AMLA: what the EU AML authority is, who it will supervise and when

AMLA, the EU Anti-Money Laundering Authority, is the EU body in Frankfurt that will supervise the riskiest cross-border financial institutions itself and oversee the national AML supervisors for everyone else. Its first selection of up to 40 directly supervised entities starts by 1 July 2027 and lasts up to six months, and direct supervision begins six months after the list is published: in 2028, by mid-year at the latest.

AMLA was created by Regulation (EU) 2024/1620, the AMLA Regulation, which has applied since 1 July 2025 (Article 108). It is the supervisory half of the EU AML package; the rulebook half is the AML Regulation, which applies from 10 July 2027.

What is AMLA?

AMLA is "a Union body with legal personality" (Article 3(1)) seated in Frankfurt am Main (Article 4). It has existed in law since 26 June 2024. Its tasks, listed in Article 5, fall into five groups:

• Direct supervision of selected credit and financial institutions (Article 5(2)).
• Indirect supervision: overseeing national financial supervisors, and taking over supervision of a firm "in exceptional circumstances" (Article 5(3)).
• Non-financial sector: coordinating supervisors of accountants, notaries and other professions, with peer reviews and investigations of breaches (Article 5(4)).
• Financial intelligence units: coordinating them, running joint analyses and hosting FIU.net (Article 5(5)).
• Rule-making: draft regulatory and implementing technical standards, guidelines and recommendations (Articles 49, 53 and 54).

Bruna Szego was appointed its first Chair on 21 January 2025 and Nicolas Vasse its Executive Director on 1 July 2025 (AMLA governance). On 1 January 2026, AMLA took over all AML/CFT mandates from the EBA; existing EBA guidelines "will remain in force until replaced by AMLA" (AMLA, 19 January 2026). Its staff is planned to grow from 120 at the end of 2025 to 432 by the end of 2027 (AMLA, 4 February 2026).

Who will AMLA supervise directly?

A firm qualifies in two steps. First, eligibility: credit institutions and financial institutions, groups included, that operate "in at least six Member States, including the home Member State", whether "through establishments or under the freedom to provide services", and "regardless of whether the activities are carried out through infrastructure on the territory concerned or remotely" (Article 12(1)). Payment institutions, e-money institutions and crypto-asset service providers each get their own risk methodology (Article 12(4)); their licence files are covered in our guide to EMI, PI and CASP licences.

Second, risk: an eligible firm whose residual risk profile is classified "high" qualifies (Article 13(1)), with the profile classified at group level (Article 12(3)). In the first round, if more than 40 qualify, AMLA keeps the 40 "operating in the highest number of Member States" (Article 106(2)), and later rounds can go above 40 (Article 13(2)). Where no entity in a member state is selected, AMLA runs an additional selection there and picks the entity whose risk profile is classified high, if there is one (Article 13(3)).

What counts as operating in a country under the freedom to provide services is set by draft standards AMLA adopted as its own in December 2025: more than 20,000 resident customers or more than EUR 50 million of transactions a year, with alternative thresholds (final report, RTS under Article 12(7)). They still need Commission adoption.

Not only banks. The Chair has said the 40 "will not only be banks" and "will probably also include crypto-asset service providers" (AMLA, 17 February 2026).

When does AMLA direct supervision start?

There is no fixed "1 January 2028" in the text, and with AMLA planning to communicate the list by the end of 2027, supervision starts by mid 2028. Each selected firm is supervised by a joint supervisory team of AMLA staff and national supervisors' staff (Article 16(1)).

What powers and fines does AMLA have?

Over selected entities, AMLA can request information (Article 17), run general investigations (Article 18) and carry out on-site inspections, including "without prior announcement" (Article 19). It can also impose administrative measures such as restricting business or proposing the withdrawal of a licence (Article 21).

Fines are set in Article 22. For serious, repeated or systematic breaches of customer due diligence, group-wide policies or reporting found in two or more member states, the base amount runs from EUR 500,000 to EUR 2 million or 1% of annual turnover, whichever is higher, and can reach 10% of turnover after aggravating factors (Article 22(3) and (6)). Periodic penalty payments go up to 3% of average daily turnover, for six months renewable once (Article 23). Decisions are published "immediately" (Article 25(1)).

What does AMLA mean for firms it does not select?

Most firms will never meet an AMLA inspector, and AMLA will still shape their files.

• Their supervisor is supervised. AMLA assesses convergence, issues requests to act and can step in on "systematic failures of supervision" (Articles 30 to 34).
• Their rulebook will be AMLA's. On 1 October 2026, AMLA submitted its final draft standards on customer due diligence to the Commission, proposed to apply six months after entry into force (AMLA).
• Some pay anyway. The supervisory fee applies to selected entities and to non-selected ones that meet the six-member-state criterion, capped at 20% of what a selected firm with the same turnover pays (Article 77(1) and (6)(e)).

A worked example: two fintechs

• Fintech A, an e-money institution licensed in Ireland (and already owing Verification of Payee), passports into eight member states and serves high-risk segments with weak controls. Eligible (nine member states), and a candidate for selection if its group residual risk is high. If picked, a joint supervisory team arrives in 2028, by mid-year at the latest, and it pays the full fee.
• Fintech B, a payment institution in France serving customers in four member states. Not eligible. The ACPR stays its supervisor, applying the AMLR from 10 July 2027 and AMLA's standards once they are adopted and apply.

How cross-border is onboarding already?

Six member states sounds like a big-bank threshold. It is not, because serving customers remotely counts. Over the past year, 4 in 10 companies onboarded by Dotfile customers were registered outside the customer's main country, and 45% of Dotfile customers onboarded businesses from six or more EU member states. Onboarding is not operating, and eligibility is decided by AMLA's thresholds, not by a customer list. But a book that crosses six borders should check AMLA's thresholds, because eligibility alone brings the supervisory fee.

Based on companies onboarded on Dotfile over the past year; aggregates only.

FAQ

Where is AMLA based? In Frankfurt am Main, Germany (Article 4 of Regulation (EU) 2024/1620).

How many entities will AMLA supervise directly? Up to 40 in the first round (Article 106(2)); later rounds can select more.

Will AMLA supervise crypto firms? CASPs are eligible if they operate in six or more member states, and the Chair expects some among the first 40.

Does AMLA replace national supervisors? No. It supervises the selected entities through joint teams with national staff and oversees national supervisors for everyone else.

What Dotfile does

Dotfile is the KYB and KYC platform obliged entities use to run customer due diligence the way AMLA's standards describe it: ownership and UBOs, identity verification, AML screening, risk scoring and monitoring, with every decision recorded. Every date in this guide sits in our 2026 to 2028 AML regulatory calendar; for the rules AMLA will supervise, read AMLR 2027: what changes for KYB, and for AMLA's earlier publications, what KYB teams need to know.