Eltoma Corporate Services — Authorised Corporate Services Provider
Articles are provided for general informational purposes by an authorised corporate services provider and do not constitute legal advice.
The new EU Anti-Money Laundering Authority is moving from legal establishment to operational supervision. For CSPs, lawyers, accountants, tax advisers, investors and business owners, the transition period should be used to prepare governance, documentation and risk evidence before the new framework becomes the ordinary compliance baseline.
The European Union’s new anti-money laundering and countering the financing of terrorism framework is moving from legislative adoption to practical implementation. Article 1 of this series addressed the wider EU AML reset: a move from fragmented national implementation towards a more harmonised European system. This second article focuses on the institutional and timing question: what is AMLA, what will happen in 2026, 2027 and 2028, and why should businesses, investors and professional advisers use the transition period to prepare?
AMLA, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, is now part of the EU’s supervisory architecture. Its founding Regulation applies from 1 July 2025. The new AML Regulation will apply from 10 July 2027, subject to specific later application for football clubs and agents. AMLA’s own timeline indicates that 2026 is a year of preparation and calibration, 2027 is the year in which 40 obliged entities are selected for direct AMLA supervision, and 2028 is the year in which direct supervision starts and AMLA becomes fully operational.
For company service providers, lawyers, accountants, tax advisers, investors and business owners, the important point is not only whether an entity will be directly supervised by AMLA. In many cases it will not. The practical issue is that AMLA will influence the supervisory environment, technical standards, risk assessment models, FIU cooperation and the expectations of national regulators across the EU. The period before July 2027 should therefore be treated as a compliance readiness period, not as a waiting period.
AMLA was established as part of the EU’s wider AML/CFT reform package. Its purpose is not merely to add another institution to the regulatory landscape, but to create a central EU authority capable of supporting a more coherent, consistent and risk-based AML framework across Member States. The new EU model combines a directly applicable single rulebook, national supervision, EU-level coordination and, for a limited group of selected high-risk financial institutions or groups, direct supervision by AMLA itself.
This distinction is important. AMLA will not replace every national AML supervisor. Cyprus, for example, will continue to have its own competent authorities and professional supervisory structures. However, AMLA will provide a central layer of methodology, coordination, supervisory convergence and standard-setting. Over time, this will influence how national supervisors assess compliance files, risk ratings, beneficial ownership evidence, source of funds, source of wealth and ongoing monitoring.
For non-financial professionals, including CSPs and professional advisers, AMLA should therefore be understood as a supervisory standard-setter and convergence authority, even where it is not the direct day-to-day supervisor. The commercial consequence is that local compliance practice will increasingly need to be defensible not only by reference to national custom, but also by reference to EU-level expectations.
AMLA’s work may be considered under four principal headings.
First, AMLA will directly supervise selected obliged entities. The first direct supervision population is expected to include up to 40 of the most impactful financial institutions or groups operating in the EU. AMLA’s direct supervision is therefore targeted, risk-based and concentrated on entities with substantial cross-border relevance.
Second, AMLA will contribute to supervisory convergence. It will work with national supervisors and develop methodologies intended to make AML/CFT supervision more consistent across the Union. This is relevant beyond the directly supervised entities, because national competent authorities will increasingly operate in an AML environment shaped by AMLA’s standards and supervisory logic.
Third, AMLA will support cooperation between Financial Intelligence Units. FIUs remain central to suspicious transaction reporting and the analysis of financial intelligence. Stronger cooperation between FIUs is a necessary element of a more effective cross-border AML system.
Fourth, AMLA will contribute to regulatory and technical standards, guidelines and methodologies. This function is particularly important for professional firms because practical compliance is often determined not only by legislation, but by the expectations contained in technical standards, supervisory guidance and inspection methodology.
For most businesses and professional service providers, 2026 should be treated as the preparation and calibration year. AMLA’s public timeline refers to the gradual ramping up of IT business services and the assessment of future IT needs during 2026. AMLA has also published its first Single Programming Document for 2026–2028, describing the Authority’s move from foundation to delivery and identifying strategic priorities including completion of the single rulebook, supervisory convergence and FIU cooperation.
From a supervisory perspective, 2026 is not a passive year. AMLA launched a data collection exercise to test and calibrate its risk assessment models. The purpose of that exercise is twofold: to inform the selection, in 2027, of up to 40 entities for AMLA’s direct supervision starting in 2028, and to support consistent assessment of money laundering and terrorist financing risks by supervisors across the EU. AMLA’s direct supervision explainer also identifies a testing, calibration and validation phase running through 2026.
This should be read as a signal to the market. The future supervisory framework is being built through data, models, methodology and regulatory instruments. Professional firms should not wait until July 2027 to review their AML framework. By then, the new regulatory baseline will already be close to operational reality.
The most important practical date for the wider market is 10 July 2027. The new AML Regulation is due to apply from that date, with a later start date of 10 July 2029 for football clubs and football agents. Directive (EU) 2024/1640 also generally applies from 10 July 2027, although certain beneficial ownership register provisions require earlier transposition by 10 July 2026 and the bank account registers interconnection is due by 10 July 2029.
This means that 2027 is not merely another preparatory stage. It is the point at which the new private-sector AML rulebook becomes the ordinary compliance baseline for obliged entities. For professional firms, this should translate into updated internal procedures, revised client due diligence standards, risk-rating methodology, beneficial ownership checks, record-keeping and escalation processes.
AMLA’s first selection procedure for direct supervision is also scheduled for 2027. According to AMLA’s explainer, national supervisors collect final data from entities eligible for direct supervision during January to March 2027, and AMLA carries out the selection procedure from July to December 2027. Up to 40 entities or groups will be selected, with input from national supervisors, and the final selection is to be communicated by the end of 2027.
Although most CSPs, lawyers, accountants and tax advisers will not be among the selected directly supervised entities, the selection process matters because it demonstrates how AMLA will use risk data, supervisory models and EU-level methodology to shape the future supervisory environment.
AMLA’s own public timeline refers to the start of direct supervision during 2028, with AMLA fully operational. The Authority’s direct supervision explainer states that from 2028 AMLA will directly supervise up to 40 of the most impactful financial institutions or groups operating in the EU. The first selection round will have taken place in 2027 and will be repeated every three years.
It would be a mistake, however, to view 2028 as relevant only to large financial institutions. Direct supervision is the visible part of AMLA’s role, but its influence is broader. Once AMLA is fully operational, national supervisors will operate in an environment of increased EU-level coordination, shared methodology, stronger technical standards and greater expectations of supervisory consistency.
For the wider professional services market, 2028 should therefore be understood as the point at which the new EU AML architecture reaches operational maturity. By that stage, firms that have treated the reform as a distant banking issue may find that their internal files, risk assessments and client review processes are behind the new regulatory expectations.
Professional firms should use the 2026–2027 period as a governance and file-readiness exercise. The key question will increasingly be whether the firm can explain, with evidence, why a client was accepted, how the beneficial owner was identified, how the source of funds and source of wealth were assessed, why the risk rating is appropriate and how the relationship is monitored after onboarding.
For CSPs and related professional advisers, this should include a review of client onboarding procedures, customer due diligence checklists, beneficial ownership verification, sanctions and PEP screening, adverse media procedures, source of funds and source of wealth standards, internal escalation routes and record retention. Higher-risk clients should be reviewed in sufficient time so that missing documents, unclear ownership chains or unsupported risk decisions can be addressed before the new framework becomes the ordinary benchmark.
The reform should also prompt firms to consider whether their AML manuals reflect practical working procedures. A policy that looks complete on paper but is not followed in the file will be difficult to defend. Equally, a file that contains documents but no reasoned risk assessment may not be sufficient in a more harmonised supervisory environment.
Business owners and investors should expect more structured and more consistent information requests from EU professional service providers. This is not because service providers are seeking to make onboarding unnecessarily burdensome. It reflects a regulatory environment in which ownership, control, commercial rationale and financial background must be capable of being evidenced.
In practical terms, clients using EU companies, Cyprus structures, investment holding vehicles or cross-border groups should expect requests for ownership charts, corporate registers, constitutional documents, identification documents, proof of address, business descriptions, contracts, financial statements, explanations of source of funds and source of wealth, and evidence supporting the commercial purpose of the structure.
The new AML framework does not prohibit legitimate cross-border structuring. It does, however, mean that a structure should be explainable. A holding company, family investment vehicle, trading company or financing arrangement should have a coherent ownership story, a commercial rationale and a file that supports both.
The following roadmap provides a practical way to approach the transition period. It is not a substitute for a formal AML gap analysis, but it identifies the main areas that should be considered before the new framework applies in 2027 and AMLA’s direct supervision phase begins in 2028.
he EU AML reform will not arrive as a single event in 2028. It is already unfolding through institutional build-up, testing, calibration, technical standards, national preparation and supervisory convergence. AMLA’s creation and the 2026–2028 timeline give businesses and professional firms a clear signal: the new AML environment is moving from legislation to practice.
For CSPs, lawyers, accountants, tax advisers, investors and business owners, the prudent approach is to use the transition period deliberately. AML policies should be reviewed, client files should be tested, beneficial ownership information should be checked, source of funds and source of wealth evidence should be strengthened and risk decisions should be documented. By the time the new EU AML Regulation applies in July 2027, compliance files should already be capable of meeting a more harmonised and more evidence-driven standard.
In short, AMLA’s timeline is not only a regulatory calendar. It is a preparation timetable for the professional services market and for clients using EU-facing corporate and investment structures.
AMLA is the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism. It is intended to support a more consistent EU AML/CFT framework through direct supervision of selected high-risk financial entities, supervisory convergence, FIU cooperation and technical standards.
The new EU AML Regulation is due to apply from 10 July 2027, with a later application date for football clubs and football agents. Businesses and professional firms should use the period before July 2027 as a compliance-readiness period.
2026 is a preparation, testing and calibration year. AMLA is building its operational capacity, working on priorities for 2026-2028 and testing risk-assessment models that support future direct supervision and supervisory consistency.
In 2027, the new AML framework becomes the practical baseline for obliged entities and AMLA is expected to select up to 40 entities or groups for direct supervision, with the first selection communicated by the end of the year.
AMLA’s direct supervision of selected entities is expected to begin in 2028, when AMLA becomes fully operational. The wider market should treat this as the operational maturity point of the new EU AML architecture.
Most CSPs, lawyers, accountants and tax advisers will not be directly supervised by AMLA. However, AMLA will influence national supervisory expectations, technical standards and file-quality requirements across the EU AML environment.
Professional firms should review AML policies, client onboarding, beneficial ownership verification, source-of-funds and source-of-wealth evidence, sanctions and PEP screening, escalation records, risk ratings and record-retention procedures.
Articles are provided for general informational purposes by an authorised corporate services provider and do not constitute legal advice.
Receive updates with practical insights on international business, law, tax, accounting, and compliance.
Be the first to hear about our latest discounts and special offers!
Follow our Telegram channel for offshore industry news:
Want updates by e-mail?
Enter your email address below to subscribe to our newsletter!