New European AML Protocol 2026: What Banks and Obligated Entities Must Do

Key data

Financial entities and those obligated in the prevention of money laundering (AML) have a new warning signal on the regulatory horizon. The EU Council adopted on 13 October 2026 the Decision (EU) 2026/2355, through which the European Union signs the Additional Protocol to the Council of Europe Convention on laundering, search, seizure and confiscation of the proceeds from crime and on the financing of terrorism.

This is not a regulation of direct and immediate application for companies, but it is the first formal step in a process that will culminate in a transposition or regulatory adaptation in each Member State. Ignoring this signal is equivalent to arriving late when concrete obligations arrive.

What does this regulation establish?

The decision authorizes the EU to sign the Additional Protocol to the Council of Europe Convention on money laundering, monitoring, seizure and confiscation of illicit assets and terrorist financing. The protocol expands and strengthens the mechanisms already existing in the original Convention in two key dimensions:

• Judicial cooperation in criminal matters: facilitates collaboration between judicial systems of different countries to investigate, seize and confiscate assets from criminal activities.
• Police cooperation: strengthens information exchange channels and joint action between security forces of the signatory States.

The scope is European and cross-border: the instruments for monitoring and confiscation of illicit assets will be applied in a coordinated manner between EU Member States and other countries that signed the original Council of Europe Convention.

It is essential to understand the regulatory sequence: this decision is the signature of the protocol, not its ratification. Formal ratification will come later, and with it the obligation for each State to transpose or adapt its internal regulations. For Spain, this will likely result in modifications to the Law 10/2010 on the prevention of money laundering and terrorist financing and its implementing regulations.

Economic and operational impact

Although the regulation does not establish specific sanction amounts or concrete figures at this stage, its operational impact for affected companies is significant. The strengthening of cross-border cooperation mechanisms implies:

• Greater exposure to international investigations: entities with cross-border operations will see how their transactions can be subject to coordinated scrutiny between several countries simultaneously.
• Tightening of due diligence: the expansion of seizure and confiscation instruments will pressure AML obligated parties to strengthen their customer identification and suspicious transaction detection procedures.
• Increase in compliance costs: the adaptation of internal systems, training of compliance teams and review of procedures represents an investment that entities must anticipate before formal transposition arrives.
• High reputational risk: in an environment of greater police and judicial cooperation, failures in AML controls will have more visible and faster consequences than in the past.

Who does it affect?

• Financial entities: banks, savings banks, credit cooperatives, payment entities and electronic money entities.
• AML obligated parties: fund managers, insurance companies, real estate companies, notaries, lawyers, auditors, tax advisors and any subject obligated by money laundering prevention regulations.
• Companies with international activity: operators with customers, suppliers or transactions in multiple countries, especially outside the EU.
• Compliance and legal departments: responsible for adapting internal procedures when transposition arrives.
• Security forces and judicial authorities: directly involved in the operational application of the protocol.

Practical example

Imagine a medium-sized Spanish bank with operations in three EU countries and correspondent relationships with entities outside the European area. Until now, an investigation into money laundering in another Member State could take months to coordinate with Spanish authorities. With the protocol in force, the mechanisms for judicial and police cooperation will be more agile and direct.

This means that this bank could receive information requests or precautionary measures on customer accounts in much shorter timeframes, and that its own suspicious transaction detection procedures will be exposed to coordinated scrutiny between several countries. If its AML controls are not updated when transposition arrives, the risk of sanction—both regulatory and reputational—multiplies.

The preventive action is clear: review procedures for due diligence now, especially in transactions with international counterparties, before the regulation becomes mandatory.

What should companies do now?

1. Identify if you are an AML obligated subject: review whether your activity includes you in the scope of Law 10/2010. If you have doubts, consult with your legal advisor before transposition arrives.
2. Audit current due diligence procedures: evaluate whether your customer identification and suspicious transaction detection controls are up to date, especially for cross-border transactions.
3. Strengthen controls in international transactions: transactions with counterparties outside the EU or in higher-risk jurisdictions will be the first to come under the focus of the new cooperation framework.
4. Monitor the ratification process: track when Spain ratifies the protocol and when the regulatory transposition is published. That is when concrete obligations will be enforceable.
5. Train the compliance team: anticipate internal training on the new cross-border cooperation mechanisms so the team is prepared when operational changes arrive.
6. Document the current status: maintain an updated record of your AML procedures. In case of inspection or request, documentary traceability is your best defense.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026D2355