. If operating in six or more EU Member States, track materiality thresholds monthly to know if you're within AMLA's scope.
The EBA will revise the model for v4.4 in September, incorporating lessons from this year's data collections. AMLA plans to distinguish unavailable information from zero values and add new data points. You have until March 31, 2027, to submit complete, validated data. Start addressing the metrics you can't currently calculate.
