Complex rules, clearly seen.
Bruna Szego has appeared twice before a joint meeting of the European Parliament’s Committee on Economic and Monetary Affairs (ECON) and its Committee on Civil Liberties, Justice and Home Affairs (LIBE): on 2 December 2025, her first appearance in office, and on 15 July 2026 to present AMLA’s 2025 annual report. This page covers the second hearing in detail and then returns to the first, so that the two can be read together.
The headline is staffing, and it is growing steeply. AMLA grew to 119 people during 2025 and had 157 on the day of the hearing. It expects 233 by the end of 2026 and 432 by the end of 2027.
| Point | Staff |
|---|---|
| End of 2025 | 119 |
| 15 July 2026 | 157 |
| End of 2026 | 233 |
| End of 2027 | 432 |
The Chair said the 2027 hires, roughly 200 people, are mainly the direct supervision teams. They will be recruited immediately before direct supervision begins in 2028. Szego was explicit that direct supervision will not be staffed by AMLA alone: joint supervisory teams will draw people from national authorities. She is also recruiting beyond supervisors, naming mathematicians, statisticians, crypto-asset specialists and IT staff.
On the rulebook, six draft instruments had been submitted to the Commission by July. She told the committees another eleven would follow during 2026 and a further fourteen in 2027.
This was the most concrete part of the hearing, and the part most worth acting on.
Szego set out four criteria the selection must satisfy: it must be objective, robust, consistent between countries, and transparent. In practice that means every eligible entity is run through the same methodology, the same indicators and the same scoring rules, applied to data reported under a single harmonised framework with common definitions.
The model is built to catch inherent risk and to catch the quality of controls. Because combining these two, we will have the score on the residual risk.Bruna Szego, answering the first question of the hearing
That sentence is the whole architecture in one line, and it is the same structure firms already know from their own business-wide risk assessment: inherent risk, controls, residual risk. The difference is who is doing the scoring and what follows from it.
She set out a sequence. Testing on real data is due to finish at the end of 2026. The data needed to run the model will be collected during 2027. The first selection runs from 1 July 2027 and must conclude within six months. The list of selected entities is published without undue delay after that, and direct supervision starts six months after publication.
Firms sitting just outside the six-Member-State threshold may feel relieved. Is that relief justified, given what the Chair said about a common methodology?
She described selection as an opportunity rather than a burden: a selected entity deals with one set of supervisory expectations instead of several, and one supervisor instead of many. Then she added the part that matters for everyone else: a common supervisory methodology and handbook are being built with national supervisors so that supervision runs the same way across the EU, for direct and indirect supervision alike.
If that works as intended, the practical question for a firm is not whether it is on the list of selected entities. It is whether its controls would survive the same methodology being applied by its national supervisor.
A Hungarian member described a one-person glass jewellery business filing a twenty- to thirty-page document drafted by a lawyer each year, with inspectors walking through the owner's house to the attic workshop. He asked what AMLA would do about burdens disproportionate to real risk.
Szego was sympathetic and precise about the limit. Most customer due diligence requirements are already set in Level 1, the Regulation itself, and AMLA's standards cannot depart from it. What she offered instead was narrower. Each measure will come with a stated justification of how proportionality was applied. Explainers will be written for entities new to the framework. Smaller entities will have simplified regimes. Interrelated mandates will be grouped for consistency. AMLA will not ask for data another authority already holds.
Any relief through the Level 2 package is therefore limited to what Level 1 allows. AMLA drafts the regulatory technical standards, and the Commission adopts them.
The MiCA transitional period ended on 1 July 2026, two weeks before the hearing. A Polish member described providers losing the ability to operate after failing to obtain licences, and the disorder that followed a local exchange failure.
Szego flagged risks at both ends of the transition. Providers winding down are under pressure as customers rush to withdraw. Attention to anti-money laundering and safety checks can slip precisely when it matters. Licensed providers on the other side face a large-scale migration of new customers arriving at once, where onboarding must be done properly and, she added, without de-risking. AMLA published an advisory note on both sides of this at the end of June 2026, shortly before the transitional period ended.
Beyond the transition, she described a four-part crypto plan: a strategic report on how risks are evolving, due by the end of 2026; a review of how supervisory practices are being tailored; building blockchain analytics capability inside AMLA; and cooperation at EU and national level. She also noted that AMLA's central database will carry information from the non-financial sector from 2029.
One of the sharpest interventions came from a member who did not ask a question so much as place evidence on the record: blanket treatment making no distinction between a head of state and a local councillor, source-of-wealth documentation demanded for fully transparent public salaries, whole families de-risked, children's accounts closed. He cited AMLR recital 98, which describes the requirements on politically exposed persons as “of a preventive and not criminal nature”. He noted that the recital calls refusing a relationship simply because someone is a politically exposed person “contrary to the letter and spirit of this Regulation”.
He noted that Article 42(2), point (b), of the AMLR requires AMLA to issue guidelines by 10 July 2027 on the level of risk associated with particular categories of politically exposed person. He asked when the draft would appear.
Szego confirmed the PEP guidelines are being grouped with the broader risk-factor guidelines so that risk factors are treated as one picture, but could not recall the timetable and offered to confirm it. On de-risking she confirmed joint guidelines with the EBA, with the EBA currently leading through a questionnaire assessing gaps in its 2023 guidelines.
For banks with large numbers of politically exposed customers, the period before the guidelines are issued may be worth watching.
The non-financial sector is really the blind spot for every Member State.Bruna Szego, on what she found during her 2025 roadshow
Her explanation was structural rather than rhetorical. The sector covers lawyers, accountants, notaries, jewellers, car dealers, crowdfunding platforms and estate agents, with football clubs joining in 2029: large numbers of people, many entirely new to the framework. In her account, supervisors in many Member States do not yet know who their obliged entities are. She explained that registration requirements take effect only once the Directive is transposed.
Hence a deliberately phased approach: a survey, the roadshow, a deliberately basic risk assessment methodology now in consultation, and explainers to follow.
The opening statement explains that AMLA must “balance timeliness with high-quality outputs that correctly reflect the differences across the financial and non-financial sectors and allow for sufficient stakeholder involvement”. It continues: “For these reasons, last year, we requested adjustments to a few deadlines and proposed a phased approach to some mandates.”
AMLA did not say whether the Level 1 timetable was achievable. The request is worth reading alongside the mandate deadlines, where AMLA's published programming document schedules 22 of its 24 planned deliverables to land after the date the legislation sets.
End of 2026. Testing of the selection model is due to conclude. AMLA said it will be “ready to start conducting joint analyses” between FIUs. The crypto strategic report is due. AMLA expects 233 staff by then.
Law enforcement arrangements. Working arrangements with Europol, Eurojust, the EPPO and OLAF are in train and two were described as being finalised. Szego sees them operating at two levels: macro risk assessment, and operational exchange on particular cases, with law enforcement able to join joint analyses. Liaison officers rather than staff exchanges are the mechanism.
High-risk third countries. AMLA's role supporting the Commission on countries beyond the FATF list starts in 2027. It is contributing to the Commission's methodology and building its own.
Szego appeared before the same two committees seven months earlier, in her first appearance since taking office. Read after the July hearing, the December record is useful less for what it announced than for what it promised, because almost everything said in July can be measured against it.
Asked about recruitment, she described the starting point: when she joined in mid-February 2025 there was “just a handful of people”. By December there were around a hundred, of whom seventy had arrived in the previous few months. Of that hundred, twenty-four Member States were represented and, in her words, “only three are missing”. She said she looked forward to working with a full Executive Board in 2026. The fifth member was appointed on 23 February 2026.
The figure to carry forward is the first one. An authority with a handful of staff in February 2025 told Parliament in July 2026 that it had submitted six draft instruments, would deliver another eleven mandates in 2026 and a further fourteen in 2027.
She told the committees that AMLA would release its single programming document shortly. She apologised for the short consultation window on it. The very short time, she said, reflected “the tight timeline and the pressure that we are working under”, and she committed to allowing more time in future.
The programming document then being written promised twenty-four of AMLA’s forty mandates during 2026. By July the Chair’s own account to the same committees was seventeen. Does the difference between the two figures reflect the conditions she described in December?
Asked how AMLA would support financial intelligence units that cannot process complex cases at the speed of larger Member States, she set out a two-step sequence. The first step is a stocktake of the initial conditions of the FIUs, to be carried out during 2026. The instrument that follows is the peer review, which she described as assessing whether and how FIUs are equipped and how efficient they are in their work. From the roadshow she added that the differences are real: some units are considerably more developed than others.
So the peer reviews are the second step of a two-step process. A unit that comes out of the baseline badly will know its position before any peer review reports.
Asked what concrete measures would reduce compliance costs, she pointed straight at the customer due diligence standard. It was work the European Banking Authority had been doing and had consulted industry on, there had been criticism of it, and AMLA was looking in more detail at what it could do to make the rules robust on the one hand and proportionate on the other.
That was two months before AMLA opened its own consultation on that standard and five before it closed. Is it fair to read the later amendments as reflecting both the consultation and work that AMLA had begun before it?
Members pressed her on whether Russia and Belarus should be treated as high risk. One argued that no further evidence was needed because the Russian state was systematically involved. Another asked how long AMLA would need to acquire the personnel, analytics and investigative tools to address sanctions circumvention. Her answer was about contribution rather than decision: AMLA supports the Commission, is building a risk framework to collect data, and has the particular advantage of holding both a supervisory pillar and an FIU pillar, so that non-confidential information from each can be pooled into a fuller picture of risks arising outside the Union.
On 3 December 2025, the Commission adopted a delegated regulation creating a new category for countries whose FATF membership is suspended, and listed Russia under it. It was later published as Delegated Regulation (EU) 2026/46. This was the day after the hearing.
Three of the four priorities she set out in December survived intact into 2026: the industry-facing mandates beginning with customer due diligence, preparation for direct supervision, and the FIU work with its first peer reviews and pilot joint analyses. The fourth, building AMLA’s own risk analysis capability, became the analytical backbone described in the programming document.
What did not survive was the volume. Her own summary of the position in December was that AMLA was “flying a plane while building it”. Taken together, the two hearings show the core priorities delivered on schedule and part of the regulatory programme rescheduled.
Abbreviations
A published reference, not advice to any particular firm; reading it creates no professional relationship.
Enquiries: office@theamlmonitor.eu · Legal notice · Privacy · Terms