How can EU leaders get ahead as AMLA and AMLR transform supervision

AMLA and AMLR will reshape EU oversight, and leaders must act now to compete in a data‑driven supervisory environment.

In brief

• The EU introduces the Anti Money Laundering Regulation (AMLR) in July 2027 to create a single rulebook that replaces fragmented national rules.
• The Anti Money Laundering Authority (AMLA) in Frankfurt will strengthen supervision, and direct oversight of high‑risk cross‑border firms begins in 2028.
• Firms need stronger data foundations, modernized customer due diligence and updated know your customer processes to manage stricter assessment cycles.

Europe is entering a new phase of anti-money laundering regulation as the European Union shifts from diverse national frameworks to a unified supervisory model. The Anti-Money Laundering Authority (AMLA) has been established in Frankfurt, and the Anti-Money Laundering Regulation (AMLR) will introduce directly applicable obligations for the private sector. For senior risk leaders, the central challenge is understanding how to compete in a supervisory environment that is increasingly structured, data driven and cross border.

What’s changed – and why it matters

AMLA began operations in 2025. It will begin directly supervising selected high‑risk and cross‑border institutions in 2028. AMLR (EU) 2024/1624 applies from 10 July 2027 and replaces differing national rules with one set of requirements for all obliged entities. The European Banking Authority has already consulted on a first package of Regulatory Technical Standards that cover Customer Due Diligence (CDD), risk profiling, selection criteria for direct AMLA supervision and sanctions.

Payment and crypto‑asset traceability are already subject to tighter controls because the revised Transfer of Funds Regulation has taken effect. These developments increase comparability across firms. Limited data lineage, inconsistent register connections and uneven group frameworks now affect competitiveness as well as compliance. They can influence access to markets, cost of capital and transaction timelines.

Direct AMLA supervision

From 2028, AMLA will directly supervise up to 40 firms that meet the criteria for high residual risk and cross‑border presence. Draft criteria include operating in at least six Member States and meeting thresholds such as customer numbers or transaction volume. Firms close to these thresholds should evaluate their operational footprint, data readiness and supervisory preparedness. AMLA will also coordinate national authorities and support Financial Intelligence Units to promote more consistent supervisory cultures across the European Union.

Implications for cross‑border mergers and acquisitions

The single rulebook reduces uncertainty after closing transactions, but pre‑sign diligence will need to go further. Buyers will focus on data quality, beneficial ownership information, connectivity to national and European registers and alignment with the new onboarding and monitoring standards. The consistency of enforcement, including potential financial penalties, will require buyers to model remediation more explicitly.

Group-wide expectations

The new framework reinforces parent‑level responsibility for group‑wide AML and counter terrorism financing programs. This includes consistent policy implementation, controlled information sharing, confidentiality safeguards and compliance with data protection law. Previous rules required mechanisms for sharing suspicious activity information. The single rulebook strengthens these expectations across all jurisdictions in which groups operate.

Technology and the pursuit of trust

Firms that succeed under the new regime will invest in strong data lineage, high‑quality reporting, reliable digital identity services and automated risk assessment. Integration with European registers for beneficial ownership, bank accounts and real estate will become essential. Firms that treat identity verification, continuous KYC and travel rule processes as core infrastructure will reduce supervisory friction and support growth strategies such as acquisitions and cross‑border expansion.

Practical next steps

• Conduct a gap analysis against AMLR and the draft technical standards and ensure onboarding focuses on risk‑relevant information in line with simplified and enhanced due diligence options.
• Deploy automated risk scoring for inherent, control and residual risk and integrate eIDAS and European Digital Identity Wallet capabilities to support event‑driven and perpetual KYC.
• Update governance to reflect outsourcing arrangements, sanctions screening, transaction monitoring, confidentiality expectations and group‑wide information sharing. Provide training so teams understand how to apply proportionality in digital environments.

Final thought: Compete on trust

The EU AML package rewards firms that build strong data foundations and apply risk‑based methods with discipline. AMLR takes effect in 2027 and AMLA begins direct supervision in 2028. Firms that act early will reduce compliance costs, improve access to markets and strengthen their competitive position.