UIF schede di feedback: how Italy benchmarks your SOS

Italy’s financial intelligence unit does something most FIUs do not: it tells a reporting firm how its suspicious-transaction output compares with its peers. The instrument is the scheda di feedback, and the UIF restarted sending them with a comunicato of 28 April 2026. It goes twice a year to firms that filed at least 100 SOS in the reference period, it sets their numbers against the previous period and against a named Gruppo di confronto, and four of the sixteen comparison groups are payments groups — cards, payment institutions and their contact points, money transfer, and virtual-currency operators. This guide sets out who gets one, when it arrives, how the peer grouping works, and what a compliance function should and should not do with an unflattering column.

1. What a scheda di feedback is

The legal hook is article 41, paragraph 2, of D.Lgs. 231/2007, which underpins the UIF’s return flow of information to reporting entities. The UIF runs two distinct flows under that heading, and they are easy to confuse because both arrive by the same channel.

The esiti communication groups the reports it names into two lists. List A holds SOS that lacked «sufficienti elementi di rischio a supporto del sospetto di riciclaggio e di finanziamento del terrorismo». List B holds reports that carried some supporting elements but were classified as low risk. The scheda di feedback sits a level above that: it is not about individual reports at all, but about the shape of your reporting as a whole.

2. Who gets one, and when

Two conditions. You must be enabled on the Infostat-UIF portal, and you must have filed at least 100 SOS in the reference period. The reference periods are the first half-year and the full year, which produces a sending rhythm worth writing into the compliance calendar:

• January to February — covering SOS sent in the first half of the previous year.
• June to July — covering SOS sent across the whole of the previous year.

The second window therefore restates the first six months inside a twelve-month figure. That is a feature, not a duplication: it lets a firm see whether a first-half pattern held or reversed.

Delivery runs by certified email (PEC) to the address the reporter has given, and the same communication is published on the Infostat-UIF portal under Visualizza messaggi. The data also comes as an XML attachment with a published schema, which is the detail most firms miss — the scheda is machine-readable, so the comparison can be loaded into your own reporting dashboard rather than read once as a PDF and filed.

The 79 intermediaries in the first send give a sense of scale. The 100-SOS floor is a real filter: most Italian obliged entities will never receive a scheda.

3. The Gruppo di confronto, and why payments firms are split four ways

Your numbers are set against two baselines: your own previous period, and a comparison group. The group «coincide di norma con la categoria di appartenenza del segnalante» — normally the reporter’s own category in the UIF’s published statistics — but with adjustments that reflect the different size and operating characteristics of certain intermediaries. The statistics in the scheda cover every member of the group, not only the firms that received a scheda.

That last point matters for interpretation. If your group has 17 members and only three of them filed 100 SOS, the group average you are being measured against still includes the fourteen that did not.

The groups relevant to a payments or crypto business, with the group sizes stated in the April 2026 comunicato, are these:

The full list runs to sixteen groups, the rest covering banks split by branch count, consumer and commercial finance, leasing and factoring, private banking and wealth management, trade finance and corporate banking, insurers, gold and precious-metal dealers, gaming service providers and public-administration offices.

Three of those five payments groups draw from a single published category. A card issuer, a money-transfer operator and a generalist payment institution can all sit under the same statistical heading and still be benchmarked separately — which is the point, because their transaction mixes produce completely different SOS profiles. Group membership is a small number in every case, so a single large reporter moves the group average visibly. Read your position as a position in a small cohort, not as a national ranking.

4. Three worked cases

Case A — the contact point that files 140 SOS in a half-year

An EU e-money institution operating in Italy through a punto di contatto files 140 SOS between January and June. It clears the 100 threshold, so in the following January-to-February window a scheda arrives by PEC and appears under Visualizza messaggi. Its comparison group is most likely CARTE, 17 members, depending on how the UIF classifies its activity.

What the firm does: takes the XML rather than the PDF, loads the indicators next to its own internal SOS statistics for the same period, and looks first at the direction of travel against its own previous half-year. A gap against the group is interesting; a reversal against yourself is actionable, because you know what changed internally and you do not know what changed inside the other sixteen.

Case B — the payment institution that files 80

A smaller payment institution files 80 SOS in the reference period. No scheda arrives. This is not a finding about the quality of its reporting, and nothing is owed to the UIF as a result.

What the firm does: stops waiting. The comparison groups and their sizes are published in the comunicato, and the UIF’s own statistical publications carry aggregate SOS figures by category. A firm below the threshold can build the same sanity check by hand once a year — its own SOS count per 1,000 active customers, per million euro of transaction volume and per alert raised, set against the category totals the UIF publishes. That is coarser than a scheda, and it catches the same failure mode: a monitoring programme that has quietly stopped producing reports.

Case C — the scheda that shows you well below your group

A money-transfer operator’s scheda shows it materially below its group on the reporting-activity indicators. The instinctive response — file more — is the wrong one, and it is worth being explicit about why.

What the firm does: treats the gap as a hypothesis to test in the monitoring chain, not a target to hit. Working backwards: are the scenarios calibrated to a materially different customer base from the rest of the group, which would explain the gap legitimately? What is the ratio of alerts raised to alerts closed without escalation, and has it drifted? How many escalations reach the responsabile for the SOS decision, and how many of those convert? A firm that finds no explanation at any of those three stages has a monitoring problem. A firm that finds its conversion rate collapsed after a scenario change has a specific, datable defect. Filing marginal reports to move a number degrades the intelligence the UIF receives and is visible in exactly the flow that would then show it — the quarterly esiti and its list A.

5. Pairing the scheda with the quarterly esiti

The two flows answer different questions, and they are considerably more useful read together than apart. The scheda tells you how much you report relative to your peers; the esiti tell you what happened to the reports you sent.

A firm above its group on volume but with a heavy list A in the quarterly esiti is reporting a lot of material the UIF does not find informative. A firm below its group on volume with almost nothing in list A may simply be selective. Neither combination is a conclusion on its own, but each one suggests where to look first — at scenario thresholds in the first case, at alert coverage in the second.

Both flows land in the same two places, so the operational fix is the same for both: make sure the PEC mailbox is monitored by someone who will act on it, and make sure the Infostat-UIF account is enabled and has more than one enabled user. A scheda that sits unread in a shared PEC inbox for six months is a supervisory finding waiting to be made, not a technical inconvenience.

6. Where the scheda belongs in your governance

Feedback that benchmarks a firm against its peers is exactly the kind of evidence an AML function is expected to use. The practical placements are three.

• In the annual effectiveness review of the monitoring system. The scheda is external evidence about output; almost everything else in that review is internal.
• In the report to the board or to the Italian management of the branch or contact point. Two numbers — your indicator and your group’s — travel further in a governance forum than a page of narrative.
• In the business-wide risk assessment. A durable gap against a peer group is a data point about inherent risk or about control effectiveness, and the assessment should say which one you concluded it was, and why.

Retain the XML with the rest of the SOS documentation. An inspection question about why reporting volumes moved in a given half-year is much easier to answer from a preserved series of schede than from a reconstruction.

7. What to do, today

• Check that your PEC address on file with the UIF is monitored by a named person in the AML function, not only by a general mailbox.
• Confirm you have at least two enabled users on Infostat-UIF who can open Visualizza messaggi, so a departure does not cut off the return flow.
• Count your SOS for the last two reference periods against the 100 threshold, and note which cycle you qualify on — half-yearly, annual, or neither.
• Decide now where the scheda lands: name the document it feeds, whether that is the monitoring effectiveness review, the board pack or the business-wide risk assessment.
• Build the manual version if you are below the threshold — SOS per 1,000 customers, per million euro of volume, and per alert, tracked half-yearly against the UIF’s published category figures.
• Retain the XML attachments as part of the SOS record, so a volume movement can be explained from a series rather than reconstructed.

Related: How to file a SOS with the UIF · UIF anomaly indicators and red-flag schemes · Comunicazioni oggettive — Italy’s objective cash return · The Italian AML framework beyond the UIF