Anti-Money Laundering Authority (AMLA)

Which institutions will AMLA supervise directly?

Up to forty groups or entities in the first round: the riskiest cross-border credit and financial institutions active in a significant number of member states, selected under Article 12 of Regulation (EU) 2024/1620. Selection is driven by risk profile and cross-border footprint, not by size alone, which means a mid-sized institution with an unusual risk profile across several member states can be selected while a larger domestic one is not.

The mechanics are fixed in the regulation: AMLA publishes the selected list within six months of the start of a selection period, direct supervision begins six months after publication, an entity stays under AMLA supervision for at least three years, and risk profiles are reassessed every three years under Article 20. The next round opens twelve months before the current one expires.

Gate one: eligibility

You must be a credit or financial institution operating in at least six Member States, including your home Member State, through establishment or through material activity under the freedom to provide services (Art. 12(1) of the AMLA Regulation).

Materiality is set by the technical standard under Article 12(7), and it is a hard arithmetic test. In a host Member State, either:

• customers resident there exceeded 20,000 as at 31 December of the previous year, or
• total annual incoming and outgoing transactions there exceed €50,000,000.

Gate two: risk

Among eligible entities, those in the high residual risk band are selected. Inherent risk is scored across customer, product, geography and channel. Controls quality is scored separately. The two combine into residual risk, and a group's score is a weighted average of its entities. AMLA must pick at least one institution per Member State where none qualifies through the standard process.

Which rules does AMLA own?

The EU-level AML mandate moved from the EBA to AMLA on 1 January 2026. Existing EBA AML/CFT guidelines remain valid under Article 54 of the AMLA Regulation until AMLA replaces them, so guidance you are working from is still in force, but its successor will come from Frankfurt.

AMLA's technical standards mandate is large and already substantially delivered. Finalised standards as at 21 July 2026 include those on business-wide risk assessment (AMLR Article 10(4)), group-wide requirements (Articles 16(4) and 17(3)), customer due diligence (Article 28(1)), criteria for transactions and business relationships (Article 19(9)), sanctions (AMLD Article 53(10)), supervisory cooperation in direct supervision (AMLAR Article 15(3)), FIU-to-FIU and FIU-to-EPPO formats, financial-sector risk assessment (AMLD Article 40(2)) and credit-institution selection (AMLAR Article 12(7)). Still open: non-financial-sector risk assessment, cross-border FIU exchange, the reporting format under AMLR Article 69(3), and guidelines on ongoing monitoring under AMLR Article 26(5).

What does AMLA publish, and how often?

Consultations on draft technical standards and guidelines, press releases and news, and an annual Single Programming Document combining work programme and budget. Its document library held 140 items in August 2026, and ten consultations had been run in total: four open and six closed. Cadence accelerated sharply through the first half of 2026, from nothing to roughly one item every few days by July. There is an RSS feed and a public consultations register.

What can AMLA actually do to an institution?

Article 31 of Regulation (EU) 2024/1620 gives AMLA power to impose administrative pecuniary sanctions on selected obliged entities for serious, repeated or systematic breaches, and periodic penalty payments to compel an entity to stop conduct or comply, subject to the ne bis in idem principle. Caps track Article 53 of Directive (EU) 2024/1640.

The methodology is now public. AMLA's final sanctions standard, published 8 July 2026, sets out a four-step gravity classification (duration, repetition, impact indicators and four gravity levels) and the mechanics of periodic penalty payments: they may be set daily, weekly or monthly, are enforceable only for the period of non-compliance, and are subject to a five-year limitation period for collection.

Against national supervisors, AMLA's tools differ: guidelines and individually addressed recommendations, binding decisions settling disagreements between financial supervisors, investigations of systemic supervisory failures, and, in the non-financial sector, a public warning to a supervisor's counterparties if a recommendation goes unheeded.

What changes if you stay under national supervision?

Two things, and both apply regardless of whether you are ever selected. First, from 10 July 2027 your AML obligations come from a directly applicable EU regulation rather than a nationally transposed directive, meaning less room for national variation and a different interpretive source when you and your supervisor disagree. Second, your supervisor (DNB, the AFM, BaFin, the FMA) is now itself subject to AMLA's oversight and convergence powers, and applies AMLA's technical standards. The rulebook changes even when the supervisor does not.

Two things to be careful about when quoting these figures. The CCV decision is dated March 2026 and was only published in July: describing it as a July fine misdates it by four months. And the bunq penalty is under appeal, so it is not final.

Three of the four decisions turn on transaction monitoring and follow-up on alerts, not on customer identification.

The national layer, which is where most institutions actually live

For everyone AMLA does not pick up, supervision stays national under AMLD6.

In the Netherlands, six supervisors are retained under the draft implementing act: DNB, the AFM, Bureau Financieel Toezicht, the deken of the local bar, the Minister of Finance, and the Kansspelautoriteit. FIU-Nederland stays under the Minister of Justice and Security, keeping the Dutch power to suspend a transaction for up to five working days. See the Wwft page for the national layer as it stands today.

The Dutch implementation is behind, and visibly so. The Implementatiewet ter voorkoming van witwassen en terrorismefinanciering went through internet consultation in 2025. The Adviescollege toetsing regeldruk concluded on 29 September 2025 that the implementation is "niet lastenluw", against the government's own stated policy of adding nothing national on top of the EU package. We found no Kamerstukken dossier for it as at 17 August 2026.

AMLD6 has four staged transposition deadlines: 10 July 2025, 2026, 2027 and 2029. The Eerste Kamer's own EU dossier reports, as at 8 May 2026, that the 2025 tranche was implemented late, the 2026 tranche is not on schedule, the 2027 tranche is on schedule and the 2029 tranche is not on schedule.

The clearest symptom is the UBO register. The decree extending access to persons with a legitimate interest went to Parliament on 2 April 2026. On 15 July 2026 the Raad van State advised in W06.26.00149/III not to adopt it unless amended, on two grounds: it fails to implement access for other persons able to demonstrate a legitimate interest, which the Directive requires be assessed case by case; and the Dutch duty to notify a UBO that their data has been accessed conflicts with the Directive's requirement that access occur without warning the entity. Not in force as at 17 August 2026.