For years, EU anti-money-laundering rules had 27 referees and no head coach. Twenty-seven national supervisors, twenty-seven interpretations, and a cross-border firm left to guess which whistle mattered. That changed with AMLA — the Anti-Money Laundering Authority now up and running in Frankfurt am Main. 2026 is the year it publishes the rulebook everyone else has to follow. Here is who AMLA is, what it is shipping this year, when it starts directly supervising firms, and why even a small non-EU business with EU customers should be paying attention now rather than in 2028.
What AMLA Is For
AMLA is the EU’s first dedicated anti-money-laundering supervisor, headquartered in Frankfurt am Main. It started operations in 2025 and is scheduled to be fully operational by 2028. Its job is twofold: write the detailed technical standards that turn the AML package into workable rules, and eventually supervise the highest-risk financial firms directly rather than leaving them solely to national authorities.
Frankfurt is not an accidental address — it puts AMLA in the same city as the European Central Bank, signalling that AML supervision is being treated as core financial infrastructure, not a compliance afterthought. Now to the part that touches everyone this year: the rulebook.
The 2026 Deliverables: Level 2 and Level 3 Standards by 10 July 2026
The headline obligation for 2026 is a deadline. By 10 July 2026, AMLA must publish its Level 2 and Level 3 measures — the regulatory technical standards (RTS), implementing technical standards (ITS) and guidelines — covering risk-based supervision, customer due diligence, and beneficial-ownership identification. These are not abstractions; they are the operating manual that tells obliged entities exactly how to identify a UBO, how to run CDD, and how supervisors will judge them.
The reason this matters even before AMLA supervises anyone is that the standards define the compliance everyone must meet under the AMLR. Nevertheless, «guidelines» understates their force: in practice, an RTS becomes the yardstick your bank and your auditor apply. When the July 2026 package lands, the vague becomes specific, and firms that prepared to the draft standards move first.
IT in 2026, First Entities Selected in 2027, Full Operation by 2028
AMLA does not flip a switch and start supervising everyone. It has a runway. In 2026 it stands up its IT services and internal machinery. In 2027 it selects a first cohort of obliged entities — reported as around 40 of the highest-risk cross-border financial firms — for direct supervision. And full operational capacity is targeted for 2028. Alongside this, AMLA begins cross-border supervisory activity across the 2026/2027 window.
So the timeline is a ramp, not a cliff. The first firms to feel direct AMLA supervision are the large, cross-border, high-risk institutions selected in 2027, not the average SME. But the standards those firms are supervised against are the same standards that flow down to everyone through the AMLR and through the banks that onboard you. Meanwhile, if your bank is in AMLA’s direct-supervision cohort, its tightened expectations reach you as a customer well before AMLA ever contacts your business. Legarithm assists with choosing the most suitable payment entity for the companies: check our EMI licensing services.
What It Means for You Before AMLA Ever Knocks
Most readers will never be directly supervised by AMLA, and that is the wrong thing to focus on. The mechanism that reaches you is indirect: AMLA writes the standards, your bank and national supervisor apply them, and your onboarding and ongoing due diligence get stricter as a result. A non-EU business with EU customers or an EU account feels the standards through the obliged entity it deals with, not through a letter from Frankfurt.
The practical move for 2026 is to align to the July standards as they publish, particularly on UBO identification and CDD, because those are the exact points where a bank will test you. To sum up, treat AMLA less as a regulator that might one day supervise you and more as the author of the rulebook your bank is already starting to apply. Prepare to the rulebook, and the supervisory ramp becomes a schedule you are ahead of rather than behind.
FAQ
Where is AMLA based and when did it start?
AMLA is headquartered in Frankfurt am Main. It started operations in 2025 and is scheduled to be fully operational by 2028.
What must AMLA publish by 10 July 2026?
Its Level 2 and Level 3 measures — regulatory and implementing technical standards and guidelines — covering risk-based supervision, customer due diligence, and beneficial-ownership identification.
When does AMLA start supervising firms directly?
It stands up IT services in 2026 and selects a first cohort of obliged entities — reported as around 40 high-risk cross-border firms — for direct supervision in 2027, reaching full operation by 2028.
Will AMLA supervise my small company?
Almost certainly not directly. Direct supervision targets large, high-risk, cross-border financial institutions. Smaller businesses feel AMLA’s standards indirectly, through their banks and national supervisors.
Why should a non-EU business care about AMLA now?
Because AMLA writes the standards that your EU bank applies during onboarding and ongoing due diligence. If you have EU customers or an EU account, the tightened rules reach you through that relationship.
Conclusion
AMLA gives EU anti-money-laundering supervision the head coach it lacked: one Frankfurt-based authority writing a single rulebook and, in time, supervising the riskiest firms directly. In 2026 its deliverable is the Level 2 and Level 3 standards due by 10 July, followed by IT build-out, a first direct-supervision cohort selected in 2027, and full operation by 2028. You will most likely never hear from AMLA directly — but you will meet its standards the moment your bank applies them. Prepare to the July rulebook now, and you are ahead of a ramp that only tightens.
Not sure whether your structure or your banking partners fall in AMLA’s line of sight? Send us your setup — your entities, your sectors, and where you bank — on Telegram or WhatsApp, and we will run an AML-readiness check against the incoming standards so you are prepared before your bank raises the bar.
Узнайте, как защитить свой бизнес.
Получите ценные юридические консультации для вашего стартапа или IT-проекта, чтобы избежать рисков и сосредоточиться на росте.
Эта статья носит исключительно информационный характер и не является юридической, налоговой или финансовой консультацией. Перед принятием решений обратитесь к квалифицированному специалисту. Редакционная политика.
