Although the AMLR will not become fully applicable until 10 July 2027, AMLA is already preparing for the next phase: harmonising AML supervision across Europe and selecting the financial groups that will come under its direct supervision in 2028. Beyond the regulatory timeline lies a more fundamental challenge: having an AML/CFT framework that is compliant on paper will no longer be enough. Financial institutions will need to demonstrate, with supporting evidence, that their framework is effective and that the risk assessments and controls underpinning it are based on reliable, verifiable data.
What is AMLA, and how will it reshape the European supervisory framework?
AMLA (Authority for Anti-Money Laundering and Countering the Financing of Terrorism) is the European authority established to strengthen and harmonise supervision in the fight against money laundering and terrorist financing. Based in Frankfurt, it was established in 2024 and began developing its operational capabilities in 2025. It is expected to become fully operational when direct supervision begins in 2028.
Its creation follows several major money laundering scandals that exposed weaknesses in supervisory coordination and oversight across Europe, including the Danske Bank scandal, which came to light in 2018 and involved substantial suspicious financial flows through the bank's Estonian branch.
The change is structural. The legislative package adopted in 2024 consists of several complementary components: the AMLR (Regulation (EU) 2024/1624), which establishes directly applicable obligations for the entities concerned; AMLD6 (Directive (EU) 2024/1640), which strengthens national anti-money laundering frameworks; and AMLA, which develops technical standards, promotes convergence in supervisory practices and directly supervises certain high-risk financial institutions.
AMLA therefore does more than change the rules financial institutions must follow. It also transforms how their AML/CFT frameworks will be assessed and supervised. Harmonised assessments require supervisors to compare objective evidence, making data quality, traceability and availability essential foundations of the supervisory process.
What are the key AML regulatory milestones between 2026 and 2028?
The implementation timeline is particularly tight:
2026: AMLA finalises its regulatory instruments. Three sets of technical standards went to the European Commission on 1 October 2026;
10 July 2027: The AMLR becomes fully applicable. However, Regulation (EU) 2024/1624 provides that certain obligations affecting specific entities will only apply from 10 July 2029, for professional football clubs and their agents;
2027–2028: The entities subject to direct supervision will be selected in 2027, ahead of the launch of AMLA's direct supervisory activities in 2028.
Together, these developments will gradually establish a common framework for assessing and supervising AML/CFT arrangements more consistently across the European Union.
How will the Single Rulebook affect banks and compliance teams?
AMLA is responsible for developing a range of regulatory instruments designed to clarify and harmonise the implementation of the new European framework. Its work programme includes RTS, ITS, guidelines and recommendations, several of which directly affect financial institutions' regulatory obligations.
Customer Due Diligence (CDD) is one of the main areas of focus.
AMLA finalised its first three sets of technical standards and sent them to the European Commission on 1 October 2026. They cover customer due diligence (Article 28(1) AMLR), business relationships and linked transactions (Article 19(9) AMLR), and group-wide rules for subsidiaries in third countries (Articles 16(4) and 17(3) AMLR). Once adopted, they set the documentation an institution must hold on each customer and how a group applies one policy across the entities it controls.
Suspicious Transaction Reports (STRs) are another key area. AMLA has worked on a harmonised format for reporting suspicions and submitting transaction records to Financial Intelligence Units (FIUs). The aim is to make information more structured and consistent across the European Union, facilitating its analysis and improving the consistency of reports submitted by financial institutions.
AMLA is also developing a common risk assessment methodology to promote greater consistency in supervision across Member States. AMLA's data collection exercise will play a role in selecting the entities that will be subject to direct supervision.
Other regulatory instruments address cooperation between supervisory authorities, sanctions and the practical arrangements for direct supervision. The objective is to bring national supervisory practices closer together and ensure a more consistent application of AML/CFT rules throughout the European Union.
The scope does not stop at banks. The AMLR extends due diligence and reporting obligations to every crypto-asset service provider. Belgian providers authorised under MiCA will have to meet both regimes, with transaction monitoring assessed against the same standards as a credit institution's.
Which financial groups will fall under AMLA's direct supervision?
One decision cannot wait for 2028. Where a group holds several entities in the Union and no European parent, the AMLR requires it to designate one entity as the EU parent undertaking (Article 2(1)(42)). That entity answers for group-wide policies, for the risk assessment and for the relationship with AMLA. Groups built around a Belgian subsidiary and a third-country parent should settle the question before the selection cycle opens in 2027.
AMLA plans to select up to 40 financial institutions or groups for its first cycle of direct supervision. The selection will take place in 2027, with direct supervision beginning in 2028. The handover of files from national authorities to AMLA is set by technical standards adopted under Article 15(3) of Regulation (EU) 2024/1620. They are expected to cover risk assessments, findings and remediation plans, not just a list of names.
For this first cycle, eligible entities must, among other criteria, operate in at least six EU Member States, whether through an establishment or under the freedom to provide services (Article 12(1) of Regulation (EU) 2024/1620), and have a high level of residual money laundering or terrorist financing risk, as assessed under AMLA's methodology. Their cross-border activities will also be taken into account during the selection process.
Preparatory work is already underway. In March 2026, AMLA launched a data collection exercise to test and calibrate its risk assessment models. These models will help inform the selection of entities in 2027.
Belgian banking groups should therefore anticipate the potential implications. BNP Paribas Fortis and ING Belgium, as part of pan-European banking groups, have characteristics that align with some of the published selection criteria. KBC presents a less clear-cut case, particularly regarding the requirement to operate in six Member States. However, none of these institutions has been officially designated as a candidate at this stage, as the selection process will not take place until 2027.
What will AMLA supervision mean for Belgian financial institutions?
The NBB estimates that around EUR 16 billion of illicit funds is laundered through Belgium every year (NBB, 5 July 2024). That estimate underpins the sectoral risk assessment the NBB publishes for the Belgian market, which remains the starting point for a business-wide risk assessment.
For the selected groups, the most significant change will be the supervisory authority responsible for their AML/CFT oversight. Today, Belgian banks remain subject to AML/CFT supervision by the competent national authorities, including the National Bank of Belgium (NBB) for institutions within its supervisory remit. From 2028, the selected entities will come under the direct supervision of AMLA at European level.
In practice, these groups will need to respond directly to AMLA's requests, provide the information required for its assessments and prepare for its supervisory activities. The new framework also provides for structured cooperation between AMLA and national supervisory authorities.
However, the impact will extend beyond the 40 selected entities. Other institutions will remain under national supervision, but national authorities will gradually adopt harmonised European risk assessment methodologies and criteria. AMLA is developing a common methodology to ensure that AML/CFT risks are assessed consistently across the European Union.
In Belgium, the NBB will therefore retain its role as national supervisor, while CTIF-CFI, the Belgian Financial Intelligence Processing Unit, will continue to act as the country's Financial Intelligence Unit. Nevertheless, the European framework will bring greater harmonisation to how AML/CFT risks and control frameworks are assessed.
Direct supervision does not replace the other relationships a group has with its supervisors. The NBB remains the prudential supervisor, the FSMA remains the conduct authority, and restrictive measures stay outside AMLA's remit. AMLA adds a layer. It does not remove one.
How can compliance, risk and IT departments prepare?
Institutions should not wait for the publication of the list of 40 entities that will fall under AMLA's direct supervision before taking action. The new European expectations will gradually reshape requirements relating to governance, data, risk assessment methodologies and controls, including for institutions that will not be directly supervised by AMLA.
Compliance departments should start by mapping the new requirements and assessing their impact on existing AML/CFT frameworks. This includes CDD, risk classification, transaction monitoring and suspicious transaction reporting. The objective is not simply to identify regulatory gaps, but also to pinpoint processes that remain overly dependent on manual controls, local practices or interpretations that are difficult to harmonise.
Risk departments, meanwhile, should review the robustness and comparability of their AML/CFT risk assessment methodologies. The question is no longer simply whether a model produces a risk score, but whether that score is supported by reliable, documented and traceable data. The data collection exercise launched by AMLA in 2026 to test its risk assessment models demonstrates that these expectations are already becoming operational.
Finally, data and IT teams should ensure that customer, transaction and risk information can be traced, consolidated and retrieved quickly. An AML/CFT framework may appear robust on paper, yet still have significant weaknesses if an institution cannot demonstrate, through supporting data, how its controls actually operate in practice.
The real challenge for 2026 is therefore not simply to "prepare for AMLA", but to assess whether an organisation can demonstrate the effectiveness of its AML/CFT framework. This means being able to link risk assessments to their underlying data, substantiate decisions and demonstrate that the controls in place deliver the expected outcomes. For groups that may fall within the scope of direct supervision, waiting for the official selection list could mean delaying action until the supervisor has already begun identifying their main weaknesses.
