ECB outlines AML supervision response to digital and cross-border risks in Europe
European banking supervisors are stepping up their response to money laundering risks as digitalisation, cross-border finance and new technologies make illicit flows harder to detect and contain. The ECB says those risks increasingly overlap with prudential concerns for banks, including governance, operational resilience, liquidity and reputational threats.
Highlights
- AMLA begins operations in July 2025 and will directly supervise about 40 high-risk entities from January 2028 under the EU's centralized AML regime.
- The ECB and AMLA will sign a Memorandum of Understanding in mid-2025 to enable enhanced information exchange and tighter cooperation on overlapping prudential and AML risks.
- Technologies like artificial intelligence, crypto-assets, and real-time payments are intensifying digital financial crime risks, increasing operational resilience and AML control requirements for European banks.
EU oversight framework shifts toward centralised AML control
As outlined by ECB Banking Supervision, the EU is reshaping its anti-money laundering architecture around a more centralised model after a series of high-profile cases exposed weaknesses in national enforcement and cross-border coordination. The speech says this shift mirrors, in part, the earlier creation of the Single Supervisory Mechanism after the euro area sovereign debt and banking crisis highlighted the limits of fragmented national supervision.The new Authority for Anti-Money Laundering and Countering the Financing of Terrorism, AMLA, formally starts operations in July 2025, while the EU's anti-money laundering regulation becomes fully binding in July 2027. Under the new structure, AMLA is set to directly supervise around 40 high-risk groups or entities from January 2028, while also coordinating financial intelligence units and helping develop the single AML rulebook.
The ECB says the move from a patchwork of national transpositions toward directly applicable EU rules is intended to improve consistency across Member States. It also highlights a key institutional difference from prudential supervision, with AMLA combining supervisory duties, financial intelligence coordination and regulatory standard-setting under one framework.
Digital threats deepen links between AML and prudential risks
Within the current EU framework, the ECB does not police banks' compliance with AML rules directly, but it does factor money laundering-related findings into prudential decisions. Those findings can affect banking licence assessments, qualifying holdings reviews, fit and proper checks for senior managers, licence withdrawals and day-to-day supervision, including the Supervisory Review and Evaluation Process.The speech says effective cooperation between AML and prudential supervisors is becoming more important as both sides address overlapping risks and may use similar measures, including business restrictions, governance changes and monetary sanctions. To support that cooperation, the ECB and AMLA sign a Memorandum of Understanding in mid-2025 covering information exchange and reciprocal representation.
The ECB argues that supervisors now face a tougher operating environment as banks expand digital onboarding, rely more heavily on third-party providers and confront rising cyber and fraud risks. It says tools such as artificial intelligence, synthetic identities, deepfakes, crypto-assets, electronic money and real-time payments are increasing the speed, anonymity and complexity of financial crime risks, making operational resilience and AML controls more tightly connected across the European banking sector.
AI-driven cyber threats and banks’ cyber resilience planning were the focus of our earlier coverage, which highlighted regulators’ concerns about more severe technology failures. We outlined how supervisors are urging large banks to develop “bare metal” recovery options so critical services can continue even if core systems are compromised, reflecting a shift from relying on prevention alone to prioritising end-to-end recovery.