The European Union is preparing to place large cross-border crypto firms under direct anti-money-laundering supervision even when they serve customers remotely without maintaining a branch or local office. The framework gives the EU Anti-Money Laundering Authority (AMLA) a route to supervise high-risk financial institutions operating across at least six member states, including crypto-asset service providers.

Under AMLA’s finalized draft selection rules, remote activity is considered material in a member state when a firm has more than 20,000 customers resident there or processes more than €50 million in annual incoming and outgoing transactions for those customers. The thresholds are alternatives. Activity conducted directly or through branches, agents or distributors can count toward the test.

The model adds an anti-money-laundering layer to MiCA’s cross-border passporting system. MiCA allows an authorized crypto-asset service provider to operate across the bloc without maintaining a physical presence in every host member state, while AMLA can still count sufficiently large remote markets toward its geographic test. The approach follows the EU’s earlier move requiring unauthorized crypto firms to wind down their activities after the MiCA transition expired.

Direct AMLA Supervision Starts in 2028

The selection methodology is not yet operational. AMLA finalized its draft regulatory technical standards in December 2025, but the rules still require approval from the European Commission before they can apply directly across member states. AMLA will begin its first selection process in July 2027, and direct supervision is scheduled to start in 2028.

Exceeding the customer or transaction threshold alone will not place a firm under AMLA supervision. An eligible institution must operate in at least six member states and receive a high residual money-laundering or terrorist-financing risk classification under AMLA’s methodology. The first selection is expected to cover up to 40 high-risk financial institutions or groups.

The relevant draft standards are set out in AMLA’s final report on regulatory technical standards%20AMLAR.pdf). Crypto firms are explicitly included in the financial-sector AML regime. The EU’s Anti-Money Laundering Regulation includes crypto-asset service providers within its definition of financial institutions and introduces enhanced requirements covering customer due diligence, cross-border crypto relationships and transfers involving self-hosted addresses. Those requirements form part of the broader 2027 crypto KYC framework.

Serious AML Breaches Can Reach 10% of Turnover

AMLA will receive direct enforcement powers over selected firms. For serious, repeated or systematic breaches involving customer due diligence, internal controls or reporting obligations, the statutory penalty framework allows sanctions to reach as high as 10% of annual turnover after aggravating and mitigating adjustments are applied.

The 10% figure is a ceiling rather than an automatic fine. Lower basic penalty ranges apply first, and AMLA must consider the seriousness and circumstances of each breach when setting the final sanction.

AMLA’s first selection cycle will run from July through December 2027. The institutions chosen will move into direct EU-level AML supervision six months after the final list is published in 2028.