Parent undertakings must ensure that internal procedures, risk assessment and staffing requirements apply to all group branches and subsidiaries in Member States and, for groups headquartered in the Union, in third countries. They must perform a group-wide risk assessment informed by business-wide assessments from branches and subsidiaries, and establish and implement group-wide policies, procedures and controls for AML/CFT, including data protection and intra-group information sharing; obliged entities must implement those measures taking account of their specificities and risks. Group-wide policies and risk assessments must include the elements listed in Articles 9 and 10 and take account of information published by authorities where group establishments are located.

Group-level compliance functions are required, including a compliance manager and, where justified, a compliance officer, with the scope documented. The compliance manager must report regularly to the management body in its management function and at minimum submit an annual implementation report and remedy identified deficiencies; they shall assist collectively responsible management bodies and prepare necessary decisions. Group policies must require exchange of customer due diligence and ML/TF risk information — including identity, beneficial ownership, purpose of relationship and suspicions with supporting analyses reported to the FIU under Article 69 — and permit non-obliged entities to provide relevant information to obliged entities. Parents must ensure confidentiality, data protection and appropriate use of exchanged information. AMLA must deliver draft RTS by 10 July 2026 specifying minimum requirements for group policies, information-sharing standards, criteria for identifying parent undertakings in specified cases and conditions applying to entities in structures with common ownership, management or compliance control; the Commission is delegated to adopt those RTS under Articles 49–52 of Regulation (EU) 2024/1620.