The EU’s anti-money laundering regime is undergoing its most significant structural overhaul in decades, and financial institutions that treat it as a distant policy shift risk being caught unprepared.
According to Alessa, at the heart of the reform is the Frankfurt-based Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), which became operational on 1 July 2025 and will assume direct supervision of the bloc’s highest-risk financial institutions by 2028.
Alessa, a Canadian RegTech firm, recently discussed AMLA, and what the EU’s AML authority means for FIs.
AMLA was created under EU Regulation 2024/1620, part of a 2024 legislative package designed to fix a fractured supervisory model in which 27 national systems interpreted the same EU directives in different ways.
Germany won the bid to host the agency in February 2024, and on 1 January 2026 the European Banking Authority completed the transfer of all its AML and CFT mandates to AMLA, consolidating powers previously scattered across multiple bodies.
The authority’s supervisory model runs on two tracks. Directly, AMLA will oversee a select group of high-risk entities active in at least six member states, chosen on objective cross-border and risk criteria.
The selection process must begin by 1 July 2027 and conclude within six months, with direct supervision launching in January 2028. Around 40 institutions are expected in the first wave, mostly large banking groups, alongside payment institutions, e-money firms and crypto-asset service providers.
Indirectly, AMLA’s reach extends much further. It will build a common supervisory methodology, run peer reviews of national regulators and, in defined circumstances, step in where a national authority fails to act.
Supervisors such as Germany’s BaFin and Luxembourg’s CSSF remain the front line for most firms, but will increasingly apply AMLA’s standards rather than their own. AMLA will also support national financial intelligence units in joint cross-border analyses and manage FIU.net, though FIUs remain the sole recipients of suspicious transaction reports.
AMLA sits alongside the Anti-Money Laundering Regulation (AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6), which together form the EU AML Package. The AMLR’s directly applicable status is its most consequential feature; from 10 July 2027, firms can no longer lean on more permissive national readings of customer due diligence or KYC rules.
The regulation also broadens the compliance net, pulling all MiCAR-authorised crypto-asset service providers fully into AML scope and adding crowdfunding platforms and non-bank consumer credit providers.
Compliance teams should not wait for 2028. Priorities include running a gap analysis against the AMLR text, particularly on enhanced due diligence for politically exposed persons, revisiting business-wide risk assessments, embedding sanctions and PEP screening into onboarding, and tracking AMLA’s 23 Level 2 and Level 3 measures, most due by 10 July 2026. Institutions treating 2026 as a preparation year will be far better placed than those scrambling once direct supervision begins.
Read the full Alessa post here.
Copyright © 2026 FinTech Global
