← Articles and guides on fraud, cybersecurity, privacy and AML

EU AMLA and the new AML package: banks, fintechs and crypto

How AMLA, the AMLR and the Travel Rule reshape EU anti-money laundering: direct supervision of 40 groups from 2028, a €10,000 cash cap and MiCA licensing.

2026-10-07

Europe is replacing 27 national anti-money laundering regimes with a single rulebook and a central authority. The AML package has three parts: the AML Regulation (AMLR), the Sixth AML Directive (AMLD6) and the Anti-Money Laundering Authority (AMLA). For crypto firms it sits on top of MiCA and the Travel Rule.

AMLA in Frankfurt

Created by Regulation (EU) 2024/1620, AMLA became operational on 1 July 2025, and on 1 January 2026 the EBA completed the transfer of its AML/CFT mandates, according to FinTech Global. It will supervise a select group of high-risk entities directly and steer national supervisors through common methodology and peer reviews. Suspicious transaction reports still go only to national FIUs.

Jones Day sets out the timeline: selection starts on 1 July 2027 and runs six months; direct supervision of 40 groups or entities active in at least six member states begins on 1 January 2028. The first wave is expected to include large banking groups plus payment, e-money and crypto-asset service providers.

AMLR: one rulebook

The AMLR applies directly from 10 July 2027. Key changes include:

A €10,000 cap on cash payments by traders of goods and services, with exceptions for private payments and deposits at financial institutions (CMS).
A ban on anonymous accounts at banks, financial institutions and CASPs, including crypto accounts using anonymity-enhancing coins.
The end of bearer shares, with deadlines in 2029 and 2030.
New obliged entities such as crowdfunding platforms and non-bank consumer lenders.

Crypto: MiCA and the Travel Rule

Rule	Milestone	Effect
Travel Rule (TFR)	Applies since 30 Dec 2024	Originator and beneficiary data travel with every crypto transfer
MiCA	Transition ended 1 Jul 2026	No MiCA licence, no service to EU clients
AMLR / AMLA	10 Jul 2027 / 1 Jan 2028	Uniform AML rules and direct supervision

The Dutch central bank (DNB) explains that CASPs must transmit originator and beneficiary information for every crypto transfer and verify ownership or control of self-hosted wallets for transactions above €1,000. Incomplete transfers must be suspended or rejected and may trigger a suspicious transaction report.

ESMA stated on 17 April 2026 that unauthorised CASPs had to implement orderly wind-down plans by 1 July 2026, moving client assets to an authorised CASP or a self-hosted wallet. Elliptic counted 213 CASP entries across 23 jurisdictions in ESMA's interim register by late June 2026, with December 2025 the busiest month at 41 authorisations.

What it means by firm type

Cross-border banks active in six or more countries are natural candidates for direct AMLA supervision from 2028 and should review KYC data quality and transaction monitoring now.
Payment and e-money fintechs may also be in the first wave, and even under national supervision they will be assessed against AMLA's common methodology.
Exchanges and custodians need a MiCA licence, Travel Rule data on every transfer, self-hosted wallet checks above €1,000 and no anonymity-enhancing products.
Brazilian and US firms serving EU clients need an authorised EU entity for crypto services and should expect tougher due diligence from European banking partners.

Checklist

Check whether your group operates in six or more member states and its risk profile.
Update cash-handling policies before July 2027.
Remove products enabling anonymity or transaction obfuscation.
Test Travel Rule interoperability with non-EU counterparties.
Track AMLA technical standards due during 2026.