Periodic updates below are dated within the scope of the expert review (as at 27 Oct 2026).
25 Oct 2026 · fim-2026-10-25 Expert reviewed
Lead Signal
The European Anti-Money Laundering Authority has moved on two fronts at once, and the two moves read as a single structural story rather than two unrelated items. On 1 October 2026, AMLA submitted three final draft Regulatory Technical Standards to the European Commission under the AML Regulation single rulebook: one on customer due diligence verification methods under Article 28(1), one on classifying business relationships and linked transactions under Article 19(9), and one on group-wide AML/CTF governance controls under Articles 16(4) and 17(3). None of the three is binding yet; they become so only once the Commission adopts them and they are published in the Official Journal, after which they apply six months later. Six days after submitting those standards, on 7 October 2026, AMLA published its response to the European Commission's targeted consultation on the review of the Markets in Crypto-Assets Regulation, and that response names five specific architecture gaps in the EU's framework for digital assets: staking, lending and borrowing activity sitting outside the regulatory perimeter altogether; no legal definition of what constitutes effective control in a decentralised finance arrangement; legal uncertainty over the treatment of stablecoins circulating in the EEA without MiCA authorisation; asset-referenced token issuers not currently captured as obliged entities for AML/CFT purposes; and insufficient information-sharing between supervisors of crypto-asset service providers across borders.
Read together, these two developments describe an authority building out the architecture of AML supervision in two directions simultaneously: tightening the mechanics of conventional due diligence and governance under the AMLR, while separately diagnosing where the crypto-asset perimeter still leaks. Both are framed by AMLA as things still to be resolved rather than resolved; the RTS await Commission adoption and the MiCA-review findings are recommendations the Commission may or may not act on. The significance is structural, not episodic: this is an authority mapping the edges of its own future jurisdiction ahead of the AMLR's direct application across the EEA on 10 July 2027.
Other Developments
AMLA's crypto diagnosis lands as the MiCA transitional window closes. Separately from the regulatory-standards work, Maltese and other national-level guidance has flagged a related risk arising from the end of MiCA's maximum Article 143(3) transitional period for existing crypto-asset service providers, which lapsed EEA-wide on 1 July 2026. Guidance circulated since highlights three specific money-laundering and terrorist-financing risks tied to that transition: the withdrawal of unauthorised virtual-asset service providers from the market, large-scale customer migration between crypto platforms as users move to authorised providers, and a resulting concentration of activity among a smaller number of authorised crypto-asset service providers. The timing links directly to AMLA's MiCA-review findings — the same perimeter gaps AMLA flagged in its consultation response are the gaps through which risk is migrating as the authorised-CASP population consolidates.
A near-term beneficial-ownership deadline is approaching but has not yet arrived. Under the sixth Anti-Money Laundering Directive, beneficial ownership registers across the EEA will be required to answer legitimate-interest access requests within twelve working days, with that obligation taking effect from 10 November 2026. This has not yet come into force as of the current reporting window and is being tracked as an item to watch rather than a completed development.
Cross-Monitor Connections
AMLA's MiCA-review response sits squarely at the intersection of financial-crime architecture and digital-asset market structure, and the same underlying facts — the closure of the CASP transitional period, the unresolved status of staking and lending activity, and the treatment of unauthorised stablecoins — are material to how the crypto-asset regulatory regime itself is read. The gaps AMLA has identified in obliged-entity status for asset-referenced token issuers and in cross-border supervisory information-sharing bear directly on how payment-system oversight of stablecoin and digital-money activity is assessed, since AML/CFT perimeter gaps in token issuance are also market-structure gaps for anyone relying on those tokens as a payment instrument. None of this is enforcement news in the conventional sense; it is architecture diagnosis by the authority best placed to see the whole picture, which is precisely the kind of signal that tends to get under-weighted relative to a single enforcement action.
Outlook
The near-term calendar carries three dates worth tracking against each other. The AMLD6 beneficial-ownership access-request deadline of 10 November 2026 arrives first and is a narrow, mechanical test of registry readiness. The three AMLR Regulatory Technical Standards submitted on 1 October 2026 remain with the Commission; the question is whether adoption proceeds on a timeline consistent with the broader 10 July 2027 AMLR application date, or whether it slips. AMLA's MiCA-review recommendations are, for now, just that — recommendations — and whether the Commission takes up any of the five gap areas identified will not be visible until the Commission's own review process produces a legislative response. None of these tracks has resolved; all three are structural and worth carrying forward as a set rather than individually.
18 Oct 2026 · fim-2026-10-18 Expert reviewed
Lead Signal
The European Union adopted its twenty-second package of Russia-related restrictive measures on 12 October 2026, through Council Implementing Regulation (EU) 2026/2281, adding approximately 1,569 new listings covering 826 entities and 743 individuals active in Russia's military-industrial complex. The Council describes this as the largest single round of listings since the war began. For obliged entities across the EEA, including banks and cross-sector firms, this is a structural widening of the designated-persons screening universe rather than an incremental addition, and it arrives alongside two other developments that together describe a tightening posture across sanctions, crypto supervision, and the core AML architecture.
Other Developments
AMLA's first regulatory technical standards package. The Anti-Money Laundering Authority submitted its first package of regulatory technical standards to the European Commission on 1 October 2026, covering customer due diligence, business relationships and linked transactions, and group-wide requirements, proposed to apply six months after entry into force. This is reported through a secondary source; AMLA's own register page was not independently opened this cycle, which caps confidence at probable rather than confirmed. The submission is a structural step in the build-out of the directly-applicable EU AML Regulation architecture ahead of the 10 July 2027 full-application date.
ESMA's stablecoin-service supervisory reversal. The European Securities and Markets Authority issued an opinion on 8 October 2026 stating that crypto-asset service providers authorised under the Markets in Crypto-Assets Regulation should cease services connected to non-MiCA-compliant asset-referenced tokens and e-money tokens for European Union clients. This reverses ESMA's narrower January 2025 position, which had permitted custody and transfer of non-compliant stablecoins. National supervisors are expected to direct remediation of pre-existing exposure within approximately three months. This directly-sourced, Tier-1 development tightens the compliance perimeter for crypto-asset service providers operating in the EEA.
Council negotiating position on direct CASP supervision. The Council of the European Union agreed a negotiating position on 9 October 2026 to bring the most significant cross-border crypto-asset service providers under direct supervision adjacent to the European Securities and Markets Authority and the Anti-Money Laundering Authority, narrowing the current national-regulator-only passporting model without replacing it. This remains a proposal requiring European Parliament agreement, reported through a single press account; the Council's own document was not located this cycle.
Cross-Monitor Connections
The widened sanctions-screening universe under the twenty-second Russia package connects directly to the payments-monitoring surface, where expanded designated-persons lists require corresponding updates to transaction-screening thresholds and payment-corridor due diligence. The ESMA stablecoin reversal and the Council's CASP-supervision proposal both connect to the digital-assets and payments trackers, where the same facts are read through a product-and-market-access lens rather than the AML/sanctions lens applied here. The AMLA regulatory-technical-standards submission is the structural backdrop against which all EEA obliged-entity compliance obligations, across sectors, will eventually be read once the standards are adopted.
Outlook
The AMLA regulatory technical standards package now sits with the European Commission, and its progression toward adoption, proposed to apply six months after entry into force, is a timeline to watch ahead of the 10 July 2027 full-application date for the broader AML Regulation and sixth AML Directive architecture. The ESMA opinion's approximately three-month remediation window points to a practical deadline in or around early January 2027 for non-compliant-stablecoin service wind-down. The Council's CASP-supervision negotiating position depends on European Parliament agreement before it can take effect. FATF's next plenary, 26-30 October 2026 in Paris, is the next point at which the grey list, currently standing at 22 jurisdictions since the 19 June 2026 plenary, could move.
9 Oct 2026 · fim-2026-10-09 Expert reviewed
Lead Signal
The European Economic Area's sanctions architecture against Russia continued to expand this cycle on two parallel tracks. The Council of the European Union agreed, on 8 October 2026, to prolong the EU's hybrid-threats and foreign information manipulation and interference (FIMI) sanctions regime by one year, extending it to 9 October 2027. This regime is distinct from, and runs parallel to, the EU's main Russia country-sanctions architecture, giving the bloc two live legal bases for designations touching the same underlying conduct. Separately, COREPER agreed on 7 October 2026 to a 22nd EU sanctions package against Russia comprising 1,646 new listings: 743 individuals, 826 entities, and 77 officials tied to elections in occupied Ukrainian territory. Formal Council adoption is scheduled for 12 October 2026; as of this cycle's close the package has not yet taken legal effect, and reporting on its scope rests on diplomatic and press sourcing rather than a published Council instrument, which caps the finding at probable rather than confirmed.
Other Developments
AMLA's first Level-2 technical standards. The EU Anti-Money Laundering Authority finalised and submitted to the European Commission, on 1 October 2026, its first three Level-2 regulatory technical standards under the AML Regulation: standards covering customer due diligence and PEP screening, business relationships and linked transactions, and group-wide AML/CFT controls. The standards are proposed to apply six months after entry into force, though no fixed Commission adoption date has been confirmed. The primary AMLA press materials were not retrieved directly this cycle, so the finding rests on consistent but non-primary commentary and is treated as probable pending a Tier-1 anchor.
EU AML Package build-out continues unevenly across instruments. The AML Regulation (Reg (EU) 2024/1624) remains on track to apply from 10 July 2027. The sixth Anti-Money Laundering Directive is transposing on a staggered basis: as of the Commission's August 2026 monitoring, 23 Member States had communicated full first-tranche transposition, with infringement proceedings pending against the remaining ten. AMLA itself has been operational in Frankfurt since 1 July 2025 and is proceeding toward its first direct-supervision selection cycle, with eligibility data due 31 December 2026, selection finalised late 2027, and direct supervision of up to 40 entities beginning in 2028.
Non-uniform incorporation across the EEA-EFTA bloc. Liechtenstein is repealing its existing anti-money-laundering statute (the SPG) and enacting a new national AMLA-implementing Act, with a consultation report adopted 3 March 2026. Norway has incorporated the Markets in Crypto-Assets Regulation but extended its national licensing deadline to 30 June 2026. Iceland has not yet incorporated either the EU AML package or MiCA. The three EEA-EFTA states are moving at materially different speeds, and uniform EEA-wide application of the core EU AML architecture should not be assumed.
MiCA transitional period closed. The EU-wide Article 143 grandfathering period for pre-existing crypto-asset service providers ended fully on 1 July 2026. Only MiCA-authorised crypto-asset service providers may now market crypto services into the EU, and reverse solicitation cannot be relied upon where a firm pays influencers to reach EU customers. This is standing digital-asset-integrity baseline content rather than a new development this cycle, but it remains directly relevant to enabler-jurisdiction and evasion-pathway analysis given the EEA-EFTA incorporation gaps noted above.
Cross-Monitor Connections
The sanctions expansion and the EEA-EFTA incorporation gaps intersect directly with crypto and digital-asset monitoring: a jurisdiction inside the EEA that has not yet incorporated MiCA or the AML package presents a different enablement profile than one that has, and the Iceland gap in particular merits continued attention as a potential routing point. The AMLA build-out, including the Level-2 technical-standards submission and the move toward direct supervision from 2028, is architecture relevant to compliance-technology and active-defence monitoring, since obliged entities' control calibration will need to anticipate the forthcoming CDD, PEP-screening and group-wide-controls standards before they formally apply.
Outlook
The 22nd sanctions package is expected to receive formal Council adoption on 12 October 2026, after which its 1,646 listings become legally effective; confirmation of the final instrument will allow the designation count to move from probable to confirmed. The hybrid-threats regime renewal is now locked in through 9 October 2027. On the AML Package architecture, the near-term marker to watch is Commission adoption of AMLA's three submitted Level-2 technical standards, with application expected roughly six months after entry into force, as scheduled. Iceland's incorporation posture on both MiCA and the EU AML package remains the key EEA-EFTA structural gap to monitor going into the next cycle.
6 Oct 2026 · fim-2026-10-06 Expert reviewed
Lead Signal
The European Economic Area standing record carries one open-architecture item this cycle: the Payment Services Regulation and the third Payment Services Directive, together the successor framework to PSD2, remain awaiting formal adoption by the European Parliament and Council. As at 6 October 2026 the European Parliament legislative train tracker had not confirmed publication of the package in the Official Journal. This is a cross-pillar standing-record point for financial integrity because the payment-services legal architecture carries AML/CTF-adjacent provisions that bear on the obliged-entity perimeter for payment institutions operating across the bloc. The development does not change enforcement posture or supervisory practice today; it marks the continued absence of a finalised successor instrument, and the standing record is updated to reflect that the current regime remains PSD2 pending adoption.
The European Parliament source states plainly that the deal needs to be formally adopted by Parliament and Council before it can enter into force. No CELEX number, Official Journal date, or entry-into-force date is available from the material gathered this cycle, and none is asserted here.
Other Developments
No other typology domain carried new evidence this cycle. The sanctions-architecture, beneficial-ownership, enabler-jurisdiction, conflict-finance, crypto/digital-asset, and compliance-technology domains are stable on baseline and are not restated here; their published standing material stands as previously filed.
Cross-Monitor Connections
The PSD3/PSR adoption delay is directly relevant to the World Payments Monitor, which tracks the same legislative-train status under its own licensing and market-access module, and the two records should be read as describing the same underlying fact from complementary angles: here as an open AML/CTF-adjacent architecture item, there as a market-access and licensing-continuity question. No connection to conflict-finance, state-capture, or information-operations monitors is supported by this cycle's evidence.
Outlook
The standing record will be updated again once the European Parliament and Council formally adopt the package, at which point a CELEX reference and an entry-into-force date should become available and the open-horizon item can be closed out or converted into a dated implementation tracker entry. Until then, the regulatory architecture for payment institutions operating in the EEA continues to rest on PSD2, and firms should not treat PSD3 or the Payment Services Regulation obligations as being in legal effect. As scheduled, formal adoption is anticipated within Q4 2026, though the timing carries meaningful uncertainty and no firmer date can be stated from the available material.
5 Oct 2026 · fim-2026-10-05 Expert reviewed
Lead Signal
The EU anti-money-laundering package reaches a structural milestone for the gambling sector this cycle, as the AML Regulation (Regulation (EU) 2024/1624, the AMLR) clarifies the boundaries of the risk-based exemption available to gambling providers. Article 4(1) allows Member States to exempt gambling providers from AMLR requirements, in full or in part, on the basis of proven low risk, but that exemption can never extend to casinos or to providers whose principal activity is online gambling or sports betting, other than gambling operated or regulated by the State itself; any exemption also requires a prior risk assessment under Article 4(2). This is not a new standard invented this cycle so much as a structural tightening and clarification of the risk-based architecture already present in the AML Directive era, and it narrows the practical space Member States have to carve gambling operators out of the obliged-entity perimeter.
Other Developments
The customer due diligence threshold for gambling transactions is restated, not introduced. Article 19(5) of the AMLR requires gambling providers to apply customer due diligence on the collection of winnings, the wagering of a stake, or both, for transactions of at least EUR 2,000, whether carried out as a single operation or through linked transactions. This restates a threshold already present in the fourth AML Directive rather than establishing a new one, and the correction matters for compliance teams benchmarking their current controls against what is actually changing versus what has simply migrated instrument.
The application timetable remains fixed but distant. Article 90 of the AMLR confirms the Regulation applies generally from 10 July 2027, with a later application date of 10 July 2029 for the obliged entities identified in Article 3(3)(n) and (o). For gambling providers caught by the general application date, this gives a defined but not immediate runway, and the near-term signal is less about new substantive duties than about the supervisory architecture being built in advance of that date.
AMLA's 2026 consultation programme is the structural development to track. The Anti-Money Laundering Authority issued draft Guidelines on business-wide risk assessment under Article 10(4) of the AMLR, launched a public consultation on draft Regulatory Technical Standards on group-wide requirements under Articles 16(4) and 17(3), and from 3 June 2026 consulted on draft Guidelines on ongoing monitoring of business relationships under Article 26(5). The Malta Gaming Authority drew its licensees' attention to these consultations, which are binding inputs to how gambling obliged entities will need to structure governance, group compliance and monitoring ahead of the 2027 application date; no gambling-sector-specific AMLA guidance has yet been identified.
FATF has turned its typology lens onto gaming and gambling. FATF published a report titled Red Flag Risk Indicators: Risks of Gaming and Gambling, dated September 2026, which the Financial Intelligence Analysis Unit in Malta brought to the attention of its subject persons on 14 September 2026. Secondary reporting places the underlying FATF publication date at 9 September 2026, a detail worth noting because the FIAU notice date and the FATF publication date are not the same fact and should not be conflated in compliance records.
Cross-Monitor Connections
The AMLR's gambling-specific thresholds and exemption boundaries interact directly with the gambling-regulatory perimeter tracked elsewhere: the same Article 4 exemption architecture determines which gambling operators sit inside the AML obliged-entity perimeter at all, a question with direct bearing on licensing and market-structure analysis for the sector. The FATF red-flag indicators for gaming and gambling, once fully absorbed, are likely to inform typology development relevant to both AML compliance functions and gambling-sector supervisory engagement, since red-flag indicators of this kind typically feed directly into national-regulator expectations for transaction monitoring thresholds and suspicious-activity reporting triggers in the licensed gambling sector.
Outlook
The near-term trajectory is governed by the AMLA consultation cycle rather than by any immediate substantive change in obligation: the Guidelines and RTS now in consultation will, once finalised, constitute the operative detail gambling obliged entities must build against ahead of the 10 July 2027 application date. A continuing gap is the EEA-EFTA incorporation status of the AMLR for Iceland, Liechtenstein and Norway, which EEA-Lex records as still under scrutiny as at 5 October 2026; until that incorporation step is confirmed, the application timeline for EEA EFTA states carries additional uncertainty beyond the EU Member State date. Compliance functions at gambling obliged entities should treat the 2026 consultation outputs as the practical signal to watch, since they will shape business-wide risk assessment, group-wide governance and ongoing-monitoring expectations well before the formal application date arrives.
4 Oct 2026 · fim-2026-10-04 Expert reviewed
Lead Signal
The EU sanctions architecture is decoupling its day-to-day designation cadence from its headline numbered packages. Ukraine's sanctions coordinator, Vladyslav Vlasiuk, stated on 3 October 2026 that the Council expects to add roughly 1,600 individuals and entities to its Russia-related sanctions list in October 2026, mostly military-industrial targets, while the formally numbered 22nd sectoral package has slipped from an October to a November expectation. No Council legal act yet exists for either the listing round or the package, so both remain announcements rather than law as of the reporting date. The practical effect for screening programmes is an administrative designation flow that moves faster and more continuously than the political process that produces the sectoral measures attached to it.
A second development this cycle sits at the intersection of sanctions architecture and the crypto perimeter. The European Securities and Markets Authority, in a filing dated 30 September to 2 October 2026 responding to the ongoing MiCA review, proposed binding ESMA classification opinions, a licensable gateway for decentralised finance activity, asset-freeze powers for supervisors, and tighter obligations on stablecoin issuers. Several independent trade outlets report consistent content for this filing, though the primary ESMA document itself was not directly retrieved this cycle, which keeps the finding at Probable rather than Confirmed.
Other Developments
AMLD6 transposition remains uneven across the bloc. As of the European Commission's August 2026 monitoring update, 23 of 27 Member States had communicated full first-tranche transposition of Directive (EU) 2024/1640, with 10 infringement proceedings still pending against the remainder. This is reported through vendor commentary citing the Commission update rather than a directly retrieved Commission source, so the underlying transposition gap is read as a structural compliance lag rather than a resolved milestone.
Cambodia has intensified enforcement specifically to avoid a renewed FATF grey-list placement. Reporting describes licence revocations and asset freezes targeting illegal online gambling and scam-linked financial crime, framed explicitly around grey-list avoidance rather than a response to a prior listing. Cambodia is not currently grey-listed, which makes this a case of enforcement anticipating a designation rather than remedying one — the kind of episodic, enforcement-led posture that contrasts with the structural capacity deficits seen in jurisdictions that remain listed.
The EU AML Regulation's gambling threshold stands unchanged but remains a notable structural feature. Regulation (EU) 2024/1624 introduces the bloc's first harmonised definition of gambling services together with a directly applicable EUR 2,000 customer due diligence threshold, taking effect from 10 July 2027 without need for national transposition, while allowing Member States to exempt low-risk gambling services under Article 4. Nothing changed on this point this cycle; it is carried here as background against which the Cambodia enforcement signal and the AMLD6 transposition gap both sit.
Cross-Monitor Connections
The ESMA MiCA review response is the clearest connective tissue this cycle between sanctions enforcement and digital-asset regulation: a licensable DeFi gateway and supervisor asset-freeze powers would, if adopted, give sanctions-screening programmes a structural tool against on-chain evasion channels that do not currently sit inside the authorised CASP perimeter. The EU's own 21st sanctions package already introduced a dedicated third-country ban tool for crypto-asset services, and the ESMA proposal would extend the architecture available to enforce against the same evasion patterns from the supervisory side rather than purely the sanctions-designation side. This is a sanctions-architecture and crypto-market-structure convergence worth tracking jointly rather than as two separate developments.
Outlook
The near-term test is whether the administrative October listing round and the November-targeted 22nd package both materialise as described, or whether the package slips again as prior packages have. The AMLD6 infringement proceedings against the four non-compliant Member States are a slower-moving but structurally significant thread: the EU's single AML rulebook cutover on 10 July 2027 depends on this transposition groundwork being substantially complete well before AMLA's planned direct-supervision start in January 2028. On the crypto side, whether the European Commission takes up ESMA's binding-opinion and DeFi-gateway proposals in a formal legislative text will determine whether this cycle's filing becomes durable architecture or remains a consultation response.
28 Sep 2026 · fim-2026-09-28 Expert reviewed
Lead Signal
The European Economic Area's structural AML and crypto-asset architecture continues to advance on two distinct clocks that are, this cycle, materially diverging from one another. Regulation (EU) 2024/1624, the AML Regulation, creates the first EU-wide legal definition of gambling services as an AML obliged-entity category, applying directly across the EU from 10 July 2027. Separately, MiCA (Regulation (EU) 2023/1114) was incorporated into the EEA Agreement by Decision No 41/2025 of the EEA Joint Committee, taking effect 24 June 2025, but the EEA-EFTA states are applying it on genuinely divergent timelines: Liechtenstein's regime is in force, Norway has extended its own licensing deadline to 30 June 2026, and Iceland has not yet incorporated the framework. The structural point is that EU-level codification and EEA-EFTA incorporation are not the same clock, and treating them as synchronised would misstate the actual compliance perimeter facing a cross-border firm operating across the bloc.
Other Developments
AMLA's continuing build-out is the backdrop against which both developments above should be read. The Anti-Money Laundering Authority has been operational in Frankfurt since 1 July 2025 and has been publishing regulatory and implementing technical standards through 2026, ahead of the EU application date for the AMLR and the sixth AML Directive. AMLA's own entry into force for EEA-EFTA purposes is itself gated by EEA Joint Committee decisions that have not yet been taken, meaning the authority's supervisory reach into Norway, Iceland and Liechtenstein remains, for now, an open question rather than a settled fact.
Incorporation-mechanism precedent exists but has not yet been exercised for this package. The EEA Joint Committee has previously incorporated the fifth AML Directive via a decision implementing JCD 63/2020, establishing that the bloc has a working mechanism for bringing EU AML instruments into EEA law. That precedent is instructive for what is likely to happen with the AMLR/AMLD6/AMLA package, but it is not itself evidence that incorporation has occurred or is imminent; Norway is still assessing its incorporation route and Liechtenstein's national implementing act remains in consultation.
Cross-Monitor Connections
The gambling obliged-entity definition under the AMLR connects directly to the advennt monitor's gambling-sector coverage: the AML definitional change does not touch gambling licensing or product legality, which remain matters of national competence entirely outside the AML package's scope, but it does bring gambling operators formally within the AML obliged-entity perimeter at EU level for the first time. The MiCA incorporation divergence across Liechtenstein, Norway and Iceland connects to the crypto and world-payments monitors' coverage of the same instrument from their respective licensing and payments-infrastructure angles; the underlying fact of divergent EEA-EFTA timing is common across all three readings, even though each monitor frames its significance differently.
Outlook
The near-term marker to watch is Norway's 30 June 2026 extended CASP licensing deadline under MiCA, followed by the EU's 10 July 2027 application date for the AMLR gambling obliged-entity definition. Whether the EEA Joint Committee moves to incorporate the AMLR/AMLD6/AMLA package before or materially after the EU application date will determine whether EEA-EFTA firms face a compliance gap or a smooth transition; as at this cycle, that incorporation decision remains pending and unresolved.
14 Sep 2026 · fim-2026-08-05 Expert reviewed
Lead Signal
Two structural developments define this cycle for the EEA financial-integrity picture. First, the EU Anti-Money-Laundering Package continued to move on schedule: the AML Regulation (AMLR, Regulation (EU) 2024/1624) remains fixed to apply directly across all 27 Member States from 10 July 2027, without national transposition, retaining its harmonised 25 percent beneficial-ownership threshold, while the sixth Anti-Money-Laundering Directive (6AMLD) confirmed the same 10 July 2027 transposition deadline, with registry-access provisions phased through to 2029. The Anti-Money-Laundering Authority (AMLA, Regulation (EU) 2024/1620) passed its first regulatory-technical-standards deadline on 10 July 2026 and published a final report on 21 July 2026 addressing cooperation arrangements for direct supervision, ahead of a January 2028 go-live at which roughly 40 selected cross-border obliged entities move under the AMLA direct-supervision perimeter. Second, the EU sanctions architecture against Russia escalated further, with the 21st sanctions package (adopted 23 July 2026) extending designation criteria for the first time beyond vessels themselves to the enabling service layer around the shadow fleet: bunkering providers, crewing agencies, and ship-registry facilitators. This follows the 20th package earlier move, effective 24 May 2026, to impose a total EU-operator transaction ban on Russia-based crypto-asset service providers, naming the RUBx platform and prohibiting EU assistance to the Russian digital rouble, alongside the designation of a Kyrgyz exchange facilitating the A7A5 stablecoin. Read together, these two currents show sanctions-evasion infrastructure and AML supervisory architecture both migrating toward more granular, structurally-targeted instruments rather than incident-level designations.
Other Developments
MiCA transitional window closed. The Markets in Crypto-Assets Regulation reached full enforcement across all 27 Member States on 1 July 2026 as its grandfathering period expired. Eight MiCA-compliant euro-denominated stablecoins were recorded as of June 2026, up from five, with compliant market capitalisation up 128 percent year-on-year to approximately 673.9 million dollars; Circle EURC remains the dominant issuer by outstanding value even as its relative market share is reported to be declining against newer entrants.
FATF grey-list churn continues. The June 2026 plenary added Iraq and Bosnia and Herzegovina to the list of jurisdictions under increased monitoring and removed Algeria and Namibia, netting the list to 22 jurisdictions; the black list was unchanged. Laos remained grey-listed, with FATF citing continuing deficiencies in Special Economic Zone casino and bank supervision, financial-intelligence-unit capacity, and money-laundering prosecution, concerns that sustain long-standing attention on the Golden Triangle Special Economic Zone 99-year concession enclave. In a related signal outside the FATF process itself, the National Bank of Cambodia governor publicly warned in January 2026 that scam-centre and illegal online-gambling activity risks re-listing, three years after the country February 2023 removal from the grey list.
Gold-trade laundering exposure persists in the UAE. Despite an April 2026 guidance refresh from the Central Bank of the UAE, gold and precious-metals trade continues to present structural trade-based-money-laundering exposure through over- and under-invoicing, allowing illicit gold proceeds to be laundered without the funds leaving the jurisdiction.
Conflict-finance designations continued on two fronts. The U.S. Treasury Office of Foreign Assets Control designated additional Houthi, Ansarallah, smuggling and revenue facilitators across Yemen, Oman and the UAE on 16 January 2026, sustaining a petroleum-import-taxation architecture assessed to generate hundreds of millions of dollars annually. Separately, FinCEN issued a supplemental alert on 30 June 2026 addressing fiscal fuel-smuggling and tax-evasion schemes on the US-Mexico border linked to the Cartel de Jalisco Nueva Generacion, a corridor assessed to generate tens of billions of dollars annually, with parallel OFAC action against two individuals and nine entities.
Cross-Monitor Connections
The service-layer expansion of EU sanctions designations, reaching bunkering, crewing and ship-registry facilitators rather than vessels alone, intersects directly with commodity-flow and conflict-finance tracking relevant elsewhere in the fleet: a shadow-fleet enabler designated for sanctions purposes is simultaneously a node in physical commodity-flow integrity. The EU crypto-transaction ban on Russia-based service providers and the parallel designation of an exchange facilitating the A7A5 stablecoin sit at the boundary between sanctions architecture and digital-asset market structure, and connect to conflict-finance tracking insofar as sanctioned-jurisdiction actors migrate settlement onto stablecoin rails as fiat channels close. The Houthi and CJNG designations both illustrate revenue architectures, petroleum-tax extraction and fiscal fuel-smuggling respectively, that generate financing at a scale relevant to conflict-finance and extractive-industry-integrity tracking beyond financial-integrity own AML/CTF lens.
Outlook
The near-term calendar is dominated by AMLA build-out: further RTS and ITS packages are expected through 2026 and into 2027 as the Authority stands up the joint-supervisory-team methodology it will need for January 2028 direct supervision of roughly 40 entities, a governance model the sector has not previously operated under. The 10 July 2027 date remains the pivotal fixed point for both AMLR direct application and 6AMLD transposition deadline, though the transposition status of individual Member States is not yet established and remains a tracked gap. On sanctions, the trajectory of designation criteria toward enabling-service layers and crypto rails is assessed to continue, and the interaction between MiCA now-fully-enforced euro-stablecoin regime and sanctions-evasion migration onto digital rails is a developing area warranting continued attention. Any scenario content elsewhere in this brief is illustrative orientation only, not a prediction of designation or enforcement outcomes.