Periodic questionnaire on the prevention of money laundering and terrorist financing

NBB_2026_02 – 16 February 2026 Circular – P. 1/7 NBB - Public Boulevard de Berlaimont 14 – BE-1000 Brussels tel. +32 2 221 29 30 company number: 0203.201.340 RPM Brussels www.nbb.be Circular Brussels, 16 February 2026 Reference: NBB_2026_02 Your correspondent:
Nathan Dessy
Supervision.ta.aml@nbb.be
Periodic questionnaire on the prevention of money laundering and terrorist financing Scope of application

• Credit institutions, including EU and non-EU branches
• Stockbroking firms, including EU and non-EU branches
• Insurance undertakings authorised to conduct life insurance business, including EU and non-EU
  branches
• Payment institutions and electronic money institutions, including EU and non-EU branches
• Payment institutions and electronic money institutions authorised in other member states of the
  European Economic Area and established in Belgium through one or more agents and/or distributors
• Settlement institutions, including EU and non-EU branches
  Summary/Objectives
  By means of this circular, the National Bank of Belgium seeks to obtain standardised information from financial institutions in order to strengthen its risk-based approach to the exercise of its statutory supervisory powers in the fight against money laundering and terrorist financing. In addition, this edition of the questionnaire anticipates the operationalisation of the future European Anti￾Money Laundering Authority (AMLA) and contributes to preparing for greater European convergence of supervisory practices. Structure

1. Introduction
2. Development of the periodic questionnaire
3. Responding to periodic questionnaires
4. Timetable
5. Practical aspects
6. Methodology for responding to the questionnaire
   BanqueNationale Jank
   DE BELGIQUE VAN BELGIË
   Eurosystem
   BanqueNationale Jank
   DE BELGIQUE VAN BELGIË
   Eurosystem

NBB_2026_02 – 16 February 2026 Circular – P. 2/7 NBB - Public Dear Sir or Madam, Please find appended hereto forms by means of which the National Bank of Belgium (hereinafter “the Bank”) seeks to obtain standardised information about, on the one hand, the inherent risks associated with money laundering and terrorist financing (hereinafter “ML/FT”) to which your institution is exposed and, on the other hand, the quality of the risk management measures taken by your institution. The Bank expects your financial institution to return the completed questionnaire as set out below.

1. Introduction
   The international standards for combating money laundering, terrorist financing and proliferation (known as the "FATF Recommendations"), adopted in 2012, require a risk-based approach. Institutions must tailor their organisation to the ML/FT risks to which they are exposed, and supervisors must have a supervisory model based on the level of ML/FT risks of the institutions under their supervision. This risk-based supervisory obligation is enshrined in both European regulations and Article 87 of the Act of 18 September 2017 on the prevention of money laundering and terrorist financing and the restriction of the use of cash. The European Banking Authority has also published guidelines on the implementation of a risk-based approach. These guidelines assist national authorities in developing their supervisory model, which must be based on four steps:

• Step 1: identification of ML/TF risk factors;
• Step 2: assessing the specific ML/FT risks for each supervised institution;
• Step 3: exercising supervision; and
• Step 4: monitoring, evaluating and adjusting the supervisory model.
  In order to enable the Bank to carry out a risk assessment for each of the different financial institutions subject to its supervision and to set its priorities accordingly, it must have information on, on the one hand, the inherent ML/TF risks to which institutions are exposed and, on the other hand, the quality of the risk control measures taken by institutions. The combination of these two assessments makes it possible to define the residual ML/TF risk incurred by each institution and the associated supervisory priorities. The purpose of the periodic questionnaire covered by this circular is to collect this information from each of the institutions subject to the Bank's supervision1 . The information provided by institutions via the periodic questionnaire is supplemented in practice by other sources of information to which the Bank has access or which it can obtain, and will be assessed in the light of these sources. These sources include, among others, findings from on-site inspections, contacts between the supervisory authority and financial institutions, contacts with auditors and the reports drawn up by them, information exchanged with the CTIF/CFI, the prudential supervisory authorities and the AML/CFT authorities of other EU Member States and third countries, information provided by the judicial authorities, etc. 1 The information provided relates only to activities for which the above-mentioned institutions are subject to supervision by the Bank. This does not include, for example, the activities of a credit institution acting as an agent for an insurance company (for the sale of insurance products), which are subject to supervision by the FSMA.

NBB_2026_02 – 16 February 2026 Circular – P. 3/7 NBB - Public
2. Development of the periodic questionnaire
In 2013, the Bank sent financial institutions an AML/CFT questionnaire for the first time. The main purpose of this questionnaire was to check the compliance of the financial institution's internal AML/CFT procedures with the relevant Belgian regulations, so the focus was mainly on the quality of the risk control measures taken by financial institutions. In subsequent years, new questions and/or new sections were regularly added to this periodic questionnaire. In 2017, the Bank also collected information for the first time on the inherent ML/TF risks to which the institutions under its supervision are exposed. Until 2023, questions on inherent ML/TF risks and those relating to compliance were grouped together in a questionnaire for each sector (credit institutions, life insurance companies, payment institutions and electronic money institutions, stockbrokers). With a view to enhancing cross-sector comparability by area of activity and improving the effectiveness of its analytical approach, the Bank carried out a structural review of the periodic questionnaire in 2024. This review resulted in the creation of several separate forms, each targeting a specific area of activity, as well as a form common to all sectors. This segmentation was intended to refine the analysis of the data collected and facilitate a more accurate assessment of risks, while preserving the comparability of information across all sectors concerned. However, the European regulatory framework will undergo a profound change in 2026–2027 with the operationalisation of the new European Anti-Money Laundering Authority (AMLA). Established by Regulation (EU) 2024/1620, this authority will introduce a major paradigm shift: the transition from exclusively national supervision to a system where national and European approaches will be more closely intertwined. From 2027, the AMLA will select certain financial institutions to be subject to its direct supervision from 2028. This selection will target the riskiest entities with a significant cross-border presence. While the basic structure of the questionnaire remains unchanged, this edition includes a substantial adaptation in anticipation of the AMLA's selection mechanism. For this reason, in addition to the usual sections on inherent risks and risk management, the Bank has introduced a new form for assessing eligibility for direct supervision by the AMLA. The sole purpose of this form is to collect factual data to determine whether your institution – or the group to which it belongs – meets the geographical conditions set out in Article 12 of Regulation (EU) 2024/1620. As a reminder, financial institutions operating in at least six Member States (including their home state) are eligible for direct supervision. In order to assess this geographical criterion objectively, the questionnaire requires the following information:

• Institutions are asked to specify whether they belong to a group. If so, they must identify the
  parent entity within the EU and, if they themselves are at the head of the group, provide a comprehensive map of the group's physical locations in other Member States.
• European regulations stipulate that an activity carried out without a physical presence (under
  the freedom to provide services) may be counted towards the "six countries" criterion, provided that it is material. To enable the Bank and the AMLA to verify this materiality, new quantitative data is required:
  o For group heads: for each Member State in which the group operates under the freedom to provide services (via the parent company or other group entities), the total number of customers and the annual volume of transactions must be reported.

NBB_2026_02 – 16 February 2026 Circular – P. 4/7 NBB - Public o For individual entities (outside a group context): a similar declaration is required for their own cross-border activities under the freedom to provide services. The Bank would like to point out that geographical eligibility does not prejudge the final selection. The period covered by the questionnaire remains unchanged: the information provided by institutions must still relate to the previous calendar year (as at 31 December). Apart from the addition of the new section on AMLA eligibility criteria described above, the other sections of the periodic questionnaire remain identical to those in the previous edition. The Bank wished to maintain this stability before undertaking a more comprehensive overhaul of the questionnaire in 2027 (covering data for 2026). This future structural revision will result from the implementation of new harmonised European standards aimed at ensuring the comparability of risk assessments within the European Union. The future questionnaire will thus be aligned with the common methodology prescribed under Article 40 paragraph 2, of Directive (EU) 2024/1640 and detailed in a Commission Delegated Regulation supplementing that Directive with regard to regulatory technical standards establishing the benchmarks and methodology for the assessment and classification of the inherent and residual risk profile of credit institutions and financial institutions. This European standardisation will introduce a common set of mandatory data points for assessing inherent risks and the quality of internal controls within the obliged entities.
3. Responding to periodic questionnaires
Financial institutions must submit their responses to the periodic questionnaire via OneGate, where it is available in the form of electronic forms. In addition to the AMLA form and the form common to all sectors, institutions must, where applicable, complete the specific forms relating to the areas of activity in which they are actually engaged. All forms are accessible via the OneGate platform to all financial institutions, regardless of the nature of their authorisation and activities. Financial institutions should only complete the specific form(s) relating to the activities they actually carry out. Any specific forms (or parts of forms) that do not apply to your institution should be declared as irrelevant using the dedicated function ("set to nihil") on OneGate. The Bank will automatically receive the information provided by your institution once the electronic forms have been completed and sent. In order to guarantee the security of the information provided, your institution must have an electronic certificate to access the OneGate application. These certificates can be obtained from various external service providers (including Globalsign, Isabel and Quo Vadis). Institutions that do not have a Belgian CBE number may, as an exception, request an exemption from the obligation to use an electronic certificate by sending an email to supervision.ta.aml@nbb.be . If such an exemption is granted, the institution concerned will be assigned a username and password to enable it to access the OneGate application and thus complete the periodic questionnaire. Further information about OneGate and access to this application can be found at the following address:
https://www.nbb.be/en/reporting/onegate-reporting/onegate-documentation.

NBB_2026_02 – 16 February 2026 Circular – P. 5/7 NBB - Public
4. Timetable
Responses to the periodic questionnaire must be submitted via OneGate by 15 May 2026 at the latest. The electronic forms in which the requested information must be provided will be made available via OneGate.
5. Practical aspects
All forms are available in Dutch, French and English.
The periodic questionnaire will not be sent to you in paper format. To view it, you must visit the Bank's website and download the relevant annexes to this circular. You can find them on the Bank's website by following these steps:
1. Go to www.nbb.be
2. Go to: Activities→ Financial supervision and resolution→ Combating money laundering and the
financing of terrorism → Information and recommendations→ Useful links and documents→ Main reference documents→ click on this circular If you have any questions, please contact the Bank's AML/CFT team at the following address:
supervision.ta.aml@nbb.be.
6. Methodology for responding to the questionnaire
a) Answering the questions
In the electronic forms available via OneGate, your institution must provide the necessary information by selecting the answer that best suits your institution's organisation (e.g. "yes", "no" or "not applicable") from the drop-down menu for each question. When numerical information is requested, your institution generally has the choice between the response options "not available" or "number". If your institution does not have the statistical information necessary to answer the question with certainty, you should select the "not available" option. Conversely, if your institution has the requested information, you should select the "number" option and enter the correct figure. Finally, if the question is not relevant to your institution, you should also select the "number" option and enter the figure "0". Please note:
Numbers must always be entered without full stops or commas between thousands. Full stops may only be used for decimals. If the number is not entered in the correct format, an error message will appear and you will not be able to complete the form.

• Example error message:
• Correct format:
  4.2 © Number
• The given inputvalue contains illegal characters © Not Available
  Number
  422.45
  4.2 © Number
• The given inputvalue contains illegal characters © Not Available
  Number
  422.45

NBB_2026_02 – 16 February 2026 Circular – P. 6/7 NBB - Public b) Reference date for answering questions With regard to the date to be taken into account when answering the questions asked, two types of questions must be distinguished. Questions relating to statistical information always specify the date or period to which the requested information must refer. In most cases, the information requested relates either (i) to the situation as at 31 December of the previous calendar year (e.g. number of customers as at 31 December 2025) or (ii) to the previous calendar year (e.g. number of payments made to high-risk countries in 2025). For qualitative questions, such as those concerning the compliance of internal procedures with applicable legislation or the controls carried out or not carried out by an institution, the institution must always take a position as at 31 December of the previous calendar year. c) Indicative list of countries that may present an increased ML/FT risk The questionnaire includes questions relating to transactions carried out from or to countries that may be considered to present an increased risk of money laundering or terrorist financing. A list is attached in the appendix. It should be noted that the countries listed are for information purposes only and that this list has no official status. d) Responsibility for the accuracy of responses The effective management of the financial institution concerned bears ultimate responsibility for the responses to the questionnaire submitted to the Bank. It should also be noted that the person designated within any financial institution in accordance with Article 9 § 2 of the Act of 18 September 2017 is primarily responsible, pursuant to that same legal framework, not only for analysing atypical transactions in order to determine whether they should be considered suspicious and reported to the Financial Intelligence Unit (CTIF/CFI), but also for implementing the policies and procedures referred to in Article 8 of the Act. This refers in particular to the internal control measures and procedures necessary to ensure compliance with the Act, which are addressed in the questionnaire. Article 9 of the Act also stipulates that this officer must ensure, in general, that the institution complies with all its obligations to prevent money laundering and terrorist financing and, more specifically, that it has put in place the appropriate administrative organisation and internal control measures required under Article 8 of the Act. This person must also have the power to propose to the effective management of the institution, on his or her own initiative, any measures necessary or useful for this purpose, including the release of the necessary resources.

NBB_2026_02 – 16 February 2026 Circular – P. 7/7 NBB - Public The Bank therefore expects senior management of financial institutions to decide on the answers to the questionnaires based on a proposal by the person responsible for the prevention of money laundering and terrorist financing within the institution. The Bank can, in the context of specific supervisory actions or on-site inspections, verify the accuracy and quality of the answers provided by institutions. A copy of this circular is being sent to the auditor(s) of your company or institution. Yours faithfully, Pierre Wunsch Governor Appendices: 7 - only available at www.nbb.be:

1. Common form for all financial institutions covered by this circular;
2. Specific form for institutions offering banking and/or financing services;
3. Specific form for institutions offering payment and/or electronic money services;
4. Specific form for institutions providing investment and asset management services and activities;
5. Specific form for institutions engaged in life insurance activities;
6. Indicative list of countries that may present an increased risk of money laundering or terrorist
   financing;
7. Common form for assessing eligibility for direct supervision by the AMLA.