Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 (Text with EEA relevance)

The Authority’s accounting officer shall send the provisional accounts for the financial year (year N) to the Commission’s accounting officer and to the Court of Auditors by 1 March of the following year (year N+1).

By 31 March of year N+1, the Authority shall send the annual report on its budgetary and financial management to the European Parliament, the Council and the Court of Auditors.

By 31 March of year N+1, the Commission’s accounting officer shall send the Authority’s provisional accounts, consolidated with the Commission’s accounts, to the Court of Auditors.

On receipt of the Court of Auditors’ observations on the Authority’s provisional accounts pursuant to Article 246 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council ([^E0015]), the Executive Board shall deliver an opinion on the Authority’s final accounts.

The Authority’s accounting officer shall, by 1 July of year N+1, send the final accounts, to the European Parliament, the Council, the Commission and the Court of Auditors, together with the Executive Board’s opinion.

A link to the pages of the website containing the final accounts of the Authority shall be published in the Official Journal of the European Union by 15 November of year N+1.

The Executive Director shall submit to the European Parliament, at the request of the European Parliament, any information required for the smooth application of the discharge procedure for the financial year concerned, in accordance with Article 261(3) of Regulation (EU, Euratom) 2018/1046.

On a recommendation from the Council acting by a qualified majority, the European Parliament shall, before 15 May of year N+2, give a discharge to the Executive Director in respect of the implementation of the budget for year N.

For the purposes of combating fraud, corruption and any other illegal activity, Regulation (EU, Euratom) No 883/2013 as well as Article 86 of Delegated Regulation (EU) 2019/715 shall apply to the Authority without any restriction.

The Authority shall accede to the Interinstitutional Agreement of 25 May 1999 between the European Parliament, the Council and the Commission concerning internal investigations by the European Anti-fraud Office (OLAF) ([^E0016]) and shall immediately adopt appropriate provisions for all staff of the Authority.

The funding decisions, the agreements and the implementing instruments resulting from them shall expressly provide that the Court of Auditors and OLAF may, where necessary, carry out on-the-spot checks on the beneficiaries of monies disbursed by the Authority.

The Authority shall establish an internal IT governance at the level of the Executive Director which establishes and manages the IT budget and ensures regular reporting to the Executive Board on compliance with applicable IT security rules and standards.

The Authority shall ensure that a sufficient share of its IT expenditure is transparently allocated to direct IT security. The contribution to the Cybersecurity Service for the Union institutions, bodies, offices and agencies (CERT-EU) may be counted in that share.

An adequate IT security monitoring, detection and response service shall be established, using the services of CERT-EU. Major incidents shall be reported to CERT-EU and to the Commission within 24 hours of detection.

The Authority shall be accountable to the European Parliament and to the Council for the implementation of this Regulation.

The Authority shall submit on an annual basis to the European Parliament, to the Council and to the Commission a report on the execution of the tasks conferred on it by this Regulation, including information on the planned evolution of the structure and amount of the supervisory fees referred to in Article 77. With respect to the guidelines and recommendations that the Authority has issued in accordance with Article 54, the report shall contain information on compliance with the guidelines and recommendations issued over the year covered by the report as well as any relevant updates on compliance with previously issued guidelines and recommendations. The report shall be made public and shall include any other relevant information requested by the European Parliament on an ad hoc basis. The Chair of the Authority shall present that report in public to the European Parliament.

At the request of the European Parliament, the Chair of the Authority shall participate in a hearing on the execution of its tasks by the competent committees of the European Parliament. A hearing shall take place at least annually. At the request of the European Parliament, the Chair of the Authority shall make a statement before the relevant committees of the European Parliament and answer any questions from their members, whenever so requested.

Within six weeks of each meeting of the General Board, the Authority shall at least provide the European Parliament with a comprehensive and meaningful record of the proceedings of that meeting that enables an understanding of the discussions held within that meeting, including an annotated list of decisions. Such record shall not reflect discussions within the General Board relating to individual obliged entities or discussions relating to confidential supervisory or FIU-related data, unless otherwise provided for in the legislative acts referred to in Article 1(2).

The Authority shall reply orally or in writing to questions put to it by the European Parliament within five weeks of their receipt.

Upon request, the Chair of the Authority shall hold confidential oral discussions behind closed doors with the competent committees of the European Parliament, where such discussions are required for the exercise of the European Parliament’s powers under the Treaties. All participants shall respect the requirements of professional secrecy.

When informing the European Parliament on matters pertaining to the Authorities’ contribution to the action of the Union in international fora, the Authority shall not disclose any information it received in the performance of that task where such information is subject to confidentiality requirements imposed by third parties.

The Staff Regulations and the Conditions of Employment of Other Servants as well as the rules adopted by agreement between the institutions of the Union for giving effect to those Staff Regulations and Conditions of Employment of Other Servants shall apply to the staff of the Authority for all matters not covered by this Regulation.

By way of derogation from paragraph 1 of this Article, the Chair of the Authority and the Executive Board members referred to in Article 63(1), point (b), shall be on a par with, respectively, a Member and the Registrar of the General Court regarding emoluments and pensionable age, as defined in Council Regulation (EU) 2016/300 ([^E0017]). For aspects not covered by this Regulation or by Regulation (EU) 2016/300, the Staff Regulations and the Conditions of Employment of Other Servants shall apply by analogy.

The Executive Board, in agreement with the Commission, shall adopt the necessary implementing measures in accordance with the arrangements provided for in Article 110 of the Staff Regulations.

The Authority may make use of seconded national experts or other staff not employed by the Authority including FIU delegates.

The Executive Board shall adopt rules regarding staff from Member States to be seconded to the Authority and update them as necessary. Those rules shall include, in particular, the financial arrangements related to those secondments, including insurance and training. Those rules shall take into account the fact that the members of staff are seconded and are to be deployed as staff of the Authority. They shall include provisions on the conditions of deployment. Where relevant, the Executive Board shall aim to ensure consistency with the rules applicable to reimbursement of the mission expenses of the statutory staff.

Members of the General Board and the Executive Board, and all members of staff of the Authority, including officials seconded by Member States on a temporary basis, as well as all other persons carrying out tasks for the Authority on a contractual basis, shall be subject to the requirements of professional secrecy pursuant to Article 339 TFEU and Article 67 of Directive (EU) 2024/1640, including after their duties have ceased.

The Executive Board shall ensure that individuals who provide any service, directly or indirectly, permanently or occasionally, relating to the tasks of the Authority, including officials and other persons authorised by the Executive Board or appointed by the public authorities and FIUs for that purpose, are subject to requirements of professional secrecy equivalent to those provided for in paragraph 1.

For the purpose of carrying out the tasks conferred on it by this Regulation, the Authority shall be authorised, within the limits and under the conditions set out in the acts referred to in Article 1(2), to exchange information with Union or national authorities and bodies in the cases where those acts allow financial supervisors to disclose information to those entities or where Member States can provide for such disclosure under the applicable Union law.

The Authority shall establish practical arrangements for implementing the confidentiality rules referred to in paragraphs 1 and 2.

The Authority shall apply Commission Decision (EU, Euratom) 2015/444 ([^E0018]).

The Authority shall adopt its own security rules equivalent to the Commission’s security rules for protecting European Union Classified Information (EUCI) and sensitive non-classified information, as set out in Commission Decision (EU, Euratom) 2015/443 ([^E0019]) and Decision (EU, Euratom) 2015/444. The security rules of the Authority shall cover, inter alia, provisions for the exchange, processing and storage of such information. The Executive Board shall adopt the Authority’s security rules following approval by the Commission.

Any administrative arrangement on the exchange of classified information with the relevant authorities of a third country or, in the absence of such arrangement, any exceptional ad hoc release of EUCI to those authorities, shall be subject to the Commission’s prior approval.

The Authority shall have in place dedicated reporting channels for receiving and handling information provided by persons reporting actual or potential breaches of:

The persons reporting through those channels and the persons concerned shall enjoy the protection of Directive (EU) 2019/1937, where applicable.

Following the submission of reports pursuant to Article 60(4) of Directive (EU) 2024/1640 by supervisory authorities in the non-financial sector, the Authority shall be able to request additional information from those supervisory authorities on how they followed up on the reports received. Those supervisory authorities shall promptly provide the requested information but shall not disclose information that may lead to the identification of the reporting person.

The Authority shall establish and maintain close cooperation with the ESAs, in particular when developing draft regulatory or implementing technical standards, guidelines or recommendations within the remit of their respective tasks.

By 27 June 2025, the Authority shall conclude a memorandum of understanding with the ESAs setting out how they intend to cooperate in the performance of their tasks under Union law.

The Authority shall cooperate and exchange information with non-AML/CFT authorities and, on a need-to-know and confidential basis, with other national authorities and bodies competent for ensuring compliance with Directives 2009/110/EC, 2009/138/EC, 2014/17/EU, 2014/65/EU and (EU) 2015/2366, and with the ESAs, within the boundaries of their respective mandates.

The Authority shall conclude a memorandum of understanding with the prudential authorities as defined in Article 4(1), point (40), of Regulation (EU) No 575/2013, the ESAs and the other national authorities competent for ensuring compliance with Regulation (EU) 2023/1114, setting out in general terms how they will cooperate and exchange information in the performance of their supervisory tasks under Union law in relation to selected and non-selected obliged entities.

By 27 June 2025, the Authority and the ECB shall conclude a memorandum of understanding setting out the practical modalities for cooperation and for exchanging information in the performance of their respective tasks under Union law.

The Authority shall ensure effective cooperation and information exchange between all supervisory authorities in the AML/CFT supervisory system and the relevant authorities and bodies referred to in paragraph 1, including with regard to access to any information and data in the central AML/CFT database referred to in Article 11.

The Authority shall share, on a regular or case-by-case basis, information that it obtained from obliged entities or the other authorities when carrying out its duties, and that stems from the application and implementation of Union law, with the other authorities upon request, provided that the requesting authority is entitled to obtain that information from obliged entities or the other authorities pursuant to Union law.

The Authority shall request information from any of the other authorities that have obtained that information, instead of requesting it directly from obliged entities, provided that the Authority is entitled to obtain that information pursuant to Union law.

A request to exchange information pursuant to paragraph 1 of this Article shall indicate the legal basis under Union law that entitles the requesting authority to obtain the information from obliged entities or the other authorities.

Where the Authority exchanges information pursuant to paragraph 1, it shall, without undue delay, inform each authority from which it obtained the information or each obliged entity if the information was obtained from obliged entities directly, about the exchange. In the case of recurring or periodic exchanges of information, the Authority shall be obliged to inform the obliged entity or the authority from which it obtained the information only once.

By way of derogation from paragraph 4, the Authority shall not be obliged to inform the authority or the obliged entity, as applicable, about the exchange of information where either of the following conditions is met:

By way of derogation from paragraph 4, the Authority shall not inform the obliged entity about the exchange of information if it determines, or is informed by the requesting authority, that doing so could compromise supervisory or resolution proceedings, actions or investigations.

Paragraphs 1 to 6 shall also apply to information that the Authority has received from an obliged entity or the other authorities and upon which the Authority has subsequently performed quality checks or which the Authority has otherwise processed.

To facilitate exchanges of information as referred to in paragraphs 1 to 7, the Authority and the other authorities may enter into memoranda of understanding regarding the arrangements for such exchanges. The memoranda of understanding may also specify arrangements for the sharing of resources for the collection and processing of shared information. The Commission may after consulting the Authority and the other authorities, develop guidance on the main elements of such memoranda of understanding.

Paragraphs 1 to 8 shall be without prejudice to the protection of intellectual property rights and shall not prevent or restrict the exchange of information between the Authority and the other authorities in accordance with other provisions of this Regulation or with other Union legislation.

The Authority and the financial supervisors may, at their own discretion, grant access to information obtained when carrying out their duties for re-use by obliged entities, researchers and other entities that have a legitimate interest in that information for research and innovation purposes, provided that the Authority or the financial supervisors granting access have ensured that all of the following conditions have been complied with:

By 11 November 2027, the Authority shall, in close cooperation with the financial supervisors, report to the Commission on all legal obstacles in sectoral legislation that prevent them, in any way, from exchanging information with the other authorities or with other entities. The report may also address non-material, obsolete, duplicative or otherwise irrelevant reporting requirements. It may also include suggestions for improving consistency between reporting requirements for financial and non-financial entities. The report shall be updated on a regular basis, where necessary.

For the purposes of this Article, “other authorities” means any of the following authorities:

Where relevant for the fulfilment of the tasks referred to in Chapter II, the Authority may set up cross-border partnerships for information sharing, in accordance with fundamental rights and judicial procedural safeguards, or participate in partnerships for information sharing established in one or across several Member States with the objective of supporting the prevention and combating of money laundering, its predicate offences and terrorist financing. Participation of the Authority in an already existing partnership shall be subject to the agreement of the authorities that have established such a partnership.

Where the Authority sets up a cross-border partnership for information sharing, it shall ensure that the partnership complies with the requirements of Article 75(3), (4) and (5) of Regulation (EU) 2024/1624. In addition to obliged entities, the Authority may invite the competent authorities referred to in Article 2(1), point (44), points (a), (b) and (c), of that Regulation, as well as Union bodies, offices and agencies which have a role in the prevention and combating of money laundering, its predicate offences and terrorist financing, to take part in the partnership, where such participation is relevant for the fulfilment of their tasks and powers. Upon the unanimous consent of the participating members, other third parties may be invited to participate, on an occasional basis, in meetings of the partnership, where relevant.

The Authority may conclude working arrangements with Union institutions, Union decentralised agencies and other Union bodies, acting in the field of law enforcement and judicial cooperation. Those working arrangements may be of a strategic, operational or technical nature, and shall in particular aim to facilitate cooperation and the exchange of information between the parties thereto. The working arrangements shall neither form the basis for allowing the exchange of personal data nor bind the Union or its Member States.

The Authority shall establish and maintain a close relationship with OLAF, Europol, Eurojust, and the EPPO. To that end, the Authority shall conclude separate working arrangements with OLAF, Europol, Eurojust and the EPPO setting out the details of their cooperation. The relationship shall aim in particular to ensure the exchange of operational and strategic information and trends in relation to ML/TF threats facing the Union.

In order to promote and facilitate smooth cooperation between the Authority and Europol, Eurojust and the EPPO, the working arrangements with them shall in particular provide for the possibility of posting liaison officers at each other’s premises, and lay down conditions to that end.

In order to achieve the objectives set out in this Regulation, and without prejudice to the respective competences of the Member States and the Union institutions, the Authority may develop contacts and enter into administrative arrangements with AML/CFT authorities in third countries that have regulatory, supervisory and FIU-related competences in the field of AML/CFT as well as with international organisations and third-country administrations. Those arrangements shall not create legal obligations in respect of the Union and its Member States nor shall they prevent Member States and their competent authorities from concluding bilateral or multilateral arrangements with those third countries.

The Authority may develop model administrative arrangements with a view to establishing consistent, efficient and effective practices within the Union and to strengthening international coordination and cooperation in the fight against ML/TF. Supervisory authorities and FIUs shall make every effort to follow such model arrangements.

In cases where the interaction between, on the one hand, several Union supervisory authorities and FIUs with, on the other hand, third-country authorities, concerns matters falling within the scope of the Authority’s tasks as set out in Article 5, the Authority shall have a leading role in facilitating such interaction where necessary. That role of the Authority shall be without prejudice to regular interactions by supervisory authorities and FIUs with third-country authorities.

The Authority shall, within its powers pursuant to this Regulation and to the legislative acts referred to in Article 1(2), contribute to the united, common, consistent and effective representation of the Union’s interests in international fora, including by assisting the Commission in its tasks relating to the Commission’s membership of the Financial Action Task Force and by supporting the work and objectives of the Egmont Group of Financial Intelligence Units.

Regulation (EC) No 1049/2001 shall apply to documents held by the Authority.

Decisions taken by the Authority under Article 8 of Regulation (EC) No 1049/2001 may be the subject of a complaint to the European Ombudsman or of an action before the Court of Justice of the European Union, under the conditions laid down in Articles 228 and 263 TFEU, respectively.

The right of access to documents shall not apply to confidential information comprising:

The confidential information referred to in paragraph 3, point (a), that relates to a supervisory procedure may be fully or partially disclosed to the obliged entities which are parties to that supervisory procedure, subject to the legitimate interest of other persons in the protection of their business secrets. That access shall not extend to internal documents of the Authority, financial supervisors, or correspondence between them.

The Executive Board shall adopt practical measures for applying Regulation (EC) No 1049/2001 and the rules regarding disclosure of information relating to supervisory procedures.

Council Regulation No 1 shall apply to the Authority.

The Executive Board shall decide on the internal language arrangements for the Authority, which shall be consistent with the language arrangements in direct supervision, adopted pursuant to Article 29.

Translation and all other linguistic services required by the Authority, other than interpretation, shall be provided by the Translation Centre for the Bodies of the European Union, as established by Council Regulation (EC) No 2965/94 ([^E0022]).

The processing of personal data on the basis of this Regulation for the purposes of ML/TF prevention as referred to in Article 70 of Directive (EU) 2024/1640 and Article 76 of Regulation (EU) 2024/1624 shall be considered necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Authority under Article 5 of Regulation (EU) 2018/1725 and Article 6 of Regulation (EU) 2016/679.

In accordance with Article 25 of Regulation (EU) 2018/1725, the Authority shall be permitted to adopt internal rules which restrict the application of the rights of data subjects where such restrictions are necessary to the performance of the tasks referred in Article 70 of Directive (EU) 2024/1640 and Article 76 of Regulation (EU) 2024/1624.

In the case of non-contractual liability, the Authority shall, in accordance with the general principles common to the laws of Member States, make good any damage caused by it or by its staff in the performance of their duties. The Court of Justice of the European Union shall have jurisdiction in any dispute over the remedying of such damage.

The personal financial liability and disciplinary liability of the Authority’s staff towards the Authority shall be governed by the relevant provisions applying to the staff of the Authority.

The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

The power to adopt delegated acts referred to in Articles 27 and 77 shall be conferred on the Commission for an indeterminate period of time from 27 December 2024.

The delegation of power referred to in Articles 27 and 77 may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.

As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

A delegated act adopted pursuant to Article 27 shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.

A delegated act adopted pursuant to Article 77 shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

The necessary arrangements concerning the accommodation to be provided for the Authority in the Member State where its seat is located and the facilities to be made available by that Member State, as well as the specific rules applicable in that Member State to the staff of the Authority and members of their families, shall be laid down in a Headquarters Agreement to be concluded between the Authority and that Member State after obtaining the approval of the Executive Board.

The Member State where the seat is located shall provide the best possible conditions to ensure the proper functioning of the Authority, including multilingual, European-oriented schooling and appropriate transport connections.

By 31 December 2030, and every five years thereafter, the Commission shall draw up a report on the Authority’s performance in relation to its objectives, mandate, tasks and location, in accordance with the Commission’s guidelines. That report shall, in particular, address:

The report referred to in paragraph 1 shall also examine whether:

In every second report, the Commission shall conduct a thorough review of the results achieved by the Authority having regard to its objectives, mandate, tasks and powers, including an assessment of whether the continuation of the Authority is still justified with regard to these objectives, mandate and tasks.

The report and any accompanying proposals, as appropriate, shall be forwarded to the European Parliament and to the Council.

Until 27 June 2028, Article 11 shall only apply to financial supervisors, credit institutions and financial institutions. However, supervisory authorities in the non-financial sector may on a voluntary basis already comply with the requirements of that Article before that date.

By way of derogation from Article 13(2), where, during the first selection process, more than 40 obliged entities would qualify for direct supervision pursuant to Article 13(1), the Authority shall carry out the tasks listed in Article 5(2) in respect of the 40 obliged entities or groups operating in the highest number of Member States whether through establishments or under the freedom to provide services.

By way of derogation from Article 13(3), the additional selection process set out therein shall not apply during the first selection process.

By way of derogation from Article 48(7), the participation of FIUs in peer reviews shall be voluntary during the first two peer review processes.