The EU is about to name 40 institutions its new anti-money-laundering "police" will supervise directly. Nobody has seen the list yet, but the selection criteria are public — so it's worth reasoning through who's likely on it.

AMLA, the EU's new Authority for Anti-Money Laundering based in Frankfurt, became operational in 2025. From 2028, it will directly supervise up to 40 "selected obliged entities" — a small, high-risk cohort — while every other institution stays under national supervisors, working from one harmonised rulebook (the AMLR) that applies directly across all 27 member states from July 2027. The reform traces back to scandals like Danske Bank's €200 billion Estonian-branch case, which exposed how fragmented national supervision let risk slip through the cracks.

National supervisors have until mid-August 2026 to submit data identifying "provisionally eligible" institutions.

The public criteria

  • Operating in at least six EU member states — via branches or freedom to provide services
  • Cross-border activity that is a "material part" of the overall business
  • A high residual money-laundering / terrorist-financing risk score under AMLA's harmonised methodology

Crucially, this isn't bank-only. Payment institutions and MiCA-licensed crypto-asset service providers are explicitly in scope too.

Reasoning from those criteria, plausible — unconfirmed — categories include major pan-European banking groups (Deutsche Bank, BNP Paribas, Santander, UniCredit); banks still shadowed by prior AML findings (Danske Bank, Swedbank); and, often overlooked, large EU-passported EMIs and CASPs whose entire business model is cross-border by design, from neobanks to crypto exchanges (Revolut, Wise, Bitpanda).

Not bank-only — payment institutions and MiCA-licensed crypto firms qualify too.

A preliminary list of eligible institutions is expected by the end of September 2026. The final 40 lands in 2027. Worth watching closely for anyone running compliance at a firm with genuinely pan-European reach — direct AMLA supervision is a materially different regime from a national regulator relationship.