AMLA is collecting the data that decides who it supervises

AMLA has set out the sequence. Data collection for calibration ran in the spring of 2026 with a sample of entities; testing and validation of the risk models continues to the end of 2026; national supervisors collect the final data from eligible entities in the first quarter of 2027; the selection procedure begins in July 2027, with the outcome communicated by the end of that year. Direct supervision starts in 2028, and the exercise repeats every three years. Two numbers frame the outcome. AMLA has said it will select up to 40 entities or groups in the first round, chosen on their residual risk profile, meaning the risk that remains once existing controls are taken into account. Eligibility is much wider than 40, so being counted as eligible in 2026 says something about a group's footprint and nothing about its conduct.

For a company with a single licence the question is trivial. It reads its own authorisation and answers. A group composes the answer from subsidiaries, branches, establishments and cross-border activity that sit in different countries, are administered by different teams and were set up at different times. It is normally put together at short notice, in a spreadsheet, by whoever was asked, and the version that leaves the building is rarely compared with the version sent last year.

That matters here because the answer travels through a national supervisor and is consolidated centrally against every other group's answer. A dormant establishment nobody closed, a branch recorded in one system and missing from another, or a member state counted differently by two teams moves a count that a threshold turns on. The same underlying record supports beneficial ownership questions, bank onboarding and every future supervisory request, so an inconsistency here seldom stays local.

The remedy is dull. Keep one maintained record of every entity, branch and establishment, each with its jurisdiction, its status, its date of registration and, where relevant, the supervisor it answers to. Produce any figure sent to a supervisor from that record and keep it with the date it was produced. Reconcile the things that quietly go stale: entities in liquidation nobody closed, branches deregistered locally but still listed centrally, establishments created for a single transaction. And give the answer an owner, because a request arriving through a national supervisor with a short deadline is answered badly when it arrives without one, and this one is scheduled years ahead.

The register carries what the template asks about: entities with their jurisdictions and registered particulars, the ownership between them, the officers who serve them, the documents that evidence them, the bank accounts and mandates attached to them. A group that maintains it can list which entities exist in which member states and draw a structure chart from the record it already holds.

Supervisory requests sit alongside every other dated obligation, with an owner and a due date, and the audit trail shows who changed a structural fact and when. Alethia files nothing with AMLA and decides nobody's eligibility. What a compliance officer gets is narrower and more useful: the request that arrives in 2027 opens on the same register that answered the one in 2026, with every change between them on the record.