AMLA ¦ AMLA finalises standards on Home-Host Supervisory Cooperation

AMLA sets common rules for home and host supervisors of cross-border groups

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has published final draft regulatory technical standards (RTS) on cooperation between home and host supervisors of cross-border groups. Adopted under the Anti-Money Laundering Directive (AMLD), Directive (EU) 2024/1640, the standards define who does what when supervisory responsibility for a group is split between several Member States, and how information moves between the authorities involved. Once adopted by the European Commission, they will apply directly and bind supervisors in every Member State without national transposition.

Why split responsibility creates risk

A group that operates through establishments in several Member States is supervised by more than one authority. The home supervisor oversees the group from the Member State where it is headquartered or authorised. Host supervisors oversee the establishments on their territory, so each authority sees only part of the group.

Laundering schemes exploit that split. Funds can pass through establishments in several countries while each supervisor follows only the activity in its own jurisdiction. Where supervisors do not exchange findings promptly, weaknesses in the group’s controls may go unaddressed for years. Several of the large European banking cases of the past decade followed that pattern, with suspicious flows through foreign branches going undetected by authorities that had no full view of the group.

The standards apply to supervisors of cross-border groups in both the financial and the non-financial sector, giving the same baseline to authorities overseeing banks, payment institutions, investment firms and insurers as to those overseeing professions and other non-financial obliged entities.

Bastian Schwind-Wagner _Follow

"Cross-border groups have long benefited, intentionally or not, from the gaps between their supervisors. Allowing EU supervisors to pass information on without asking for consent first, and to run joint inquiries, removes much of the friction that kept findings in one country from reaching the authorities in another.

For group compliance functions, the message is consistency. What a branch tells its host supervisor and what the parent tells the home supervisor will be compared more often, so remediation plans and management information should tell the same story everywhere."

Defined roles for home and host

The RTS specifies the respective duties of home and host supervisors and the practical arrangements for day-to-day cooperation. Until now, the division of labour has rested largely on general principles in the directive, joint guidelines and bilateral memoranda of understanding, which has produced very different practices from one pair of authorities to the next.

A common allocation of tasks also makes supervision more predictable for obliged entities. A Luxembourg bank with branches elsewhere in the EU, or the Luxembourg branch of a group headquartered in another Member State, should be able to understand which authority leads on which questions and how findings in one jurisdiction will reach the other.

Information sharing without prior consent

The RTS introduces a simplified disclosure framework. It allows information received from one EU supervisor to be shared onward with other EU supervisors without first obtaining the consent of the authority that provided it.

Consent requirements have been a practical obstacle to supervisory cooperation. Each request for permission adds time, and in a cross-border case several authorities may need the same information at once. Removing that step within the EU supervisory community should speed up the exchange of findings on group-wide control weaknesses, high-risk customers and suspicious patterns, while the confidentiality obligations that bind supervisors continue to apply.

For obliged entities, information provided to one supervisor, including inspection findings and remediation commitments, can travel more easily to the others overseeing the group. Inconsistent explanations to different authorities will be harder to maintain.

Cross-border inquiries and coordinated supervision

The standards also allow home and host supervisors to conduct cross-border inquiries and to coordinate their supervisory approaches. In practice, this means one authority can ask another to obtain information or carry out checks on its behalf, and authorities can align their supervisory plans for a group so that the same issues are not examined separately at different times.

Coordinated supervision reduces duplication for groups, which often face overlapping requests from several authorities. It also lets supervisors concentrate on the parts of a group where the money laundering and terrorist financing risk is highest.

Proportionality built into the process

AMLA describes the framework as simple, proportionate and efficient. Supervisors are expected to check the data already available to them before requesting information from a counterpart, which keeps requests targeted. At the same time, they are expected to share relevant information proactively, in line with a risk-based approach, without waiting to be asked.

Proactive sharing means that a host supervisor learns of serious deficiencies identified by the home supervisor, and vice versa. The obligation to check existing data first keeps the system from producing a flood of routine requests.

What changes for Luxembourg

Luxembourg is home to a large number of branches and subsidiaries of foreign groups and to groups that operate across the EU from the Grand Duchy. The Commission de Surveillance du Secteur Financier (CSSF) and the other national supervisors therefore act in both roles, as home supervisor for groups based in Luxembourg and as host supervisor for establishments of groups based elsewhere.

For obliged entities, the main practical effect is that supervisory information will circulate more freely and more consistently across the group’s supervisors. Group compliance functions should expect findings from one jurisdiction to feature in discussions with another, and should make sure that their remediation plans, management information and responses to supervisors are consistent across all the Member States in which they operate.

The standards sit alongside AMLA’s own role. For the selected groups it will supervise directly from 2028, AMLA itself becomes the lead supervisor. For the far larger number of groups that remain under national supervision, cooperation between home and host authorities will continue to determine how effective AML/CFT oversight is across borders.

Dive deeper

• AMLA ¦ Press Release – AMLA finalises standards on Home-Host Supervisory Cooperation (pdf) ¦ Link