In brief. Anti money laundering (AML) is the set of laws, regulations and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. It applies to banks, professionals and a growing number of non-financial businesses, and exposes them — and their directors — to criminal, administrative and reputational consequences when the framework is breached.

ILA is an Italian criminal-defence firm. This guide outlines UK rules for reference; we assist English-speaking clients whose case has an Italian dimension — extradition to or from Italy, Interpol Red Notices and cross-border proceedings — alongside local counsel abroad.

In brief

  • AML combines preventive obligations (customer due diligence, record-keeping, reporting) and criminal sanctions against money laundering itself.
  • The framework rests on FATF Recommendations, the EU AML Directives (4th and 5th — Dir. 2015/849, 2018/843 — plus the criminal-law Directive 2018/1673, the so-called 6AMLD), the 2024 EU AML package (applicable from 10 July 2027) and, in the UK, the Money Laundering Regulations 2017 (MLR 2017, as amended) plus the Proceeds of Crime Act 2002 (POCA).
  • In Italy, AML obligations are governed by D.Lgs. 231/2007, while the offences sit in art. 648-bis (laundering, 4–12 years), art. 648-ter (use of unlawful proceeds, 4–12 years) and art. 648-ter.1 c.p. (self-laundering, 2–8 years), with lower brackets where the proceeds derive from a contravention.
  • Breaches can lead to criminal prosecution, heavy fines, professional disqualification and corporate liability under D.Lgs. 231/2001 in Italy or the failure-to-prevent offences abroad.
  • A cross-border AML matter typically involves several jurisdictions at once: legal coordination from a single firm is essential.

What is anti money laundering?

Anti money laundering refers to the regulatory and criminal-law architecture that requires regulated entities — banks, financial intermediaries, lawyers, accountants, real-estate agents, crypto-asset service providers — to identify their clients, monitor transactions and report suspicions of illicit funds to a Financial Intelligence Unit. The same architecture criminalises the conduct of transferring, concealing or converting proceeds of crime to give them an appearance of legitimacy.

AML is therefore two things at once: a compliance regime for businesses and a substantive criminal offence for individuals and entities that handle the proceeds of crime. The two layers interact constantly: a missed suspicious transaction report (STR) does not only trigger an administrative fine — it can become the foundation of a personal criminal charge against the compliance officer or the director.

The Italian firm assists clients across multiple legal systems, and the AML framework is one of the clearest examples of overlapping rules.

European Union

  • Directive (EU) 2015/849 (4th AMLD) — risk-based approach, beneficial-ownership registers.
  • Directive (EU) 2018/843 (5th AMLD) — extension to virtual asset service providers and pre-paid cards.
  • Directive (EU) 2018/1673 (the so-called 6AMLD, criminal-law directive) — harmonised criminal definition of money laundering and liability of legal persons; transposed in Italy by D.Lgs. 195/2021.
  • Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620 (AMLA) — the 2024 package: the new single rulebook applies from 10 July 2027; AMLA (Frankfurt) has been operational since 1 July 2025 and will directly supervise selected obliged entities from 2028.

United Kingdom

  • Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017, as amended, most recently by SI 2026/621) — preventive obligations.
  • Proceeds of Crime Act 2002 (POCA) — the three core offences: concealing (s. 327), arranging (s. 328) and acquisition/use/possession (s. 329), punishable by up to 14 years’ imprisonment; failure to disclose in the regulated sector (s. 330), up to 5 years.
  • Economic Crime and Corporate Transparency Act 2023 — reform of Companies House, reform of the identification doctrine for corporate liability and a new “failure to prevent fraud” offence for large organisations, in force since 1 September 2025.

Italy

  • D.Lgs. 231/2007 — preventive AML regime, identification, STR to UIF (Unità di Informazione Finanziaria della Banca d’Italia).
  • Art. 648-bis c.p. (riciclaggio), 648-ter c.p. (impiego di denaro di provenienza illecita), 648-ter.1 c.p. (autoriciclaggio).
  • D.Lgs. 231/2001 — corporate criminal liability for AML predicate offences, with organisational models as a defence.

Who is subject to AML obligations?

The scope of the regime has expanded steadily. Today it covers, among others:

  • Banks, payment institutions and electronic-money institutions
  • Investment firms, asset managers, insurance distributors (life products)
  • Crypto-asset service providers (CASPs)
  • Lawyers, notaries, accountants and statutory auditors when assisting clients in specified financial or real-estate transactions
  • Real-estate agents, including letting agents for monthly rents of EUR 10,000 or more
  • Art dealers and intermediaries (transactions of EUR 10,000 or above)
  • Gambling operators, including online platforms

For occasional transactions outside a business relationship, CDD is currently triggered at EUR 15,000 (in Italy, art. 17 D.Lgs. 231/2007); Regulation (EU) 2024/1624 lowers the general threshold to EUR 10,000 and introduces an EU-wide cap of EUR 10,000 on cash payments from 10 July 2027 (Member States may keep lower limits: in Italy the cash limit is EUR 5,000).

Falling within the scope means appointing an MLRO (Money Laundering Reporting Officer), performing Customer Due Diligence (CDD) — including enhanced due diligence (EDD) for politically exposed persons and high-risk jurisdictions — keeping records (five years under the UK MLR 2017, ten years in Italy) and filing suspicious activity reports (SARs in the UK; STRs to the UIF in Italy).

Core obligations: from CDD to suspicious reporting

A compliance programme that actually withstands scrutiny rests on five pillars:

  1. Customer due diligence — verifying identity, beneficial ownership and purpose of the relationship before opening it.
  2. Ongoing monitoring — transactional surveillance proportionate to the risk profile.
  3. Record-keeping — retention of documents and electronic data for at least five years.
  4. Internal procedures and training — written policies, named officer, periodic training.
  5. Reporting — timely SAR/STR, with the duty of confidentiality (the “tipping-off” prohibition).

A common failure point in cross-border groups is the inconsistent application of CDD between parent and subsidiaries: regulators increasingly look at group-wide compliance, and so do prosecutors when they construct corporate criminal cases.

What goes wrong: typical case scenarios

(Illustrative examples of typical situations: they do not refer to specific proceedings or to clients of the firm.)

Case 1 — The corporate client and the “third-party payer”

A European trading company receives a payment from a non-EU jurisdiction through a vehicle that is not the contractual counterpart. The compliance officer flags the inconsistency but the relationship manager pushes the transaction through. Several months later, an STR from another bank triggers an investigation. In similar situations the defence can work on reconstructing the documentary trail and the timing of the internal red flags, in order to delimit the personal position of the compliance function.

Case 2 — The crypto exchange and the missed source-of-funds check

A retail customer deposits in a virtual currency tied — at the chain-analysis level — to a sanctioned wallet. The exchange’s automated screening missed the link due to outdated rule-sets. Both the local AML supervisor and the criminal authority opened parallel proceedings. A possible defence strategy focuses on the organisational model, on the actual training of the analysts and on showing that the failure was systemic, not intentional — the difference between an administrative sanction and a criminal charge for the officers involved.

AML and white-collar crime: a single defence strategy

AML investigations rarely come alone. They overlap with allegations of fraud, tax evasion, corruption or insider dealing — the family of conducts known as white collar crime. When a foreign authority issues a request involving AML, it can also activate mutual legal assistance, freezing orders and, in the worst cases, an INTERPOL Red Notice. This is why the firm treats AML matters jointly with white-collar and international cooperation issues — for a broader understanding of the predicate side, see the firm’s complete guide to money laundering in Italy and the white-collar crime pillar.

For practical due-diligence procedures we publish a dedicated overview of anti money laundering checks, while the underlying criminal offence is analysed in money laundering and in the conceptual entry on money laundering meaning.

Frequently asked questions

What is the difference between AML compliance and money laundering as a crime? AML compliance is the set of preventive duties owed by regulated businesses. Money laundering as a crime is the conduct of converting or concealing proceeds of crime. A compliance failure can support a criminal charge but the two layers remain legally distinct.

Who supervises AML obligations? In Italy, the UIF at the Bank of Italy receives STRs; sector supervisors (Bank of Italy, CONSOB, IVASS) verify compliance. In the UK, the FCA, HMRC and professional supervisors share oversight, with the NCA receiving SARs.

Are lawyers required to file suspicious reports against their own clients? Yes, with strict carve-outs. The duty does not apply to information obtained while assessing the client’s legal position or in connection with judicial proceedings. The boundary is jurisdiction-specific and must be assessed case by case.

What sanctions apply for AML breaches? Administrative fines (in Italy, for banks and financial intermediaries, up to EUR 5 million or 10% of annual turnover — art. 62 D.Lgs. 231/2007), removal of authorisation, personal disqualification of directors and compliance officers, and — in the most serious cases — criminal prosecution and corporate liability under D.Lgs. 231/2001 in Italy or equivalent regimes abroad.

Can a company defend itself by showing a compliance programme was in place? Yes. An effective, monitored and periodically updated programme is the centrepiece of the corporate defence under D.Lgs. 231/2001 and, increasingly, under the UK failure-to-prevent regimes. “Paper compliance” is not enough: regulators and courts look for actual implementation.

Talk to ILA’s international AML team

If you are responsible for compliance in a regulated business, or you have received a request from an Italian or foreign authority on AML grounds, our cross-border team can review the matter and propose a coordinated strategy.

Request a confidential consultation — response within 24 hours.

Read also our overview of money laundering and anti money laundering checks.

Last updated: October 2026. References: Dir. (EU) 2015/849; Dir. (EU) 2018/843; Dir. (EU) 2018/1673; Reg. (EU) 2024/1624; Dir. (EU) 2024/1640; Reg. (EU) 2024/1620 (AMLA); D.Lgs. 231/2007; D.Lgs. 195/2021; D.Lgs. 231/2001; art. 648-bis, 648-ter, 648-ter.1 c.p.; MLR 2017 as amended (UK); POCA 2002 (UK); ECCTA 2023 (UK).