The First Measurement: What Europe's Single AML Supervisor Will Find in 2028

THE BRIEF

The EU Anti-Money Laundering Authority submitted its first three finalised technical standards to the European Commission on 1 October 2026 and will directly supervise 40 high-risk financial institutions from January 2028, selected during 2027 under a harmonised risk methodology now being tested with national supervisors.

The case for consolidation is an effectiveness gap rather than a rulebook gap. FATF found that 76% of countries satisfactorily implement its Recommendations while just 10% of supervisory systems demonstrated effectiveness, and the European Court of Auditors found EU anti-money-laundering supervision fragmented and largely national.

The closest precedent is the Single Supervisory Mechanism. Before the ECB assumed euro area banking supervision in November 2014, its comprehensive assessment re-measured 130 banks against one standard and surfaced EUR 24.6 billion in capital shortfalls and EUR 136 billion in additional non-performing exposures.

The architecture that passes the first AML measurement is being decided now, in the window before the 2027 selection round, and the 2026 data collection already functions as its opening exercise.

I. A SUPERVISOR IS BEING BUILT FASTER THAN MOST PROGRAMMES ARE BEING REBUILT

The legislative phase of the European Union's anti-money-laundering reform is complete, and the supervisory phase now runs on a published construction schedule. The package adopted on 31 May 2024 comprises a single rulebook regulation that applies directly to obliged entities from 10 July 2027, a regulation establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), in operation since 1 July 2025, and a sixth directive reorganising national supervision and financial intelligence units, with its main transposition deadline also set at 10 July 2027 [1][2][3][4]. On 1 October 2026 the authority submitted its first three finalised technical standards to the European Commission, covering customer due diligence, the boundary between business relationships and occasional transactions, and group-wide arrangements reaching subsidiaries and branches in third countries [5]. Once adopted and published in the Official Journal, those standards are expected to apply six months after entry into force [5][6].

The institution being built toward that rulebook is scaling on an equally public timetable. AMLA's first multi-annual programming document plans a workforce growing from 120 staff at the end of 2025 to 432 by the end of 2027 and the delivery of 24 of its 40 regulatory mandates during 2026 [7], together with a data collection exercise, launched in March 2026, that calibrates the risk-assessment model on which its supervisory choices will rest [7][8]. The draft standards governing that model were published in December 2025, and they carry the structural change: for the first time, supervisors across the Union will assess money laundering and terrorist financing risk through a single common methodology, which AMLA is testing with national supervisors during 2026 [9]. The authority's Chair, Bruna Szego, described the instruments as marking "a significant step toward supervisory convergence" [9]. Convergence, read operationally, removes the local discretion through which existing obligations have been applied, and that removal is a larger change than any new obligation in the package.

II. THE GAP CONSOLIDATION EXISTS TO CLOSE IS EFFECTIVENESS, NOT COVERAGE

The reform's premise is a measured distance between written compliance and operating effectiveness. The Financial Action Task Force's 2022 stocktake of its global assessments found that 76% of countries satisfactorily implement its 40 Recommendations, against 36% in 2012, yet just 10% of countries' supervisory systems demonstrated effectiveness, and 97% of countries had not reached a high level of effectiveness in the preventive measures that obliged entities apply [10]. Written compliance has propagated far faster than the capacity of supervisory systems to confirm that it operates, and the distance between the two is widest at exactly the point where obliged entities meet their supervisors.

The European Court of Auditors reached the equivalent conclusion for the Union specifically. Its 2021 special report found institutional fragmentation and poor coordination at EU level, supervision that remained largely national, and an EU oversight framework insufficient to ensure a level playing field, in a market where Europol estimates the value of suspicious transactions at about 1.3% of the Union's gross domestic product [11].

Danske Bank remains the scale demonstration. Between 2008 and 2016 the group's Estonia branch processed USD 160 billion through United States banks on behalf of non-resident customers, and by at least February 2014 the bank knew, from internal audit, regulators, and a whistleblower, that the branch's anti-money-laundering programme fell short of its own standards; in December 2022 the bank, a global financial institution headquartered in Denmark, pleaded guilty in the United States to conspiracy to commit bank fraud and agreed to forfeit USD 2.059 billion [12]. A branch in one Member State, inside a group headquartered in another, ultimately answered to a prosecutor in a third country, and that geometry is what a single European supervisor exists to eliminate.

III. WHAT FIRST CONTACT WITH ONE YARDSTICK DID TO BANK CAPITAL

The Union has consolidated the supervision of an entire industry once before, and the record of that exercise is the best available forecast for this one. Before the European Central Bank assumed direct supervision of euro area banks on 4 November 2014, it re-measured them: the comprehensive assessment combined an asset quality review with a stress test across 130 banks and identified a capital shortfall of EUR 24.6 billion across 25 banks, together with EUR 136 billion in additional non-performing exposures and EUR 48 billion in gross adjustments to asset values [13]. From that date the ECB directly supervised 120 significant banking groups representing 82% of euro area banking assets, with roughly 3,500 smaller banks remaining under national supervision inside a common framework [14].

The shortfalls did not appear because balance sheets collapsed while the assessment ran; they appeared because a single review and a common stress scenario were applied to every institution at once, and the EUR 136 billion of newly identified non-performing exposures were loans already on the books, recognised as non-performing only when one assessment replaced local practice [13]. That is the mechanism a first supervisory cycle performs, and it is indifferent to subject matter. It converts tolerated local variation into recorded findings at the speed of a single exercise, because divergence that was invisible while every institution was measured locally becomes visible the moment every institution is measured together.

IV. SELECTION IS ALREADY MEASUREMENT

Direct supervision begins on 1 January 2028, and the selection that determines its first population runs from 1 July 2027 for six months, applying criteria set in technical standards: activity in at least six Member States and exposure to the highest money laundering and terrorist financing risks, assessed under the harmonised methodology [15]. The selected group of 40 will be supervised by joint supervisory teams drawing staff from AMLA and national supervisors, and the list will be reviewed every three years [9][15]. The perimeter is not a safe harbour: AMLA may assume supervision of an entity outside the 40 where systematic failures go unaddressed at national level, or at a national supervisor's request [15].

Harmonisation also travels downward. The sixth directive reorganises national supervision and financial intelligence units around the same framework, and AMLA's programming for 2026 includes a common supervisory model and manual for the national authorities it will not replace, together with thematic reviews, joint analysis mechanisms, and the first peer reviews on the financial intelligence side [3][7]. An institution that is never selected will therefore still meet the new architecture, through its existing supervisor, operating a method designed centrally rather than at home.

For boards, the operative fact is that measurement precedes supervision by two years. The data collection launched in March 2026 calibrates the model from which every institution's first European risk rating will be computed, and submissions made in the 2026 and 2027 exercises are the raw material of that rating, which makes the submission the opening act of supervision whether or not it is labelled one [7][9]. The question a board can act on is what its institution's risk profile looks like when computed by a method the institution does not get to interpret, rather than whether it will appear among the 40.

V. THE ARCHITECTURE THAT SURVIVES FIRST MEASUREMENT IS OBSERVABLE IN OPERATION

The finalised standards reward observable operation. The customer due diligence standard specifies the information to be collected and verified for customers and beneficial owners, extends to non-face-to-face onboarding and electronic identification, and reaches the screening of politically exposed persons, their family members, and close associates [5]. The group-wide standard sets minimum requirements for governance, risk management, internal controls, and secure information sharing across a group, with additional measures for subsidiaries and branches in third countries [5]. Each requirement is checkable in operation: a supervisor with inspection powers can sample files, trace an alert from generation to disposition, and compare a branch's practice against the group policy that claims to govern it. The failure mode this architecture is designed to expose is the one FATF has already quantified globally, a programme whose documentation outruns its operation [10].

Three properties will separate the institutions that pass first measurement from those that become findings. The first is data that reconciles: the figures submitted to AMLA's data collection, the figures in the institution's own business-wide risk assessment, and the figures a joint supervisory team would extract on site must be the same figures, because discrepancy among them is itself evidence about control. The second is group coherence: the group-wide standard aims squarely at the geometry of the Danske failure, a group whose effective standard was set by its weakest branch, and third-country operations are where the standard places its additional measures [5][12]. The third is demonstrated disposition, the ability to show screening, monitoring, and escalation operating end to end, because effectiveness, the property national regimes rarely confirmed, is the property the new supervisor exists to establish [10][11].

Ownership of that work sits above the compliance function. Boards that treat the 2027 deadline as a documentation refresh delegate downward exactly the decisions, on data architecture, group structure, and third-country operations, that the first measurement will test, and the precedent for what a first measurement does at scale is already on the record [13].

VI. CONCLUSION: THE YARDSTICK ARRIVES BEFORE THE SUPERVISOR

Consolidated supervision raises standards by re-measurement rather than by increment: an entire population is assessed against one instrument, and divergence that local discretion had absorbed becomes a recorded finding. That is what the comprehensive assessment did to euro area bank capital in 2014, and the anti-money-laundering package points the same instrument at financial crime controls on a published schedule [13][15]. The prediction follows directly: AMLA's first supervisory cycle, beginning in January 2028, will surface material gaps in programmes that national supervisors had accepted for years, concentrated where group documentation and branch operation diverge, and the institutions that avoid that outcome will be those that treated the 2026 and 2027 data exercises as the start of supervision rather than its prelude. The selection methodology is drafted, the calibration exercise began in March, and the first binding standards are with the Commission [5][7][9]. For the 40, and for the far larger population that will be assessed by the same method through national supervisors, the first measurement is already underway in everything but name.

RECOMMENDATIONS

Within 90 days

Reconcile the data before the supervisor does. Map the data points supplied, or likely to be requested, under AMLA's risk-assessment data collection against the institution's business-wide risk assessment and board risk reporting, and resolve discrepancies now; under a harmonised methodology, inconsistency between external submissions and internal reporting is itself evidence about control.

Within six months

Test group coherence where it is weakest. Commission an operating-effectiveness review of anti-money-laundering controls at the group's highest-risk third-country branches and subsidiaries against the finalised group-wide standard, sampling live customer files and alert dispositions rather than policies, and report the results to the board unfiltered.

Within 12 months

Rebuild customer due diligence evidence to the finalised standards. Align onboarding, non-face-to-face identification, electronic identification, and the screening of politically exposed persons with the technical standards submitted to the Commission on 1 October 2026, working on the assumption that they apply six months after entry into force rather than waiting for the Official Journal date.

Continuously

Adopt the common methodology as the house metric. As AMLA finalises the harmonised risk-assessment methodology, recompute the institution's own risk profile under it and present the result to the board with the same regularity and discipline as capital and liquidity metrics, whether or not selection among the 40 is plausible.

Benchmarks that should change this guidance

Commission adoption of the technical standards with material amendments, slippage of the 1 July 2027 selection start or the January 2028 supervision start, or publication of a final risk-assessment methodology with substantially different weightings would each alter the sequencing above, though not the direction.

CAVEATS

Regulatory state at the date of analysis. The three technical standards finalised on 1 October 2026 are final drafts submitted to the European Commission; they may be amended before adoption, and their application date depends on publication in the Official Journal. Readers should confirm the adopted texts before relying on specific provisions.

Precedent limits. The 2014 comprehensive assessment measured prudential capital, which is quantifiable in a way anti-money-laundering effectiveness is not; a first AMLA cycle may surface its findings through supervisory measures and sanctions rather than a single headline figure, and the EUR 24.6 billion analogy is directional, not a prediction of magnitude.

FATF figures are global. The 76%, 10%, and 97% effectiveness figures come from FATF's April 2022 stocktake of fourth-round mutual evaluations across its global network; individual EU Member State ratings vary, and subsequent evaluation rounds will update the distribution.

Selection parameters. The criteria summarised here, activity in at least six Member States and exposure to the highest risks, reflect the AMLA regulation's framework and the 2025 draft standards as analysed in professional commentary; the operative parameters are those of the technical standards as adopted.

Danske Bank. The case is cited for the facts admitted in the December 2022 United States plea; it is not a finding about the conduct of any national supervisor.

Europol estimate. The figure of about 1.3% of EU gross domestic product is an estimate of the value of suspicious transactions cited by the European Court of Auditors, not a measurement of funds actually laundered.

REFERENCES

[1] European Parliament and Council, "Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing," EUR-Lex, 31 May 2024. URL: https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng

[2] European Parliament and Council, "Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism," EUR-Lex, 31 May 2024. URL: https://eur-lex.europa.eu/eli/reg/2024/1620/oj/eng

[3] European Parliament and Council, "Directive (EU) 2024/1640 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing," EUR-Lex, 31 May 2024. URL: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024L1640

[4] Arthur Cox, "AML Update: 'Single Rulebook' and AMLA Regulations, and related Directives, published in Official Journal," June 2024. URL: https://arthurcox.com/insights/aml-update-single-rulebook-and-amla-regulations-and-related-directives-published-in-official-journal

[5] Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), "AMLA finalises key standards for the private sector," 1 October 2026. URL: https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en

[6] Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), "Final Report: Draft Regulatory Technical Standards under Article 28(1) of Regulation (EU) 2024/1624," 30 September 2026. URL: https://www.amla.europa.eu/document/download/e15ab2e5-4074-4de8-bb9d-613dd8b7fdd1_en?filename=Final%20Report%20-%20draft%20RTS%2028%281%29%20AMLR.pdf

[7] AMLA, "Single Programming Document 2026-2028: What you need to know," February 2026. URL: https://www.amla.europa.eu/document/download/002fd9dd-9d75-4675-be3c-c1a2da5ced83_en?filename=SPD+2026-2028+Explainer.pdf

[8] AMLA, "AMLA launches data collection exercise to test risk assessment models," 16 March 2026. URL: https://www.amla.europa.eu/amla-launches-data-collection-exercise-test-risk-assessment-models_en

[9] AMLA, "AMLA takes major step toward harmonised EU supervision," 18 December 2025. URL: https://www.amla.europa.eu/amla-takes-major-step-toward-harmonised-eu-supervision_en

[10] Financial Action Task Force, "Report on the State of Effectiveness and Compliance with the FATF Standards," April 2022. URL: https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Report-on-the-State-of-Effectiveness-Compliance-with-FATF-Standards.pdf

[11] European Court of Auditors, "Special Report 13/2021: EU efforts to fight money laundering in the banking sector are fragmented and implementation is insufficient," June 2021. URL: https://op.europa.eu/webpub/eca/special-reports/fight-money-laundering-13-2021/en/index.html

[12] U.S. Department of Justice, "Danske Bank Pleads Guilty to Fraud on U.S. Banks in Multi-Billion Dollar Scheme to Access the U.S. Financial System," 13 December 2022. URL: https://www.justice.gov/archives/opa/pr/danske-bank-pleads-guilty-fraud-us-banks-multi-billion-dollar-scheme-access-us-financial

[13] European Central Bank, "Comprehensive Assessment: results presentation," 26 October 2014. URL: https://www.bankingsupervision.europa.eu/pdf/ca/141026_presentation-slides.pdf

[14] European Central Bank, "ECB assumes responsibility for euro area banking supervision," 4 November 2014. URL: https://www.bankingsupervision.europa.eu/press/pr/date/2014/html/sr141104.en.html

[15] Jones Day, "Direct Supervisory Powers of the New European Anti-Money Laundering Authority," July 2025. URL: https://www.jonesday.com/en/insights/2025/07/direct-supervisory-powers-of-the-new-european-antimoney-laundering-authority. Primary source: European Parliament and Council, "Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism," EUR-Lex, 31 May 2024. URL: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1620