AMLA ITS Final Report Published Source monitoring active

AMLA final report: draft ITS on FIU reporting to the EPPO

AML Agent page published: . Page updated: .

AMLA, the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism, published its final report on draft implementing technical standards (ITS) for Financial Intelligence Unit (FIU) reporting to the European Public Prosecutor's Office (EPPO) on 3 July 2026. Prepared under Article 81(1) of Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (AMLR), the draft establishes a common format for reporting analysis results and relevant information where there are reasonable grounds to suspect criminal activity within the EPPO's competence. It covers report content, secure transmission and lawful restrictions on the information's use.

As checked on 9 October 2026, AMLA's register lists the instrument as Final report published. AMLA announced submission to the European Commission; the final report itself does not make the technical standards binding. Adoption follows the ITS procedure in Article 53 of Regulation (EU) 2024/1620 (AMLAR), with Official Journal publication and commencement assessed separately. Draft Article 7 proposes general application from 10 July 2027 and application of Article 3(2), the machine-readable submission requirement, from 10 July 2028. The reporting duties address FIUs, rather than creating a new direct EPPO reporting duty for all obliged entities.

Open official source Back to tracker

Key takeaways

  • The final draft proposes general application from 10 July 2027, with the Article 3(2) machine-readable submission requirement following on 10 July 2028. Entry into force would be 20 days after Official Journal publication; AMLA's report is a proposal for Commission adoption.
  • FIU reporting is tied to reasonable grounds to suspect activity over which the EPPO could exercise competence under Articles 22 and 25(2)-(3) of Regulation (EU) 2017/1939. An ordinary money laundering case does not automatically fall within that remit.
  • The Annex has nine sections covering reporting contacts, suspected offences and EU financial damage, a case summary, potential suspects, case description, financial analysis, conclusions, use restrictions and urgent measures. The required content and instructions remain relevant even where the template's technical implementation differs.
  • FIUs would complete mandatory fields where they hold the information. Structured report content should generally stay within the template; supporting documents and relevant evidence may be attached in a format that is not machine-readable.
  • Reports would normally use a secure electronic channel protecting confidentiality and integrity. This ITS does not prescribe FIU.net as the sole channel or XML as the sole machine-readable format.
  • Paper or electronic data carriers would be permitted in exceptional circumstances only with EPPO acceptance and continued protection of confidentiality and integrity.
  • FIUs would identify permitted uses and restrictions under applicable EU and national law. Judicial use, intelligence use and the defined criminal-cooperation use have different purposes; restrictions must be explained unless confidentiality prevents it.
  • FIU reporting under AMLR Article 81(1) and AMLA reporting of joint-analysis results under AMLAR Article 41(2) are separate ITS. Banks and other obliged entities retain their own applicable reporting and information-response duties.

What changed

The final report follows the public hearing on 27 May 2026, held jointly with the separate proposal for AMLA reporting to the EPPO. AMLA announced finalisation and Commission submission on 3 July 2026. This is the final-draft stage of the Article 81(1) instrument, rather than the adoption of a binding Commission implementing regulation.

Compared with the consultation paper, final draft Article 7 defers the Article 3(2) machine-readable submission requirement to 10 July 2028. General application remains proposed for 10 July 2027. The extra year concerns that technical requirement, rather than deferring the entire template, security and permitted-use framework.

The Annex changes several mandatory/discretionary classifications. Details of the national criminal case reference, the national judicial contact and the linked European Delegated Prosecutor (EDP) become discretionary, while the questions about an existing national investigation and an EDP's involvement remain mandatory. Article 4(2) continues to qualify mandatory completion by whether the FIU holds the information.

The potential-suspect fields are revised. For natural persons, given and family names replace the earlier naming structure; gender and identification-document details are discretionary, with separate fields for document information and a unique identification number. For legal persons, legal type becomes mandatory, registration date and country become discretionary, and trade name, registration number and contact details are included as discretionary fields.

The geographic fields now distinguish other Member States from other countries rather than singling out a second Member State. The template retains core information on where suspected conduct and damage to the Union's financial interests occurred, alongside the offence, timing and damage information needed to assess EPPO competence.

Article 6 expressly allows one or more permitted-use categories and specifies the explanation duty for restrictions in points (b)-(e), subject to confidentiality. The final draft retains the common Annex structure, completion rules, secure-channel approach and exceptional-transmission route already present in the consultation. Its feedback section identifies field adjustments and the machine-readable deferral as the principal changes following stakeholder feedback.

Why it may matter

The proposed format connects FIU financial analysis with the EPPO's assessment of possible offences affecting the EU's financial interests. These may involve EU-budget fraud, relevant public-sector bribery, misappropriation, laundering of the proceeds of covered offences, or other conduct falling within the EPPO Regulation. A well-supported report explains the suspected conduct, money flows and EU financial connection; it does not itself establish guilt or determine that the EPPO must investigate. Competent national authorities already have prompt reporting duties under EPPO Regulation Article 24 within its legal scope; the AMLR's general application date is 10 July 2027.

The EPPO's remit is defined by law, including Directive (EU) 2017/1371, the PIF Directive, as implemented nationally, and Articles 22-25 of Regulation (EU) 2017/1939. Serious cross-border VAT fraud requires the specified connection with at least two Member States and total damage of at least EUR 10 million. That is not a general minimum value for all EPPO reports. Article 25 has separate rules on exercising competence, including specified cases below EUR 10,000; national direct-tax offences are excluded under Article 22(4).

The PIF Directive's current consolidated text incorporates amendments made by Directive (EU) 2026/1021, including the terminology and provisions on public-sector bribery. The amending directive has its own national-transposition timetable. Legal qualification must follow the applicable national law and the EPPO Regulation; the reporting template does not itself expand the EPPO's competence.

Consistent report content can help the EPPO assess competence, recognise links between subjects and transactions, identify an EDP already involved and understand urgent risks. AMLA's cost-benefit analysis identifies incomplete or inconsistent reporting and follow-up questions as practical problems. The proposed machine-readable format supports automated processing, while allowing FIUs and the EPPO to retain appropriate secure transmission arrangements.

Permitted use is as important as delivery. Intelligence provided to identify possible criminal conduct is different from material authorised for use as evidence in proceedings. FIUs should preserve source conditions and required permissions, including restrictions on information received from another FIU. Selecting an unrestricted-use category cannot waive applicable statutory confidentiality, data protection or procedural safeguards.

The Commission's 18 September 2026 evaluation of the EPPO identifies national implementation problems that can obstruct direct reporting by competent authorities and delay referrals. That is policy and implementation context, rather than a new reporting rule. Preparation should address lawful referral routes, case ownership and secure handling as well as the technical template.

For private compliance teams, this ITS concerns the downstream handling of financial intelligence by public authorities. Suspicious-activity or transaction reporting to the competent FIU, response to lawful information requests and any other applicable reporting obligations remain distinct. AMLA's own joint-analysis reporting and the separate FIU-to-FIU exchange standard also have different mandates and should retain separate regulatory records.

Who may be affected

Legal and compliance advisersFinancial Intelligence UnitsOther affected stakeholders

The direct reporting audience is FIUs in Member States participating in the EPPO, with the EPPO and its European Delegated Prosecutors receiving and using the reports within the applicable legal framework. Relevant operational teams include FIU analysts, legal advisers, information-security staff, data and IT teams, and prosecutorial staff responsible for intake and follow-up.

As checked on 9 October 2026, the EPPO lists 25 participating Member States; Denmark and Ireland remain outside participation. The final report's July background reference to 24 states predates Hungary's confirmed participation. Commission Decision (EU) 2026/1701 confirmed Hungary's participation, effective from 2 August 2026, but application of specified operational provisions is linked to the twentieth day after appointment of its European Prosecutor. Participation and operational commencement must be checked separately.

Other FIUs, authorities in non-participating Member States and third countries can be relevant to information provenance and criminal cooperation. They are not automatically subject to this proposed FIU-to-EPPO format merely because they hold information relevant to an EPPO case. Draft Article 2(e) defines criminal-cooperation use by reference to formal EPPO requests to non-participating Member States or third countries.

Banks, payment and e-money firms, crypto-asset service providers, other financial institutions and non-financial obliged entities can be affected indirectly through their reports, records and responses to lawful requests. This ITS does not itself require all such firms to implement the FIU's EPPO template or report every suspicion directly to the EPPO. Advisers supporting FIUs or firms should distinguish those responsibilities.

Practical considerations

  • For FIUs, map the legal referral trigger and EPPO competence assessment. Record the suspected conduct, its connection with the Union's financial interests, relevant countries and any uncertainty requiring legal assessment; retain the without-undue-delay obligation.
  • Map existing report data to all nine Annex sections. Include the case summary, financial analysis and conclusions within the structured report instead of relying solely on attached documents.
  • Use the final Annex's mandatory and discretionary markings, including its changes to case contacts and suspect identification. Populate mandatory information held by the FIU and document gaps; the template should not become a reason to delay a referral while seeking information the FIU does not hold.
  • Validate Annex-specific formats, including DD-MM-YYYY dates with hyphens, instructed ISO 3166-1 short country names, ISO 4217 currency codes and the stated numeric conventions. These report formats differ from the site's YYYY-MM-DD editorial date-entry format.
  • Check national investigation and EDP involvement, case identifiers, contact details and any connected FIU work. Keep records current so the recipient can coordinate follow-up and identify related cases.
  • Confirm the secure electronic route with the EPPO, including recipient authentication, permissions and controls protecting confidentiality and integrity. This proposal permits suitable channels rather than requiring every FIU to use a single platform.
  • Build the Article 3(2) machine-readable capability for the proposed July 2028 date. Agree a processable format with the EPPO, test the Annex data mapping and preserve supporting evidence; XML is an example, rather than the only permitted format.
  • For exceptional paper or data-carrier submissions, obtain EPPO acceptance and document the reason, authorised recipient and arrangements protecting the information during transmission and receipt.
  • Record permitted uses, information provenance and any necessary originator consent. Explain use restrictions unless confidentiality prevents it, and distinguish intelligence, judicial and the defined criminal-cooperation purposes under draft Article 2.
  • Highlight any urgent asset, transaction or evidence-preservation issue, including expiry dates and actions already taken, where relevant information is available. The Annex marks urgent-measure fields as discretionary; existing lawful powers and deadlines remain separate.
  • For obliged entities, maintain sound national FIU reporting, evidence preservation and responses to lawful requests. Assess any direct EPPO reporting or public crime-reporting route under the applicable rules rather than treating this FIU ITS as a new universal private-sector obligation.
  • Track Commission adoption under AMLAR Article 53, Official Journal publication and the adopted timing. Plan separately for the proposed July 2027 general requirements and July 2028 machine-readable submission, and recheck participating-country and operational scope before implementation.

These considerations support professional review and do not constitute legal advice.

AMLR 81(1)Article 81(1) of Regulation (EU) 2024/1624Regulation (EU) 2024/1624 (AMLR), Articles 81 and 82: FIU-EPPO cooperation and information requestsRegulation (EU) 2024/1624 (AMLR), Article 69: obliged-entity reporting to FIUsRegulation (EU) 2024/1624 (AMLR), Article 90: application provisionsCouncil Regulation (EU) 2017/1939 (EPPO Regulation), Articles 2 and 22-25Directive (EU) 2017/1371 (PIF Directive), Articles 2-4, as amended by Directive (EU) 2026/1021Directive (EU) 2026/1021, Articles 36-39: PIF amendments, transposition and entry into forceRegulation (EU) 2024/1620 (AMLAR), Article 53: implementing technical standards adoption procedureRegulation (EU) 2024/1620 (AMLAR), Article 41(1)-(2): separate AMLA joint-analysis reportingDirective (EU) 2024/1640 (AMLD), Articles 19-20: FIU functions and safeguardsDirective (EU) 2024/1640 (AMLD), Articles 29-35: FIU cooperation, channels and onward-use conditionsCommission Decision (EU) 2026/1701, Articles 1-3: Hungary's participation and operational conditionsAMLA final draft FIU-to-EPPO ITS, Articles 1-7 and Annex (proposed provisions)

Official sources