AMLA Direct Supervision from 2028: What Cyprus Financial Firms Need to Know

EU anti money laundering supervision is shifting from a national model to an integrated one. For Cyprus financial firms the date that matters is 2028, when AMLA begins supervising selected cross-border financial institutions directly, at group level. AMLA is the EU Authority for Anti Money Laundering and Countering the Financing of Terrorism.

Cyprus AMLA direct supervision will reach very few firms. No more than 40 entities or groups across the whole EU will be selected in the first round, and a firm only becomes eligible if its regulated activity spans enough Member States. Cyprus Investment Firms are not being moved wholesale from CySEC to Frankfurt, and CySEC is not losing its AML mandate.

The reform still matters beyond the selected list. A common EU risk methodology, more standardised data and closer work between AMLA and national supervisors are likely to influence the information, governance evidence and risk data that national supervisors expect from firms more broadly. The first eligibility exercise has already reached the data correction and alignment stage, so 2028 is not as distant as it may appear.

What CySEC published on 14 August 2026

On 14 August 2026, CySEC issued Circular C796 to CIFs and other regulated entities. It directs firms to AMLA’s final report on the draft implementing technical standards under Article 15(3) of Regulation (EU) 2024/1620, together with AMLA’s reporting package and FAQs for identifying provisionally eligible entities.

The circular does not create a Cyprus regime of its own, and it does not impose a new set of Cyprus compliance requirements. It passes on the EU level material and tells the market that AMLA is preparing to supervise selected institutions at group level from 2028.

The initial eligibility data submission phase has now closed. National supervisors were required to submit the relevant data to AMLA by 15 August 2026 as part of AMLA’s first eligibility exercise. A correction and alignment phase follows before the provisional pool of eligible entities is finalised, which AMLA expects by the end of September 2026. Selection itself takes place in 2027. Preparation started this early because the model depends on consistent information about group structure, establishments, cross-border services and money laundering and terrorist financing risk.

What AMLA is, and what it is not

AMLA was established under Regulation (EU) 2024/1620 and is based in Frankfurt. It sits at the centre of a network that includes national financial supervisors and national financial intelligence units.

Most of its work is convergence: common methodologies, technical standards, coordination between supervisors and support for cooperation between FIUs. Direct supervision applies only to a limited group of selected financial sector entities.

Two points are often confused. AMLA does not replace national FIUs, so suspicious transaction reports continue to go through the Cyprus framework. AMLA also does not authorise investment firms. Licensing and AML supervisory responsibility remain separate questions.

What changes in 2028

From 2028 AMLA becomes the direct AML and CFT supervisor of up to 40 selected credit institutions, financial institutions or groups across the EU. The first list is drawn up in 2027, and the selection process is then repeated every three years.

Supervision runs through joint supervisory teams led by AMLA staff and staffed in part by the relevant national authorities. Even where AMLA takes the lead, the national supervisor stays in the relationship. The framework is built around cooperation, transfer of supervisory files and continuity when a firm enters or leaves AMLA supervision.

AMLA’s mandate covers AML, CFT and related sanctions compliance. A selected CIF would still answer to CySEC and other competent authorities for conduct, prudential, governance and market rules.

Which financial institutions could be selected

The ordinary route has two stages.

Eligibility. The institution, or the group it belongs to, must operate in at least six EU Member States, including its home Member State. A Member State counts where the firm operates through a qualifying establishment, or where it provides relevant services under the freedom to provide services above the applicable materiality thresholds. Having clients abroad, or holding a passport that is barely used, is not necessarily enough. Activity carried on directly, through branches, agents or distributors is aggregated, and where several group entities are active in the same Member State their activity is aggregated too.

AMLA’s current draft technical standards set two alternative materiality thresholds for the freedom to provide services: more than 20,000 customers resident in the Member State concerned, or more than EUR 50 million in annual incoming and outgoing transactions generated by those customers. Meeting either one is enough, and the final figures depend on the technical standards in force at the time of the assessment.

Risk assessment. AMLA then scores eligible firms under a harmonised methodology, measuring inherent risk and residual risk. Residual risk is what remains once the quality and effectiveness of existing controls are taken into account. Up to 40 eligible institutions or groups assessed as presenting a high residual money laundering or terrorist financing risk may then be selected under AMLA’s selection methodology.

Two clarifications are worth stating plainly. Being asked to submit eligibility data is not selection. And selection is not a public finding of wrongdoing; it allocates supervisory resource by risk rather than imposing a sanction. Separate provisions allow AMLA to take over supervision for a limited period in exceptional cases, such as serious or systematic failures combined with significant risk. Those provisions sit outside the regular selection cycle.

Does this apply to every Cyprus CIF?

No. A firm active only in Cyprus, or in a handful of Member States, will not meet the threshold of six Member States. Most Cyprus firms will continue to be supervised for AML purposes by CySEC or another national authority.

Group membership makes the analysis harder. Eligibility can be assessed at group level, so the Cyprus company’s own passporting record is not the whole answer. Subsidiaries, branches, other establishments and cross-border services elsewhere in the group all feed into the assessment.

Remaining with CySEC does not make the reform irrelevant. AMLA’s common methodologies are designed to influence how national authorities assess risk, so data requests, governance expectations and peer comparison are likely to converge across the EU regardless of who holds the file.

Why group structure and cross border activity matter

Under the new framework, the map of legal entities becomes a supervisory document rather than an internal one. AMLA needs to see which entity provides which regulated service, in which Member State, on what legal basis, and under whose controls.

A typical group might hold a Cyprus CIF, an EU payment institution, branches in several Member States and further companies supplying technology, marketing or operational support. Groups planning to expand across the single market should also follow how EU level incorporation and cross-border structuring options develop, since the choice of vehicle affects where regulated activity ends up.

That raises practical questions. Is customer due diligence run locally or centrally? Who owns the transaction monitoring rules? Can customer and alert data be accessed lawfully across the group? Which board approves the group AML policy? How do weaknesses reach senior management?

Complexity is not a compliance failure. Undocumented responsibility, inconsistent customer risk scoring and fragmented data are different, because they raise residual risk and make supervisory reporting harder. Groups should keep a current map of entities and regulatory perimeter, with AML responsibilities clearly allocated.

What it means for new Cyprus licence applicants

Most new CIF applicants will not be candidates for direct supervision. A new firm rarely starts with operations in six Member States or with the scale of the first selected groups.

That is not a reason to ignore the framework. A credible Cyprus licence application already has to explain target markets, cross border strategy, governance, outsourcing, customer profile, products, payment flows and the AML control environment. If the plan involves rapid passporting, or the applicant belongs to a larger financial group, the future supervisory footprint belongs in the structuring discussion from the start. The same applies to firms weighing an acquisition of an existing licence against a fresh application, since an acquired entity brings its own passports and its own cross border footprint.

The mistake to avoid is a nominally local AML framework that cannot scale. Policies, systems and staffing can be proportionate at launch, but they should be capable of supporting consistent group standards, reliable management information and additional jurisdictions. Regulators and banking partners respond better to a plan that shows how controls mature as the business grows.

AMLA is not taking over CIF authorisation. Applicants still meet CySEC, MiFID and Cyprus legal requirements. What has changed is that licence design and AML operating design can no longer be run as separate workstreams.

Preparing AML and KYC governance

The preparation period should be spent on control quality and data lineage rather than on producing more policy documents.

Boards should be able to show who owns AML risk at entity and group level, how compliance challenges commercial decisions, and how material issues reach senior management. The money laundering reporting officer needs real authority, information and resources. Outsourcing screening or onboarding does not move accountability away from the regulated firm.

KYC standards need to be consistent enough to support group oversight while allowing local differences that can be justified. Customer risk models need documented inputs, approval, validation and change control. Monitoring alerts should be traceable from source data through investigation to closure. Firms should also know where customer, payment and screening data sit, whether group functions can lawfully reach them, and whether regulatory submissions can be reproduced from controlled source systems.

The selection exercise shows the direction of travel. Supervisors want structured, comparable data, not assurances that a firm has strong compliance. Completeness, definitions, reconciliation and ownership of data will carry more weight each year.

Effect on bank and EMI onboarding

AMLA does not set the commercial risk appetite of banks or electronic money institutions. A bank can still decline a client that meets every regulatory minimum, and staying off the selected list does not make a firm low risk.

The indirect effect is real. Banks and EMIs assessing a Cyprus financial firm typically review its regulated activities, target markets, ownership, group structure, client jurisdictions, expected payment flows, client money or safeguarding arrangements, AML systems and compliance history. Inconsistent group information or an unclear cross border model can stall onboarding even where the licence is entirely valid, and it remains one of the most common reasons applications fail at the onboarding stage. Firms choosing between a bank and an EMI for their operating accounts face a separate set of trade-offs, which we cover in our guide to remote business banking for cross-border companies.

Firms that align the licensing file, the AML framework and the banking narrative answer due diligence questions faster. The same entity map, description of fund flows and customer risk profile should appear in regulatory filings, bank applications and internal governance papers without contradiction.

Should you change your Cyprus structure now?

Not for the sole purpose of staying below an eligibility threshold. Restructuring on that basis can create operating inefficiency, tax and legal cost, and an arrangement that is difficult to explain to regulators and banks. It may also fail if the wider group remains in scope.

A structural review is justified for other reasons: the current arrangement no longer reflects how the business runs, responsibilities are split ambiguously, data cannot support group oversight, or rapid cross-border expansion is planned. Often the right answer is better governance and better systems rather than a new jurisdiction or a new entity chain.

No firm can be certain about selection before AMLA completes the 2027 assessment and issues notifications. The realistic goal for 2026 is readiness: know whether the group may be eligible, understand what supervisors are likely to ask for, and close material control gaps whoever ends up holding the file.

Preparation checklist, 2026 to 2028

Map the group and its EU footprint. Record regulated entities, branches, other establishments and services provided under freedom to provide services in each Member State.
Test the eligibility assumption. Work out whether the firm or group operates in at least six Member States, counting only qualifying establishments and services under the freedom to provide services that pass the materiality thresholds. Measure customers and transaction volumes per Member State, aggregated across group entities and distribution channels.
Assign data ownership. Name accountable owners for cross-border, customer, product, delivery channel, transaction and control effectiveness data.
Assess inherent and residual risk. Make sure the methodology separates business exposure from the effect of mitigating controls.
Review group AML governance. Document board oversight, escalation routes, compliance independence and the split between central and local functions.
Reconcile KYC standards. Identify differences in client acceptance, beneficial owner verification, screening and enhanced due diligence that cannot be justified.
Validate monitoring and reporting. Test data lineage, alert governance, case records, management information and the reproducibility of regulatory submissions.
Review outsourcing. Confirm oversight, audit rights, access to records, service levels and exit plans for critical AML providers.
Align licensing and banking materials. Keep the business plan, permissions, website, client agreements and description of fund flows consistent.
Track formal developments. Follow AMLA, CySEC and European Commission publications as the technical standards and the 2027 selection process advance.

Frequently asked questions

Will CySEC stop supervising AML in 2028?
No. CySEC remains the direct AML supervisor of Cyprus firms within its remit that are not selected, and contributes staff and local expertise to the joint supervisory teams for those that are.

How many firms will AMLA supervise directly?
Up to 40 credit institutions, financial institutions or groups across the EU. The first list is drawn up in 2027, and the selection process is repeated every three years.

Does a Cyprus CIF with international clients qualify?
Not on that basis alone. Eligibility depends on operations in at least six Member States, through qualifying establishments or through services provided under the freedom to provide services above the applicable materiality thresholds, assessed at group level where relevant.

Does AMLA selection mean a firm has breached AML rules?
No. Selection is a risk based allocation of supervisory responsibility, not an enforcement outcome.

How FinPro Consulting can help

FinPro Consulting advises financial businesses on Cyprus licensing, corporate and group structuring, AML and KYC framework design, compliance documentation and preparation for bank or EMI onboarding.

For a new applicant, that usually means aligning proposed services, target markets, governance, operating model and AML controls before the file is submitted. For an established group, it more often means mapping the EU footprint, closing the gap between entity level and group level procedures, and assembling a due diligence package that reads consistently for regulators and banking partners.

The right structure depends on what the business actually does, where it operates, who its clients are and how fast it intends to grow. AMLA’s 2028 mandate is a reason to raise regulatory readiness, not a reason to restructure in haste.

This article is for general information only and does not constitute legal, regulatory or tax advice. Whether a firm falls under AMLA direct supervision depends on the applicable EU rules, the final methodology and AMLA’s formal assessment.

Official Sources

TagsAMLA Cyprus CySEC