AMLA builds the EU's AML supervisory machinery

Introduction#

AMLA is now the EU's AML/CFT rule-maker. It has sent its first final draft standards for the private sector to the European Commission, but none of them is law yet. It must begin choosing the entities it will supervise directly by 1 July 2027. Direct supervision of that first group is expected from 2028.

How it got here#

1 July 2025. AMLA stood up in Frankfurt under Regulation (EU) 2024/1620. Article 13(4) requires it to begin the first selection by 1 July 2027 and finish it within six months. It must then publish the list. Direct supervision begins six months after publication.

1 January 2026. AMLA took over every AML/CFT mandate the European Banking Authority held, including the EuReCA database. Existing EBAThe European Banking Authority — ESMA's banking-side sibling, responsible for MiCA's stablecoin rulebook. It drafts; the Commission adopts. guidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. stay in force until AMLA replaces them. A citation that names the EBA as the responsible authority is now wrong on the institution, even where it is right on the rule.

12 May to 15 August 2026. AMLA published its reporting package for identifying provisionally eligible entities on 12 May. National supervisors' data collection closed on 15 August. AMLA expected a provisional list of eligible entities by the end of September 2026.

1 October 2026. AMLA sent three sets of final draft regulatory technical standards under Regulation (EU) 2024/1624, the AMLR, to the Commission. They cover customer due diligence, business relationships and thresholds, and group-wide requirements. The same day it published final draft standards on how home and host supervisors of cross-border groups share the work.

7 October 2026. AMLA opened a consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. on draft standards for a central AML/CFT database. AMLA states the database will hold supervisory information, shared among supervisors on a need-to-know basis.

What AMLA weighs for direct supervision#

The AMLA Regulation sets the test in Articles 12 and 13. This checklist follows it; it is not exhaustive, and the detailed method is in standards AMLA must write.

• The kind of firm. Only credit institutions, financial institutions and groups of them can be chosen. Crypto-asset service providers are a named category.
• Reach. The firm must operate in at least six Member States, including its home state. Activity counts “regardless of whether the activities are carried out through infrastructure on the territory concerned or remotely”.
• Risk. AMLA classifies each firm's risk as low, medium, substantial or high. Only a firm whose residual risk is high qualifies.
• Customers. Its share of non-resident customers from high-risk third countries, and of politically exposed persons.
• Products and services. The volume of products most vulnerable to money laundering, and of products that offer anonymity. For money remitters, transfers to and from high-risk third countries.
• Geography. Correspondent banking and correspondent crypto-asset services provided in high-risk third countries.
• Controls. The quality of the firm's own policies, controls and procedures. This turns inherent risk into residual risk.
• Tie-breaks. If more than 40 qualify in the first round, AMLA takes the 40 operating in the most Member States. Among those in the fewest states, the highest share of transactions with third countries decides.

Below six Member States there is no direct supervision, whatever the risk. A crypto-asset service provider that passports into six Member States, with premises in none of them, is inside the gate. After the first round, selection repeats every three years.

Who else the new rules catch#

The AMLR applies from 10 July 2027 to every obliged entity in its Article 3. Football agents and professional football clubs are only two of them, and the AMLR reaches them later, from 10 July 2029. That is why AMLA's customer due diligence standards carry a separate date for football.

The obliged entities include:

• credit and financial institutions;
• auditors, external accountants and tax advisers;
• notaries, lawyers and other independent legal professionals, for transactions such as property deals and setting up companies or trusts;
• trust or company service providers;
• estate agents, including for lettings at a monthly rent of at least EUR 10 000;
• traders in precious metals and stones, and in high-value goods;
• providers of gambling services, and crowdfunding service providers;
• traders in cultural goods at EUR 10 000 or more;
• credit intermediaries, investment migration operators and non-financial mixed activity holding companies.

Most of them stay with their national supervisors. AMLA's direct supervision reaches only the credit and financial institutions it selects.

What comes next#

Short term (to January 2027)

• 3 November 2026, 16:00 CET. Public hearing and consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. deadline on the central database standards.

Medium term (to April 2028)

• By 1 July 2027. AMLA must begin its first selection of directly supervised entities.
• 10 July 2027. The AMLR applies, except to football agents and clubs.
• 2028. Direct supervision of the first group begins.

Long term

• 10 July 2029. The AMLR, and the customer due diligence standards if adopted as drafted, apply to football agents and professional football clubs.

No date yet

• The Commission's adoption of the final draft standards. AMLA gives no timetable, and the Commission may amend them.
• The standards would then apply six months after they enter into force, as AMLA proposes.

Open questions#

1. Has AMLA published the provisional list of eligible entities it expected by the end of September 2026? Our record does not yet show it.
2. When will the Commission adopt the final draft standards, and will it amend them?
3. Which entities will be in the first group? No one can know until the selection in 2027.

What this is not#

• The provisional list names entities that are eligible, not entities selected. No selected list exists, for crypto-asset service providers or anyone else, and none can until 2027.
• The final draft standards are not law. None binds an obliged entity until the Commission adopts it and it is published in the Official Journal.
• Being an obliged entity is not the same as being supervised by AMLA. Most obliged entities never will be.

Reading#

Primary

• Regulation (EU) 2024/1624, the AML Regulation, Official Journal, 19 June 2024
• Regulation (EU) 2024/1620, the AMLA Regulation, Official Journal, 19 June 2024
• EBA and AMLA complete the handover of AML/CFT mandates, AMLA, 1 January 2026
• AMLA's next step toward the 2027 selection of entities for direct supervision, AMLA
• AMLA press release on its final standards for the private sector, AMLA, 1 October 2026
• Consultation paper: draft RTS under Article 11(6) AMLAR, AMLA, 7 October 2026

Ours

• What's live now: FCA, FINMA and the EU

Official

• AMLA news and publications