MOST READ OF 2025: Has Revolut put itself top of the pile for direct supervision by AMLA after €3.5 million fine in Lithuania?

By STEPHEN RAE for AML Intelligence

• This article was originally published on September 4, 2025, and is re-published as part of AML Intelligence’s ‘Most Read of 2025’ series

THIS WEEK’s decision by the Lithuanian Central Bank to fine Revolut €3.5 million for FCC failings may have also have put the fintech on the list of those most likely to face direct supervision by AMLA.

The Anti-Money Laundering Authority (AMLA) will very soon be looking at Europe’s 40 most high-risk obliged entities that it will supervise directly from Frankfurt.

Given Revolut’s major transnational footprint and now a fine for ongoing AML failings, the fintech founded by Nik Storonsky has suddenly emerged as a contender for direct supervision. The fact the bank is based in the UK but with a banking licence in Lithuania also means the fintech is likely to come under more scrutiny.

The 40 institutions selected for supervision from Frankfurt will face more intensive oversight by AMLA, as the EU steps up its enforcement in the fight against financial crime.

So how will AMLA decide on the 40 “high risk” entities it will directly supervise. Articles 12–14 of the EU legislation, dictate that selection will be based on a multi-factor risk assessment. This involves combining internal benchmarks, sectoral data, and national-level indicators.

Choosing the 40 Entities

• Only entities whose residual risk is ultimately classified as high may qualify for selection.
• If more than 40 entities meet this threshold, AMLA will coordinate with national supervisors to limit the number, taking into account capacity and resourcing.
• Priority will be given to entities operating in Member States with the highest volume of transactions involving third countries.
• Cross-border impact and systemic importance will be considered.

The 40 chosen entities can span a range of categories, including:

• Credit institutions (banks)
• Crypto-asset service providers
• Payment institutions
• Collective investment undertakings
• Life insurance companies and intermediaries
• Investment firms
• Bureaux de change and other financial institutions

Key Selection Criteria and Process:

Under Article 12, AMLA will perform a periodic assessment—in collaboration with national financial supervisors—across at least six Member States, regardless of whether activities are conducted remotely or via physical presence.

Risk Profile Methodology:

Entities will be classified by AMLA as having a low, medium, substantial, or high risk profile based on two dimensions:

1. Inherent Risk – linked to customers, products, services, transactions, and delivery channels
2. Residual Risk – linked to effectiveness of internal controls and risk mitigation measures

Benchmarks used will include:

• Share of non-resident or high-risk third-country clients (including PEPs)
• Volume of high-risk transactions or services
• Degree of anonymity and privacy provided (e.g. crypto)
• Geographic exposure (cross-border transactions, offshore linkages)
• Engagement in correspondent banking or crypto-asset services

Article 14: Exceptional Cases

In exceptional circumstances, AMLA may assume direct supervision of a non-selected entity upon request by a national financial supervisor. This will be allowed when:

• There is a specific AML/CFT failure or risk event
• Shadow banking or sanctions evasion risk is identified
• The supervisor provides a detailed risk case, transfer timeline, and relevant data

Timeline

• AMLA’s first selection process is set to commence by July 1, 2027
• A new list of directly supervised entities will be published periodically
• The Authority is required to notify all selected entities and national authorities in advance

Strategic Impact

This new supervisory approach reflects the EU’s commitment to a more risk-based and intelligence-led AML regime, ensuring supervisory intensity is proportionate to threat exposure, the legislation says.

It marks a shift toward greater centralisation of AML enforcement at the EU level, with AMLA playing an active operational role, particularly in banking and crypto.

The AML community will now look toward the upcoming draft regulatory technical standards—due by January 2026—for more detail on how benchmarks will be applied in practice.