Our co-signing associations representing European accountants, auditors, lawyers and tax advisors strongly support the EU’s ambition to step up the fight against money laundering and terrorist financing. Our respective professions play a key role in that fight. Their knowledge of clients and businesses puts them in a position to identify unusual behaviour and report suspicions.
The creation of the new AML Authority (AMLA) and the Single Rulebook provide an opportunity to make Europe’s AML system more consistent and, above all, more effective.
At the inaugural conference of the new AML Authority (AMLA) in June 2026, Commissioner Albuquerque called for a step change towards a genuinely risk-based system, with simpler, smarter and more proportionate regulation and supervision, stressing that the new legislation is only the starting point and that implementation will be the key test. Our professions wholeheartedly support the Commissioner’s messages.
However, we have serious concerns that this goal will not be met, following our review of AMLA’s draft regulatory technical standards (RTS), which set out detailed requirements for how obliged entities and supervisors will apply the new AML framework.
We consider that the very detailed and granular requirements of the RTS focus on compliance processes, documentation and data collection, rather than ensuring effective anti-money laundering controls centred on risk-based requirements. In other words, ensuring a compliance paper trail rather than enabling effective anti-money laundering prevention and detection.
Based on the draft RTSs, we have serious legal concerns that the emerging new AML framework will directly conflict with the fundamental intention of the EU legislators in the AML Package and the European Commission’s objectives of competitiveness, proportionality, cutting unnecessary administrative burdens, and the think-small-first principle.
However, the issue is not just about competitiveness or administrative burden. It is whether the rules truly direct obliged entities and supervisors towards effectively addressing financial crime risks, or only towards producing more data, onerous processes documentation and demonstrating compliance.
This is not an argument for lowering AML standards. It is an argument for making them work effectively.
We call on the European Commission and AMLA to consider our key concerns below, take a step back, carefully assess whether the draft RTSs contribute to genuine AML effectiveness, and make changes to them accordingly. We believe these draft RTSs can, and should, be amended while still respecting the Level 1 mandate. Our associations stand ready to continue to propose solutions to this end.
A risk-based AML system needs information. But the volume of information collected is not a measure of its effectiveness. Data should be relevant to the risks and help obliged entities and supervisors understand where those risks lie and act on them, not create a vast tick-the-box compliance exercise with no regard to underlying risks or proportionality. This is one of the clearest concerns emerging from our engagement with AMLA’s consultations to date.
Where the Level 1 legislation leaves room for implementation choices, AMLA has repeatedly tended to add greater detail, further data, documentation, prescription and additional compliance requirements. Taken together, these requirements risk creating an increasingly rigid and prescriptive compliance framework, leaving less room for obliged entities and supervisors to focus on the risks that actually matter.
The test should not be whether something can be collected, counted or documented. It should be whether doing so in reality helps firms or supervisors identify and address financial crime risks. Conversely, the volume of information collected should not create a giant haystack that obfuscates or hides the needle – i.e. the individuals or entities that pose a real risk to our financial integrity and systems.
More data can provide useful intelligence, but data without a clear risk purpose can also create noise. For practitioners in our sectors, it can divert valuable time and resources away from understanding clients, identifying unusual behaviour and focusing on higher-risk situations. For supervisors, large volumes of information can make the relevant risks harder rather than easier to identify.
Overly prescriptive requirements also risk limiting the ability of national supervisors, including self-regulatory bodies, to exercise their supervisory responsibilities in a genuinely risk-based and proportionate manner.
Where information is required, there should be a clear understanding of what it tells the obliged entity or supervisor about risk and how it will be used. Where a process is prescribed, it should contribute to preventing or detecting financial crime instead of just ticking a box.
For every new requirement, the starting question should be: how will this help prevent or detect financial crime?
AMLA consistently describes its approach as risk-based and proportionate. Our experience with the detailed requirements under development tells a different story.
This matters particularly for smaller practices. In the non-financial sector, most of the firms are small practices, many are sole practitioners. Efficient AML prevention must reflect the realities of the sector. SMEs do not have the compliance departments, technology and systems of large institutions. Increasingly detailed expectations around risk assessments, data, documentation, governance and monitoring require investments in sophisticated compliance systems.
Small does not mean low risk. But nor should every small firm be expected to build the compliance infrastructure of a much larger institution.
There is a point at which regulatory complexity becomes a barrier to doing business. If smaller practices must continually invest in systems, technology and compliance capacity, the cumulative burden risks making it increasingly difficult for them to remain economically viable and competitive, without making Europe better at detecting financial crime.
Requirements and supervisory attention should reflect the actual risks, nature and complexity of the business. Proportionality is the key factor in order to focus on the greatest risks.
Another recurring issue in our consultation responses is that requirements designed around the operating models of financial institutions are being applied to non-financial professional services without sufficient adaptation.
As we have consistently highlighted to AMLA, accountants, auditors, lawyers and tax advisers are not banks. They do not hold accounts for their clients, process payments or, as a rule, manage client funds. They also do not have access to transactions at the time they occur and therefore cannot be expected to prevent their processing. In many cases, they will only have visibility as part of a transaction, whereas banks, including through cooperation with correspondent banks, may have a much broader view.
The principal drivers of their ML/TF risk are often the nature of the client base and the services provided, rather than the transaction-based activities typical of financial institutions. Transferring financial-sector requirements to non-financial professions without sufficient adaptation can therefore create obligations that do not reflect their business models or the risks they actually face.
For such professional services, the framework should focus on the risks arising from the client, the service provided, the purpose and circumstances of the engagement and the professional’s knowledge of the client’s activities. Effective regulation should build on these characteristics rather than try to recreate a banking compliance model around them.
A Single Rulebook should strive for common approaches and outcomes across Europe. But in doing so, it should not require the same processes for sectors with fundamentally different business models and risk exposures. Requirements that fail to reflect the realities of non-financial professions also risk divergent interpretations and inconsistent application across Member States, undermining the very purpose of the Single Rulebook.
This requires sufficient non-financial sector expertise within AMLA and meaningful engagement with those sectors when the rules are being designed.
The operational and legal feasibility of the new requirements remains a key concern. As currently drafted, several AMLA RTSs risk being unnecessarily complex at best, and legally impossible at worst, for non-financial sector entities to implement.
For example, the draft RTS on group-wide requirements raises serious questions about AMLA’s approach in comparison to the AML Regulation’s (AMLR) provisions. The AMLR mandates AMLA to specify the minimum requirements for group-wide policies and controls and determine the conditions under which these requirements should apply to networks and partnerships (Article 16(4) AMLR). In doing so, the co-legislators explicitly called on AMLA to avoid overburdening these sectors and take proportionality into account (Recital 45 AMLR).
Many network and partnership structures in our sectors consist of legally independent firms without a parent undertaking that has the authority to direct and enforce AML requirements across the network. The requirements must therefore reflect the legal and operational realities of these structures.
We acknowledge that AMLA has made efforts to take stakeholders’ concerns into account and made changes to the RTS following the consultation in its latest submission to the Commission. These efforts are welcome. However, the amended requirements are still likely to have a significant impact on professional networks, and questions remain about how compliance can be achieved in practice.
The scale of the group-wide RTS changes also calls for realistic implementation periods and a practical, proportionate supervisory approach. During the initial implementation phase, supervision should focus on supporting firms in achieving compliance, providing guidance and addressing practical difficulties, rather than immediately imposing penalties on firms making genuine efforts to comply. AMLA should provide a clear signal to supervisors to support this approach.
A more proportionate approach should reflect the legal and operational realities of these structures. Group-wide obligations should follow the actual governance and control within a network and the ability to implement and enforce those obligations. Secondary legislation should not require organisations to change their legal frameworks and activities in order to fit within a legal structure which otherwise does not apply to them.
The draft RTS on risk assessment of non-financial professions is another clear example of where proportionality must work in practice, but where we have concerns on the basis of AMLA’s drafting. The requirements should focus on information that genuinely helps supervisors identify risks, rather than imposing extensive data collection and reporting obligations. They should allow realistic implementation deadlines, less frequent reassessments where justified by risk, and simpler requirements for lower-risk firms, while avoiding disproportionate burdens on smaller practices. The rules should also build on existing national supervisory expertise, including that of self-regulatory bodies, and leave sufficient flexibility for genuinely risk-based supervision. We fear that as currently drafted by AMLA, this is not the case.
Detailed processes and documentation can support consistency and effective supervision. But they should not replace the professional judgement needed to identify unusual behaviour and assess financial crime risks.
Our respective professions contribute to detecting financial crime because they understand their clients and apply professional judgement to what they see. A framework that increasingly prescribes how compliance must be demonstrated risks turning the risk-based approach into a formalistic inefficient box ticking exercise.
EU rules should set clear safeguards and outcomes while preserving sufficient flexibility for firms and supervisors to focus on the risks that matter.
This is also consistent with the EU’s wider objective of strengthening competitiveness and reducing unnecessary administrative burdens. Requirements that do not materially improve the prevention or detection of financial crime impose costs on firms and absorb supervisory resources without a corresponding AML/CFT benefit.
Well-targeted requirements allow both firms and supervisors to focus their resources on identifying and addressing financial crime risks.
AMLA is still building the detailed framework. Our associations have responded to the AMLA consultations, and we sincerely hope that our messages and recommendations are given serious consideration by AMLA and the Commission.
We suggest four principles for the next phase:
At a time where other major financial jurisdictions are reviewing their legislation to focus on effectiveness of economic crime prevention and detection, these RTSs risk moving the EU towards a costly compliance system. This does not protect the financial system and is likely to make it uncompetitive.
There is still time to adjust the direction before these requirements become embedded in the European AML system. Our associations stand ready to work with AMLA and the Commission on how these principles can be translated into practical solutions while respecting Level 1. Our consultation responses have identified problems, but they have also identified concrete solutions and recommendations.
Europe has invested heavily in a stronger AML framework. Its success should ultimately be measured by whether Europe becomes better at identifying and stopping financial crime, not by how much information firms provide or how many compliance processes they can demonstrate.
That is the test the implementation of the Single Rulebook should now meet.
