AMLA is consulting on the rules that will decide how your supervisor rates your firm, and for a small Cyprus practice that rating will normally be produced without a single question about how good its AML controls are.
The draft regulatory technical standards, published on 13 July 2026 under Article 40(2) of Directive (EU) 2024/1640, give supervisors in every member state one methodology for assessing and classifying the inherent and residual ML/TF risk profile of obliged entities in the non-financial sector. AMLA sent the financial-sector version to the Commission in December 2025; this is the other half.
AMLA's reason for splitting them is blunt. The non-financial sector runs to more than two million natural and legal persons, dominated by very small entities including solo entrepreneurs, at uneven levels of AML/CFT maturity, and its supervision is fragmented. Some supervisors already run entity-level assessments on around 200 data points. Others have never run one at all.
The method has three steps. Supervisors score inherent risk first, on indicators covering the structure of the entity itself, its customers, products and services, geographies and distribution channels, each scored 1 to 4. They then score the quality of AML/CFT controls, A for very good down to D for poor. Residual risk combines the two, weighted in favour of inherent risk: good controls pull the classification down, but weak ones never push it above what the business already is. Below 1.75 is low risk, 3.25 or above is high, and a supervisor may move a firm one level either way, with reasons documented.
Annex I is where this stops being abstract: sixteen lists of data points tailored to the categories of obliged entity under Article 3(3) of Regulation (EU) 2024/1624. The full list runs to 44 data points for a trust or company service provider, 35 for an estate agent, 34 for an auditor, accountant or tax advisor, and 28 for a notary or lawyer in the listed transactions. They are counts rather than opinions: customers that are legal arrangements, customers who are PEPs, transactions paid fully or partly in cash or crypto-assets, identities verified on a non-face-to-face basis. Annex II adds 31 controls data points, among them how many customers still have no verified beneficial owner, and whether targeted financial sanctions controls are manual or automated.
AMLA proposes a lighter regime for small entities: fewer than five full-time equivalent employees and annual turnover below EUR 600 000, both at once. Those firms report 10 to 25 data points and nothing on controls; their controls score is deemed equal to their inherent score unless the supervisor knows otherwise. The reduced list is a floor, though: where a sectoral risk assessment puts a category at medium-high or high risk, supervisors may require the full set from everyone in it. On AMLA's Eurostat estimates, 81% of auditors, accountants and tax advisors and 83% of real estate agents sit below the five-employee line; with the turnover test applied as well, AMLA still expects 73% of that first sector to qualify.
The timetable is long. The methodology would apply from 31 December 2028, with the first classifications due by 31 December 2029. Until then supervisors keep applying their existing national methodologies, which in Cyprus means supervisors such as the Bar Association, ICPAC and CySEC. Assessments then run yearly, or once every three years for a firm already classified low risk. The consultation closes on 27 September 2026, with a public hearing on 10 September.
The point is not the deadline. The first assessment reads a full calendar year of data, and the questions are countable ones about your own client book. A firm that cannot pull those counts from its own records will be sending its supervisor guesses.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗