From 2028, the Anti-Money Laundering Authority (AMLA), now operational in Frankfurt, will assume direct supervisory responsibility over a selected group of high-risk obliged entities across the European Union, particularly credit institutions and certain crypto-asset service providers licensed under MiCA. The selection criteria are embedded in the AML Regulation (EU) 2024/1624 (AMLR) and the AMLA framework regulation, with final designation expected to follow the completion of key regulatory technical standards by 10 July 2026. Institutions that fall within scope face a materially different compliance environment: direct federal-level scrutiny by AMLA rather than coordination through national competent authorities alone.
The Institutional Architecture Behind AMLA Direct Supervision
AMLA became operational on 1 July 2025, establishing itself in Frankfurt as the EU's first centralised anti-money laundering authority. The transition of AML/CFT mandates from the European Banking Authority (EBA) was completed on 1 January 2026, marking a structural shift in how the Union coordinates financial supervision. AMLA's Single Programming Document for 2026–2028, published on 4 February 2026, sets out its operational priorities and resource planning for the period leading up to direct supervisory engagement.
The architecture is deliberately two-tiered. AMLA will directly supervise a defined subset of obliged entities – those assessed as posing the highest residual money laundering and terrorist financing risk. All other obliged entities remain subject to national competent authorities, albeit within a framework now substantially harmonised through the AMLR and AMLD6 (Directive (EU) 2024/1640). AMLA functions as a coordinator and supervisor-of-supervisors for the wider population, but wields direct investigative and sanctioning powers over the selected group.
For cross-border groups with EU operations, understanding where AMLA's direct reach begins is not merely an academic question. It has immediate consequences for governance structures, internal audit scope, record-keeping obligations, and the management of beneficial owner registers.
Legal Framework: AMLR, AMLD6 and the Role of Technical Standards
The primary legal basis for AMLA direct supervision rests on the AMLR (Regulation (EU) 2024/1624) and the AMLA founding regulation. Both the AMLR and AMLD6 apply from 10 July 2027, giving obliged entities and Member States a defined runway for adaptation. Direct AMLA supervision of the first selected entities then commences in 2028, following the completion of selection procedures.
The AMLR introduces a harmonised beneficial ownership threshold of 25% or more, which forms part of the due diligence infrastructure that AMLA will assess when reviewing an institution's AML/CFT framework. AMLD6 governs the operation of beneficial ownership registers and the supervisory responsibilities of national authorities, establishing the cooperative structure within which AMLA operates.
Critically, AMLA is required to finalise most of its 23 regulatory technical standards (RTS) and implementing technical standards (ITS) by 10 July 2026. These standards will define with precision the risk indicators, supervisory methodologies, and reporting obligations that selected institutions must meet. Until those standards are adopted and implemented, some aspects of the selection and supervision framework remain interpretively open. Institutions should monitor EUR-Lex closely for delegated acts and published RTS drafts as consultation periods close.
Which Entities Are in Scope: The Selection Criteria
AMLA direct supervision is not universal. The selection mechanism targets obliged entities that meet a combination of cross-border activity thresholds and residual risk assessments. Based on the AMLA framework regulation, the following categories are particularly relevant:
- Credit institutions operating in a significant number of Member States and assessed as posing elevated AML/CFT risk – the precise numerical thresholds are set in the AMLA founding regulation and will be operationalised through the relevant RTS.
- Crypto-asset service providers (CASPs) holding a licence under MiCA (Regulation (EU) 2023/1114) and operating across multiple EU jurisdictions. The intersection of the MiCA licensing regime with AMLA supervision creates a dual regulatory burden that groups entering the EU crypto market should plan for explicitly. For further context on the end of the MiCA transitional period and what it means for CASPs, see our MiCA transition analysis.
- Other financial institutions – including payment institutions, e-money institutions, and certain investment firms – where cross-border exposure and risk indicators meet the selection threshold.
Non-financial obliged entities (real estate agents, auditors, trust and company service providers, lawyers in certain capacities) are generally not in scope for AMLA direct supervision at this stage, though they remain subject to the AMLR's harmonised obligations and national supervisory oversight under AMLD6. This distinction matters for structuring compliance budgets and governance priorities.
ESMA and EBA retain their sector-specific roles in the supervisory ecosystem. AMLA does not displace ESMA's responsibilities under MiCA or EBA's ongoing prudential remit; it operates in parallel, focusing specifically on the AML/CFT dimension. Clear protocols for information sharing and joint supervisory actions between AMLA, EBA, ESMA, and national competent authorities are expected to emerge through the RTS process.
Open Questions and Interpretive Risks
Several material questions remain unresolved as of the date of this analysis. First, the exact methodology for assessing "residual risk" – the factor that may tip a borderline institution into AMLA's direct supervision perimeter – has not yet been fully specified in publicly available RTS drafts. Institutions with complex group structures, multiple CASP licences, or diverse product ranges face genuine uncertainty about whether they will fall within or outside the selected group.
Second, the interaction between AMLA's supervisory college model and national competent authority jurisdiction is still being defined. For groups supervised at both AMLA and national levels – for instance, a banking group with some entities selected and others not – the practical division of supervisory labour will depend on guidance that has not yet been issued.
Third, the enforcement and sanctioning framework available to AMLA against selected entities under the AMLR involves potentially significant administrative measures. However, the precise procedural rights of institutions subject to AMLA decisions – including rights of review before the European Commission and potential recourse to the Court of Justice of the European Union (CJEU) – are set out in the founding regulation and will be tested in practice only once AMLA begins exercising its powers.
Finally, cross-border implications for non-EU groups are not fully resolved. A third-country institution providing services into the EU through a branch or via a CASP licence may find that AMLA's reach extends to its EU-facing operations in ways that differ from the current patchwork of national AML supervision. Beneficial owner disclosure and the 25% threshold under the AMLR will apply irrespective of where the ultimate parent is domiciled.
If your organisation is assessing its position within the AMLA supervision perimeter, our team is available to discuss the specific facts of your structure. Please reach out to info@ferrazwhitmore.com or visit our contacts page.
Practical Impact: What Changes for Institutions Within Scope
Being selected for AMLA direct supervision is a qualitatively different experience from national AML supervision, even under the most active national competent authorities. Institutions should expect the following:
- Dedicated joint supervisory teams (JSTs) composed of AMLA staff and representatives from national competent authorities, modelled in some respects on the ECB's approach under the Single Supervisory Mechanism (SSM) – though AMLA's mandate is strictly AML/CFT rather than prudential.
- Heightened on-site inspection risk: AMLA has explicit powers to conduct on-site inspections at selected entities. Institutions should ensure that their document management, data governance, and staff availability protocols are inspection-ready.
- Direct reporting obligations to AMLA, which will sit alongside – and in some cases supersede – existing national reporting flows. Groups currently reporting to multiple national financial intelligence units and supervisors should model the impact of consolidating certain AMLA-directed obligations.
- Sanctions exposure: AMLA can impose administrative sanctions directly on selected entities for AML/CFT breaches under the AMLR. The financial and reputational consequences of a formal AMLA finding are likely to exceed those of most current national enforcement actions, given the EU-wide visibility of AMLA decisions.
- Governance scrutiny: AMLA supervision will likely involve detailed review of governance frameworks, including the suitability and mandate of AML compliance officers, the adequacy of group-wide AML/CFT policies, and the functioning of beneficial ownership identification procedures at the 25% threshold.
For institutions with Netherlands operations, the AML/CFT compliance environment has been particularly active in recent years. Our dedicated AML compliance practice in the Netherlands can assist with assessing readiness for both current national requirements and the incoming AMLA framework.
Cross-Border and Structural Considerations
The shift to AMLA direct supervision has non-trivial structural implications for groups that have organised their EU presence around jurisdictional arbitrage in AML supervision. The harmonisation introduced by the AMLR removes a significant part of the variation between Member State regimes that previously existed. Groups that chose a particular EU booking entity or head office location partly on the basis of lighter-touch national AML enforcement will need to reassess that calculus.
For international groups with EU-regulated entities, the beneficial owner identification and disclosure requirements under the AMLR – applying the 25% threshold consistently across all Member States – mean that corporate structures involving intermediate holding vehicles, nominee arrangements, or complex fund structures will require thorough review prior to 10 July 2027. The interaction with national beneficial ownership register requirements under AMLD6 adds a further layer: even where AMLA is not the direct supervisor, the registers will be accessible to AMLA and to national competent authorities across the EU.
Tax structuring decisions and AML compliance are increasingly intertwined in cross-border group planning. Corporate structures that reduce tax exposure may create beneficial ownership disclosure patterns that draw AML scrutiny, and vice versa. Our tax law practice works alongside our AML compliance team to ensure that group structuring advice takes both dimensions into account.
Third-country groups entering the EU through a MiCA CASP licence face a particularly demanding environment. The CASP licence requires ongoing AML/CFT compliance under the AMLR, and if the licensed entity meets AMLA's selection thresholds, it will be subject to direct AMLA supervision from 2028. Planning the scope of EU operations, the choice of booking entity, and the compliance infrastructure should begin well in advance of the 10 July 2027 application date.
Strategic Recommendations for Preparation
Given the lead times involved and the volume of RTS still being finalised by July 2026, proactive preparation is the most effective risk management tool available to obliged entities at this stage. The following steps are material regardless of whether an entity ultimately falls within the AMLA-selected group:
- Map your selection exposure: Conduct an internal analysis of whether your entity or group meets the indicative criteria for AMLA direct supervision – cross-border presence, risk categorisation, and MiCA CASP licence status are the starting points.
- Monitor the RTS pipeline: Track the 23 RTS and ITS that AMLA is required to finalise by 10 July 2026. Each standard that is adopted will refine the compliance obligations that selected – and non-selected – entities must meet from 2027 onwards.
- Review beneficial ownership structures: Ensure that your beneficial ownership identification framework is capable of consistently identifying and recording holders at the 25% threshold across all relevant jurisdictions, consistent with the AMLR.
- Assess governance and compliance officer mandates: AMLA supervisory reviews are likely to scrutinise the independence, seniority, and resourcing of the AML compliance function. Institutions with compliance officers who lack board-level access or adequate staffing should address this before 2027.
- Engage with national competent authorities now: The transition to AMLA supervision will be prepared through national competent authority channels. Maintaining a constructive supervisory relationship at the national level positions institutions better for the selection and joint team formation process.
- Model the operational impact of dual reporting: Where groups currently report to multiple national supervisors, model what AMLA-directed centralised reporting would require in terms of data infrastructure, translation of legal obligations, and staff capacity.
Outlook
The period between now and 10 July 2026 – when the bulk of AMLA's RTS and ITS are due – is the most consequential planning window available. After that date, the regulatory perimeter will be substantially fixed, and institutions that have not begun adapting their governance, compliance infrastructure, and group structures will find themselves under significant time pressure ahead of the 10 July 2027 application of the AMLR and AMLD6.
AMLA's 2026–2028 programming document makes clear that the authority is building operational capacity in parallel with the regulatory standard-setting process. The first selection decisions are expected to be taken in the period leading up to the 2028 start of direct supervision, meaning that engagement with the selection process may begin for some institutions before the AMLR technically applies.
The EU's move to centralised AML supervision represents the most significant structural change to the European financial compliance landscape since the introduction of the SSM for prudential purposes. Institutions that treat AMLA as a distant regulatory development rather than an immediate planning priority do so at meaningful operational and reputational risk.
If you would like to discuss your institution's exposure to AMLA direct supervision, assess readiness against the incoming AMLR framework, or explore structural options in light of these changes, our team is available to assist. You are welcome to contact us at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.