ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
AMLA direct supervision will reach a capped population of large cross-border financial groups, not the whole market. That is the single most misunderstood point about the new Authority for Anti-Money Laundering and Countering the Financing of Terrorism, and getting it wrong in either direction is expensive — firms either budget for oversight they will never receive — see AML compliance cost for what actually drives the number — or assume they are outside a selection they may well be inside.
Regulation (EU) 2024/1620 sets out exactly who is assessed, on what criteria and on what timetable. Here is what the text actually says.
Three gates have to be passed, and most obliged entities fail the first.
| Gate | Test | Article |
|---|---|---|
| 1 | The entity is a credit institution or financial institution, or a group of them | 12(1) |
| 2 | It operates in at least six Member States, including the home Member State | 12(1) |
| 3 | Its residual risk profile is classified by the Authority as high | 13(1) |
Gate 1 excludes every non-financial obliged entity outright — estate agents, lawyers, accountants, trust and company service providers, gambling operators, high-value goods traders and the rest. AMLA direct supervision does not reach them at all, whatever their size.
Gate 2 is broader than it first appears, and this is where firms misjudge their position. Article 12(1) counts operation whether through establishments or under the freedom to provide services, and regardless of whether the activities are carried out through infrastructure on the territory concerned or remotely. A firm serving six Member States cross-border from a single office is counted.
Article 12(3) requires the Authority to classify the inherent and residual risk profiles of assessed entities as low, medium, substantial or high, based on benchmarks and a methodology set out in regulatory technical standards. Where the assessed entity is part of a group, the classification is made at group-wide level.
Only the entities classified as high on residual risk qualify as selected obliged entities under Article 13(1). Because the methodology comes from technical standards, a firm cannot predict its own classification before those are settled — which is why the honest position today is an assessment of exposure to selection rather than a prediction of the outcome.
Article 12(2) is worth noting separately: supervisory authorities and the obliged entities subject to periodic assessment must supply the Authority with any information necessary to carry out the assessment. That is an obligation on the firm, not only on its national supervisor.
Article 13(4) sets the clock, and it runs later than most implementation plans assume.
On the statutory maxima that places the start of AMLA direct supervision around the middle of 2028 — after Regulation (EU) 2024/1624 itself begins to apply on 10 July 2027. Any plan that assumes supervision transfers to the Authority on the application date is planning against the wrong sequence, as our AMLR 2027 timeline sets out.
Article 13(2) allows the Authority, where more than forty entities would qualify, to agree in consultation with the supervisory authorities on a different number greater than forty, taking account of its own capacity to hire and allocate supervisory staff.
For the first round, Article 106(2) makes transitional provision: where more than forty would qualify, the Authority carries out the tasks in respect of forty entities or groups — those operating in the highest number of Member States, with a tie-break on the ratio of third-country transaction volume to total transaction volume in the last financial year. Article 106(3) also disapplies the additional selection process in Article 13(3) during that first round.
So the realistic scale of AMLA direct supervision at launch is forty groups across the entire Union. Everyone else continues to be supervised nationally, under a framework the Authority coordinates rather than operates.
The Authority’s role is much wider than the forty. Article 5 of Regulation (EU) 2024/1620 gives it tasks that reach every obliged entity indirectly: monitoring risks across the internal market, collecting and analysing information on weaknesses identified in the application of the rules, maintaining a central database, and supporting cooperation between supervisors.
More immediately, the Authority writes the technical standards and guidelines that fill in the detail of the Regulation. Most carried a statutory deadline of 10 July 2026 and many were still in draft or consultation at the time of writing — including the standards on the information necessary for customer due diligence and the guidelines on ongoing monitoring. The Authority publishes its regulatory instruments and open consultations on its own website.
That is where AMLA affects a small obliged entity: not through direct supervision, but through the Level 2 measures its national supervisor will apply.
A firm that passes gates 1 and 2 should assume the assessment will happen and prepare for the information request rather than the outcome.
The practical readiness test is how quickly four artefacts can be produced: the business-wide risk assessment with its last review date, the approval record showing which policies the management body approved and when, the suspicion assessments that did not result in a report, and training delivery by named individual. If any of those takes more than a day to assemble, that is the finding — before anyone arrives.
Group structure matters too. Because classification is made at group-wide level, the assessment reaches subsidiaries whose own activity would never have attracted attention. AMLR Article 16 already requires group-wide policies and a compliance manager at group level, so the coordination route should exist before the request does.
For the forty or so entities inside it, the practical difference is less about the questions and more about the vantage point. A national supervisor sees the entity in its own market. The Authority sees the group across every Member State it operates in, and its classification is made at group-wide level under a common methodology applied to every assessed institution.
Three consequences follow for a firm preparing.
Inconsistency between jurisdictions becomes visible. Where a group has allowed each subsidiary to interpret the framework locally, AMLA direct supervision is the first vantage point from which those differences appear side by side. AMLR Article 16(1) already requires group-wide policies that all branches and subsidiaries implement, taking into account their specificities — but “taking into account” is a duty to adapt, not a licence to diverge below the group standard.
Third-country establishments come into view. For groups whose head office is in the Union, AMLR Article 16(1) extends the requirements to branches and subsidiaries in third countries, and AMLR Article 17 governs what happens where local law is less strict or prevents compliance altogether. Where additional measures are relied on under AMLR Article 17(2), the home Member State supervisors must already have been informed — and that notification is exactly the kind of thing an assessment surfaces.
The evidence has to be group-assemblable. A request that reaches the parent and takes three weeks to answer because five subsidiaries hold their records differently is itself a finding about the group-wide framework.
None of this is unique to AMLA direct supervision. It is the same evidence a national supervisor would ask for, produced across more entities at once — which is why the readiness work is worth doing whether or not the selection reaches you.
For a selected obliged entity, the Authority takes on the supervisory tasks in Article 5(2). For everyone else nothing changes: the national supervisor remains, working within a framework the Authority coordinates.
On the Article 12(1) test as drafted, yes — the threshold is at least six including the home Member State. But count carefully before concluding: cross-border services with no local establishment and no local infrastructure still count, and entering a sixth market changes the answer.
Yes. Selection turns on the Authority’s own classification of residual risk under a common methodology, carried out in collaboration with financial supervisors. It is not a sanction and it does not follow from a national finding.
The list is published without undue delay once the first selection concludes, which on the statutory maxima is within six months of a start no later than 1 July 2027. Direct supervision then begins six months after publication.
Whether or not AMLA direct supervision reaches your firm, the evidence a supervisor asks for is the same, and it is produced by the programme rather than assembled for the visit. Our EU AMLR Toolkit includes a supervisory engagement procedure, a correspondence register that tracks commitments to closure, and a selection exposure assessment that works the six-Member-State test. The role split behind it all is in our guide to the AML compliance officer under AMLR, and the wider regime change in AMLR vs AMLD.
September 7, 2026
September 7, 2026
September 7, 2026
September 7, 2026
September 7, 2026