Segnalazioni periodiche antiriciclaggio (Italy)

The segnalazioni periodiche antiriciclaggio are Banca d’Italia’s annual AML data return, and most payment firms in Italy still treat them as a questionnaire. They are not. Since the Provvedimento of 27 November 2024 added a Part Eight and an Annex 2 manual to the Banca d’Italia AML organisation provisions of 26 March 2019, every supervised intermediary sends a coded, validated return through INFOSTAT by 31 March, covering the previous calendar year. It sits alongside, and must reconcile with, the annual AML function report due on 30 April. This guide walks through who files, the seven sections and their voce codes, the INFOSTAT mechanics, and the classification rules that catch first-time filers.

1. Legal basis and calendar

Article 7 of Legislative Decree 231/2007 empowers Banca d’Italia to issue provisions on organisation, procedures and internal controls, and to require periodic reports relevant to AML/CFT. Banca d’Italia used that power in the Provvedimento of 27 November 2024, which inserted Parte Ottava, “Le segnalazioni periodiche antiriciclaggio”, into the Disposizioni of 26 March 2019 and added Allegato 2, the “Manuale per le segnalazioni di vigilanza antiriciclaggio”. The recitals cite the EBA risk-based supervision guidelines (EBA/2021/16): the return feeds Banca d’Italia’s own ML/TF risk model for each supervised intermediary.

The rule itself is short. Recipients send the return annually, the reference period is the previous calendar year, stock data are taken at 31 December, and the deadline is 31 March of the following year. The next cycle therefore covers 2026 and falls due on 31 March 2027. Banca d’Italia published a consolidated text of the Disposizioni on 13 March 2026, together with a user guide and an example XML file on its AML regulation page.

2. Who files

Part Eight addresses the “destinatari” of the Disposizioni. The list includes banks, SIMs, SGRs, SICAVs and SICAFs, Article 106 TUB intermediaries, electronic money institutions, payment institutions, CASPs (added by the Provvedimento of 23 July 2025), Italian branches of banking and financial intermediaries headquartered in another EU country or a third country, and EU banks, PIs and EMIs required to appoint a central contact point in Italy under Article 43(3) of Decree 231/2007.

Two practical points follow. First, an EU EMI or PI with an Italian branch files for the branch; the manual addresses branches expressly in several voci. Second, the footnote excluding central-contact-point entities from the Disposizioni applies to Part Two, not Part Eight. A firm distributing in Italy through agents with a central contact point should not assume it is outside the return; it should confirm its position with Banca d’Italia before the first deadline.

3. The seven sections and their voci

The manual organises data in four levels: section, voce, sottovoce and attributes. Seven sections exist, but not every recipient fills every section:

Section V is where the work sits. It asks for direct AML/CFT costs and investments, board meetings that discussed AML (including those that examined the annual report and self-assessment), where the AML function sits and what is outsourced, the experience of the AML head and the SOS officer, AML FTEs, audits and corrective actions, reports from the control body under Article 46 of Decree 231/2007, checks on the distribution network, training hours, terrorism screening alerts, CDD backlog, transaction-monitoring alerts, judicial and police requests, SOS sent to the UIF, SOS archived, SOS pending at year-end, and the residual-risk score.

Stock data are at 31 December; flow data cover the year. Euro amounts in sections IV and V are reported in whole euro, with other currencies converted at the ECB reference rate on the reference date.

4. Filing through INFOSTAT

The return travels through INFOSTAT, either as an XML file built to Banca d’Italia’s technical documentation or through the portal’s manual data entry, which the system converts to the same XML. A firm without INFOSTAT access must first send the signed adhesion form to the PEC address of Banca d’Italia’s statistical data service; the PIN comes back to the firm’s PEC mailbox (or a digital domicile for foreign entities without PEC), with the password sent separately to the designated manager. The manual also asks for a functional mailbox used only for reporting exchanges.

The user guide describes a scheduler showing the 31 March deadline and the 31 December accounting date, and a Diagnostico function that runs a test submission through the same checks as the official one. Banca d’Italia then re-runs its controls on receipt. Findings (rilievi) must be corrected promptly, or the data confirmed with an explanation if the anomaly reflects real activity. Corrections are made by resubmitting the entire return, never a partial file.

5. The classification rules that trip first filers

One customer, one sottovoce. In voce 61653, a customer under enhanced due diligence who falls into several categories is reported once, following a fixed priority: cross-border correspondent accounts first, then relationships involving high-risk third countries identified by the Commission under Article 9 of Directive (EU) 2015/849, then PEPs, then other high-risk countries the firm applies EDD to. Sottovoci 20 and 22 are residual, for EDD applied for any other reason.

Occasional customers are split. Voce 61651 counts account holders who also made occasional transactions; voce 61655 counts customers with no ongoing relationship at 31 December who made occasional transactions subject to CDD under Article 17 of Decree 231/2007.

Frozen customers. Voce 61651 also asks how many account holders were subject to asset-freezing measures communicated to the UIF under Article 7 of Legislative Decree 109/2007 during the year.

Identification channel. Voce 61659 separates new customers identified in person, remotely via digital identity or qualified electronic signature (SPID is the manual’s example), via video identification with an operator (referencing EBA/GL/2022/15), via automated biometric matching, via other remote procedures, and through third parties, with the third-party category specified.

6. Worked example: an EU EMI’s Italian branch

Facts: An EMI authorised in another Member State runs an Italian branch serving 40,000 retail customers and 3,000 small businesses. AML controls are performed by a head-office team in the home state.

What the rule says: The branch is a destinatario under letter (i). It fills sections I, II, V and VII. It does not fill section III (reserved to Italian intermediaries) or section VI (reserved to Italian group parents). In voce 61667 the manual tells branches to include the costs the head office incurs to run AML controls on the branch. In voce 61673 it reports that the AML function’s tasks are outsourced to the “casa madre”.

What the practitioner does: The branch’s compliance lead obtains a cost allocation from head office, agreed in advance and documented, and counts only effective time on Italian AML work for staff who also cover other tasks. FTEs in voce 61683 follow the same allocation, so costs and headcount tell one story.

Outcome: A return that shows the head-office model plainly rather than reporting near-zero branch costs that Banca d’Italia’s risk model would read as under-investment.

7. Worked example: reconciling SOS figures

Facts: A payment institution’s case-management system shows 1,800 transaction-monitoring alerts in 2026, 140 cases escalated to the SOS officer, 95 SOS sent to the UIF, 38 archived and 7 still open at 31 December.

What the rule says: Voce 61701 wants all automated alerts, whether routed to first-level review or straight to the AML function. Voce 61705 wants the number and euro amount of SOS sent to the UIF in the year. Voce 61707 wants archived cases, split by origin (automated systems, front line, control functions, judicial requests, other), each counted once by first origin in time. Voce 61708 wants cases pending at the reference date.

What the practitioner does: The MLRO reconciles 95 plus 38 plus 7 to the 140 escalations before filing, and ties the 95 to the UIF portal’s own record of transmitted reports. A case first raised by an alert and later the subject of a judicial request is counted as “automated systems”.

Outcome: Figures that match the SOS filings and the annual report, which is where supervisors look for inconsistencies.

8. Worked example: the self-assessment timing trap

Facts: A firm plans its annual cycle around 30 April: the AML function finalises the self-assessment and the annual report in April and the board approves them the same month.

What the rule says: Voce 61709 asks for the overall residual-risk score for the reference period from the self-assessment run under the Part Seven methodology. That score goes in the return due 31 March, a month before the report that contains it.

What the practitioner does: The firm moves the self-assessment scoring to February, locks the residual-risk figure before the INFOSTAT diagnostic run, and uses the April report to explain it. Board meeting counts in voce 61669 cover meetings held during the reference year, so the approval of last year’s report counts in this year’s return.

Outcome: One residual-risk figure used consistently in both documents.

9. Building the return as a control, not a form

• Data owner per voce. Customer counts from the core system, alerts and SOS from case management, costs from finance, training from HR.
• CDD backlog as a live metric. Voce 61699 asks for customers with incomplete CDD data, incomplete beneficial-owner data, and CDD reviews overdue against the firm’s own refresh schedule. If you only compute these once a year, the number will surprise you.
• Diagnostic run in early March, leaving time for a full resubmission.
• A reconciliation file kept with the return, tying each figure to its source extract, ready for a rilievo.

FAQ

What to do, today

• MLRO: map each Section V voce to a data owner and a source system.
• Compliance lead of an Italian branch: agree the head-office cost and FTE allocation for voci 61667 and 61683 before December.
• Risk: move self-assessment scoring ahead of the 31 March deadline.
• Reporting: confirm INFOSTAT access and the functional mailbox now, not in March.

Related: AML data returns compared across the EU · INFOSTAT, Banca d’Italia’s reporting channel · The Italian reporting calendar