AMLA Frankfurt: Europe's Anti-Money Laundering Authority Goes Operational

Since 1 January 2026, Europe has a new authority that is meant to fundamentally reshape the fight against money laundering and terrorist financing. The Anti-Money Laundering Authority (AMLA) has taken up its seat in Frankfurt am Main and, in the first few months of its operational existence, has already made clear that it does not intend to be a paper-based supervisor. The first Public Hearing on 24 March 2026, which drew more than 1,600 stakeholders, the publication of the multi-year programme (Single Programming Document, SPD) on 4 February and the full handover of all AML/CFT mandates from the European Banking Authority (EBA) – every one of these signals points in the same direction: AMLA means business.

For German banks, this systemic shift is far more than a bureaucratic transfer of competence between EU bodies. AMLA sits at the heart of an entirely new European supervisory framework for Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) that replaces the previous patchwork of national money laundering laws with a directly applicable EU rulebook. From 10 July 2027, the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) will supersede substantial parts of the German Money Laundering Act (Geldwäschegesetz, GwG). From 1 January 2028, AMLA will assume direct supervision of 40 selected financial institutions. Any institution that fails to realign its compliance architecture in the remaining months risks regulatory conflict, operational inefficiency and strategic mispositioning.

The New Supervisory Framework: From Patchwork to Single Rulebook

Why Europe Needs Its Own AML Authority

The decision in favour of a dedicated European anti-money laundering authority was not a bureaucratic reflex but a response to a structural failure. The money laundering scandals of recent years – from Danske Bank to Wirecard AG and the suspicious activity at Dutch and Baltic institutions – exposed an uncomfortable truth: the previous system, in which 27 national supervisors implemented the European AML directives at their own discretion, produced a regulatory patchwork. Criminals exploited the gaps between national jurisdictions systematically.

The European Commission responded with the most comprehensive overhaul of European anti-money laundering policy in two decades. The so-called AML Package, which entered into force in June 2024, rests on three pillars: the directly applicable Anti-Money Laundering Regulation (AMLR), the Sixth Anti-Money Laundering Directive (AMLD VI) and the AMLA Regulation that establishes the new authority itself. Together, these instruments create a Single Rulebook – a uniform body of rules that applies in all 27 Member States without national transposition and that drastically narrows the interpretative scope national legislators previously enjoyed.

The Mandate Handover: From EBA to AMLA

On 1 January 2026, EBA and AMLA completed the formal transfer of all AML/CFT competences. With this, the EBA's standalone AML/CFT mandate, in place since 2020, came to an end. AMLA took over the EuReCa database, supervisory findings, risk assessments and all existing EBA guidelines and standards in the field of anti-money laundering. The latter remain in force until AMLA replaces them with its own rulebook – an approach designed to ensure regulatory continuity for the industry.

But AMLA is more than a renamed EBA division. While the EBA pursued anti-money laundering as one task among many, AMLA is exclusively focused on AML/CFT. That focus is reflected in its resources: the budget rises from EUR 13.6 million in 2025 to EUR 96 million by 2028. Headcount more than triples from 120 at the end of 2025 to 432 by the end of 2027. Frankfurt am Main as the seat is no accident – proximity to the European Central Bank (ECB) and the Deutsche Bundesbank creates institutional synergies that will be decisive for effective supervision.

The Multi-Year Programme: Roadmap to 2028

Five Strategic Priorities

On 4 February 2026, AMLA published its first Single Programming Document (SPD) for the period 2026–2028. The document is the authority's operational blueprint and defines five central fields of action that are to steer the transition from the founding phase to full operationalisation.

First: completing the Single Rulebook. AMLA will develop the remaining Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) that flesh out the EU Anti-Money Laundering Regulation. The 2026 focus is on the RTS for Customer Due Diligence (CDD) and on the definition of business relationships – both areas that were the subject of the first Public Hearing on 24 March 2026.

Second: preparing direct supervision. During 2026, AMLA will finalise the risk-analysis and selection methodology by which the 40 institutions for direct supervision will be chosen from 2028 onwards. The actual selection process begins in 2027.

Third: promoting supervisory convergence. Even institutions that do not fall under direct supervision will feel the impact. AMLA will develop common supervisory standards and monitor their application by national authorities.

Fourth: operationalising the FIU framework. AMLA will coordinate cooperation between national Financial Intelligence Units (FIUs), introduce joint analytical procedures and start the first pilot cases for joint-analysis projects.

Fifth: building a central AML/CFT database, to be prepared in 2026 and fully operational in 2027. This database will materially improve the supervisory information base and systematise the exchange of information between supervisors.

The Public Hearing: Early Signals for Practice

The first Public Hearing on 24 March 2026 was more than a formality. Over 1,600 stakeholders – credit institutions, payment service providers, dealers in goods and civil society representatives – participated in the two sessions, which addressed the draft RTS on business relationships (Article 19(9) of Regulation (EU) 2024/1624) and on Customer Due Diligence (Article 28(1)).

The consultation on both RTS runs until 8 May 2026. For German banks, the content is of immediate relevance: the RTS on business relationships set out, for the first time on an EU-wide basis, uniform criteria for when a business relationship exists and when occasional or linked transactions have to be aggregated. The RTS on CDD specify how institutions must verify customer identity and conduct ongoing monitoring – risk-sensitive and proportionate, but to a single European standard.

What Direct Supervision from 2028 Will Actually Mean

Forty Institutions Under the Magnifying Glass

The most far-reaching aspect of the new AMLA architecture is direct supervision of 40 selected financial institutions and groups from 1 January 2028. These institutions will be chosen through a standardised, risk-based procedure that takes account of inherent money laundering risk, the quality of internal control systems, cross-border activity (in at least six Member States) and the size of the institution.

The selection criteria will be defined in a dedicated RTS that becomes applicable from 10 July 2027. The first selection process starts on 1 July 2027 and runs for six months. The list of selected institutions is published immediately after completion. The cohort is reviewed every three years and adjusted where necessary.

For the institutions affected, direct AMLA supervision means a fundamental change in supervisory culture. Instead of dealing with their respective national supervisor – in Germany, the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) – they will face a European authority with its own investigative powers, the ability to conduct on-site inspections and the authority to impose sanctions in case of breaches. BaFin does not lose its general competence in those cases, but AML supervision over the selected institutions transfers entirely to AMLA.

Investigative Powers: More Than Paper Tigers

AMLA has wide-ranging investigative powers that go significantly beyond what the EBA was ever able to exercise in the field of anti-money laundering. They include on-site inspections, requests for documents and data, interviews with staff and the imposition of fines and periodic penalty payments. For institutions that have so far regarded AML supervision primarily as a national matter, this is a paradigm shift.

Operational Implications for German Banks

The End of the GwG as We Know It

10 July 2027 marks a watershed for German anti-money laundering practice. On that date, the EU Anti-Money Laundering Regulation becomes directly applicable and replaces substantial parts of the German Money Laundering Act. BaFin has already called on its supervised institutions to prepare early for the changes and to adjust internal processes accordingly. The previous practice of implementing national AML rules with considerable interpretative latitude will be replaced by a uniform European rulebook that leaves no room for national peculiarities.

Concretely, German banks will have to migrate their entire AML/CFT documentation – internal policies, procedural manuals and training materials – to the new legal basis. Customer Due Diligence, customer risk classification, transaction monitoring and suspicious activity reporting must comply with the requirements of the AMLR and the related RTS – no longer the GwG.

Compliance Architecture: From Silos to an Integrated Platform

The new requirements force German banks to fundamentally rethink their compliance architecture. Until now, AML/CFT processes in many institutions were organised as a separate function – often with their own IT systems, their own data sets and limited integration into the wider risk management framework. The AMLA standards, in particular the requirements for a Business-Wide Risk Assessment, make an integrated view mandatory.

Every second respondent to a recent industry survey expects AMLA to drive higher staffing and budget needs in the compliance function. Investments will not stop at additional headcount. Technological upgrades are required: real-time transaction monitoring, AI-supported detection of suspicious activity, automated sanctions screening and digitalised Know Your Customer (KYC) processes. Institutions still relying on manual checks and Excel-based risk classifications face a fundamental modernisation programme.

Area	Previous Practice (GwG)	New Requirement (AMLR/AMLA)
Customer Due Diligence	National implementation with interpretative latitude	EU-wide uniform standard via RTS; risk-sensitive and proportionate
Risk Assessment	Institution-specific methodology	Standardised Business-Wide Risk Assessment per AMLA specifications
Suspicious Activity Reports	National FIU (BKA central unit)	National FIU remains, but AMLA coordinates and initiates Joint Analysis
Supervision	BaFin as sole AML supervisor	BaFin for most institutions; AMLA directly for 40 selected groups
Sanctions	National fining schedules	AMLA may impose fines and periodic penalty payments directly
Data Infrastructure	Fragmented national systems	Central AML/CFT database from 2027; EuReCa system taken over

BaFin and AMLA: Cooperation Rather Than Competition

For BaFin, AMLA does not mean disempowerment, but it does mean repositioning. BaFin remains the competent AML/CFT supervisor for the vast majority of German institutions. At the same time, it must adopt and apply the standards and methods developed by AMLA. Convergence of supervisory practice – until now mostly a slogan in EU documents – is for the first time backed by a concrete enforcement mechanism through AMLA.

In its current strategy paper for 2026–2029, BaFin has identified cooperation with AMLA as one of its central fields of action. The authority is preparing to integrate the new European standards into its own supervisory practice. For institutions, the consequence is clear: even those not under direct AMLA supervision will feel the new standards – through BaFin as the extended arm of European harmonisation.

The Transition Phase: What Has to Happen Now

The timeline is clear, the complexity considerable. German banks face a triple challenge: changing the legal basis (from GwG to AMLR by July 2027), preparing for potential direct AMLA supervision (selection from July 2027) and fundamentally modernising the compliance infrastructure. A structured approach is indispensable.

Opportunities and Strategic Perspectives

Despite all the regulatory complexity, the strategic value of the AMLA reform should not be overlooked. The Single Rulebook eliminates the jurisdictional arbitrage that has favoured competitive distortions within the EU. Institutions active across several Member States benefit from uniform requirements rather than 27 different national interpretations. After an initial investment phase, compliance costs will reduce in the medium term as the complexity of multi-layered regulation falls away.

At the same time, the modernisation of compliance infrastructure offers an opportunity to develop AML/CFT from a pure compliance exercise into a strategic differentiator. Institutions that invest in advanced transaction monitoring, AI-supported risk detection and seamless KYC processes improve not only their regulatory position but also customer experience and operational efficiency. The best compliance systems are those that do not burden customers but protect them.

Anyone who treats the AMLA reform as a mere regulatory obligation misjudges its strategic implications. Anyone who treats it as a chance to modernise can sustainably strengthen their competitive position. What matters is that German banks act now – the time remaining until 10 July 2027 is shorter than many boards want to admit.