What AMLA says about cryptocurrencies, in one sheet.
AMLA is the EU's first direct supervisor for high-risk financial entities.
Established by Regulation (EU) 2024/1620, AMLA opened in Frankfurt and started operations on 1 July 2025. Direct supervision of selected obliged entities begins 1 January 2028. Up to 40 entities operating in at least 6 Member States will be picked from the financial sector — explicitly including crypto-asset service providers.
Four dates that matter.
2024
2025
2027
2028
Across credit institutions, e-money issuers, payment institutions, and CASPs. At least one per Member State.
An entity must operate across ≥ 6 EU Member States to qualify for direct supervision.
Customer due diligence required on any crypto transfer above this amount — including transfers to self-hosted wallets.
Today ~120; ramping to enable joint supervisory teams and on-site inspections of selected entities.
Direct supervision.
AMLA itself supervises 40 selected high-risk financial entities. Joint supervisory teams composed of AMLA staff + national supervisors.
Indirect oversight.
Sets EU-wide standards, guidelines and technical standards. Reviews national supervisors' performance. Steps in as last resort if NCAs fail.
FIU coordination.
Operates the new FIU.net platform. Facilitates joint cross-border case analyses. Hub for the EU's financial intelligence network.
Investigatory powers.
Information requests, on-site inspections, sealing of premises, sanctions. Independent investigatory teams for serious-breach cases.
Single rulebook.
Establish one harmonised EU AML/CFT rulebook — eliminate divergent transposition across Member States.
Effective implementation.
Ensure the existing EU AML/CFT framework is actually applied — not just on paper.
FIU support.
Build a cooperation mechanism for Financial Intelligence Units; common reporting templates & standards.
International reach.
Strengthen the international dimension of the EU framework; coordinate with FATF and third-country regimes.
The shortlist — still being drafted.
EBA's RTS on selection criteria closed consultation 6 Jun 2025. Apply from 10 Jul 2027. Highest-risk cross-border CASPs, credit and financial institutions are likely.
The numbers compliance teams need by heart.
What CASPs can no longer touch.
What must travel with every transfer.
How the rest of the world is doing.
Have some form of VASP regime.
Of 138 jurisdictions reviewed under Recommendation 15, 99 have introduced a VASP regulatory regime. The remainder are still drafting.
Have not yet implemented Travel Rule.
Despite being a 2019 standard, most jurisdictions still lack a working Travel Rule regime — leaving the EU's December 2024 implementation a global outlier.
Now the dominant illicit-finance rail.
FATF's targeted update flags stablecoins as the asset most used by DPRK actors, scammers and sanctioned entities — replacing earlier privacy-coin focus.
Who pays for AMLA.
Hybrid: a portion from the EU general budget, the rest from fees levied on obliged entities — directly or indirectly supervised. CASPs in scope of direct supervision will contribute proportionate to risk and footprint.