EBA publishes final 4.3 reporting technical package for third-country branches and AMLA risk-assessment reporting
Third-country-branch reporting teams and AMLA-scope obliged entities must produce reports conforming to the EBA 4.3 DPM, validation rules and XBRL taxonomy — AMLA risk-assessment reporting from 31 December 2026 and CRD Article 48l TCB reporting from 31 March 2027
Change
On 9 July 2026 the European Banking Authority (EBA) published the final technical package for version 4.3 of its reporting framework, providing the DPM, validation rules and XBRL taxonomies for Third-Country Branch supervisory reporting under Article 48l CRD (first reference date 31 March 2027) and for AMLA risk-assessment reporting used to identify obliged entities for AMLA direct supervision (first reference date 31 December 2026).
Why it matters
The package fixes the data points, validation logic and XBRL structure that reports must satisfy, removing local interpretation of those elements, for two obligations: CRD Article 48l supervisory reporting by Third-Country Branches (first reference date 31 March 2027) and AMLA risk-assessment reporting supporting the methodology to identify obliged entities for AMLA's direct supervision (first reference date 31 December 2026). Reporting systems, templates and validation routines must be updated to the published DPM and taxonomies before the relevant reference dates or submissions will fail EBA validation. A draft was published on 17 April 2026; the final version incorporates stakeholder feedback, and the EBA may issue a hotfix at end-September 2026 if early implementation surfaces critical issues.
Implications
- — Third-country branch reporting teams at credit institutions must map and populate reporting feeds to the EBA 4.3 DPM and submit using the EBA XBRL taxonomy by the 31 March 2027 first reference date — feeds not conforming to the published DPM, validation rules and taxonomy will produce invalid or non-accepted CRD Article 48l submissions.
- — Entities within scope of AMLA's risk-assessment data collection must produce the AMLA risk-assessment reporting using the 4.3 DPM and taxonomy components by the 31 December 2026 first reference date — this reporting feeds the methodology identifying which obliged entities fall under AMLA's direct supervision.
- — Bank IT and reporting-system vendors must implement the 4.3 annotated templates, validation rules and XBRL configurations in client-facing software before the relevant reference dates — without the updates, clients risk being unable to generate accepted CRD Article 48l or AMLA risk-assessment reports.
Who is affected
- — Third-country branch reporting teams at credit institutions
- — Obliged entities within scope of AMLA's risk-assessment data collection
- — Bank IT and reporting-system vendors
What to watch
- — 31 December 2026 — first reference date for AMLA risk-assessment reporting under the EBA 4.3 technical package, supporting identification of obliged entities for AMLA direct supervision.
- — 31 March 2027 — first reference date for Third-Country Branch supervisory reporting under CRD Article 48l using the EBA 4.3 DPM, validation rules and XBRL taxonomy.
- — End of September 2026 — the EBA may issue a targeted hotfix to the 4.3 package if early implementation feedback surfaces critical clarifications or adjustments.