AMLA 2026-2028: How Europe's New Financial Supervisor Is Tightening the Network Across Banks, FIUs, Ownership, and Transactions

1. AMLA Is Not a Financial Police Force for Every Citizen - but It Is Not an Ordinary EU Agency Either

A precise assessment starts with four different layers: direct supervision, indirect supervision, FIU coordination, and private controls.

The effect is distributed: AMLA shapes the system, national bodies exercise public powers, and private gatekeepers decide concrete access.

2. 2026 to 2028: The Architecture Is Not Merely Announced - It Is Already Being Calibrated

2026 is not a waiting year. It is the year in which data models, technical standards, and selection methods are being tested in practice.

AMLA is working on three parallel tracks in 2026: the Single Rulebook, supervisory convergence, and FIU cooperation. The Single Programming Document 2026-2028 translates those aims into rulemaking mandates, IT projects, risk models, and staff growth. AMLA expected staffing to rise from about 120 at the end of 2025 to 432 by the end of 2027. That figure does not prove unlimited power, but it does evidence a move from foundation to operational capacity.

For direct supervision, a data exercise in spring 2026 calibrated common risk models. National supervisors are also reporting entities that may satisfy the cross-border eligibility conditions. The actual selection of up to 40 entities follows in 2027; the first group is expected by the end of that year, with direct supervision starting in 2028.

The operational hinge is July 10, 2027. The core AMLR applies from that date, Member States must have implemented the new directive architecture, and management of FIU.net is due to transfer to AMLA. Some technical requirements phase in through 2028. Institutions must therefore build data, policy, and group processes before the formal start date.

Waiting until 2028 means meeting processes that institutions built in 2026 and 2027.

3. Who Falls Under Direct AMLA Supervision - and Why the Number 40 Does Not Define the Wider Reach

The first selection targets high-risk financial entities and groups with significant cross-border activity. The remainder does not disappear from the system.

Direct supervision requires a financial obliged entity or group with material activity across several Member States and a high residual money-laundering or terrorist-financing risk under the common methodology. AMLA's final draft specifies activity, group, and risk data. There is no defensible public list of names before completion of the selection; naming individual banks now would be speculation.

A Joint Supervisory Team combining AMLA and national supervisors is foreseen for each selected entity. AMLA may conduct investigations and on-site inspections, require binding measures, and impose sanctions or periodic penalty payments within its mandate. That is a genuine supranational supervisory function - over the selected institution, not every client of that institution.

The indirect reach is wider. Common risk methods, supervisory colleges, peer reviews, dispute settlement, and action where national supervision fails affect the rest of the financial sector. AMLR duties apply to obliged entities regardless of whether AMLA or a national authority is the immediate supervisor. Forty is therefore the ceiling for the first direct population, not the number of institutions whose processes will change.

Direct jurisdiction is narrow. Standard-setting and supervisory effects are system-wide.

4. The Data Picture: Not One Omniscient Register, but Connected Legal Responsibilities

The right question is not whether AMLA owns one super-database. It is which body may access, transmit, or reconcile which data for which legal purpose.

The network becomes denser through standardisation and institutional interoperability, not unlimited access.

5. How Public Law Becomes Private Access Control

The decisive chain does not end with the supervisor. It ends with a private institution's customer, product, and transaction decision.

“The new compliance question is not only whether every individual decision is lawful. It is whether every institution can read the same economic story from the same facts.”

Read the deeper institutional and evidence logic in Banking Without Borders↗

Bankability does not arise from invisibility. It arises from verifiable economic coherence.

6. Who Will Feel the Change First

Internationality alone does not create risk. Friction arises where complexity, event pressure, and weak evidence meet.

Complexity can be governed. Uncoordinated complexity becomes an access dependency.

7. The Strategic Response: Build a Consistent International Position

Moving abroad, forming a foreign company, or transferring assets does not make anyone invisible. It increases the value of a coherent architecture.

The first working file is an authoritative fact sheet: citizenships, actual homes, tax residences, roles, shareholdings, beneficial owners, corporate purposes, management locations, banks, custodians, and relevant wallets. Each fact has a source, validity date, owner, and a list of other places where the same information is used.

The second file separates source of wealth from source of funds. Source of wealth explains how the overall wealth was economically created. Source of funds identifies the origin and path of the specific amount in the transaction. Contracts, tax returns, account records, corporate documents, and transaction evidence must carry the narrative, not merely accompany it.

The third file is the event and change sequence. Relocation, sale, gift, distribution, account opening, new company, management change, and major transfer are put into order. Before each irreversible step, the team identifies which authority, bank, custodian, or professional has not yet made its decision. The objective is not a guarantee. It is to close avoidable inconsistencies before the event.

The strongest international structure is not the least visible. It is the one that keeps the same story under scrutiny.

8. The Regulatory Reality Check: What Is Certain Today - and What Remains Open

A defensible analysis separates current law, adopted timelines, work in progress, and speculation.

It is certain that AMLA exists, its founding regulation applies, its work programme is active, AMLR generally applies from July 2027, FIU.net is due to transfer into its responsibility, and the first direct population is to be selected in 2027 and supervised from 2028. It is also certain that AMLA has already been developing or finalising technical standards, guidance, data models, and common formats in 2026.

Institutionally prepared but not final in every detail are numerous RTS, ITS, and guidelines. Consultation papers show operational direction but are not identical to final applicable law. Risk models are being calibrated; eligible entities are being identified; the names of directly supervised entities are not fixed before the process ends.

It would be speculation to claim that AMLA automatically obtains real-time access to every account, tax file, property register, and wallet of every EU citizen. It would be equally wrong to say that only 40 institutions are affected. The precise position lies between those claims: powers remain purpose-limited and distributed while standards, data fields, and supervisory expectations converge across the Union.

Serious strategy begins where certainty, preparation, reasonable inference, and speculation are visibly separated.