NBB periodic AML questionnaire — Belgium’s OneGate return

Belgium’s annual AML questionnaire now contains a form whose only purpose is to work out whether the European supervisor will take you over. Circular NBB_2026_02 of 16 February 2026 carries the National Bank of Belgium’s periodic questionnaire on the prevention of money laundering and terrorist financing. It is filed through OneGate, it was due by 15 May 2026, and this edition adds a seventh annex — an AMLA eligibility form testing the six-Member-State criterion in Article 12 of Regulation (EU) 2024/1620. This piece covers who is in scope, what the forms ask, the conventions that block submission, and three worked cases.

1. What the questionnaire is for

Belgian AML supervision is risk-based by statute. Article 87 of the Act of 18 September 2017 on the prevention of money laundering and terrorist financing and the restriction of the use of cash obliges the supervisor to run a model built on the ML/TF risk of each supervised institution, and the European Banking Authority’s guidelines set the four steps that model follows: identify risk factors, assess each institution, supervise, then monitor and adjust.

The periodic questionnaire is how the National Bank gathers the inputs — inherent risk on one side, quality of control measures on the other, producing a residual risk score and the supervisory priority attached to the institution.

It is not the Bank’s only source. The answers are read against inspection findings, supervisory correspondence, auditors’ reports, information exchanged with the Belgian FIU (CTIF-CFI), the prudential authorities, AML/CFT authorities in other Member States and third countries, and information from judicial authorities.

2. Who has to file — including firms that are not Belgian

The circular’s scope list is broader than the set of firms the Bank prudentially authorises, and this is where foreign payment firms get caught.

• Credit institutions, including EU and non-EU branches.
• Stockbroking firms, including EU and non-EU branches.
• Insurance undertakings authorised to conduct life insurance business, including branches.
• Payment institutions and electronic money institutions, including EU and non-EU branches.
• Payment institutions and electronic money institutions authorised in another EEA Member State and established in Belgium through one or more agents and/or distributors.
• Settlement institutions, including branches.

The fifth line is the one to read twice. A firm passporting into Belgium through an agent or distributor network has no Belgian authorisation and may never have spoken to the National Bank about capital or governance — and is still expected to answer. The circular also confines the exercise: the information relates only to activities for which the institution is supervised by the Bank, so activities supervised by the FSMA fall outside it.

3. Seven annexes, and only some of them are yours

The circular carries seven annexes. Since a structural review in 2024 the questionnaire has been split by area of activity rather than by authorisation type, so the same business can be compared across sectors.

• A common form for all institutions covered by the circular.
• Specific forms for banking and/or financing services; payment and/or electronic money services; investment and asset management services and activities; and life insurance.
• An indicative list of countries that may present increased ML/TF risk — and the circular is explicit that it is for information only, with no official status.
• The new common form for assessing eligibility for direct supervision by AMLA.

All forms are visible in OneGate to every institution regardless of authorisation, which is a trap dressed as convenience. You complete only the specific forms for activities you actually carry out; anything that does not apply must be declared irrelevant using the “set to nihil” function. Leaving an inapplicable form untouched is not the same thing, and the difference is visible to the supervisor.

4. The AMLA eligibility form

This is the substantive change in the 2026 edition. Regulation (EU) 2024/1620 establishes the European Anti-Money Laundering Authority, which will select institutions in 2027 for direct supervision from 2028, targeting the riskiest entities with a significant cross-border presence. Article 12 sets the geographic gate: a financial institution operating in at least six Member States, including its home state, is eligible.

The form collects only the factual data needed to test that gate. It asks whether the institution belongs to a group; if so, to identify the parent entity within the EU; and, where the institution is itself the group head, to map the group’s physical locations in other Member States.

Then it goes further than physical presence, because the Regulation does too. Activity carried on under the freedom to provide services — with no establishment at all — counts towards the six-country criterion provided it is material. To let the Bank and AMLA test materiality, the form requires new quantitative data: for group heads, the total number of customers and the annual volume of transactions for each Member State in which the group operates under freedom of services, through the parent or any group entity; for standalone entities, the same for their own cross-border activity.

The Bank notes that geographical eligibility does not prejudge the final selection. True, and not reassuring: these are the figures that decide whether a firm appears on the list at all, and the firm supplies them itself.

5. Answering conventions that stop the form dead

Responses go through OneGate as electronic forms, available in Dutch, French and English. There is no paper version. The mechanics are unforgiving in small ways.

• Qualitative questions use a drop-down — typically yes, no or not applicable.
• Numerical questions offer “not available” or “number”. If the institution does not hold the statistic with certainty, it selects not available; if the question is not relevant, it selects number and enters 0. Two different answers, saying different things.
• Number formatting. No thousands separators; full stops only as decimal separators. A wrongly formatted figure produces an illegal-characters error and the form cannot be completed until it is fixed.
• Reference date. Statistical questions state the date or period. Qualitative questions are answered as at 31 December of the previous calendar year, not as at the date of filing.
• Certificates. OneGate access requires an electronic certificate from an external provider. An institution without a Belgian enterprise (CBE) number may exceptionally request an exemption from the Bank’s AML/CFT team and is issued a username and password instead.

The qualitative reference date matters more than it looks. A firm that remediated a control gap in March and answers in May is describing a state of affairs that did not exist on the reference date. The correct answer is the 31 December position, with the remediation raised through supervisory channels.

6. Worked example — the group that counts to six

Facts: a Belgian electronic money institution heads a small EU group. It has branches in two Member States, a subsidiary in a third, and sells into four more purely under freedom of services — three with a few hundred customers each, one with a substantial book.

Which rule applies: Article 12 counts operation in at least six Member States including the home state. Physical presence here is four. Freedom-of-services activity counts, but only where material — which is why the form asks for customers and annual transaction volume per Member State rather than a yes/no.

What the practitioner does: stops treating the FoS countries as a passporting-notification list and starts treating them as a reporting dimension. Pulls customer counts and annual transaction volumes per Member State of residence — customer master and transaction ledger, reconciled — and maps the group’s physical locations from the corporate register. Documents the materiality reasoning per country, because the Bank can verify it on inspection.

Outcome: the firm sees its own numbers before the supervisor does. Whether it lands at five countries or seven, it can explain the count — and it now holds the per-country dataset the 2027 harmonised questionnaire will ask for again.

7. Worked example — the passporting firm with no Belgian number

Facts: a payment institution authorised in another EEA Member State distributes a prepaid product in Belgium through agents. It has no Belgian establishment, no Belgian enterprise number and no prudential relationship with the National Bank. Nobody in the firm is watching Belgian circulars.

Which rule applies: the scope expressly covers payment and e-money institutions authorised in another EEA Member State and established in Belgium through agents and/or distributors. Access needs an electronic certificate, but a firm without a CBE number may request an exemption from the Bank’s AML/CFT team and receive credentials instead.

What the practitioner does: requests the exemption early, because credentials are a lead-time item against a fixed deadline. Establishes which specific forms apply — common form, payment and e-money form, AMLA form — and sets everything else to nihil. Scopes the answers to Belgian agent-distributed activity, since the information relates only to activities supervised by the Bank.

Outcome: the durable fix is organisational. Every market entered through agents acquires a host-state AML reporting obligation that no passport notification will remind you about. That register has to be maintained by whoever decides to enter the market.

8. Worked example — “not available” is an answer about you

Facts: an institution cannot split its Belgian transaction volume by counterparty country for the reference year. The analyst, under deadline pressure, selects “not available” on a dozen country-level questions.

Which rule applies: the convention is explicit. “Not available” means the institution does not hold the statistic with certainty; number with a value of 0 means the question is not relevant. The first is a statement about the firm’s data capability, the second about its business.

What the practitioner does: uses “not available” where it is true and records why — that list is next year’s data-gap register. Where the figure is obtainable with work, does the work: a supervisor treats an inability to produce basic geographic exposure data as a finding in itself, and monitoring that cannot be broken down by country has a known blind spot.

Outcome: the pattern of “not available” answers describes the firm’s MI capability as precisely as the numeric answers describe its risk, and it is read that way.

9. Who signs, and who else gets a copy

Responsibility is allocated explicitly. Effective management bears ultimate responsibility for the answers submitted. The person designated under Article 9 §2 of the Act of 18 September 2017 — the AML compliance officer — is primarily responsible for analysing atypical transactions and implementing the internal control policies required by Article 8, which are precisely what the questionnaire interrogates. The Bank therefore expects senior management to decide the answers, on a proposal from that officer.

Two further facts belong in the governance calendar. The Bank can verify the accuracy and quality of the answers during supervisory actions or on-site inspections. And a copy of the circular goes to the institution’s auditors, so the questionnaire is visible to a second party seeing the same control framework from another angle.

One more date is worth diarising. The structure is deliberately stable this year ahead of a comprehensive overhaul in 2027, covering 2026 data, aligned with the common methodology required by Article 40(2) of Directive (EU) 2024/1640 and the Commission Delegated Regulation setting the benchmarks for classifying inherent and residual risk. That will bring a mandatory common data set, and the year to build the underlying data is this one.

FAQ

What to do, today

• Check whether Belgium is in your reporting perimeter at all. Agents and distributors put you there even with no establishment and no Belgian authorisation.
• Sort OneGate access before the data work, and request the certificate exemption early if you have no CBE number. Credentials are a lead-time item against a fixed date.
• Build the per-Member-State dataset — customers and annual transaction volume — for every country you serve under freedom of services. The AMLA form needs it, and so will the 2027 questionnaire.
• Set inapplicable forms to nihil rather than leaving them blank, and answer qualitative questions as at 31 December, not as at the filing date.
• Treat your “not available” answers as next year’s work plan, and have effective management approve the responses on the AML compliance officer’s proposal — the circular allocates responsibility that way.

Related: AML data returns compared — beyond the SAR · OneGate at the NBB — PI and ELMI reporting · CTIF-CFI — reporting suspicions in Belgium