Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Financial Integrity Monitor

European Economic Area EEA

Domains (D1–D6)

Sources

Role actions

Jurisdiction profile

CleanTier ARisk: IncreasingMixed

EU AML architecture is mid-transition: AMLR (Reg 2024/1624) becomes the directly-applicable single rulebook from 10 July 2027, 6AMLD (Dir 2024/1640) is under national transposition, and AMLA (Reg 2024/1620) began operations mid-2025 in Frankfurt, building toward direct CASP/bank supervision from 2028.

Sanctions architecture (19th/20th Russia packages) is aggressive but BO transparency was rolled back by the 2022 Sovim ruling and CASP supervision remains nationally fragmented pending AMLR application.

Key deficiencies

Beneficial ownership register public access remains restricted EU-wide since the CJEU Sovim/WM ruling (Nov 2022); BORIS interconnection cannot provide public access, undermining D2 transparency
Bulgaria, an EU/EEA member state, remains on the FATF Jurisdictions Under Increased Monitoring ('grey') list pending on-site verification as of the June 2026 Plenary
No formal operational information-exchange interface exists between Europol and AMLA, fragmenting the EU financial intelligence landscape
Divergent national implementation of MiCA/CASP AML supervision creates 'jurisdiction shopping' risk flagged by France's AMF, Austria's FMA and Italy's CONSOB
AMLA direct supervision of high-risk obliged entities (including crypto) does not begin until 2028, leaving a multi-year gap during which national supervisors retain primary responsibility despite acknowledged inconsistency

Recent developments (18m)

AMLA began operations mid-2025 in Frankfurt; Bruna Szego appointed first Chair; staff reached ~120 by end-2025
European Commission added Russia to the EU list of high-risk third countries for AML/CFT (Delegated Regulation (EU) 2026/46, 3 Dec 2025)
EU 19th sanctions package (23 Oct 2025) sanctioned the A7A5 ruble-backed stablecoin ecosystem, its developer, Kyrgyz issuer and trading platform, plus five additional Russian banks and third-country banks/oil traders
EU 20th sanctions package (23 Apr 2026, crypto provisions effective 24 May 2026) imposed a sector-wide transaction ban on Russian- and Belarusian-established crypto-asset service providers and activated the anti-circumvention tool against an entire jurisdiction for the first time
EBA's fifth biennial ML/TF risk assessment flagged a 2.5-fold increase in authorised CASPs in the EU between 2022 and 2024 alongside persistent AML/CFT control weaknesses
FATF June 2026 Plenary made an initial determination that Bulgaria has substantially completed its action plan, pending an on-site verification visit before delisting

Member jurisdictions

This page covers law made at European Economic Area level once. Each member’s page covers implementation, national authorities, national options and local enforcement (30 of 30 members covered here).

Brief

Lead signal

Lead Signal

Read full brief

Lead Signal

The European Economic Area's sanctions architecture against Russia continued to expand this cycle on two parallel tracks. The Council of the European Union agreed, on 8 October 2026, to prolong the EU's hybrid-threats and foreign information manipulation and interference (FIMI) sanctions regime by one year, extending it to 9 October 2027. This regime is distinct from, and runs parallel to, the EU's main Russia country-sanctions architecture, giving the bloc two live legal bases for designations touching the same underlying conduct. Separately, COREPER agreed on 7 October 2026 to a 22nd EU sanctions package against Russia comprising 1,646 new listings: 743 individuals, 826 entities, and 77 officials tied to elections in occupied Ukrainian territory. Formal Council adoption is scheduled for 12 October 2026; as of this cycle's close the package has not yet taken legal effect, and reporting on its scope rests on diplomatic and press sourcing rather than a published Council instrument, which caps the finding at probable rather than confirmed.

Other Developments

AMLA's first Level-2 technical standards. The EU Anti-Money Laundering Authority finalised and submitted to the European Commission, on 1 October 2026, its first three Level-2 regulatory technical standards under the AML Regulation: standards covering customer due diligence and PEP screening, business relationships and linked transactions, and group-wide AML/CFT controls. The standards are proposed to apply six months after entry into force, though no fixed Commission adoption date has been confirmed. The primary AMLA press materials were not retrieved directly this cycle, so the finding rests on consistent but non-primary commentary and is treated as probable pending a Tier-1 anchor.

EU AML Package build-out continues unevenly across instruments. The AML Regulation (Reg (EU) 2024/1624) remains on track to apply from 10 July 2027. The sixth Anti-Money Laundering Directive is transposing on a staggered basis: as of the Commission's August 2026 monitoring, 23 Member States had communicated full first-tranche transposition, with infringement proceedings pending against the remaining ten. AMLA itself has been operational in Frankfurt since 1 July 2025 and is proceeding toward its first direct-supervision selection cycle, with eligibility data due 31 December 2026, selection finalised late 2027, and direct supervision of up to 40 entities beginning in 2028.

Non-uniform incorporation across the EEA-EFTA bloc. Liechtenstein is repealing its existing anti-money-laundering statute (the SPG) and enacting a new national AMLA-implementing Act, with a consultation report adopted 3 March 2026. Norway has incorporated the Markets in Crypto-Assets Regulation but extended its national licensing deadline to 30 June 2026. Iceland has not yet incorporated either the EU AML package or MiCA. The three EEA-EFTA states are moving at materially different speeds, and uniform EEA-wide application of the core EU AML architecture should not be assumed.

MiCA transitional period closed. The EU-wide Article 143 grandfathering period for pre-existing crypto-asset service providers ended fully on 1 July 2026. Only MiCA-authorised crypto-asset service providers may now market crypto services into the EU, and reverse solicitation cannot be relied upon where a firm pays influencers to reach EU customers. This is standing digital-asset-integrity baseline content rather than a new development this cycle, but it remains directly relevant to enabler-jurisdiction and evasion-pathway analysis given the EEA-EFTA incorporation gaps noted above.

Cross-Monitor Connections

The sanctions expansion and the EEA-EFTA incorporation gaps intersect directly with crypto and digital-asset monitoring: a jurisdiction inside the EEA that has not yet incorporated MiCA or the AML package presents a different enablement profile than one that has, and the Iceland gap in particular merits continued attention as a potential routing point. The AMLA build-out, including the Level-2 technical-standards submission and the move toward direct supervision from 2028, is architecture relevant to compliance-technology and active-defence monitoring, since obliged entities' control calibration will need to anticipate the forthcoming CDD, PEP-screening and group-wide-controls standards before they formally apply.

Outlook

The 22nd sanctions package is expected to receive formal Council adoption on 12 October 2026, after which its 1,646 listings become legally effective; confirmation of the final instrument will allow the designation count to move from probable to confirmed. The hybrid-threats regime renewal is now locked in through 9 October 2027. On the AML Package architecture, the near-term marker to watch is Commission adoption of AMLA's three submitted Level-2 technical standards, with application expected roughly six months after entry into force, as scheduled. Iceland's incorporation posture on both MiCA and the EU AML package remains the key EEA-EFTA structural gap to monitor going into the next cycle.

weekly_brief_draft · JID EEA

Domain intelligence (D1–D6)

D1 Sanctions Architecture and Evasion

Sanctions Architecture and Evasion

The EU's Russia sanctions architecture deepened on two parallel legal tracks this cycle. On 8 October 2026 the Council of the European Union prolonged the EU's hybrid-threats and foreign information manipulation and interference (FIMI) sanctions regime by one further year, extending its operation to 9 October 2027. This regime, grounded in a distinct Treaty basis from the EU's main Russia country-sanctions architecture, runs parallel to it rather than within it, meaning the bloc now holds two independent and simultaneously renewable legal bases capable of reaching overlapping conduct and overlapping targets. From a sanctions-architecture perspective, this dual-track structure is itself the more durable finding: a renewal decision of this kind extends institutional capacity and legal reach even in weeks where no new individual is designated under it.

Alongside the hybrid-threats renewal, COREPER reached political agreement on 7 October 2026 on a 22nd sanctions package against Russia, comprising 1,646 new listings: 743 individuals, 826 entities, and 77 officials connected to elections conducted in occupied Ukrainian territory. This is among the larger single-package designation volumes in the Russia sanctions programme's recent history. Formal Council adoption was scheduled for 12 October 2026, meaning the package had not yet entered into legal force as of this cycle's close. The designation figures currently rest on corroborating diplomatic and press reporting rather than a published Council legal instrument, and the finding is accordingly held at probable confidence rather than confirmed; a Tier-1 Council source is required before the designation count can be treated as settled.

Taken together, the renewal and the pending package illustrate a sanctions programme that is still in an expansionary phase on both its country-specific and its thematic tracks, with the thematic hybrid-threats track providing continuity of legal reach independent of any single package's adoption timetable. The practical consequence for screening programmes is that both tracks require separate monitoring: a sanctions-screening system calibrated only to the country-specific Russia regime risks missing designations made exclusively under the hybrid-threats/FIMI legal basis, and vice versa.

The EEA-EFTA incorporation picture is directly relevant to how this sanctions expansion interacts with crypto-asset and cross-border financial activity. Liechtenstein, Norway and Iceland sit outside the EU proper but inside the EEA, and their pace of incorporating EU-level financial-integrity instruments is uneven: Iceland in particular has not yet incorporated either the EU AML package or the Markets in Crypto-Assets Regulation. A sanctions-evasion architecture reading of this gap treats non-uniform incorporation as a structural enablement factor independent of any enforcement failure. No enforcement action need exist in Iceland for the gap to be analytically significant: the gap itself is the signal, and it should be read against the closure of the EU-wide MiCA grandfathering period on 1 July 2026, after which only MiCA-authorised providers may lawfully market crypto services into the EU. Where a jurisdiction has not incorporated MiCA, the degree to which EU-level crypto-asset controls actually bind within it is less certain, and that uncertainty itself has evasion-pathway relevance.

Outlook

Formal Council adoption of the 22nd package, scheduled for 12 October 2026, is the immediate confirmatory event to watch: its publication would move the designation count from probable to confirmed and would normally be accompanied by the underlying legal instrument naming each listed individual and entity. The hybrid-threats regime's renewal to 9 October 2027 is now settled and gives the EU a full additional year of operation under that legal basis regardless of the country-specific package's progress. On the EEA-EFTA side, Iceland's incorporation status on both MiCA and the EU AML package remains the key open structural question; any movement toward incorporation, or any further delay, would be material to the enabler-jurisdiction reading of the EEA bloc as a whole.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions and Professional Facilitators

Enabler Jurisdictions and Professional Facilitators

The EEA bloc's three EFTA members, Liechtenstein, Norway and Iceland, are incorporating core EU financial-integrity instruments at visibly different speeds this cycle, and the resulting divergence is itself the structural finding worth foregrounding under an enabler-jurisdiction lens. Liechtenstein is repealing its existing national anti-money-laundering statute, the SPG, and replacing it with a new national Act implementing the AMLA framework; a consultation report on that replacement was adopted 3 March 2026, putting Liechtenstein on an active, if not yet concluded, path toward alignment with the EU AML package. Norway has gone further on the crypto-asset side, having incorporated the Markets in Crypto-Assets Regulation, though it has extended its own national licensing deadline for crypto-asset service providers to 30 June 2026, giving domestic firms additional runway relative to the EU-wide timetable. Iceland, by contrast, has not yet incorporated either the EU AML package or MiCA at all.

An enabler-jurisdiction reading of this divergence does not require any enforcement failure or scandal to be analytically significant. The absence of incorporation is itself the signal: where an EEA state has not yet brought MiCA or the AML package into its domestic legal order, the degree to which EU-level crypto-asset-service and AML controls actually bind within that jurisdiction is less certain than it is elsewhere in the bloc, and that uncertainty is precisely the kind of structural gap that professional facilitators and intermediaries are positioned to exploit, irrespective of whether any specific instance of exploitation has yet been observed or prosecuted. This is architecture, not incident: the three jurisdictions are moving toward the same eventual destination, but at different speeds, and the gap between them is a live exposure for the period during which it persists.

This divergence sits against the backdrop of the EU-wide closure of the MiCA transitional period on 1 July 2026, after which only MiCA-authorised crypto-asset service providers may lawfully market services into the EU, and after which reverse solicitation can no longer be relied upon where a firm has paid an influencer to reach EU customers. A jurisdiction that has not incorporated MiCA at all, such as Iceland currently, sits in an ambiguous position relative to this EU-wide closure: the EU-level restriction binds providers seeking to serve EU customers, but the domestic licensing and supervisory apparatus that would normally accompany such a restriction is not yet in place locally. That combination, binding external restriction without matching domestic supervisory infrastructure, is a textbook enabler-jurisdiction configuration and merits continued monitoring independent of whether it produces an observable enforcement gap in the near term.

The broader EU AML Package architecture, meanwhile, continues its own staggered build-out: the sixth Anti-Money Laundering Directive's transposition shows 23 Member States having communicated full first-tranche transposition as of the Commission's August 2026 monitoring exercise, with infringement proceedings pending against the remaining ten. While this transposition data concerns EU Member States rather than the EFTA states discussed above, it illustrates that staggered, non-uniform implementation timelines are a feature of the EU AML architecture's rollout generally, not a phenomenon unique to the EEA-EFTA periphery; the EFTA divergence should be read as a more pronounced instance of a pattern that also exists, in milder form, within the EU itself.

Outlook

Iceland's incorporation status on both MiCA and the EU AML package is the single clearest marker to watch going into the next cycle: either instrument's domestic incorporation would narrow the structural gap described above, while continued non-incorporation would extend the window during which the gap persists. Liechtenstein's SPG-replacement process, having passed a consultation-report stage in March 2026, is a further marker worth tracking toward eventual enactment. Norway's extended crypto-licensing deadline of 30 June 2026 should by this point have passed, and confirmation of its domestic licensing outcomes, as scheduled, would close out that particular thread of the EEA-EFTA incorporation picture.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto / Digital Assets / Financial Innovation

Not covered

Crypto / Digital Assets / Financial Innovation is not yet covered for this jurisdiction in this report.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

AML/CTF Regime

The EU's Anti-Money Laundering Authority took a concrete regulatory-build-out step this cycle, finalising and submitting to the European Commission, on 1 October 2026, the first three Level-2 regulatory technical standards developed under the AML Regulation. The three standards cover customer due diligence and politically-exposed-person screening, the treatment of business relationships and linked transactions, and group-wide AML/CFT controls for firms operating across multiple entities or jurisdictions. The standards are proposed to apply six months after their entry into force, though no fixed Commission adoption date has yet been confirmed. This finding currently rests on consistent third-party commentary rather than a retrieved primary AMLA press release, and is accordingly held at probable rather than confirmed confidence pending direct corroboration from AMLA's own publication.

This submission sits within the broader architecture of the EU AML Package, which remains durably structured as three distinct instruments operating on different legal mechanics. The AML Regulation itself, Regulation (EU) 2024/1624, is directly applicable across the EU and remains on track to apply from 10 July 2027. The sixth Anti-Money Laundering Directive, by contrast, requires transposition into each Member State's own national law, and that transposition is proceeding on a staggered basis: the Commission's August 2026 monitoring exercise recorded 23 Member States as having communicated full first-tranche transposition, with infringement proceedings now pending against the remaining ten. The third instrument, the AMLA Regulation (Regulation (EU) 2024/1620), establishes the Anti-Money Laundering Authority itself, which has been operational in Frankfurt since 1 July 2025 and is now moving toward its first direct-supervision selection cycle: eligibility data is due by 31 December 2026, selection of the first cohort is to be finalised in late 2027, and direct supervision of up to 40 obliged entities is scheduled to begin in 2028.

The technical-standards submission is best read as an early procedural milestone within that longer supervisory transition. AMLA's direct-supervision mandate will depend on a body of Level-2 technical standards specifying exactly how customer due diligence, PEP screening, linked-transaction treatment and group-wide controls are to be assessed; the three standards submitted this cycle are the first tranche of that underlying rulebook, rather than the supervision itself. The shift they anticipate is a structural one: supervision of the highest-risk, cross-border obliged entities moving from purely national competent authorities toward a hybrid regime in which AMLA exercises direct or indirect oversight, with national authorities continuing to supervise the remainder of the obliged-entity population. That hybrid perimeter, not any single enforcement action, is the durable feature of the current AML/CTF regime architecture in the EEA.

The staggered 6AMLD transposition picture, with ten Member States still subject to infringement proceedings on first-tranche obligations as of August 2026, is a reminder that the AML Package's three instruments are not progressing in lockstep. A directly applicable Regulation such as the AMLR removes transposition risk by construction, whereas a Directive such as 6AMLD carries exactly the kind of implementation-timing divergence now visible across the ten Member States still in infringement proceedings. Firms operating across multiple EU Member States should expect the practical content of their AML/CTF obligations to vary somewhat by Member State for as long as 6AMLD transposition remains incomplete, even though the AMLR's directly applicable provisions will eventually apply uniformly from July 2027.

Outlook

The principal near-term marker is Commission adoption of the three submitted Level-2 technical standards; their application is proposed for six months after entry into force, as scheduled, though the Commission has not yet confirmed a fixed adoption date. Completion of 6AMLD transposition in the ten Member States currently subject to infringement proceedings is a second marker worth tracking, since it bears directly on how uniformly the AML Package applies across the bloc in the interim. Further out, the eligibility-data deadline of 31 December 2026 for AMLA's first direct-supervision selection cycle is the next scheduled structural milestone in the AML/CTF regime's build-out.

D8 Commercial Activity

Not covered

Commercial Activity is not yet covered for this jurisdiction in this report.

Regulatory horizon

No dated horizon items this cycle. 5 items tracked without a confirmed date.

5 pending date · baseline fim-2026-07-05

Role action cards

MLRO

Two parallel EU sanctions tracks (country-specific and hybrid-threats/FIMI) both moved this cycle, and a 22nd Russia package with 1,646 listings awaits formal adoption.

Screening programmes calibrated only to the country-specific Russia regime may miss designations made exclusively under the hybrid-threats/FIMI legal basis, now renewed to 9 October 2027. The pending 22nd package, once formally adopted on 12 October 2026, will require rapid list ingestion given its scale.

2 evidence refs

Compliance

AMLA submitted its first three Level-2 AMLR technical standards on CDD, PEP screening and group-wide controls, and EEA-EFTA incorporation of the AML package and MiCA remains uneven.

Firms should expect the practical content of AML/CTF controls to continue varying across EEA-EFTA states for as long as Iceland has not incorporated the AML package or MiCA and 6AMLD transposition remains incomplete in ten EU Member States.

3 evidence refs

Legal

The EU's hybrid-threats sanctions regime was renewed to 9 October 2027 on a distinct legal basis running parallel to the main Russia country-sanctions regime.

Counsel advising on sanctions exposure should treat the hybrid-threats/FIMI regime as an independent legal basis for designations, separate from the country-specific regime, when assessing nexus risk.

1 evidence refs

Board

The EU AML Package architecture continues its multi-year build-out, with AMLA moving toward direct supervision of up to 40 entities from 2028.

The institution's eventual supervisory relationship with AMLA, rather than purely national authorities, is a multi-year structural trajectory that board-level oversight should track as the selection cycle (eligibility data due 31 December 2026) progresses.

1 evidence refs

CTO

The EU-wide MiCA grandfathering period for crypto-asset service providers ended 1 July 2026, and EEA-EFTA incorporation of MiCA remains incomplete in Iceland.

Platform and infrastructure planning for EU market access should account for the closed transitional period and for the fact that MiCA's domestic binding force is uneven across the EEA-EFTA periphery.

2 evidence refs

Risk

Non-uniform EEA-EFTA incorporation of the AML package and MiCA is a persistent structural enabler-jurisdiction signal, independent of any observed enforcement gap.

Exposure concentration analysis should treat Iceland's non-incorporation of both instruments as a live structural factor rather than a stable baseline, given its divergence from Liechtenstein's and Norway's active incorporation paths.

1 evidence refs

Operations

A 22nd EU sanctions package of 1,646 listings is pending formal adoption on 12 October 2026.

Transaction-monitoring and screening-list update workflows should prepare for ingestion of a large listing batch once the Council formally adopts the package.

1 evidence refs

Audit

AMLA's submitted Level-2 technical standards and the staggered 6AMLD transposition across Member States create documentation gaps that audit should track as the AML Package architecture matures.

Control-testing scope should anticipate eventual testing against the CDD, PEP-screening and group-wide-controls standards once adopted, and should note the ten Member States currently subject to 6AMLD infringement proceedings as a source of jurisdictional inconsistency in current control documentation.

2 evidence refs

Decision lens

MLRO

Two parallel EU sanctions tracks (country-specific and hybrid-threats/FIMI) both moved this cycle, and a 22nd Russia package with 1,646 listings awaits formal adoption.

Compliance

AMLA submitted its first three Level-2 AMLR technical standards on CDD, PEP screening and group-wide controls, and EEA-EFTA incorporation of the AML package and MiCA remains uneven.

Legal

The EU's hybrid-threats sanctions regime was renewed to 9 October 2027 on a distinct legal basis running parallel to the main Russia country-sanctions regime.

Board

The EU AML Package architecture continues its multi-year build-out, with AMLA moving toward direct supervision of up to 40 entities from 2028.

CTO

The EU-wide MiCA grandfathering period for crypto-asset service providers ended 1 July 2026, and EEA-EFTA incorporation of MiCA remains incomplete in Iceland.

Risk

Non-uniform EEA-EFTA incorporation of the AML package and MiCA is a persistent structural enabler-jurisdiction signal, independent of any observed enforcement gap.

Operations

A 22nd EU sanctions package of 1,646 listings is pending formal adoption on 12 October 2026.

Audit

AMLA's submitted Level-2 technical standards and the staggered 6AMLD transposition across Member States create documentation gaps that audit should track as the AML Package architecture matures.

Shared evidence: 3 refs

Scenario sketches

AMLA direct-supervision transition and the evasion landscape

Illustrative scenario for analytical orientation only. As AMLA's Level-2 technical standards on CDD, PEP screening and group-wide controls move toward application, and as AMLA's first direct-supervision selection cycle approaches (eligibility data due 31 December 2026, first cohort from 2028), the supervisory perimeter for the largest cross-border obliged entities could shift from a purely national to a hybrid EU-level model. One illustrative mechanism worth orienting analysis toward: entities positioned just below AMLA's direct-supervision eligibility thresholds, or domiciled in EEA-EFTA states where incorporation of the underlying AML package remains incomplete, such as Iceland currently, could face a period of relatively lighter-touch supervision precisely while larger peers are absorbed into AMLA's direct perimeter. This is an illustrative structural possibility, not an observed fact or a prediction of actual displacement.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)

Tracker	Status	Note
T1 · Russian Sanctions-Evasion Architecture	escalating	22nd Russia package (1,646 listings, agreed 7 Oct 2026) and hybrid-threats-regime renewal to 9 Oct 2027.
T2 · EU AML Package / AMLA	watch	AMLA submitted first three Level-2 AMLR RTS to Commission 1 Oct 2026; EEA-EFTA incorporation remains uneven (Iceland lagging).
T3 · FATF Grey List	no_change	No plenary since 17-19 Jun 2026; next Plenary 26-30 Oct 2026, after this cycle's window.
T4 · Beneficial-Ownership Register Status	no_change	No new EEA-level development found this cycle.
T5 · Crypto & Digital-Asset Integrity	watch	MiCA EU-wide grandfathering ended 1 Jul 2026; Iceland has not implemented MiCA, Norway extended to 30 Jun 2026.
T6 · Sanctions Regime Divergence	watch	EU's pace of autonomous Russia listings continues to outstrip comparable US/UK listing rounds this cycle on available evidence.

Registers

Enforcement actions

The Commission adopted Delegated Regulation (EU) 2026/46, formally listing Russia as a high-risk third country with strategic AML/CFT deficiencies, following a technical assessment triggered by Russia's suspended FATF membership. 3 Dec 2025
The 19th sanctions package designated the developer and Kyrgyz issuer of the ruble-backed stablecoin A7A5, the operator of a platform trading it, five additional Russian banks (Istina, Zemsky Bank, Absolut Bank, MTS Bank, Alfa-Bank), and eight banks/oil traders in Tajikistan, Kyrgyzstan, UAE and Hong Kong, alongside a full transaction ban on Rosneft and Gazprom Neft. 23 Oct 2025
The 20th sanctions package, adopted 23 April 2026 with crypto measures effective 24 May 2026, imposed a complete ban on transactions between EU persons and any CASP or platform established in Russia, and an equivalent sectoral ban for Belarus, activating the EU's anti-circumvention tool against an entire jurisdiction for the first time. 23 Apr 2026
At its June 2026 Plenary, FATF made an initial determination that Bulgaria has substantially completed its AML/CFT action plan, including securing BO register accuracy and VASP/postal money operator market-entry controls, and now warrants an on-site assessment before removal from the increased monitoring list. 19 Jun 2026
Commission Delegated Regulation (EU) 2026/83 added Bolivia and the British Virgin Islands to the EU high-risk third country AML/CFT list while delisting six African jurisdictions following FATF's June/October 2025 Plenary decisions. 4 Dec 2025

Sanctions changes

Russia added to the EU list of high-risk third countries for AML/CFT via Commission Delegated Regulation (EU) 2026/46, following a technical assessment of countries with suspended FATF membership. 3 Dec 2025
The EU's 19th Russia sanctions package (23 Oct 2025) imposed a full transaction ban on Rosneft and Gazprom Neft, a Russian LNG import ban from 1 Jan 2027, transaction bans on 5 additional Russian banks and 8 third-country financial operators, and first-ever crypto-sector sanctions (A7A5 stablecoin ecosystem). 23 Oct 2025
The EU's 20th sanctions package (23 Apr 2026) introduced a full maritime services ban for Russian crude oil, listed 43 additional shadow-fleet vessels (reaching 640 total), and imposed a sector-wide transaction ban on Russian/Belarusian CASPs, effective 24 May 2026. 23 Apr 2026
Council Regulation (EU) 2025/2618 (18 Dec 2025) sanctioned 41 further shadow-fleet vessels; the Council separately renewed the core territorial-integrity sanctions regime for six months to 31 July 2026 and the Crimea/Sevastopol regime to 23 June 2026, requiring periodic re-authorisation votes that create renewal-cliff risk. 18 Dec 2025

Regulatory horizon (register)

AMLR (Reg 2024/1624) becomes directly applicable EU-wide
AMLA's first harmonised selection of 40 directly-supervised entities
6AMLD Member State transposition deadlines complete
FATF October 2026 Plenary: Bulgaria on-site verification outcome
AMLA full staffing and fee-based funding model matures

Active schemes

[CRITICAL] Ruble-backed stablecoin (A7A5/Grinex) sanctions-evasion architecture
[HIGH] EU beneficial-ownership register opacity post-Sovim rollback
[CRITICAL] DPRK IT-worker crypto proliferation-financing network (EU node)
Divergent CASP/MiCA supervision enabling jurisdiction shopping

Sources

Coverage gaps

Since the November 2022 CJEU Sovim/WM ruling, the EU's BORIS…

Since the November 2022 CJEU Sovim/WM ruling, the EU's BORIS beneficial-ownership interconnection system cannot provide public access to national BO registers, reversing a core 5AMLD transparency tool relied on by investigators and civil society across the bloc.

A June 2026 Council document confirms that reciprocal exchan…

A June 2026 Council document confirms that reciprocal exchange of operational information between Europol and AMLA is currently not foreseen, despite both bodies sitting at the centre of the EU's financial-crime and money-laundering response architecture.

MiCA's single-passport model combined with divergent nationa…

MiCA's single-passport model combined with divergent national AML/CFT scrutiny at CASP authorisation has produced 'jurisdiction shopping' concerns publicly raised by France's AMF, Austria's FMA and Italy's CONSOB, while the EBA documented a 2.5-fold rise in authorised CASPs (2022-2024) alongside persistent AML control weaknesses.

Conflict-finance/extractive-industry integrity (D4) coverage…

Conflict-finance/extractive-industry integrity (D4) coverage specific to EEA/EU-bloc architecture is comparatively thin in this baseline relative to sanctions (D1) and crypto (D5) coverage; available sourcing centred on Russia-energy sanctions (oil price cap, LNG ban) rather than dedicated EU conflict-minerals or extractive-corruption enforcement actions within the 18-month window.

Evidence

Confidence-tiered claims

Council prolonged the EU's hybrid-threats/FIMI sanctions regime against Russia by one year, to 9 October 2027, decided 8 October 2026. SRC-fim-EEA-001

Probable · 1 source

1,646 new listings (743 individuals, 826 entities, 77 occupied-Ukraine election officials) agreed by COREPER 7 Oct 2026; formal Council adoption scheduled 12 Oct 2026, not yet legally effective as of cycle close. SRC-fim-EEA-002

Probable · 1 source

AMLA finalised and submitted to the European Commission its first three Level-2 AMLR regulatory technical standards (CDD/PEP screening; business relationships/linked transactions; group-wide AML/CFT controls) on 1 Oct 2026; proposed to apply six months after entry into force, no fixed Commission adoption date yet confirmed. SRC-fim-EEA-003

Probable · 1 source

AMLR (Reg 2024/1624) on track to apply 10 Jul 2027; 6AMLD (Dir 2024/1640) transposition staggered with Commission's Aug 2026 monitoring showing 23 Member States communicating full first-tranche transposition and infringement proceedings pending against 10 others; AMLA operational in Frankfurt since 1 Jul 2025, proceeding toward first direct-supervision selection cycle (eligibility data 31 Dec 2026, selection finalised late 2027, direct supervision from 2028 for up to 40 entities). SRC-fim-EEA-005

Probable · 1 source

Liechtenstein is repealing its SPG and enacting a new national AMLA implementing Act (consultation report adopted 3 Mar 2026); Norway has incorporated MiCA with an extended national licensing deadline to 30 Jun 2026; Iceland has not yet incorporated the EU AML package or MiCA. EEA uniformity on these files remains unresolved. SRC-fim-EEA-006

Probable · 1 source

EU-wide Art.143 grandfathering period for pre-existing crypto-asset service providers ended fully on 1 Jul 2026; only MiCA-authorised CASPs may now market crypto services into the EU and reverse solicitation cannot be relied on where a firm pays influencers. SRC-fim-EEA-008

Probable · 1 source