AMLR Has Member States on Their Toes: What the 2026 National Risk Assessments Mean for Your Business-Wide Risk Assessment

AMLR has got countries on their toes. Are you preparing for it?

Between June and October 2026, three Member States put new national risk assessments into the hands of their obliged entities. Ireland launched its 2026 assessment on 18 June. Spain's 2026 Análisis Nacional de Riesgos was approved by its national prevention commission on 12 June and the public version was published in July. Luxembourg's 2026 terrorist financing assessment was announced by the CSSF on 12 October, less than a year and a half after Luxembourg updated its money laundering assessment in May 2025.

Ireland, Spain and Luxembourg are the first movers I see in this direction, although each is approaching it differently. Their methodology and implementation measures point towards the risk assessment framework that AMLR and AMLD6 establish.

Each of these documents feeds into the business-wide risk assessment of every obliged entity in that country, which is exactly what my Business-Wide Risk Assessment under AMLR Article 10 seminar is built around. My practical advice is that when your own Member State publishes, you put everything else aside, read it and test your own assessment against it. That is my recommendation, not a statutory deadline, but it is the right instinct.

1. Three Member States, three different documents

The three publications are not the same kind of document, and the difference matters for how you read them.

Spain published a comprehensive ML/TF national risk assessment. The public version runs to 284 pages and covers every sector subject to Law 10/2010, from credit institutions to crowdfunding platforms and multiple IBAN services. Spain carried out a full national risk assessment in 2020 and a partial update through the 2024 Addendum. The 2026 report explains that, unlike exercises focused on partial or sectoral updates, this edition reassesses threats, vulnerabilities and risks across all sectors. It cites Article 8 of Directive (EU) 2024/1640 (AMLD6) as reinforcing the obligation to carry out the national assessment.

Luxembourg published a national risk assessment of terrorist financing covering the observation period 2021 to 2024. It follows the FATF Terrorist Financing Risk Assessment Guidance (2019) and applies a three-stage framework of threat, vulnerability and mitigating factors to produce inherent and residual risk scores for each sub-sector.

Ireland launched its 2026 Money Laundering, Terrorist Financing and Proliferation Financing national risk assessment together with a Priority Actions Implementation Plan. The plan sets out 30 actions for the following 18 months, each with a responsible body and a delivery quarter, and presents them as a way to demonstrate measurable progress ahead of Ireland's 2028 Mutual Evaluation.

2. Spain: the AMLA rating scale arrives early

The most telling detail in the Spanish report is methodological. Inherent and residual risk are rated using the classification in Article 12(3) of Regulation (EU) 2024/1620, the AMLA Regulation: low, medium, substantial and high. Spain then added intermediate levels (low/medium, medium/substantial, substantial/high) for a more granular result. Strictly, Article 12(3) is the scale AMLA itself will use to classify the inherent and residual risk profiles of credit and financial institutions operating in at least six Member States, as part of selecting entities for direct supervision. Spain has chosen to borrow it for its national assessment. That choice is the signal.

On the sector chapters, the highest residual rating goes to crypto-asset service providers, which remain high for both money laundering and terrorist financing even after MiCA and recent supervisory action. Money remittance, e-money institutions and currency exchange start from high inherent risk and end at substantial residual risk. Credit institutions, real estate and lawyers are all rated substantial for residual money laundering risk, and online gambling substantial/high. The executive summary describes e-money institutions and money remittance as carrying high money laundering risk, so it is worth reading the sector conclusions rather than relying on the summary alone.

For investment firms and fund managers, the securities chapter is worth reading in full. The sector is rated substantial for inherent money laundering risk and medium for residual money laundering risk, with terrorist financing risk rated low at both stages. The report records 64 AML/CFT inspections of the sector between 2020 and 2025, most of them of investment firms, and one sanction since 2020 against an entity providing investment services, where deficiencies were found in staff training and in the external expert report. It also observes that employees' knowledge of their AML/CFT obligations "cannot always be considered satisfactory" (my translation). The same chapter already refers to recital 131 of the AMLR when discussing omnibus accounts.

What this means in practice: nothing in Article 12(3) requires your firm to adopt a four-point internal scale. But if your national assessment is written in low, medium, substantial and high, you need to be able to show how your own ratings relate to it. Labels alone are not enough. A firm whose "medium" is defined differently from the national "medium" should say so, explain its definitions and methodology, and document how the national findings were reflected.

3. Luxembourg: high inherent risk where the volume is

Luxembourg's assessment concludes that the prevailing terrorist financing threat comes from lone actors, small cells and foreign terrorist fighters with low and granular financial needs, using basic and widely available products offered by retail banks, payment institutions, e-money institutions and, increasingly, virtual asset service providers. Funds are mainly of legitimate origin, such as salaries, social benefits and small loans, which makes detection harder. The scenario of large international terrorist organisations using the financial centre to move substantial funds is assessed as largely theoretical, with a low threat rating.

The sector table is direct. Retail and business banks, entities operating online, payment institutions, e-money institutions and virtual asset service providers are all rated high for inherent terrorist financing risk and medium for residual risk. Car dealers, accountants, professional directors and business centres, notaries, chartered professional accountants and commercial companies are also rated high inherent and medium residual.

The report also looks ahead. Among cross-sector and emerging vulnerabilities, it flags stablecoins and self-hosted wallets (while noting that overall volumes remain limited),virtual IBANs and instant payments fragmenting financial chains and compressing response windows, AI-enabled forged documents used to access regulated sectors, and unregulated donation-based crowdfunding platforms, which "present elevated risk pending AMLR application in July 2027". AMLR entered into force in July 2024. The July 2027 date is when it generally starts to apply.

4. Ireland: the firm's risk assessment written into the national plan

Ireland's implementation plan contains the clearest statement of how a national risk assessment is supposed to reach the firm. Under Action 2, due in Q3 2027, the Central Bank will roll out its updated Risk Evaluation Questionnaire sector by sector and provide periodic, structured feedback to sectors and firms on ML/TF and financial sanctions evasion risks and the associated AML/CFT obligations, expressly "in line with 6AMLD requirements". Firms will be expected to incorporate this feedback into their business-wide risk assessments and their AML/CFT systems and controls.

Action 3, due in Q1 2027, states that regulated financial firms should ensure their AML/CFT frameworks keep pace with changing threats and vulnerabilities arising from new technologies and innovation. The Central Bank, for its part, is to develop a systematic understanding of how emerging technologies, including AI, create both vulnerabilities and opportunities, and to set out its expectations on firms' AML/CFT governance, risk management and wider control frameworks so that they keep pace with the criminal use of new technologies.

The national assessment, in other words, is not meant to sit in the background. It is designed to arrive in your business-wide risk assessment.

5. Why AMLR makes the timing matter

Taking national risk assessments into account is not new. The EBA's ML/TF Risk Factors Guidelines already list governments' national risk assessments among the sources firms should always consider when identifying ML/TF risk. What AMLR does is put the link into a directly applicable regulation, with a fixed start date.

Article 8 of AMLD6 requires each Member State to carry out a national risk assessment, keep it up to date and review it at least every four years, to make appropriate information available promptly to competent authorities and obliged entities, and to publish a summary of the findings. Member States must transpose AMLD6 generally by 10 July 2027.

On the firm side, Article 10(1) of Regulation (EU) 2024/1624 (AMLR) requires obliged entities to identify and assess their ML/TF risks, and the risks of non-implementation and evasion of targeted financial sanctions, taking into account at least, among other things, the findings of the national risk assessments carried out under Article 8 of AMLD6 and any relevant sector-specific risk assessment. Article 10(3) requires the business-wide risk assessment to be documented, kept up to date and regularly reviewed, including where any internal or external events significantly affect the ML/TF risks associated with the entity's activities, products, transactions, delivery channels, customers or geographical zones of activity. AMLR generally applies from 10 July 2027.

A new national assessment may identify precisely that kind of external change. It does not automatically change your firm's rating. A national sector rating informs your assessment, it does not determine your score. But it does require you to review the relevant findings, decide whether your risks have significantly changed, and be able to show how you reached that conclusion.

My practitioner forecast: my expectation is that the remaining Member States will follow before AMLR generally applies on 10 July 2027. That is my practitioner assessment, not a publication deadline imposed by AMLD6. My reasoning is practical. A Member State whose firms build their first AMLR business-wide risk assessments on an ageing national picture has an obvious problem, both with its supervised population and with its next mutual evaluation.

For UK readers, the comparison is about the same practical review discipline, not about AMLR, which does not apply to UK firms generally. HM Treasury published the UK's National Risk Assessment of Money Laundering and Terrorist Financing 2025 on 17 July 2025, and your firm-wide risk assessment should already show how you considered it.

6. The day your national risk assessment lands

These are the steps I recommend taking first when your Member State publishes. They are my practical recommendations rather than a sequence prescribed by any of the texts above.

1. Compare the ratings. Compare national inherent ratings with your own inherent scores, and residual ratings with your residual scores, allowing for differences in scope and methodology. Where your assessment differs materially from the relevant national findings, explain and document why.

2. Check the typologies. Read the threat chapters for new typologies and products, and check whether each one appears in your risk factors and your scenario library.

3. Check the geography. Compare the jurisdictions the national assessment treats as higher risk with your client and payment flows.

4. Map the scale. Where it is meaningful, map your internal ratings to the national findings. Compare definitions and methodology, not only labels, and record how your levels correspond to the national ones.

5. Document the review. Record that the national assessment was considered, what you concluded, what changed in your risk assessment as a result, and who approved it. Article 10(3) AMLR requires the business-wide risk assessment to be documented, kept up to date and made available to supervisors on request. A clear review record is the practical evidence of how the national findings were taken into account.

If you want to work through these steps against your own assessment, my Business-Wide Risk Assessment under AMLR Article 10 seminar covers each of them, from inherent and residual scoring to documenting the review.

Know what is coming before it arrives. The Business-Wide Risk Assessment under AMLR Article 10 seminar walks through the full methodology, including how to bring national and supranational risk assessment findings into your scoring, step by step.

Explore the Business-Wide Risk Assessment seminar at cpds.academy

Sources

Department of Finance (Ireland),National Risk Assessment: Money Laundering, Terrorist Financing and Proliferation Financing 2026 and Priority Actions Implementation Plan, launched 18 June 2026

Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias (Spain),Análisis Nacional de Riesgos de Blanqueo de Capitales y de Financiación del Terrorismo 2026, public version

Ministry of Justice (Luxembourg),2026 National Risk Assessment of Terrorist Financing, and CSSF announcement of 12 October 2026

Regulation (EU) 2024/1624 (AMLR),Articles 10 and 90, Directive (EU) 2024/1640 (AMLD6),Articles 8 and 78, and Regulation (EU) 2024/1620 (AMLA Regulation),Article 12(3),EUR-Lex

EBA, ML/TF Risk Factors Guidelines (EBA/GL/2021/02, consolidated), paragraph 1.30

HM Treasury, National Risk Assessment of Money Laundering and Terrorist Financing 2025, 17 July 2025

This article is for general information only and does not constitute legal advice. Where a view is marked as a practitioner forecast or recommendation, it is the author's interpretation and is not attributed to any of the sources cited.