EU’s AMLA goes live in 2025 and will start direct supervision of high-risk firms in 2028

The EU’s anti-money laundering setup is being rebuilt around a new Frankfurt-based authority, and the firms that sit in the cross-border, higher-risk bucket should not treat 2028 as a distant date. The practical point for PSPs and other financial institutions is simple: national playbooks are giving way to a more centralized rulebook, and the margin for local interpretation is shrinking.

1. According to Alessa, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) became operational on 1 July 2025 and will begin direct supervision of the EU’s highest-risk financial institutions by 2028. Germany won the bid to host the agency in February 2024.
2. AMLA was created under EU Regulation 2024/1620 as part of a 2024 legislative package aimed at replacing a fragmented model in which 27 national systems interpreted the same EU directives in different ways. On 1 January 2026, the European Banking Authority completed the transfer of all its AML and CFT mandates to AMLA.
3. The authority will supervise in two ways. Direct supervision will cover a select group of high-risk entities active in at least six member states, chosen on objective cross-border and risk criteria. The selection process must begin by 1 July 2027 and conclude within six months, with direct supervision starting in January 2028.
4. Roughly 40 institutions are expected in the first wave, mostly large banking groups, alongside payment institutions, e-money firms and crypto-asset service providers. For the industry, that is the part worth watching: the first cohort will be a mixed list, not just banks.
5. AMLA’s reach goes beyond the direct-supervision list. It will build a common supervisory methodology, run peer reviews of national regulators and step in in defined cases where a national authority fails to act. National supervisors such as Germany’s BaFin and Luxembourg’s CSSF remain the front line for most firms, but will increasingly apply AMLA’s standards rather than their own.

AMLA sits alongside the Anti-Money Laundering Regulation (AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6), which together make up the EU AML Package. The AMLR becomes especially important on 10 July 2027, when firms can no longer rely on more permissive national readings of customer due diligence or KYC rules. It also brings all MiCAR-authorised crypto-asset service providers fully into AML scope, while adding crowdfunding platforms and non-bank consumer credit providers.

For compliance teams, the source points to a fairly direct to-do list: run a gap analysis against the AMLR text, focus on enhanced due diligence for politically exposed persons, revisit business-wide risk assessments, embed sanctions and PEP screening into onboarding, and track AMLA’s 23 Level 2 and Level 3 measures.