AMLA Harmonises AML Enforcement Across the EU: Four Categories of Breaches

AMLA, the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism, has finalised its draft Regulatory Technical Standards (RTS) under Article 53(10) of Directive (EU) 2024/1640 (AMLD).

The standards decide how supervisors in every Member State will assess the gravity of AML breaches and set the level of fines. They are to apply from 10 July 2027 and cover not only banks, but also law firms, accountants, notaries, auditors and real estate agents.

New rules on the assessment of AML breaches and the imposition of penalties

The RTS replace divergent national practices with one common assessment framework:

• a single list of gravity indicators: duration, repetition, the conduct of the person responsible, impact on customers and on ML/TF risk exposure, the nature of the breach (internal procedures, customer due diligence, reporting, record retention) and structural failures in the AML framework;
• four categories of gravity, from category one (no or minor impact, short-lived, non-repetitive) to category four (very significant impact, structural failure, breach facilitating crime);
• categories three and four count as “serious, repeated or systematic” breaches within the meaning of Article 55(1) AMLD, which unlocks the most severe measures;
• mitigating and aggravating criteria – prompt self-reporting and effective remediation reduce the fine; concealment, intent, benefit derived, losses to third parties and previous breaches increase it;
• periodic penalty payments (PePPs) – set on a daily, weekly or monthly basis for the period of non-compliance with a supervisory measure, subject to a five-year limitation period for collection and to the right to be heard (up to four weeks for written submissions).

Who will be affected by the new rules? Obligated institutions and management staff

All obliged entities, in both the financial and the non-financial sector. This matters: 70% of respondents to AMLA’s consultation came from the non-financial sector, and the text was adjusted so that it also works for small firms and sole practitioners. Football clubs and football agents will be covered from 10 July 2029.

Board members should note that the RTS set separate criteria for natural persons who are not obliged entities themselves, including senior management and the management body in its supervisory function. Supervisors will look at their actual responsibilities, involvement in the breach and income.

How can you prepare your business for the new AML rules? Key steps

• map the indicators onto your AML risk register and check which current gaps would already fall into category three or four;
• close ongoing breaches – duration and repetition alone can push a breach into a higher category;
• document remedial actions, as mitigation will not be granted without evidence;
• set a clear cooperation channel with the Polish General Inspector of Financial Information (GIIF) and the Polish Financial Supervision Authority (KNF);
• clarify AML responsibilities within the management board and the scope of your AML Officer’s duties;
• train your team and update customer due diligence, reporting and record-retention procedures.

How can an organisation prepare for the new requirements?

The new AML regime may result not only in heavy fines, but also in restrictions on business activities, the loss of a licence or interference in the management structure. It is therefore advisable to review procedures, the allocation of responsibilities and the response to breaches well in advance.

Our team supports companies and law firms with AML audits, adapting procedures, clarifying responsibilities within the board, and representing clients before the GIIF. Please contact us to identify which areas of your organisation require the most urgent action. For a broader overview, see our guide to Anti-Money Laundering (AML) Compliance in Poland.