AMLA Direct Supervision: Which Firms, When, and What the Data Requests Look Like

The firms AMLA will supervise directly do not yet know for certain that they have been chosen. The ones that will handle it best are already building the data capability the selection is going to demand.

Most of what is written about the EU’s new Anti-Money Laundering Authority is about the institution: where it sits, how it is staffed, what it means for the European supervisory architecture. That is the political story. For a technology function inside a regulated firm, the relevant question is narrower and more concrete. Does your firm fall into the pool AMLA can select from, and when the requests start, can you actually produce what a supervisor working from a harmonised, cross-border data model will ask for? Those two questions have answers you can work on now, well before the first selection.

What “direct” supervision actually changes

AMLA was established by Regulation (EU) 2024/1620, which entered into force on 26 June 2024, and the authority formally began operations on 1 July 2025 from its seat in Frankfurt. Most obliged entities will never deal with it directly; they stay with their national supervisor, and AMLA’s role over them is indirect, through coordination and standards. A small group will not. From 2028, a limited set of high-risk institutions come under AMLA’s direct supervision.

Direct supervision is a different reporting relationship, not a stricter version of the one you have. Each selected entity is supervised by a joint supervisory team drawn from AMLA and the relevant national authorities, coordinated by AMLA. The centre of gravity moves. Your primary supervisory counterparty is no longer solely your national regulator working to a national template; it is a team applying a common EU methodology and a common data model across firms in several member states at once. That is the shift that matters for how you hold and produce your data.

Which firms, and on what logic

Selection runs in two stages: an eligibility gate, then a risk cut. The gate is cross-border footprint. Broadly, a credit or financial institution is in scope for assessment if it operates in at least six member states, whether through establishment or under the freedom to provide services, with genuinely material activity in each rather than a nominal presence. The exact customer-number and transaction-volume thresholds sit in the technical standards, so verify your position against the final RTS rather than a rule of thumb.

From that eligible pool, AMLA selects the entities exposed to the highest money-laundering and terrorist-financing risk, using a harmonised assessment that combines inherent and residual risk on defined data points. The first selection is expected to run from 1 July 2027 over roughly six months, with direct supervision starting from 1 January 2028, and the group reviewed on a three-year cycle. Reporting suggests the first cohort will be capped at around 40 groups and entities, though the number for later cycles is not fixed.

If you run a cross-border payments business, an e-money institution, a crypto-asset service provider operating across the bloc, or a banking group with real presence in six or more member states, the honest working assumption is that you are in the eligibility pool. Whether you are then selected depends on your residual-risk position — which is something you can estimate now rather than discover in 2027.

What the data requests will look like

This is the part that lands on the technology function, and it starts before selection. The selection process itself begins with a data-collection exercise: AMLA has asked national supervisors to gather defined data from potentially eligible entities against a common template, with a collection deadline in August 2026 and a provisional list of eligible entities expected around the end of September 2026. In other words, the first cross-border data request arrives roughly a year before anyone is formally selected, and it is framed by AMLA’s model, not your national one.

Once a firm is under direct supervision, expect the mix to be offsite reporting plus onsite inspection. The substance a joint supervisory team works from is predictable: customer risk-rating distributions, transaction-monitoring alert volumes and how they were dispositioned, coverage of customer due diligence and enhanced due diligence, politically-exposed-person and sanctions-screening results, and beneficial-ownership records. The hard demand is not the existence of any one of these. It is producing them sliced by jurisdiction, on a single consistent taxonomy, across every entity in the group, on a supervisor’s timetable.

Why this is a data-architecture problem, not a policy one

The firms that will struggle are not the ones with weak AML policies. They are the ones whose data grew up separately in each country — different core systems, different transaction-monitoring tools, different definitions of what “high-risk customer” even means. Ask that group to state the same thing the same way across six national entities and you expose every inconsistency at once. A firm whose underlying risk is higher but whose data is coherent will present better than one whose risk is lower but whose numbers do not reconcile.

Which is why the preparation is architectural. It means a common data model with agreed definitions and a data governance framework that fixes them across jurisdictions, so “high-risk” and “alert” and “EDD applied” mean one thing group-wide. It means the pipelines to pull consistent data out of heterogeneous national systems, which is squarely an ETL/ELT and data-movement decision. And it means somewhere to assemble and query it at group scale without stumbling into cost or lock-in traps, which is the data-warehouse selection question. None of that is built in the weeks after a supervisor asks.

What to do before the request arrives

Three things, in order. Map your selection risk: run the six-member-state test against your real footprint and form an honest view of your residual-risk position, and put both 2027 and 2028 on the board’s regulatory deadline calendar. Inventory the data the harmonised model will want and locate where each element actually lives across the group. Then build the capability to produce cross-jurisdiction, consistently-defined AML data on demand — before the first template, not after the first inspection.

Being drawn into direct supervision does not change your risk. It changes who is looking, and how coherent your answer has to be. The firms that treat AMLA selection as a data-provisioning problem in 2026 will answer cleanly in 2028. The ones that treat it as a 2028 problem will spend that year explaining why their six countries cannot agree on what a high-risk customer is.