The EU Anti Money Laundering Authority and the AML reform package: an update

In July 2021, the European Commission presented a package of legislative proposals designed to combat money laundering, terrorist financing and the evasion of sanctions. These proposals included the establishment of a new EU agency, the Anti Money Laundering Authority (AMLA). On 13 December 2023, the EU Parliament and Council of the EU announced that they had reached a "provisional agreement" on the AMLA's creation.

We have previously published an analysis of the proposed creation and role of the AMLA, covering: its direct and indirect supervisory powers; cooperation with Financial Intelligence Units (FIUs); and funding. In this post, we provide an update on the progress of the proposals relating to the AMLA. We also update on the current progress of the AML reform package, on which the EU Council and European Parliament (Parliament) reached provisional agreement on 18 January 2024.

Recap on the AMLA

As a reminder, it was originally envisaged that AMLA would have tasks within five broad areas:

1. Direct supervision: the AMLA will directly supervise a number of the highest risk cross-border financial sector firms group – known as Selected Obliged Entities – to ensure their group-wide compliance with AML/CFT requirements
2. Supervision of financial sector supervisors: carrying out periodic reviews to ensure that all financial supervisors have adequate resources and powers necessary for the performance of their tasks;
3. Enhancing the supervision of non-financial sector supervisors: coordination of peer reviews of non-financial supervisors' standards and practices and requesting such supervisors to investigate possible breaches in respect of the entities they supervise;
4. FIU coordination: identifying relevant cases for joint analysis by Financial Intelligence Units and the making available of information and tools to FIUs; and
5. Rule-making and guidance: a general power to adopt regulatory technical standards and implementing technical standards.

Whilst it is those firms who are identified as Selected Obliged Entities who will be most immediately impacted by the creation of AMLA, its indirect supervisory and rule-making powers are also very significant. There are many areas of the draft AML reform package where important details are to be addressed via technical standards in due course.

An update on AMLA's Governance and seat

According to the Council of the EU's press release of 13 December 2023, under the provisional agreement, AMLA will have a general board composed of representatives of supervisors and FIUs from all member states, and an executive board that will be the governing body of AMLA, composed of the chair of the Authority and five independent full-time members.

Nine Member States have submitted applications to host the AMLA: Brussels, Frankfurt, Dublin, Madrid, Paris, Rome, Riga, Vilnius, and Vienna. The Commission is expected to submit its assessments of the applications in January 2024.

An update on AMLA's Supervisory powers

Direct supervision (up to 40 firms):

1. The AMLA will select up to 40 groups and entities within the financial sector (including crypto asset service providers) as Selected Obliged Entities in the first selection process. The AMLA will agree the selection criteria, to comprise those entities deemed to pose the highest risk of money laundering or terrorist financing, active in at least 6 EU countries and including at least one institution from each member state.
2. The Selected Obliged Entities will be supervised by joint supervisory teams led by AMLA that will carry out assessments and inspections. AMLA will also have fining powers in relation to these directly supervised entities.
3. The AMLA will ensure that Selected Obliged Entities have internal policies and procedures in place to ensure the implementation of targeted financial sanctions, asset freezes and confiscations – marking an expansion of the purely AML / CFT supervisory requirements envisaged in the original proposals.

Indirect supervision (everyone else):

1. As originally envisaged, for non-selected obliged entities (i.e. everyone other than the 40 firms selected using the criteria above), AML/CTF supervision will remain at member state level.
2. For firms which are subject to cross-border supervisory 'colleges', AMLA will be given the power to settle disagreements between supervisors with binding effect. (As a recap, 'colleges' are structures that serve to enhance cooperation between different supervisors involved in the supervision of certain cross-border financial sector firms. As of 31 December 2022, competent authorities had reported 229 fully operating colleges to the EBA, with an additional 54 colleges had yet to hold their first meeting)[i].
3. In other cases (i.e. firm firms which are not supervised via a formal college structure), AMLA will be able to resolve disagreements on the request of a financial supervisor.
4. Outside the financial sector, and again as originally envisaged, AMLA's role will be more limited, but nonetheless still important. It will "have a supporting role, carrying out reviews and investigating possible breaches in the application of the AML/CFT framework", and will be able to issue non-binding recommendations. The release also notes that national supervisors will be able to voluntarily set up a cross-border supervisory college for a non-financial sector entity operating if deemed needed.
5. The position on whistleblowing will also be different as between the directly and indirectly supervised sector. The press release notes (somewhat cryptically) that "a reinforced whistleblowing mechanism" will be introduced, but that in terms of reports concerning regulated firms, AMLA will only deal with reports coming from financial sector firms. It will also be able to address reports from employees of national authorities.

Other:

1. The press release also notes AMLA's role in coordinating FIUs in member states.
2. The AMLA will also establish and keep updated a central database of information relevant for the anti-money laundering and countering the financing of terrorism (AML / CFT) supervisory system.

Timeline

The legal texts of the AMLA Regulation will now be finalised and presented to member states' representatives and the EU Parliament for approval in early 2024, before being formally adopted by the Council of the EU and the EU Parliament.

The AMLA is expected to conclude the list of Selected Obliged Entities by August 2025 and thereafter to have commenced its direct supervisory activities before the end of 2026. By 2030 the Commission will have completed its first assessment of the performance of the AMLA.

Whilst the EU institutions have not indicated their expectation of any delays to the foregoing timeline, it is notable that the draft Regulation had originally anticipated that the AMLA would be established at the beginning of 2023. There is a possibility that the realisation of other milestones set out in the draft Regulation, including the date of the commencement of the AMLA's direct supervisory activities, might also be delayed.

AMLA Commentary

The agreed updated legislative text had not been published at the time of writing. It is therefore not entirely clear the extent to which the provisionally agreed position departs from the original proposals regarding AMLA's powers and responsibilities in certain respects.

However, it is clear from the press release that the provisional agreement widens the scope of the AMLA's direct supervision from the original proposal of between 12 and 20 groups/entities, to 40. The EU's commentary on the provisional agreement also indicates that there has been an expansion of the remit of the AMLA's planned direct supervisory powers to include crypto asset service providers, in line with the EU Markets in Crypto-Assets (MiCA) Regulation, which entered into force on 29 June 2023. Nonetheless, considering the AMLA will directly supervise relatively few financial entities, its primary impact will likely be indirectly through its influence on the supervision of EU financial institutions by national authorities.

In order to ensure its effectiveness, the AMLA is likely to prioritise harmonising and improving supervisory practices across the EU. This will involve establishing the joint supervisory team structures; and policies and processes for cooperation with national AML authorities, and other EU and third-country agencies.

Banks and financial entities should anticipate stricter AML regulatory standards and more intensive supervision as the new EU AML regime is introduced. However, many of the details of the proposed EU AML package are, under the EU's original proposals, dependent on further technical standards and guidance to be prepared by the AMLA and will therefore only be available once the AMLA becomes operational. As such, there may be some further delay until the full detail of the enhanced regulatory standards becomes available for firms to consider against their existing controls.

AML Package

In relation enhanced regulatory standards, it is also worth noting that the Council has very recently announced that it has reached provisional agreement with the European Parliament on parts of the proposed EU money laundering package. Our briefing on the original package can be found here, with a deep dive on the customer due diligence (CDD) and related proposals here.

We will be publishing a separate briefing when more detail becomes available in due course. In the interim, we highlight the following elements which are called out in the Council press release:

• The scope of the AML regulated sector will be expanded, including further coverage of the crypto sector, traders in luxury goods and (at the discretion of member states, in that they can de-scope assessed low risk entities) professional football clubs and agents. Football clubs and agents will be brought into scope five years after the Regulation comes into effect, rather than three years as for other newly in-scope sectors;
• As originally proposed, there will be an EU-wide limit on cash payments (i.e. payments of physical cash) of over EUR 10,000. In addition, CDD will be required on 'occasional transactions' in cash in the EUR 3,000-10,000 bracket;
• In relation to enhanced due diligence (EDD), there will be changes in relation to ultra high net worth customers, high risk third country EDD (where the existing requirements are widely considered to be unhelpfully rigid, and separate reforms are also expected from a UK perspective), and cross-border 'correspondent' relationships between crypto firms;
• Beneficial ownership registers will be extended to address the ultimate beneficial owners (UBOs) of non-EU entities holding real estate in EU member states. This is, of course, already a feature of the UK regime, following the introduction of the ROE register via the Economic Crime (Transparency and Enforcement) Act 2022. It appears the EU equivalent of this register will be retroactive with effect from 1 January 2014, but that it may not be publicly accessible (albeit there will be access for "persons with a legitimate interest, including press and civil society"). The real estate registers will be accessible to competent authorities through a single access point, to facilitate investigations.
• Seemingly in relation to registers generally (i.e. not only the incoming real estate UBO registers), information submitted to the register will need to be verified. It is also interesting to note that – no doubt in light of the increased focus on sanctions circumvention following the Russian invasion of Ukraine, which post-dated the introduction of the original draft legislation – entities associated with sanctioned persons will need to be flagged on registers. Register-holding agencies will be given power to carry out inspections at registered entity premises to assess doubts regarding the accuracy of the registered information.
• Importantly for compliance purposes, and as discussed in our previous briefings, there will be further clarification of the definition of a UBO, albeit the basic % threshold for ownership will remain at 25%. This is welcome for global consistency purposes, given the earlier debate about the possibility of lowering the threshold.
• Finally, the Council has noted that there will be amendments to the responsibilities and powers of FIUs, apparently including "a firm framework for FIUs to suspend or withhold consent to a transaction" – it is to be hoped that this does not create the same inefficiencies as the UK's consent/DAML regime.

Many of these elements were features of the original proposal and, as ever, the devil will be in the detail in terms of the precise drafting of the new measures. We will provide a further briefing on this in due course, when the legislation is available.

[i] See https://www.eba.europa.eu/sites/default/files/document_library//Joint%20Guidelines%20on%20cooperation%20and%20information%20exchange%20on%20AML%20-%20CFT.pdf and  https://www.eba.europa.eu/publications-and-media/press-releases/supervisory-cooperation-fight-against-financial-crime