EU AML Authority and National Competent Authorities

1. Why This Topic Matters

For more than three decades, the European Union has fought money laundering through a series of directives that each Member State had to transpose into its own national law. The result was a patchwork: 27 sets of rules, 27 approaches to supervision, and uneven enforcement. Scandals such as Danske Bank Estonia (over EUR 200 billion of suspicious non-resident flows), ABLV in Latvia, Pilatus Bank in Malta and the collapse of Wirecard exposed how criminals exploited the gaps between national supervisors. Dirty money flowed across borders, but supervision stopped at them.

The EU responded in 2024 with the most ambitious reform in its AML history: the AML Package. At its heart is a brand-new EU body, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), working alongside and above the existing National Competent Authorities (NCAs). For CAMS candidates this topic is important because it reshapes who supervises whom in Europe, how FIUs cooperate, and how obliged entities (banks, crypto providers, lawyers, real estate agents and others) will be examined and sanctioned. It also tests a core CAMS skill: understanding the layered architecture of regulatory regimes and the collaboration between supranational, national and institutional actors.

2. The Legislative Context: The 2024 EU AML Package

You cannot understand AMLA without knowing the package it belongs to. Adopted in 2024, it has four pillars:

• The AML Regulation (AMLR, Regulation (EU) 2024/1624) - the Single Rulebook. Because it is a regulation, it applies directly in every Member State without transposition. It harmonises customer due diligence, beneficial ownership (25% threshold, with powers to lower it for high-risk sectors), politically exposed persons, record keeping and group-wide policies. It introduces an EU-wide cash payment limit of EUR 10,000 and expands the list of obliged entities to crypto-asset service providers, crowdfunding platforms, luxury goods traders and, from 2029, professional football clubs and agents. Most provisions apply from 10 July 2027.

• The Sixth AML Directive (AMLD6, Directive (EU) 2024/1640) - governs matters that remain national: the organisation and powers of supervisors and FIUs, beneficial ownership registers, bank account registers, national risk assessments and cooperation mechanisms. Member States must transpose it by 10 July 2027.

• The AMLA Regulation (Regulation (EU) 2024/1620) - creates the Authority itself and defines its powers.

• The recast Transfer of Funds Regulation (Regulation (EU) 2023/1113) - extends the travel rule to crypto-asset transfers, requiring originator and beneficiary information to accompany transactions.

Exam insight: Know the difference between a regulation (directly applicable, uniform) and a directive (sets objectives, requires national transposition). Questions often test whether a candidate understands why the EU moved from directives to a regulation - to eliminate divergence.

3. What Is AMLA?

AMLA is a decentralised EU agency with its seat in Frankfurt am Main, Germany, chosen in early 2024 after a competition among nine candidate cities. It was formally established in mid-2024, began operating in July 2025, and is scheduled to assume direct supervision of selected financial institutions in 2028. Its first Chair is Bruna Szego, formerly of the Bank of Italy.

AMLA has three overarching missions:

1. Direct supervision of the riskiest cross-border financial sector obliged entities.
2. Indirect supervision and oversight of all other obliged entities through the national supervisors, to drive convergence and consistency.
3. Support and coordination of Financial Intelligence Units (FIUs).

It also has a rule-making function: drafting regulatory and implementing technical standards, guidelines and recommendations that fill in the details of the Single Rulebook.

4. How AMLA Works

4.1 Direct Supervision of Selected Obliged Entities

AMLA will directly supervise roughly 40 credit and financial institutions (including crypto-asset service providers) that are considered the highest risk and operate in several Member States. Selection is based on a two-step methodology: an entity must have a significant cross-border footprint (operating in a minimum number of Member States) and must be assessed as high residual risk under a harmonised risk methodology. The first selection is expected in 2027, with supervision beginning in 2028, and the list is reviewed periodically (every three years). AMLA can also take over supervision of a non-selected entity in exceptional cases where national supervision has failed.

Supervision is carried out by Joint Supervisory Teams (JSTs), modelled on the ECB's Single Supervisory Mechanism. Each JST is led by AMLA staff and includes staff from the relevant national supervisors. AMLA may conduct on-site inspections, request information, require remediation and impose pecuniary sanctions and periodic penalty payments directly on selected entities. Fines can reach up to 10% of annual turnover or EUR 10 million (whichever is higher) for serious breaches by legal persons.

4.2 Indirect Supervision and Oversight of National Supervisors

For the thousands of obliged entities not under direct supervision - most banks, insurers, payment institutions, and all non-financial obliged entities such as lawyers, accountants, notaries, real estate agents, casinos and dealers in high-value goods - supervision stays with the NCAs. AMLA's role here is to make national supervision consistent and effective. Tools include:

• Peer reviews and thematic reviews of national supervisors.
• A harmonised supervisory risk assessment methodology that all supervisors must apply.
• Coordination of AML/CFT supervisory colleges for cross-border groups.
• A central database (building on the EBA's EuReCA) of material weaknesses found in obliged entities.
• Power to request a national supervisor to act and, if it fails to do so, to escalate to the Commission and in financial-sector cases to step in.
• For the non-financial sector, AMLA's role is lighter: it coordinates, issues guidance, conducts peer reviews and can investigate alleged breaches of EU law by national supervisors, but it does not directly supervise lawyers, accountants or real estate agents.

4.3 FIU Support and Coordination

AMLA does not replace national FIUs - each Member State retains its own FIU as the central national agency receiving suspicious transaction reports. Instead, AMLA:

• Hosts and manages FIU.net, the secure information exchange network between EU FIUs.
• Facilitates and coordinates joint analyses of cross-border suspicious cases involving several FIUs.
• Develops common templates, standards and a harmonised reporting format for suspicious transaction and activity reports.
• Conducts peer reviews of FIUs and promotes best practice and training.
• Identifies emerging trends and typologies and shares strategic analysis.

4.4 Governance

AMLA has a General Board that meets in two compositions: a supervisory composition (heads of national AML supervisors) and an FIU composition (heads of national FIUs). An Executive Board (Chair plus five independent full-time members) takes decisions on individual selected entities and runs the agency. There is also an Executive Director responsible for day-to-day management, and an Administrative Board of Review for challenges to AMLA decisions. The ECB, European Supervisory Authorities (EBA, EIOPA, ESMA), Europol, Eurojust and the European Public Prosecutor's Office participate as observers or cooperation partners.

4.5 Relationship with the EBA

From 2020 to 2025 the European Banking Authority held the EU-level mandate to lead, coordinate and monitor AML/CFT in the financial sector, issuing guidelines (for example on risk factors and on the role of the AML compliance officer) and running the EuReCA database. These AML/CFT powers and resources transfer to AMLA. The EBA retains its prudential role. Expect older study materials to reference the EBA; newer ones will reference AMLA.

5. National Competent Authorities (NCAs)

The term NCA covers every national body designated under AMLD6 to perform AML/CFT functions. Three broad categories matter for the exam:

5.1 National AML/CFT Supervisors

Each Member State must designate supervisors for every category of obliged entity. Examples include BaFin (Germany), ACPR (France), De Nederlandsche Bank (Netherlands), the Central Bank of Ireland, the CSSF (Luxembourg), the Bank of Italy and Banco de Espana. For non-financial sectors, supervision may be performed by ministries, gambling regulators, or self-regulatory bodies such as bar associations and chartered accountancy institutes, which must themselves be overseen by a public authority. Supervisors must:

• Apply a risk-based approach to supervision, allocating intensity and frequency of inspections according to the risk profile of the entity and sector.
• Have adequate powers to obtain information, conduct on-site and off-site inspections, and impose effective, proportionate and dissuasive sanctions.
• Cooperate with each other through AML/CFT colleges for groups operating in at least three Member States and through home-host arrangements.
• Exchange information with prudential supervisors (including the ECB under the SSM), FIUs, law enforcement and tax authorities, subject to professional secrecy rules.
• Contribute to the National Risk Assessment (NRA), which every Member State must perform and update, and which feeds into the EU-level Supranational Risk Assessment (SNRA) issued by the Commission.

5.2 Financial Intelligence Units

Every Member State has one FIU - for example TRACFIN (France), the FIU Germany within the customs administration, FIU-Nederland, UIF (Italy) and SEPBLAC (Spain). The FIU is operationally independent and autonomous, receives suspicious transaction reports from obliged entities, analyses them and disseminates intelligence to law enforcement. Under AMLD6, FIUs gain clearer powers to suspend transactions, access bank account registers and beneficial ownership registers, and must provide feedback to reporting entities. They cooperate with each other through FIU.net and the Egmont Group, and with AMLA in joint analyses.

5.3 Other Authorities

Beneficial ownership register authorities, customs authorities (cash controls at the EU border above EUR 10,000), tax authorities, law enforcement, prosecutors and the EPPO all form part of the national ecosystem. AMLD6 also requires Member States to establish mechanisms, such as national coordination committees, to ensure these authorities cooperate domestically.

6. How the Layers Fit Together: The Collaboration Model

The best way to think about the new EU architecture is as a hub-and-spoke system with shared rules:

• The Single Rulebook (AMLR) sets identical obligations for all obliged entities.
• AMLA is the hub: directly supervising the few riskiest cross-border institutions, setting technical standards, ensuring national supervisors apply the same methodology, and coordinating FIUs.
• NCAs are the spokes: supervising the vast majority of obliged entities day-to-day, receiving and analysing reports, imposing most sanctions, and feeding information upward.
• Obliged entities remain responsible for their own risk assessments, controls and reporting, now under a harmonised framework.

This mirrors the way banking prudential supervision has operated since 2014 under the SSM: the ECB directly supervises significant banks, national authorities supervise less significant ones, and all apply a single rulebook. CAMS questions may draw this analogy explicitly.

7. Key Dates to Memorise

• 2021 - Commission proposes the AML Package.
• Early 2024 - Frankfurt chosen as AMLA seat; political agreement reached.
• June 2024 - AML Package published in the Official Journal; AMLA legally established.
• 1 July 2025 - AMLA begins operations.
• 10 July 2027 - AMLR applies; AMLD6 transposition deadline.
• 2028 - AMLA begins direct supervision of selected obliged entities.
• 10 July 2029 - AMLR applies to football clubs and agents.

8. Exam Tips: Answering Questions on EU AML Authority and National Competent Authorities

Tip 1 - Know who does what. The most common question format gives a scenario and asks which body is responsible. Remember: AMLA directly supervises only selected high-risk cross-border financial entities; NCAs supervise everyone else; national FIUs receive STRs; AMLA coordinates FIUs but does not receive STRs itself. If an answer suggests AMLA receives suspicious transaction reports from a local bank, it is wrong.

Tip 2 - Distinguish direct from indirect supervision. Expect questions on the two-tier model. Direct supervision means AMLA leads the JST and can fine the institution. Indirect supervision means AMLA oversees the national supervisor through peer reviews, methodologies and requests to act. For non-financial sectors, AMLA's role is coordination only.

Tip 3 - Regulation versus directive. If a question asks why the EU adopted a regulation for obliged entity requirements, the answer is harmonisation and direct applicability without national transposition. If it asks what remains in the directive, the answer concerns the institutional framework: supervisors, FIUs, registers and national cooperation.

Tip 4 - Remember that national authorities remain central. A frequent distractor implies AMLA replaces national supervisors or FIUs. It does not. AMLA complements and coordinates. The correct answer usually describes a shared or cooperative arrangement rather than a wholesale transfer of power.

Tip 5 - Link to the risk-based approach. CAMS consistently rewards answers grounded in risk. Selection of entities for direct supervision is risk-based; intensity of national supervision is risk-based; FIU joint analyses target cross-border risk. When two answers seem plausible, choose the one that reflects risk-based allocation of supervisory resources.

Tip 6 - Know the drivers. Questions about the rationale for AMLA expect you to cite fragmented national enforcement, divergent transposition of directives, and cross-border scandals such as Danske Bank. Tie the solution (centralised oversight plus a single rulebook) to the problem (inconsistency and regulatory arbitrage).

Tip 7 - Watch the timeline. If a question includes dates, remember the staged approach: established 2024, operational 2025, rulebook applies 2027, direct supervision 2028. An answer claiming AMLA fined a bank in 2025 is anachronistic.

Tip 8 - Be alert to EBA references. Older CAMS material describes the EBA as the EU-level AML coordinator for the financial sector. If an exam item refers to EBA AML guidelines, it is not wrong for the period before 2025; simply recognise that those functions have moved to AMLA.

Tip 9 - Cooperation mechanisms are testable. Memorise the main channels: AML/CFT colleges for supervisors, FIU.net and joint analyses for FIUs, EuReCA-style central databases for weaknesses, national coordination mechanisms under AMLD6, and information sharing with prudential supervisors such as the ECB. Questions on collaboration often ask you to identify the appropriate channel for a given cross-border situation.

Tip 10 - Eliminate extremes. Answers using absolute language - AMLA supervises all EU banks, national FIUs are abolished, obliged entities report only to AMLA - are almost always distractors. The EU model is layered and cooperative.

9. Quick Revision Summary

• AMLA = EU Anti-Money Laundering Authority, Frankfurt, established 2024, operational 2025, direct supervision 2028.
• Three missions: direct supervision of about 40 selected high-risk cross-border financial entities; indirect oversight of national supervisors; support and coordination of FIUs (hosts FIU.net).
• Powers: joint supervisory teams, on-site inspections, fines, technical standards, peer reviews, requests to act.
• Package: AMLR (single rulebook, applies July 2027), AMLD6 (institutional framework, transpose by July 2027), AMLA Regulation, recast Transfer of Funds Regulation (crypto travel rule).
• NCAs: national AML supervisors (financial and non-financial, including self-regulatory bodies), national FIUs, registers, customs, law enforcement. They retain day-to-day supervision and all STR reception.
• Collaboration: AML colleges, FIU.net, joint analyses, national risk assessments feeding the supranational risk assessment, cooperation with ECB, Europol, EPPO.
• Exam approach: identify the right actor, respect the direct/indirect split, prefer risk-based and cooperative answers, and reject absolutes.