The EU is Overhauling its AML/CTF Framework and May Be Looking to Leverage or Facilitate The Work of PPPs

September 9, 2021
17 minutes

The Commission’s ambitious overhaul package

In late July 2021, the European Commission took a further step towards enhancing the existing European Union (EU) anti-money laundering and countering terrorism financing (AML/CTF) regime by releasing “an ambitious package of legislative proposals.”1 This was not a surprise: the Commission warned of its coming in the 7 May 2021 ‘Action Plan for a comprehensive Union policy on preventing money laundering and terrorist financing.’2

The package aims to enhance the existing EU AML/CTF regime in several ways: increasing uniformity of rules across all Member States, whilst updating them to take account of new and emerging modalities borne out of technological advances and innovation; facilitating and improving connection and cooperation between Financial Intelligence Units (FIUs); and creating an EU-level body to oversee the framework and ensure a more consistent and holistic ‘EU-wide’ view of and approach to, investigating and prosecuting AML/CTF activity.

There are two key elements of change: a change to the EU’s AML/CTF institutional framework through the creation of a new EU AML/CTF authority, and a change to the EU’s AML/CTF legislative framework through the creation of a single, harmonised, and directly applicable ‘rule book’ to replace and update the existing patchwork of legislation.

To that end, the package comprised four draft legislative proposals:

  1. A Regulation establishing a new central EU-level AML/CTF Authority (“AMLA”),3 which will be discussed in more detail below.
  2. A Regulation to harmonise AML/CTF rules:4
    This draft Regulation will effectively establish a ‘single EU rulebook’ for AML/CTF, with directly applicable rules that will not require transposition into national law. The proposed ‘harmonising’ effect would be particularly notable in the key areas of customer due diligence and beneficial ownership. The number and type of ‘obliged entities’ within scope of the recast AML/CTF rules would also increase (in line with new and emerging risks) to cover more firms that are not strictly financial institutions, such as crowdfunding service providers, investor residence schemes, consumer credit providers and mortgage credit intermediaries, for example.

    The draft Regulation would also harmonise the powers and tasks of national supervisors and FIUs, and includes key provisions to connect existing national registers of bank accounts and facilitate quick access by FIUs and law enforcement agencies to information on bank accounts and safe deposit boxes held on that connected system of registries across the Union.5 In theory, this will accelerate financial investigations and the recovery of criminal assets in EU cross-border cases. It should be noted that this draft Regulation is also just the framework – the Commission proposes that the AMLA will prepare detailed technical standards in due course, and Member States may still opt to extend the AML/CTF rules to additional sectors at national level. The full ‘single EU rulebook’ is expected to be in force by the end of 2025.

  3. An expansion of AML/CTF rules to the entire crypto sector:6
    Currently only certain categories of crypto-asset service providers are included in the scope of EU AML/CTF rules. The proposed revision to the 2015 Transfers of Funds Regulation7 will include rules that are concerned with, for example, enhancing the traceability of crypto-asset transfers, obliging all crypto-asset service providers to conduct due diligence on their customers, and prohibiting anonymous crypto-asset wallets.

  4. A new Anti-Money Laundering Directive on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing Directive (EU) 2015/849:8 The package includes what the Commission refers to as a sixth Directive on AML/CTF (‘AMLD6’), to repeal and replace the existing fourth Anti-Money Laundering Directive,9 which was itself amended by the fifth Anti-Money Laundering Directive.10 AMLD6 proposes new rules and minimum standards for national supervisors and FIUs, which are designed to enhance co-ordination and improve cooperation and efficiency, and the AMLA will be tasked with issuing further guidelines.

    Of particular interest is the Commission’s use of the draft AMLD6 to provide for a more robust international dimension to the AML/CTF framework, including by better alignment with the revised FATF Recommendations in relation to third countries. A country that is listed by FATF will also be listed by the EU. There will be two EU lists, a “black-list” and a “grey-list”, with the latter reflecting the FATF listing. Following listing, the EU will apply measures proportionate to the risks posed by the country. The EU will also be able to list countries that are not listed by FATF, but which pose a peculiar or specific threat to the EU’s financial system. The Commission’s stated intention is that both it and the AMLA will have the tools to allow the EU to keep pace with a fast-moving and complex international environment with rapidly evolving risks in this way.

The remainder of this alert will focus on the proposed change to the EU’s AML/CTF institutional framework. We will also examine the way in which the EU’s new approach to AML/CTF may look to work with and/or facilitate the private sector to fulfil certain complementary AML/CTF functions, including by drawing on the success and model of certain public-private partnership (PPP) initiatives. Further updates will follow, tracking the progress and detail of the proposed changes to the AML/CTF legislative framework, summarised above.

The AMLA: background

It is no coincidence that these proposals followed the publication in June 2021 of the European Court of Auditors’ special report on the EU’s AML/CTF efforts in the banking sector (the “ECoA Report”).11 The ECoA Report found that there was institutional fragmentation (across several EU bodies) and poor co-ordination at EU level when it came to taking action to prevent money laundering or respond to identified risks. The ECoA Report also noted that there was insufficient implementation and application of AML/CTF laws and frameworks at national level, and that EU bodies have limited tools to ensure such implementation and do not use them effectively.12

The proposed creation of the new AMLA is therefore critical and central to the planned overhaul of the EU’s approach to AML/CTF, which currently sees AML/CTF supervision effectively take place at national level, with insufficient EU oversight framework to ensure a level playing field. The Commission’s announcement stated that AMLA will “transform AML/CTF supervision in the EU”, and it will have a key role to play in enhancing cooperation among national FIUs and co-ordinating national authorities to ensure that the private sector “correctly and consistently applies EU rules” throughout the Union. The proposal is that AMLA will also support FIUs to improve their analytical capacity around illicit flows of funds and make financial intelligence a key source for law enforcement agencies.

This should mark a departure from the current fragmented position, where a variety of EU bodies play different roles in relation to AML/CTF:

  • The Commission is responsible for developing policy, monitoring transposition of rules into national law, and carrying out risk analysis.
  • The European Banking Authority (EBA) is responsible for analysing and investigating breaches of EU law and setting detailed standards for use by national supervisors and the sector, and its legal mandate and powers in respect of AML/CTF were significantly increased in January 2020.
  • The European Central Bank (ECB) is responsible for the prudential supervision of banks in the Euro area, which includes taking account of AML/CTF laundering and terrorist financing (AML/CTF) risk. Since 2019, it has had a role in sharing necessary and relevant AML/CTF information with national supervisors.

The ECoA Report observed that none of the above bodies was discharging those functions sufficiently: the Commission was “slow to assess Member States’ transposition of directives due to poor-quality communication by Member States and limited resources at the Commission”; the EBA (despite carrying out thorough investigations into potential breaches of EU law) appeared to be open to the lobbying of its Board of Supervisors who were part of a deliberative process, while the ECB (despite making a “good start” in sharing information with national supervisors) is hampered by certain slow decision-making procedures and the variable quality of the material shared by national supervisors.13

In its May 2021 Action Plan, the Commission noted that it was considering whether – as an alternative to creating a new authority – any of the existing EU bodies (and particularly the EBA) might take on the required tasks. For legal and other reasons, including difficulties with the EBA’s model of governance and its lack of supervisory experience, the Commission decided against that option. The upshot is that the EBA will lose its AML/CTF-related powers and competences to the AMLA.

The AMLA: role

The AMLA will have a combination of direct and indirect supervisory powers and perform different roles in the financial and non-financial sectors.

In the financial sector, it will directly supervise a limited number of high-risk financial institutions and carry out indirect supervision of other financial institutions through monitoring and co-ordinating national supervisors. The financial institutions subject to direct supervision (referred to in the AMLA Regulation as “selected obliged entities”) will be determined by way of objective selection criteria or by Commission decision and are expected to be high-risk cross-border financial institutions (or groups) carrying on activity in a significant number of Member States and have the highest risk profile in several of those Member States. Any financial institutions requiring immediate emergency action to address imminent money laundering or terrorist financing risks will also be subject to direct supervision. The Commission proposes that the AMLA will start the first selection process on 1 January 2025 and publish a list of the selected financial institutions within one month of that date. The first cohort of selected financial institutions will be transferred to EU-level supervision at the start of 2026. Any selected financial institution will remain under the AMLA's direct supervision for at least three years even if, during that period, it ceases to meet the selection criteria. The Commission expects that 100 of the AML’s expected 250 staff will be dedicated to direct supervision of financial institutions, working in joint supervisory teams located in the country where the relevant financial institution is headquartered.

In the non-financial sector, its supervision will be entirely indirect, through the oversight and co-ordination of national supervisors or self-regulatory bodies (SRBs).

In summary, AMLA will:

  • monitor risks, threats, and vulnerabilities across the EU and in third countries;
  • establish and keep up to date a central AML/CTF database of information collected from national supervisors (including by taking over the EBA’s database) and share its analyses with national supervisors as required to facilitate their supervisory activities;
  • establish a single integrated system of AML/CTF supervision across the EU, based on common supervisory methodologies and convergence of high supervisory standards;
  • directly supervise some of the ‘riskiest financial institutions’ that operate in a large number of Member States or require immediate action to address imminent risks, which will include carrying out supervisory review and requiring specific procedural or governance changes or imposing appropriate sanctions;
  • indirectly supervise other financial institutions, including through periodic peer and thematic reviews to ensure that all national supervisors have sufficient resources;
  • have the power to investigate obliged entities’ potential breaches of the proposed single rulebook and impose sanctions up to a maximum of 10% turnover (or €10m), and/or to call on other supervisory authorities to investigate obliged entities and consider sanctions for breaches;
  • monitor and co-ordinate national supervisors responsible for other financial entities, as well as co-ordinate supervisors of non-financial entities; and
  • support co-operation among national FIUs and facilitate co-ordination and joint analyses between them, to better detect illicit cross-border financial flows.

The AMLA: composition, funding, and timeline

The AMLA will have a Chair and an Executive Director. The Executive Director will oversee the daily and administrative management of the AMLA, with responsibility for budget implementation, resources, staff and procurement. The Chair will represent the AMLA and run its Executive Board (i.e. the governing body empowered to take all decisions concerning obliged entities and national supervisors, as well as decisions on its draft budget and other matters relating to its operation and functioning) and its General Board (which is expected to have two alternative compositions, one having a ‘supervisory’ composition of heads of national AML/CTF supervisors and the other relating to the AMLA’s FIU remit).

The Commission calculated that the total annual expenditure of the AMLA (when fully operational) will be €45.6 million. Once the AMLA has reached around 250 staff (which is expected by the end of 2025), its funding will come partly from the EU budget (25%) and mostly from fees paid by certain obliged entities (75%). The methodology for determining which obliged entities will be subject to such fees and the amounts concerned will be laid down in a future Commission Delegated Act. This is a significantly larger budget and headcount for AML/CTF than ever before – the EBA, which currently dedicates 13 of its approximately 200 staff to AML/CTF matters, has an annual budget of €50 million (40% of which comes from the EU budget, and 60% from national supervisory authorities).

The Regulation establishing the AMLA sets out certain key milestones in its development: by 1 January 2023, certain of its provisions are expected to apply, enabling the AMLA to be established, with the Regulation applying fully by 1 January 2024.

A number of Member States are already vying to host the AMLA, including Germany (which already hosts the ECB in Frankfurt), France (which has hosted the EBA in Paris since Brexit), and Italy.

Leveraging the private sector: consultation on PPPS

A week after it released the AML/CTF package above, the Commission launched a public consultation on guidance on the rules applicable to the use of public-private partnerships (“PPPs”) in the broader framework of preventing and fighting money laundering and terrorist financing. The Commission explained that discrepancies between the legal frameworks and practical arrangements across the EU mean that it is essential for it to provide guidance and share good practices for PPPs in relation to, in particular, antitrust rules, safeguards and limitations in relation to data protection and guarantees on fundamental rights.

The consultation’s aims in this regard are to:

  • Obtain information on the types of PPPs currently operating in Member States in AML/CTF settings, as well as the types of information exchanged within those partnerships and the measures put in place to guarantee the preservation of fundamental rights.
  • Gather input regarding the mechanisms established to measure the effectiveness and success of those partnerships (e.g. key performance indicators (KPIs) or any other performance metrics).
  • Improve the Commission’s understanding of the impacts, benefits and added value of the various PPPs in AML/CTF settings.

In our December 2020 alert,14 we looked at the way in which PPPs are being used to address the challenges financial institutions face in identifying or detecting potential criminal activity in isolation. While criminal networks deliberately conceal money laundering schemes by using multiple accounts across multiple financial institutions (and often jurisdictions), a given financial institution will typically see only the fraction of the transaction, network, or trend that appears in the accounts it administers, and most countries prohibit information-sharing between counterpart financial institutions regarding financial crime risk or suspicion. One response to these practical challenges was to establish PPPs for sharing financial information.

The first of those partnerships, the United Kingdom’s Joint Money Laundering Intelligence Taskforce (JMLIT) in 2015, marked a fundamental shift in approach to financial crime and put information-sharing and collaboration across PPPs at the centre of efforts to detect and respond to financial crime. That UK innovation is now a mainstream feature of the financial crime architecture in most liberal democracies, with 18 countries establishing similar partnerships, covering 20 of the top 30 global financial centres. Most recent and notable is the Dutch initiative, Transaction Monitoring Netherlands (TMNL). As discussed in detail in our recent article, TMNL is a first-of-its-kind private company established in 2020 by the five largest Dutch banks (i.e. ING, ABN Amro, Rabobank, Triodos Bank, and de Volksbank) to act as a collective information-monitoring entity for all payments across those banks, and to work closely with Dutch enforcement agencies, including the ministries of Finance and Justice and Security, the Fiscal Information and Investigation Service (FIOD), and the FIU.

The Commission’s consultation on PPPs closes on 2 November 2021. It will be interesting to see what guidance emerges, and whether it is sufficiently clear or useful to enable greater and/or enhanced use of PPPs in more countries. The impact of greater intelligence-sharing, including in conjunction with the co-ordination of the new AMLA and recast EU AML/CTF regime, should be to markedly increase the quality and utility of detecting and reporting suspicious activity, and thus to improved investigation and prosecution of financial crime.

Conclusion and comment

Behind this legislative package is the recognition that the EU needs a more modern, more consistent and more integrated AML/CTF regime to face the increasing scale and complexity of money laundering and terrorist financing activity across the EU. The Commission has now started taking the first steps in that direction. The Commission’s acknowledgment of the useful role played by PPPs in the AML/CTF context, and its desire to prepare guidance to facilitate better quality reporting is not only encouraging, but indicative of the planned shift towards a more cohesive and holistic approach to financial crime in the EU.

While the proposed package concerns AML/CTF, it sits adjacent to and overlaps with the EU’s regulation and supervision of the financial services sector (most obviously through its directives on payment services, payment accounts, and electronic money, for example) and should therefore have a considerable impact on financial services firms. The proposed overhaul may indirectly benefit firms operating across multiple Member States, too, since a single EU AML/CTF rulebook and a greater degree of certainty or predictability regarding regulatory investigation and enforcement actions should ease the compliance burden to some extent.

It remains to be seen what impact these changes, and particularly direct supervision by the AMLA, will have on firms that also operate or are supervised in the UK, which has newfound autonomy over its own AML/CTF regime since Brexit. By coincidence, just days after the Commission unveiled its overhaul package, Her Majesty’s Treasury (HMT) in the UK launched a call for evidence as part of a broad review of the UK’s AML/CTF regulatory and supervisory regimes, as well as a consultation in respect of specific amendments to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs).15 These exercises arose out of the UK’s Economic Crime Plan for 2019-2216 (which tasked HMT with reviewing the MLRs and the related Oversight of Professional Body Anti-Money Laundering and Counter Terrorist Financing Supervision Regulations 2017) as well as the legal duty in those regulations to review their regulatory provision. The response period is open until mid-October 2021, with HMT due to publish a report by the end of June 2022. While there is scope for divergence between the EU and UK AML/CTF regimes, it seems unlikely that the UK would depart significantly from the EU, since both regimes will need to remain compliant with the FATF Recommendations, and the UK will in any event wish to retain ‘equivalence’ as it is now a third country for EU AML/CTF purposes. Divergence is more likely to involve either or both of the EU or the UK ‘gold-plating’ particular AML/CTF measures. Firms operating in both the UK and the EU will want to respond to the UK consultations to make the case for alignment with the EU’s proposals, and to ensure that any divergence between the EU and UK AML/CTF regimes does not result in inordinately complicated or onerous compliance obligations.

We will keep track of the EU’s legislative package as it progresses through the European Parliament and Council, and issue updates at appropriate points.

In a nutshell: three takeaway points

(1) What?
The European Commission is taking steps to overhaul and future-proof the current AML/CTF framework, which has been insufficiently and inconsistently implemented and applied at national level, and beset by institutional fragmentation and poor co-ordination at EU level, where EU bodies had limited tools and powers, and failed to use them properly.

(2) How?
The Commission has proposed a legislative package which includes a harmonized, single rulebook for AML/CTF and the creation of a new EU-level AML authority (AMLA). The package also proposes revisions to existing AML/CTF legislation, including, for example, to set minimum standards to improve co-ordination, co-operation and efficiency between national supervisors and Financial Intelligence Units (FIUs), and also to future-proof the framework to account for technological innovation and challenges. The latter includes expanding the list of ‘obliged entities’ to the likes of crowdfunding service providers and bringing the entire crypto sector within scope of AML/CTF rules.

(3) When?
The draft legislative package has yet to be scrutinised and agreed by the European Parliament and Council (and therefore the Member States) as part of the ordinary legislative process, which may take well over 12 months.

If or when agreed and approved, the new Regulations will be directly applicable in Member States, but AMLD6 will need to be transposed into national law in the same way as its predecessor Anti-Money Laundering Directives. To give the AMLA time to become operational and complete the Single EU Rulebook (e.g. by developing the necessary technical standards), the new AML/CTF framework is expected to apply three years after adoption. The Commission expects AMLA to be operational in 2024 and begin direct supervision slightly later, once AMLD6 has been transposed and the new AML/CTF framework starts to apply, which is expected by the end of 2025.


  1. Beating financial crime: Commission overhauls anti-money laundering and countering the financing of terrorism rules, European Commission Press Release, (20 July 2021), The package was accompanied by an Impact Assessment: Commission Staff Working Document Impact Assessment Accompanying the Anti-money laundering package, (SWD(2021) 190),
  2. Communication from the Commission on an Action Plan for a comprehensive Union policy on preventing money laundering and terrorist financing, (C/2020/2800), OJ C 164, 13.5.2020, p. 21-33.
  3. Proposal for a Regulation Of The European Parliament And Of The Council establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU) 1094/2010, (EU) 1095/2010’, COM(2021) 421 final, available at:
  4. Proposal for a Regulation Of The European Parliament And Of The Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, COM(2021) 420 final, available at
  5. Access to financial information will be subject to the robust safeguards in Directive (EU) 2019/1153 on the exchange of financial information.
  6. Proposal for a Regulation Of The European Parliament And Of The Council on information accompanying transfers of funds and certain crypto-assets (recast), COM(2021) 422 final, available at
  7. Regulation 2015/847/EU.
  8. Proposal for a Regulation Of The European Parliament And Of The Council on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing Directive (EU) 2015/849, COM(2021) 423 final, available at
  9. Directive 2015/849/EU (adopted on 20 May 2015, with a transposition deadline of 26 June 2017).
  10. Directive 2018/843/EU (adopted on 30 May 2018, with a transposition deadline of 10 January 2020).
  11. European Court of Auditors, Special Report 13/2021 (28 June 2021),
  12. Ibid. at pages 50‒66
  13. Ibid. page 6.
  14. Transaction Monitoring Netherlands: A novel solution to the banking industry’s AML puzzle?’ (16 December 2020), available at
  15. Call for Evidence: Review of the UK’s AML/CFT regulatory and supervisory regime’ (22 July 2021), available at; and ‘Open consultation: Amendments to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 Statutory Instrument 2022’, (22 July 2021), available at
  16. Economic Crime Plan 2019 to 2022’, (12 July 2019), available at