The Authority for Anti-Money Laundering and Countering the Financing of Terrorism has an address. As of February 2026, its staff are moving into the MesseTurm, the pencil-shaped tower that has defined the Frankfurt skyline since the 1990s. AMLA started operations on 1 July 2025. It has a chair, Bruna Szego, in post since January 2025. It has a budget, a recruitment pipeline, and a three-year work programme.
What it does not have is a bank to supervise.
The supervisor that does not yet supervise
AMLA was created to fix the structural flaw exposed by Wirecard, Danske Bank, and a decade of cross-border laundering scandals: anti-money-laundering supervision in the EU was national, fragmented, and only as strong as its weakest member-state regulator. The answer was a single EU authority with direct supervisory teeth, seated — after a contested 2024 vote — in Frankfurt, alongside the European Central Bank.
The teeth do not bite until 2028. AMLA’s direct supervision of selected obliged entities begins on 1 January 2028. Until then, the building fills with people who are, for now, writing rules rather than enforcing them.
That gap is not a delay or a scandal. It is the design. But it changes what German banks should actually be paying attention to over the next eighteen months — and it is not the supervisor going up in the MesseTurm.
What is actually happening in 2026 and 2027
AMLA’s near-term job is construction, in two senses. One is literal headcount. The authority is scaling from roughly 120 staff at the end of 2025 to a cruising capacity of about 430 by the end of 2027, per its Single Programming Document 2026-2028.
The other construction is the part that matters for institutions. AMLA’s stated 2026 priorities are to finalise the level-2 technical standards under the EU’s single anti-money-laundering rulebook, build its risk-analysis function, and design the methodology it will use to pick the entities it supervises directly. The regulatory technical standards take legal effect on 10 July 2027, and the selection process for direct supervision runs through 2027 ahead of the 2028 start.
So the sequence is: methodology in 2026, selection in 2027, supervision in 2028. The supervisor is the last thing to arrive, not the first.
Who lands in the forty
When AMLA does begin direct supervision, it will not take over the whole market. It will directly supervise around 40 high-risk obliged entities, selected on cross-border footprint and money-laundering risk. The criteria currently expect a directly supervised entity to be active in at least six member states, with a high inherent risk profile, and the design anticipates roughly one directly supervised group per member state.
For a German institution, two outcomes are live. Either it is large and cross-border enough to land in the forty, in which case its lead AML supervisor in 2028 stops being BaFin and becomes a joint supervisory team run from Frankfurt. Or it sits outside the forty — which is where the overwhelming majority of German banks, payment firms, and crypto-asset service providers will sit — and stays under BaFin.
That second group should not read “stays under BaFin” as “nothing changes.”
The rulebook moves even when the supervisor does not
This is the part the 2028 headline obscures. Direct supervision is the narrow channel. The broad channel is harmonisation, and it does not wait for 2028.
Under the single rulebook, AMLA writes the binding standards that every national supervisor then enforces. In practice that means BaFin’s own interpretive guidance — its Auslegungs- und Anwendungshinweise — loses binding force for matters covered by the EU anti-money-laundering regulation and is replaced by AMLA guidelines. The supervisor in the room stays German. The rulebook it applies becomes European, and it is being drafted now.
This inverts the usual compliance instinct. German institutions outside the forty may be tempted to treat AMLA as a 2028 problem belonging to the country’s biggest banks. The opposite is closer to true. Every German obliged entity inherits the AMLA-written standards through BaFin, on the 2027 technical-standards timeline, regardless of who their named supervisor is. The firms most exposed to change in the near term are not necessarily the ones AMLA will supervise — they are the ones whose existing national workarounds, templates, and AuA-based interpretations are about to be overwritten by a common EU methodology.
Implications
Three things follow for German finance.
First, the planning horizon is 2027, not 2028. The technical standards that define customer due diligence, beneficial-ownership evidence, and risk classification land in mid-2027. An institution that waits for the supervisor to show up in 2028 has missed the window to adapt its systems to the standards that supervisor will apply.
First-tier banks should already be modelling whether they fall inside the direct-supervision population, because the selection methodology is being built in 2026 and the cross-border-footprint threshold is the variable they can least influence late.
Second, the value of national interpretive guidance is decaying on a known schedule. Compliance functions that have spent years calibrating to BaFin’s AuA are calibrating to a document with an expiry date for AMLR-covered matters. The migration cost is real, and it is front-loaded into the standards-drafting period, not the supervision period.
Third, the Frankfurt seat is a coordination fact, not yet a supervision fact. AMLA sitting beside the ECB matters for how prudential and AML supervision will eventually align for the largest groups. But for 2026 and 2027, the authority’s hold over German banks runs through the rulebook and through BaFin, not through anyone in the MesseTurm knocking on a bank’s door.
The tidy version of the AMLA story is that Europe built a money-laundering supervisor and put it in Frankfurt. The accurate version is that Europe is writing a common rulebook, and the supervisor is the slowest-moving part of it. German institutions that organise around the building will be early. German institutions that organise around the rulebook will be on time.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.