AMLA's 2028 supervision start gives UK groups a reason to build one AML data model

British groups should stop running a separate AML stack for every country

This column is for the people who own financial crime technology in British groups with European operations: CIOs and CTOs at banks, payment firms and crypto businesses, heads of financial crime change, and the founders who sell screening and monitoring tools into them. My position is that the next two years are the moment to rebuild customer due diligence and transaction monitoring around one shared data model for customers, ownership, risk and transactions. EU and UK rules should then be applied to that model as configuration, rather than maintained as parallel country systems.

The trigger is in Frankfurt. The EU's Authority for Anti-Money Laundering and Countering the Financing of Terrorism, AMLA, sets out in its Single Programming Document for 2026 to 2028 that it will directly supervise the forty most impactful credit and financial institutions in the EU. It plans a budget rising from €13.6 million in 2025 to €43.1 million in 2026, €66.9 million in 2027 and €96.0 million in 2028, when supervision costs start to be funded by fees.

On 15 July 2026 AMLA's Chair, Bruna Szego, told the European Parliament's ECON and LIBE committees that the authority grew to 119 staff in 2025 and plans to reach 233 by the end of 2026 and 432 by the end of 2027. She said AMLA will run its first selection of directly supervised firms from 1 July 2027 and be ready to start direct supervision in 2028.

The strongest objection is that Britain will not follow Brussels and only forty firms will notice

A sceptical UK CTO would say I am solving a European problem with British money. The UK sits outside AMLA. Its Money Laundering Regulations are being amended on their own path, not to track the EU regulation.

And AMLA will directly supervise only forty institutions, chosen, according to AMLA's own FAQs, from financial firms active in at least six Member States with a high residual risk profile. Most UK groups will never be selected, so why rebuild?

Much of that is true, and the divergence is already in law. The UK's Money Laundering and Terrorist Financing (Amendment) Regulations 2026, made on 9 June 2026, convert many thresholds from euros to sterling and change some values on the way.

In the customer due diligence rules, 15,000 euros becomes £12,000 and 1,000 euros becomes £800. Enhanced due diligence on country risk now turns on the FATF list of jurisdictions subject to a call for action, rather than the wider high-risk third country definition. A model built to mirror EU rules line by line would be wrong for Britain within months.

But that is my argument, not a rebuttal of it. When two regimes share the same objects (customers, beneficial owners, accounts, transactions, risk scores) and differ mainly in thresholds, country lists and timing, the cheapest design is one data model with jurisdiction-specific rules on top. Selection for direct supervision is the narrow part of the EU reform. The single rulebook applies to every obliged entity in the EU, including the subsidiaries of British groups, and the group-wide standards AMLA finalised in 2026 explicitly cover groups headed outside the Union.

Europe is replacing national rulebooks on a fixed timetable

The EU rulebook is arriving in pieces, and the pace has been steady. Szego told MEPs that AMLA has forty mandates to deliver under the single rulebook. Six draft instruments had been submitted to the European Commission by July 2026, with eleven more planned for that year and fourteen in 2027. She was also candid that the state of convergence across Member States is low, particularly in the non-financial sector.

The most important instruments for technology teams have now landed. On 1 October 2026 AMLA announced it had finalised three sets of regulatory technical standards for the private sector, covering customer due diligence, the line between business relationships and occasional transactions, and group-wide arrangements. The customer due diligence standard sets out the information firms must collect and verify, including non-face-to-face verification, electronic identification and screening of politically exposed persons. Once adopted and published in the Official Journal, the standards are proposed to apply six months after entry into force.

The programming document also shows where the EU regulation's own clock sits. It notes that Article 75 of the Anti-Money Laundering Regulation, on partnerships for information sharing, becomes applicable on 10 July 2027, and that AMLA will monitor implementation of the current framework until the end of June 2027 before turning to the new one. AMLA also plans a central AML database to be fully operational in 2027 and is building a risk assessment model to select firms, which it is now testing on real data.

Group-wide rules will reach British head offices through their EU entities

This is the part of the reform that most directly touches British groups. AMLA's factsheet on group-wide minimum requirements says a parent undertaking in the Union must be identified where a group has at least two obliged entities in the EU that are not in a parent and subsidiary relationship, including where they belong to a head office in a third country. Britain is a third country for these purposes.

That EU parent must maintain a group-wide framework covering governance, a group-wide risk assessment across all entities, activities and jurisdictions, consistent policies, information sharing, training and remediation of weaknesses. The factsheet lists the information entities may share: customer and beneficial ownership information, customer due diligence information, transaction information and risk assessment findings. Sharing must follow a need-to-know principle, comply with data protection rules, use secure channels and be documented.

A companion factsheet on legal impediments in third countries covers the reverse case, an EU group with branches or subsidiaries outside the Union, which includes many with British operations. Where third-country law restricts customer due diligence, information sharing or record-keeping, the group must notify the supervisor, seek customer consent where possible and apply additional measures. Where risks remain, the factsheet lists terminating relationships, refusing transactions or closing operations in the third country.

Either way, the EU entity will be asked to show what customer and transaction data flows between British and EU entities, on what basis, and how it is controlled. Groups running separate country systems will struggle to answer that cleanly.

Britain is re-platforming its own supervision at the same time

The UK side is moving too. In its response on reforming AML supervision, updated on 21 October 2025, HM Treasury confirmed that the FCA will become the single professional services supervisor. The response says there are 23 different supervisors for professional services firms, which inevitably leads to inconsistencies. Firms supervised by professional bodies, and accountancy service providers and trust and company service providers supervised by HMRC, will move to the FCA.

The timing is genuinely uncertain. HM Treasury says implementation depends on enabling legislation, funding and a detailed transition plan, and that the start date will be heavily dependent on parliamentary time. It also says the FCA will receive funding to hire staff and invest in new technology for the role.

Meanwhile the 2026 amendment regulations are already changing what firms' systems must calculate. HM Treasury's policy note on the draft regulations, published in 2025, described the aim as a more risk-based and proportionate regime, and explained that converting thresholds to sterling reflects UK market practice after EU exit. Most of the final instrument came into force 21 days after it was made, with some provisions on cryptoasset businesses and correspondent relationships starting on 1 February 2027. So British compliance technology is being rewritten on one timetable while European subsidiaries prepare for another.

What one data model means in practice

I am not arguing for one global rule set. I am arguing for one set of definitions. A customer, a beneficial owner, a legal entity, an account, a transaction, a risk rating and a due diligence record should mean the same thing in the UK and EU entities, sit in the same schema and carry the same identifiers. The differences between regimes then become parameters: the £12,000 or 15,000 euro occasional transaction trigger, the country list that drives enhanced due diligence, the verification methods each regime accepts.

The payoff shows up in three places. Group-wide risk assessment becomes a query rather than a reconciliation exercise across incompatible systems. Information sharing between the UK and EU entities can be controlled field by field, which is what the need-to-know and documentation duties in AMLA's group-wide standard require. And when either regime changes a threshold or a list, as the UK did in June 2026, the change is a configuration release rather than a code change in several systems.

There is a cost, and I would not hide it. Migrating historical customer files into a common schema is slow, and the AMLA standards are still drafts the Commission can amend. But firms will have to touch these systems anyway to meet the EU customer due diligence standard and the UK's new thresholds. Doing the work once, on one model, is cheaper than doing it twice.

What is still uncertain

Three things could change the picture. The Commission can still amend AMLA's final draft standards before adoption, and their application date depends on when that happens. AMLA's selection methodology is still being calibrated, so no group can yet be certain whether it will be among the forty. And the date on which the FCA takes over professional services supervision rests on legislation that has not yet been passed.

None of these uncertainties argues for waiting. Each one is about the rules that will sit on top of the data, not about the data itself. Whatever the final thresholds and lists, both regimes will want accurate customer, ownership and transaction records that can be explained and shared under control.

What I would do now as a CTO in a UK group with EU entities

First, map every system that holds customer due diligence, beneficial ownership, screening and transaction monitoring data across UK and EU entities, and record where definitions differ. Second, agree a common schema and identifier scheme, owned by one team, and make every new build and vendor integration conform to it.

Third, move regime-specific rules into configuration: thresholds by currency, country lists by source, and verification methods by jurisdiction, each with version history. Fourth, document UK to EU data flows now, with legal basis and access controls, so the EU parent can answer the group-wide questions AMLA's standards will raise. Fifth, write the AMLA and UK timetables into one programme plan, with July 2027 and 2028 on the same page as the FCA transition.

Europe is building one supervisor, and Britain is building a single professional services supervisor of its own. The groups that hold one clean picture of their customers will be ready for both.