AMLA in Frankfurt: What the EU's New AML Authority Means for DACH Market Entrants

In February 2024, Frankfurt won the contest to host the European Union's new Anti-Money Laundering Authority. The symbolism is hard to miss: the city that houses the European Central Bank and BaFin's securities supervision is now also the centre of gravity for European financial-crime supervision. For firms planning a DACH market entry, the consequences are practical, not symbolic.

The authority — AMLA — is the institutional core of the EU's anti-money-laundering package adopted in 2024. That package rests on three pillars: a directly applicable Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), the sixth Anti-Money Laundering Directive (AMLD6, Directive (EU) 2024/1640), and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the authority itself. The bulk of the AMLR's obligations applies from 10 July 2027 — which means the preparation window is now, not later.

Why a Regulation Changes Everything

For three decades, European AML law lived in directives, and directives must be transposed into national law. The result was a patchwork: the German Geldwäschegesetz (GwG), the Austrian Finanzmarkt-Geldwäschegesetz, and their counterparts across the Union shared a common ancestry but diverged in detail — thresholds, definitions, documentation expectations. Cross-border firms had to maintain jurisdiction-specific AML manuals and reconcile conflicting national guidance.

The AMLR ends that model for the harmonised core. As a regulation, it applies directly in every member state, without transposition. Customer due diligence standards, beneficial-ownership definitions, group-wide policies, and the catalogue of obliged entities will read identically in Berlin, Vienna, and Luxembourg. For a fintech running one compliance programme across several EU markets, this is the single largest simplification in the history of European AML law — and simultaneously a one-time migration project, because existing GwG-based frameworks must be mapped onto the new rulebook.

What Actually Changes in Substance

• Beneficial ownership. The AMLR sets the ownership-and-control threshold at 25 percent, with tighter rules for high-risk structures and a harmonised approach to nominee arrangements. Registers become more consequential, and discrepancy reporting becomes routine.
• A cash cap. A Union-wide limit of 10,000 euros for cash payments in professional transactions — a genuine novelty for Germany and Austria, where cash culture runs deep.
• Crypto in the regulation itself. Crypto-asset service providers under MiCA, obliged entities since the end of 2024, carry full customer due diligence duties under the AMLR, for occasional transactions from 1,000 euros.
• Harmonised CDD. Standard, simplified, and enhanced due diligence are specified at EU level, with technical standards to follow — reducing the room for national gold-plating that historically complicated multi-market rollouts.

AMLA Itself: Direct Supervision Is Coming

AMLA began building its organisation in Frankfurt in 2025 and is scaling toward its first flagship function: from 2028, it will directly supervise a first cohort of roughly forty credit and financial institutions considered high-risk and cross-border — selected by methodology, not by application. Everyone else remains nationally supervised, but under AMLA's coordination, with joint analysis teams, harmonised methodologies, and the power to take over supervision in defined escalation cases.

For DACH market entrants, two consequences follow. First, BaFin's and the FMA's AML expectations will converge toward AMLA's supervisory methodology — firms should expect more data-driven supervision, more structured risk questionnaires, and less tolerance for paper-only frameworks. Second, fast-growing payment and crypto firms with multi-country footprints should understand the selection methodology early: being designated for direct AMLA supervision changes reporting lines, inspection cadence, and the seniority of compliance staffing a firm needs.

“

The firms that treated the GwG as a checklist will experience the AMLR as a burden. The firms that built genuine financial-crime risk management will experience it as a moat.

The German Angle

Germany fought hard for the AMLA seat, and the win fits a broader repositioning. After the FATF's 2022 evaluation criticised enforcement fragmentation, Germany consolidated analysis capacity and invested in its Financial Intelligence Unit. Frankfurt now hosts the ECB, parts of BaFin, and AMLA within one urban perimeter — a concentration of supervisory talent that will shape hiring markets, consulting capacity, and, not least, the informal expectations that supervisors bring to authorisation files.

Practically, firms preparing a German application in 2026 are well advised to build the AML section of the file to the coming AMLR standard already; the application itself is assessed under today's GwG. A risk assessment under section 5 GwG that is scheduled for a structural rewrite in 2027 is a weak foundation; an assessment already organised around the AMLR's categories is a statement of competence.

Switzerland: Adjacent, Not Identical

Switzerland is not bound by the EU package, but it is moving in a parallel direction: in September 2025 parliament adopted a federal register of beneficial owners and, in a narrower form than the Federal Council had proposed, due diligence duties for certain advisory activities. Firms operating across the EU-Swiss boundary should plan for conceptual alignment with persistent procedural differences — the classic Swiss pattern.

From Paper to Database: The Operational Dimension

The least discussed consequence of the package may be the most expensive one: AMLA's supervisory model runs on structured data. Joint analysis, risk scoring across member states, and the selection methodology for direct supervision all presuppose that institutions can report customer risk, transaction patterns, and control effectiveness in machine-readable form. A compliance function whose evidence lives in Word documents and quarterly PDF reports will spend 2026 and 2027 building data pipelines — not because the AMLR says “build pipelines”, but because every interaction with the new supervisory architecture assumes they exist.

The same logic applies to screening infrastructure. Harmonised customer due diligence raises the bar for name-matching quality, sanctions-list handling, and adverse-media processes, and it narrows the room for idiosyncratic national workarounds. Institutions that treat their screening stack as a commodity purchase will find the gap between vendor promise and supervisory expectation uncomfortable; those that own their matching thresholds, tuning decisions, and false-positive economics will have answers ready when the questionnaires arrive.

What Directly Supervised Institutions Should Expect

For the cohort that ends up under AMLA's direct supervision, the operating reality will resemble what significant banks experienced when the Single Supervisory Mechanism arrived: joint supervisory teams mixing AMLA staff with national supervisors, annual supervisory cycles with structured risk assessments, and supervisory fees levied on the supervised. The institutions in scope — large cross-border credit institutions and financial institutions with elevated inherent risk — should expect the intensity of engagement to step up well before 2028, because the selection assessment itself requires deep data submissions.

Even firms that will never be selected should study the methodology, for a simple reason: national supervisors will borrow it. The risk factors AMLA weighs — cross-border footprint, product risk, customer mix, weaknesses found in past inspections — are becoming the common European vocabulary of AML supervision, and a firm that can discuss its own profile in that vocabulary controls the conversation.

The Timeline in Detail

1. 012025: AMLA operational build-up in Frankfurt — leadership in place, first staff cohorts, methodology work begins.
2. 022026: consultation rounds on technical standards and guidelines; institutions map AMLR deltas and start remediation.
3. 0310 July 2027: the AMLR's core obligations apply across the Union; national laws recede to the areas AMLD6 leaves them.
4. 042027: selection assessment for direct supervision runs on institutions' data.
5. 052028: AMLA assumes direct supervision of the first cohort; everyone else meets the harmonised regime through their national supervisor.

Preparing Without Panic

1. 01Map your current GwG/FM-GwG framework against the AMLR chapter by chapter and log the deltas.
2. 02Rebuild the beneficial-ownership file for complex clients now — it is the area with the highest rework cost.
3. 03Decide where group-wide policies will live and which entity owns them; the AMLR expects genuine group governance.
4. 04If you are a payment or crypto firm with multi-country ambitions, assess your exposure to AMLA direct-supervision criteria.
5. 05Budget compliance hiring against 2027, not against today’s requirements.

Conclusion

The AML package replaces a fragmented directive landscape with a single rulebook and a single coordinating authority — headquartered in the middle of the DACH region. For well-governed firms, harmonisation lowers the long-run cost of multi-market compliance; for everyone, 2026 is the year the migration project must start. Aegiron Capital Group helps international firms plan the move to the incoming standard as a project and prepare the documents for it; legal review stays with the law firm you engage.