European Economic Area EEA

The defining sanctions-architecture development this cycle is the shift from entity-level to jurisdiction-level enforcement. The Council of the European Union adopted its twentieth sanctions package on 23 April 2026, with crypto provisions taking effect 24 May 2026, imposing a complete transaction ban between EU persons and any crypto-asset service provider or platform established in Russia, alongside an equivalent sectoral ban for Belarus. This activates, for the first time, an anti-circumvention tool at the level of an entire national CASP sector rather than against individually named platforms, closing precisely the gap that allowed a successor exchange to emerge each time a predecessor was designated. Neither OFAC nor OFSI has mirrored this jurisdiction-wide approach, making the EU regime the most structurally advanced of the three in this specific respect, even as it remains the most exposed to the unanimity-renewal constraint described below.

The persistence problem this measure is meant to solve is illustrated starkly by the ruble-backed A7A5 stablecoin ecosystem. Following the March 2025 seizure of Garantex, a network linked to Ilan Shor launched A7A5 through a Kyrgyz issuer, routing settlement through Promsvyazbank and the successor exchange Grinex. Cumulative on-chain transaction volume crossed one hundred billion dollars by January 2026, less than a year after launch, before layered United States, United Kingdom and EU sanctions constrained daily volumes from approximately one point five billion dollars to roughly five hundred million dollars. The pattern is architecture, not incident: designation of one node in the chain reliably produces a successor node rather than a cessation of activity, and the sanctions response this cycle is notable precisely because it attempts to target the sector rather than the node.

Compounding this is the addition of Russia to the EU list of high-risk third countries for AML and CFT purposes, via Commission Delegated Regulation (EU) 2026/46, effective 3 December 2025. This listing operates on a distinct legal track from the CFSP restrictive-measures regime that has applied to Russia since 2014 and again since 2022, and it obliges enhanced due diligence across the EU obliged-entity population regardless of whether a given counterparty or transaction is separately subject to a CFSP asset freeze or transaction ban. The layering of an AML high-risk designation atop an existing sanctions regime is itself a structural signal: it extends the compliance perimeter from designated entities and transactions to an entire jurisdiction-of-counterparty risk factor.

The EU is not the only jurisdiction exposed to Democratic Peoples Republic of Korea proliferation-financing infrastructure operating through crypto rails. OFAC March 2026 designations identified a Vietnam-based facilitator who converted approximately two point five million dollars into cryptocurrency between mid-2023 and mid-2025 on behalf of an IT-worker network linked to the Amnokgang Technology Development Company, with operations spanning Vietnam, Laos and Spain. Spain functioned here as an unwitting European transit and enabler node in a wider multi-chain, multi-jurisdiction laundering playbook, even though the EU was not the primary designated target of the underlying scheme. This illustrates a recurring pattern in DPRK-linked proliferation finance: exposure arrives through transit-node status rather than through direct sanctions-evasion intent by the exposed jurisdiction itself.

Divergence between the three principal Western sanctions regimes remains a standing architectural feature rather than a transitional one. OFSI imposed a one hundred sixty thousand pound penalty on Bank of Scotland, part of Lloyds Banking Group, for Russia sanctions breaches in January 2026, illustrating the continued UK reliance on an administrative, pecuniary-penalty enforcement posture distinct from the EU AMLA-centred supervisory model. Separately, OFAC and OFSI convened an Enhanced Partnership Exchange across January and mid-2026 specifically targeting shadow-fleet typologies, a bilateral alignment mechanism operating outside the EU framework entirely, evidence of a parallel United States and United Kingdom enforcement-convergence track that the EU does not currently participate in. Underlying all of this is a structural asymmetry the EU regime alone carries: its core Russia sanctions architecture requires unanimous six-monthly renewal, with the core regime renewed to 31 July 2026 and the Crimea and Sevastopol regime to 23 June 2026, creating a recurring political veto point that the non-sunsetting United States and United Kingdom designation models do not share. This is a standing structural vulnerability in the EU sanctions architecture, independent of any single enforcement outcome, and it is the analytical counterweight to the jurisdiction-wide anti-circumvention innovation described above.

Read together, these developments indicate an EU sanctions architecture that is simultaneously innovating at the enforcement frontier, through sector-wide CASP bans, and structurally fragile at its foundation, through the unanimity-renewal mechanism, while transatlantic partners pursue a differently structured but converging enforcement track. The red-flag indicators associated with this evasion architecture are themselves instructive for obliged entities operating correspondent or virtual-asset-service-provider relationships: rapid migration of user volume to a successor exchange or stablecoin issuer following designation of a predecessor platform, and ruble-pegged stablecoin settlement routed through a single domestic bank acting as a fiat gateway, are both observable at the payment-data and on-chain level and both featured directly in the A7A5 and Grinex pattern this cycle.

Outlook

The near-term calendar carries two Russia-sanctions renewal dates that will test the EU unanimity mechanism directly: the Crimea and Sevastopol regime falls due 23 June 2026 and the core regime 31 July 2026, and any single Member State veto at either juncture would represent a structural discontinuity in an otherwise hardening EU sanctions posture. Separately, the EU AML high-risk-country listing of Russia, layered atop the CFSP regime, is not itself time-limited and will continue to shape enhanced due diligence obligations for EU obliged entities regardless of the outcome of the sanctions-renewal votes. Whether the sector-wide CASP transaction ban activated in the twentieth package materially reduces A7A5 or Grinex-linked volumes, or whether a further successor platform emerges, is the key architecture-level question for the coming cycles, and would be the clearest test yet of whether jurisdiction-wide anti-circumvention tools outperform entity-level designation in an evasion ecosystem defined by its capacity to reconstitute itself. This is offered as analytical orientation on the observed trajectory, not as a forecast of any specific outcome.

Beneficial-ownership transparency in the EEA this cycle is best read as a story of persistent structural rollback rather than incremental repair. More than three years after the November 2022 Court of Justice of the European Union judgment in WM and Sovim invalidated mandatory public access to beneficial-ownership registers as disproportionate under Charter Articles 7 and 8, the BORIS interconnection system continues to operate on a restricted, legitimate-interest basis, and no legislative fix has been identified in this baseline window. The consequence falls unevenly: opacity persists most acutely in jurisdictions previously flagged for patchy beneficial-ownership implementation inside the bloc itself, including Luxembourg, Cyprus and Malta, meaning the current transparency regime disproportionately protects exactly the enabler jurisdictions the framework was designed to constrain.

Bulgaria remains the sole EU or EEA member state on the FATF grey list, though the June 2026 Plenary made an initial determination that its AML and CFT action plan, including beneficial-ownership register accuracy and market-entry controls for virtual-asset service providers and postal operators, has been substantially completed. An on-site verification visit is expected ahead of the October 2026 Plenary, and a successful outcome would remove the last EU or EEA member state from increased monitoring, closing an internal reputational and enhanced-due-diligence gap that has applied bloc-wide enhanced scrutiny to Bulgaria-linked relationships in the interim.

Separately, the United Kingdom assumed the FATF Presidency effective 1 July 2026, with Giles Thomson appointed FATF President and prioritising fraud, scam-compound risk and risk-based supervision globally, including a grey-listing methodology review intended to relieve pressure on least-developed countries. A UK-led FATF term may in turn influence how grey-listing criteria are applied to future EEA-relevant determinations, including any subsequent Bulgaria-style pending delisting case.

The durable structural backdrop against which this cycle should be read is the EU AML Package, which comprises three distinct legal instruments proceeding on separate tracks. The AML Regulation, or AMLR, Regulation (EU) 2024/1624, is directly applicable EU-wide without national transposition and becomes applicable from 10 July 2027, harmonising customer due diligence, beneficial-ownership and cash-payment rules, including a ten thousand euro cash-payment cap, and folding crypto-asset service providers into the same obliged-entity framework as banks. The sixth Anti-Money Laundering Directive, or 6AMLD, Directive (EU) 2024/1640, by contrast, must be transposed by each Member State individually, on divergent deadlines of two to three years from its June 2024 Official Journal publication, with full bloc-wide transposition expected by approximately mid-2027, though this baseline does not establish per-Member-State transposition vehicles or status. The third instrument, the AMLA Regulation, Regulation (EU) 2024/1620, establishes the Anti-Money Laundering Authority itself, which began operations in Frankfurt on 1 July 2025 and is building toward a direct and indirect supervision perimeter that will, from 2028, shift a portion of AML supervision from purely national authorities toward a hybrid EU-level regime. This three-instrument, multi-track architecture, rather than any single beneficial-ownership development this cycle, is the structural frame within which the BORIS rollback, the Bulgaria grey-list process and future EEA beneficial-ownership signals should all be read.

Read together, the AMLR direct-applicability track and 6AMLD per-Member-State transposition track will, in principle, eventually restore a harmonised customer due diligence and beneficial-ownership baseline across the bloc, but that harmonisation date, 10 July 2027 for the AMLR and approximately mid-2027 for full 6AMLD transposition, sits roughly four and a half years after the Sovim and WM judgment first opened the current transparency gap. The multi-year interval between judicial rollback and legislative repair is itself the material beneficial-ownership finding of this cycle.

Outlook

The most immediate beneficial-ownership-adjacent milestone is the FATF on-site verification visit to Bulgaria, expected ahead of the October 2026 Plenary, which will determine whether the sole remaining EU or EEA grey-listed state exits increased monitoring. On a longer horizon, the AMLR becomes directly applicable EU-wide from 10 July 2027 and 6AMLD transposition is expected to complete across the bloc on a similar timetable, jointly restoring a harmonised legal baseline for beneficial-ownership record-keeping even though public access itself remains constrained absent a distinct legislative fix to the Sovim and WM gap. AMLA supervisory build-out, including its first work programme expected by December 2026 and its first harmonised selection of up to forty high-risk cross-border obliged entities in 2027, will progressively determine how much of the beneficial-ownership and customer due diligence architecture is enforced at EU level rather than nationally. This is offered as orientation on a known regulatory calendar, not as a prediction of outcomes.

The defining enabler-jurisdiction finding this cycle is the volatility of the EU high-risk third country list itself. Commission Delegated Regulation (EU) 2026/83 added Bolivia and the British Virgin Islands to the EU high-risk third country AML and CFT list while simultaneously delisting Burkina Faso, Mali, Mozambique, Nigeria, South Africa and Tanzania. The British Virgin Islands, a jurisdiction with a long-documented offshore and enabler function, re-entered the EU list only months after being delisted in June 2025, a pattern of churn that sits awkwardly alongside the more predictable, twice-yearly FATF Plenary cycle and raises a methodological question about how the EU list-update process weighs enabler-jurisdiction risk relative to FATF determinations.

A second, arguably more structurally significant enabler-jurisdiction finding concerns facilitators operating inside the EEA bloc itself rather than in an external offshore centre. Three national competent authorities, the AMF in France, the FMA in Austria and CONSOB in Italy, have publicly called for stronger EU-level oversight and tighter supervision of cross-border activity to prevent jurisdiction shopping under the MiCA single-passport model. Because a crypto-asset service provider authorised in any one Member State can passport its licence bloc-wide, the national competent authority applying the least rigorous AML and CFT scrutiny at the point of initial authorisation effectively sets the AML floor for the entire bloc. This is a structural enabler condition, not an isolated incident, and it persists as a live vulnerability until the Anti-Money Laundering Authority assumes direct supervision of a first cohort of cross-border high-risk obliged entities, a milestone that will not arrive before 2028.

Beneficial-ownership opacity compounds the enabler-jurisdiction picture from a different angle. The restricted, legitimate-interest-only access regime that has applied since the November 2022 Sovim and WM ruling disproportionately benefits enabler jurisdictions inside the EU itself, particularly Luxembourg, Cyprus and Malta, each previously documented for patchy beneficial-ownership register implementation. An enabler-jurisdiction assessment of the EEA therefore cannot rest solely on the external high-risk list; it must also account for the internal capacity of certain Member States to continue functioning as opacity centres under a framework that, for now, does not compel public disclosure.

A further capacity gap reinforces the enabler dynamic at the level of institutional cooperation rather than legal framework. A June 2026 Council document confirms that Europol and the Anti-Money Laundering Authority currently lack a reciprocal operational information-exchange interface, meaning AMLA supervisory findings, which might otherwise surface professional-facilitator networks operating across jurisdictions, cannot be systematically cross-matched against Europol criminal intelligence. In an enabler-jurisdiction analysis, this is a structural fragmentation of the EU financial-intelligence architecture rather than a single agency shortfall, and it degrades the practical value of the more aggressive external sanctions and high-risk-listing measures described elsewhere this cycle, since intelligence generated by one arm of the architecture cannot readily inform enforcement action by another.

Applying the enabler-jurisdiction filter methodology to the British Virgin Islands re-listing specifically requires separating legal framework, enforcement capacity and jurisdictional choice. A jurisdiction re-entering a high-risk list within months of exiting it may reflect a genuine deterioration in underlying AML and CFT controls, a change in EU risk-assessment methodology, or simply volatility in how episodic findings are weighed against structural indicators; this baseline does not have sufficient longitudinal EU list-history data to distinguish between these explanations with confidence, and that itself is a research gap worth flagging for subsequent cycles.

Taken together, external list volatility, internal beneficial-ownership opacity in specific Member States, MiCA passporting arbitrage and the Europol-AMLA intelligence gap describe an enabler-jurisdiction landscape in which the EEA functions simultaneously as a rule-setter externally and as a residual permissive space internally, a duality that architecture-over-incident analysis is specifically designed to surface.

Outlook

The MiCA jurisdiction-shopping vulnerability is structurally time-bound to the AMLA direct-supervision calendar: a first harmonised selection of up to forty high-risk cross-border obliged entities is expected in 2027, with direct supervision commencing in 2028, and until that date the least rigorous national CASP authorisation regime will continue to set the bloc-wide AML floor for the crypto sector under MiCA passporting. Whether the EU high-risk third country list stabilises or continues to show volatility relative to the FATF Plenary cycle is also worth monitoring, particularly for jurisdictions, like the British Virgin Islands, that combine offshore-centre characteristics with recent delisting and relisting history. This is offered as an orientation toward a known institutional calendar and a documented pattern, not as a prediction of the future listing status of any specific jurisdiction.

Conflict-finance signal this cycle centres overwhelmingly on the Russian war economy rather than on extractive-industry corruption more broadly, a concentration that is itself worth naming explicitly given the FIM mandate to correct for regional and sectoral coverage imbalance. The EU nineteenth sanctions package, adopted 23 October 2025, imposed a full transaction ban on Rosneft and Gazprom Neft and a Russian LNG import ban effective from 1 January 2027, directly constraining two of the core revenue streams that fund the Russian war economy rather than merely designating discrete entities within it. Read through a conflict-finance lens, this action traces a source, namely Russian state-linked energy revenue, through a channel, namely EU import and transaction relationships, toward deployment in a continuing armed conflict, satisfying the three-stage conflict-finance filter methodology directly.

Alongside the energy-sector transaction bans, the EU shadow-fleet vessel listing architecture continued its expansion this cycle, reaching six hundred forty vessels by June 2026, up from five hundred fifty seven after the nineteenth package, with forty one additional vessels listed via Council Regulation 2025/2618 in December 2025 and forty three more added in the twentieth package. This is an architecture-level enforcement pattern rather than a single incident: successive listing rounds target the physical transport infrastructure that allows sanctioned Russian oil to reach market despite the price-cap and import-ban measures targeting the underlying commodity and its principal corporate sellers. The persistence of this vessel-listing expansion pattern across three successive sanctions instruments, the nineteenth package, the December 2025 regulation, and the twentieth package, indicates sustained EU institutional attention to shadow-fleet logistics specifically, even as broader extractive-industry due-diligence enforcement receives comparatively less sustained institutional attention within the same period.

Notwithstanding this substantial Russia-focused signal, this baseline explicitly identifies EU-bloc conflict-finance and extractive-industry-integrity coverage outside the Russian war economy as comparatively thin. No dedicated EU conflict-minerals due-diligence enforcement outcomes under Regulation 2017/821 were identified within the eighteen-month baseline window. This is a self-identified sourcing gap rather than a finding that no such enforcement activity has occurred, and it should be read as a research-coverage limitation rather than as evidence of an absence of extractive-industry-integrity risk within the EEA supply-chain footprint. Applying the three-pillar balance principle, this gap is itself analytically significant: a financial-integrity assessment of conflict finance that is structurally weighted toward the Russian war economy, simply because that is where enforcement volume and sanctions-list activity concentrate, risks under-representing extractive-industry corruption and conflict-mineral flows that generate less enforcement volume but may carry comparable conflict-finance significance.

The concentration of this cycle signal in the Russian war economy also reflects a broader pattern in how conflict-finance evidence becomes available to a research process of this kind: sanctions designations, transaction bans and vessel listings generate a steady stream of primary-source regulatory documentation, whereas conflict-minerals due-diligence enforcement, where it exists, is less likely to be centrally catalogued in the same regulatory-press-release format. This is a structural feature of the evidence base rather than a substantive judgment about the relative severity of Russian war-economy financing versus extractive-industry corruption, and future research cycles should specifically target primary sources for Regulation 2017/821 enforcement outcomes and Sahel or Democratic Republic of Congo extractive-sector financial flows to correct the current imbalance.

Outlook

The Russian LNG import ban takes effect from 1 January 2027, and its actual implementation, together with any further expansion of the shadow-fleet vessel listing beyond the six hundred forty vessels recorded by June 2026, are the clearest near-term conflict-finance developments to track within the current baseline scope. The more significant outlook item, however, is a coverage gap rather than a forward-looking regulatory event: closing the identified thinness in EU conflict-minerals and extractive-industry-integrity sourcing under Regulation 2017/821, and in Sahel and Democratic Republic of Congo-linked extractive flows, is a research priority for subsequent cycles rather than a described regulatory milestone. This is offered as an honest account of current coverage limits rather than as a prediction of enforcement outcomes.

The central digital-asset finding this cycle is a structural mismatch between the pace of crypto-asset service provider sector growth and the maturity of the AML and CFT controls applied to that sector. The European Banking Authority fifth biennial ML/TF risk assessment documents a two and a half times increase in authorised CASPs across the EU between 2022 and 2024, a period spanning the phased entry into force of the Markets in Crypto-Assets Regulation, alongside persistent AML and CFT control weaknesses that have not kept pace with that growth. Read through a digital-asset lens rather than a sanctions-architecture lens, this is the same underlying MiCA passporting dynamic that produces the jurisdiction-shopping vulnerability described elsewhere this cycle: the AMF, FMA and CONSOB have called publicly for stronger EU-level oversight specifically because divergent national AML and CFT scrutiny at CASP authorisation persists until the Anti-Money Laundering Authority assumes direct supervision of cross-border obliged entities no earlier than 2028, leaving rapid sector expansion to outpace its supervisory architecture for a multi-year window.

The ruble-backed A7A5 stablecoin ecosystem is, from a digital-asset-integrity perspective, a case study in how quickly illicit-finance infrastructure can be rebuilt on-chain following a prior enforcement action. Following the March 2025 seizure of the Garantex exchange, a successor ecosystem launched a stablecoin through a Kyrgyz issuer and routed settlement through the exchange Grinex, reaching one hundred billion dollars in cumulative on-chain transaction volume by January 2026, a scale that rivals many licensed CASP operations, before layered sanctions compressed daily volumes from approximately one point five billion dollars to roughly five hundred million dollars. The EU response, a sector-wide transaction ban on Russian and Belarusian CASPs activated via the twentieth sanctions package with crypto provisions effective 24 May 2026, represents the first EU attempt to address this kind of on-chain reconstitution problem at the level of jurisdiction and sector rather than individual platform, a structurally significant innovation for digital-asset sanctions enforcement specifically, though it remains untested against the next successor platform that this evasion architecture may produce.

Digital-asset exposure to Democratic Peoples Republic of Korea proliferation financing also persists this cycle through the same on-chain and multi-chain layering techniques that have characterised DPRK crypto activity for several years. OFAC March 2026 designations identified a facilitator converting approximately two point five million dollars into cryptocurrency for an IT-worker network linked to Amnokgang Technology Development Company, operating across Vietnam, Laos and Spain between mid-2023 and mid-2025. From a digital-asset-architecture perspective, this scheme depends on the same underlying vulnerability as the A7A5 case, namely the capacity of crypto-conversion facilitators and virtual-asset-service-provider counterparties to move value across jurisdictions faster than compliance and law-enforcement responses can track it, even where, as here, the exposed European jurisdiction was an unwitting transit node rather than a designated target.

The red-flag indicators associated with the A7A5 and Grinex pattern are directly applicable to digital-asset compliance programmes: rapid migration of user volume to a successor exchange or stablecoin issuer following designation of a predecessor platform is observable on-chain, while ruble-pegged stablecoin settlement routed through a single domestic bank acting as a fiat gateway is observable in payment data, and both indicators are specifically relevant to virtual-asset-service-provider counterparty due diligence programmes operating correspondent relationships with EEA-domiciled crypto platforms.

Taken as a whole, the digital-asset picture this cycle is one of structural tension between rapid, MiCA-enabled sector growth, a persistent capacity of sanctioned or proliferation-financing networks to reconstitute infrastructure on-chain, and a supervisory architecture, AMLA direct CASP supervision, that will not be operative before 2028. Each of these three elements independently would warrant close monitoring; together, they describe a digital-asset compliance environment in which growth, evasion architecture, and supervisory capacity are moving on materially different timelines.

Outlook

The AMLR becomes directly applicable EU-wide from 10 July 2027, bringing crypto-asset service providers into the same obliged-entity framework as banks for customer due diligence, beneficial-ownership and cash-payment purposes, a harmonisation event that will apply uniformly regardless of the authorising Member State. The Anti-Money Laundering Authority is expected to complete its first harmonised selection of up to forty high-risk cross-border obliged entities, plausibly including significant CASPs, in 2027, with direct supervision commencing in 2028. Until that date, whether the sector-wide crypto sanctions activated this cycle measurably reduce successor-platform reconstitution of the kind observed with A7A5 and Grinex, or whether a further successor emerges, remains the key open digital-asset-integrity question. This is offered as orientation on a documented trajectory, not as a prediction of platform-level outcomes.

The compliance-technology and active-defence picture this cycle is one of steady institutional build-out running alongside a persistent capacity gap in inter-agency intelligence sharing. The Anti-Money Laundering Authority continues to stand up its Frankfurt operations, having commenced activity on 1 July 2025 under Chair Bruna Szego, taken over administration of the EuReCA database by the end of 2025, and finalised three sets of reporting-format technical standards intended to speed cross-border financial-intelligence flow between national financial intelligence units and obliged entities. A public hearing held 2 July 2026 on guidelines for the ongoing monitoring of business relationships signals a supervisory direction of travel toward a perpetual-KYC-adjacent expectation, in which customer due diligence is treated as a continuous rather than point-in-time obligation, a meaningful active-defence and compliance-technology development in its own right regardless of its eventual final form.

A note of caution belongs alongside this build-out narrative. Baseline research initially described the AMLA operational start as occurring in mid-2025 with end-2025 staffing of approximately one hundred twenty, while challenge-stage verification against the AMLA official site produced a more precise 1 July 2025 start date and an alternative staffing estimate of approximately eighty. This active precision discrepancy, on what is fundamentally a RegTech and SupTech capacity-build-out signal, is a reminder that institutional stand-up claims of this kind warrant continued verification rather than being treated as settled once reported, and confidence in the underlying claim has accordingly been assessed rather than treated as high pending resolution of the staffing figure.

The most consequential compliance-technology gap identified this cycle, however, sits not within the AMLA build-out itself but at its institutional boundary. A June 2026 Council document confirms that Europol and AMLA currently lack a reciprocal operational information-exchange interface, meaning AMLA supervisory findings cannot be systematically cross-matched against Europol criminal intelligence. This is a structural fragmentation of the EU financial-intelligence architecture rather than an isolated administrative oversight: it means that a supervisory finding generated by AMLA about, for example, a beneficial-ownership or CASP-authorisation weakness in a given Member State cannot automatically inform a parallel Europol criminal investigation into professional-facilitator networks exploiting that same weakness, and vice versa. Applying an active-defence lens specifically, this gap degrades the practical value of every other compliance-technology investment described this cycle, since intelligence generated on one side of the institutional boundary cannot readily reach the other.

Looking ahead to the supervisory perimeter itself, AMLA is set to select up to forty high-risk cross-border obliged entities for direct EU-level supervision in 2027, with direct supervision commencing in 2028. This marks the durable structural shift of the supervisory perimeter from purely national authorities toward a hybrid EU-level regime, and it is the anchor fact against which all near-term AMLA compliance-technology and active-defence developments, including the reporting-format standards and ongoing-monitoring guidelines described above, should ultimately be read: they are the technical and procedural infrastructure being built in advance of a supervisory transition that itself remains roughly two years away.

Taken together, the EuReCA database transfer, the finalised reporting-format standards, and the ongoing-monitoring guidelines under consultation describe a genuine and improving compliance-technology trajectory at EU level, even as the confirmed absence of a Europol interface and the unresolved AMLA staffing-figure discrepancy indicate that this trajectory remains incomplete both externally, in its connection to criminal-intelligence functions, and internally, in the verifiability of its own operational metrics.

Outlook

AMLA is expected to publish its first work programme and supervisory methodology by December 2026, a milestone that should clarify how the ongoing-monitoring guidelines under public hearing this cycle will be finalised and applied. Full staffing toward a projected cruising capacity of approximately four hundred thirty by the end of 2027, alongside a transition from EU-funded start-up financing to a predominantly fee-funded model from 2028, represents a structural test of institutional independence and capacity that will only become assessable over the next eighteen months. Whether the confirmed Europol-AMLA information-exchange gap is addressed through a legislative proposal, and on what timetable, is not established in this baseline and is a specific item to track in subsequent cycles. This is offered as orientation on a documented institutional-build-out calendar, not as a prediction of the eventual operational capacity or effectiveness of AMLA.