In brief. The money laundering regulations applicable to entities operating in Italy combine three layers: EU regulations and directives (the AML package), Italian implementing legislation (mainly D.Lgs. 231/2007) and sectoral rules issued by competent supervisors (Banca d’Italia, IVASS, CONSOB, OAM). Since 2024 the framework is being reshaped by the single AML rulebook (Regulation EU 2024/1624, applicable from 10 July 2027) and by the establishment of the EU AML Authority (AMLA). International Lawyers Associates (ILA) advises obliged entities and individuals on AML compliance and on related criminal proceedings.

At a glance

  • The applicable AML rules combine EU and Italian sources, supplemented by sectoral guidance from supervisors.
  • D.Lgs. 231/2007 is the central Italian AML statute, implementing the EU directives.
  • The new AML package (2024) includes the Single Rulebook (Regulation 2024/1624, applicable from 10 July 2027), Directive 2024/1640 and the AML Authority (Regulation 2024/1620).
  • Obliged entities include banks, financial institutions, payment institutions, crypto-asset service providers, professionals (lawyers, accountants, notaries), real estate intermediaries and others.
  • Cash: in Italy payments in cash are limited to amounts below EUR 5,000 (art. 49 D.Lgs. 231/2007); from 10 July 2027 the AMLR also sets an EU-wide cap of EUR 10,000, without prejudice to lower national limits.
  • Core obligations: customer due diligence (CDD), enhanced due diligence (EDD), suspicious transaction reporting (STR) and record keeping.
  • Sanctions for breach can be substantial (financial penalties and disqualification) and may overlap with criminal liability under Article 648-bis of the Italian Criminal Code and Article 25-octies of D.Lgs. 231/2001.

The applicable EU framework

Regulation EU 2024/1624 (Single AML Rulebook). Directly applicable in all member states from 10 July 2027 (10 July 2029 for football clubs and agents). Sets out uniform rules on customer due diligence, beneficial ownership transparency, reporting obligations and prohibited products and services.

Regulation EU 2024/1620 (AML Authority Regulation). Establishes the EU AML Authority (AMLA), headquartered in Frankfurt and operational since 2025. From 2028 AMLA will directly supervise a selected number of the highest-risk cross-border obliged entities; it also coordinates national supervisors and FIUs.

Directive EU 2024/1640 (6AMLD). New directive complementing the regulation, with rules on national supervisors, FIUs, beneficial ownership and bank account registers; to be transposed by 10 July 2027. Criminal-law aspects remain governed by Directive (EU) 2018/1673, transposed in Italy by D.Lgs. 195/2021.

Existing 4AMLD (Directive EU 2015/849) and 5AMLD (Directive EU 2018/843) remain relevant during the transition until the new package becomes fully operational.

Italian implementation: D.Lgs. 231/2007

The Italian AML statute is Legislative Decree 231 of 21 November 2007, repeatedly amended to implement successive EU directives. It sets out:

  • scope of obliged entities (Article 3): banks, financial institutions, fiduciary companies, payment institutions, electronic money issuers, crypto-asset service providers, professionals (lawyers, accountants, notaries) in specified activities, real estate brokers, gaming operators, dealers in gold, antiques and works of art;
  • customer due diligence (Articles 17 onwards): identification of the customer and the beneficial owner, ongoing monitoring;
  • enhanced due diligence for higher-risk situations (politically exposed persons, customers from high-risk third countries);
  • suspicious transaction reporting to the Italian FIU (UIF) within Banca d’Italia (Article 35);
  • record-keeping requirements (Article 31);
  • administrative and criminal sanctions for breaches (Title V, arts. 55 onwards).

Sectoral rules and supervisors

Different supervisors issue sectoral AML guidance applicable to obliged entities under their remit:

  • Banca d’Italia for banks, payment institutions, electronic money institutions, asset managers (regulations issued under Article 7 of D.Lgs. 231/2007);
  • IVASS for insurance undertakings;
  • CONSOB for investment firms and listed issuers;
  • OAM for financial agents and credit brokers (it also kept the register of virtual-currency service providers, now replaced by authorisation under the MiCA Regulation (EU) 2023/1114 and D.Lgs. 129/2024);
  • Agenzia delle Dogane e dei Monopoli for gaming operators;
  • Ministero dell’Economia e delle Finanze for policy coordination and sanctioning procedures;
  • MEF Comitato di Sicurezza Finanziaria for high-level coordination and FATF-related action.

Core obligations for obliged entities

Customer Due Diligence (CDD). Identification and verification of the customer and the beneficial owner. CDD is mandatory at onboarding and at thresholds during the relationship. The identification must reach a level of certainty consistent with the risk.

Enhanced Due Diligence (EDD). Applies to higher-risk relationships: politically exposed persons (PEPs) and their families and close associates, customers based in high-risk third countries identified by the EU Commission, complex or unusual transactions without economic rationale, cross-border correspondent relationships.

Suspicious Transaction Reporting (STR). Obligation to report transactions or facts suspected of being related to money laundering or terrorism financing to the UIF, without informing the customer (no tipping off).

Record keeping. Obligation to retain CDD documentation and transaction records for a defined period (in Italy, ten years from the end of the relationship or the occasional transaction; the AMLR will set a five-year EU standard from July 2027).

Risk assessment and internal procedures. Obliged entities must adopt a written risk assessment, internal policies, training, an AML officer and adequate internal control functions.

Sanctions for breach

Breach of AML obligations triggers:

  • administrative sanctions under Articles 56 onwards of D.Lgs. 231/2007: fines for the entity and, in defined cases, for individual executives; failure to file an STR is an administrative breach (art. 58: EUR 3,000, or EUR 30,000–300,000 in serious, repeated or systematic cases); for banks and financial intermediaries fines can reach EUR 5 million or 10% of annual turnover (art. 62);
  • criminal sanctions under Article 55 for specific offences (falsification of CDD data or records, false information supplied by the customer, breach of the tipping-off prohibition);
  • corporate criminal liability under D.Lgs. 231/2001, Article 25-octies, for money laundering committed in the entity’s interest.

The 2017 reform (D.Lgs. 90/2017) substantially increased the level of fines and aligned them with the EU expectations of “effective, proportionate and dissuasive” sanctions.

Interaction with criminal money-laundering offences

AML compliance does not operate in isolation from the criminal offence of money laundering. Failures in CDD or STR can lead to:

  • administrative proceedings for failure to report and criminal charges for falsification of CDD data or records;
  • complicity charges for active or passive cooperation in laundering;
  • 231/2001 liability for the entity for failing to prevent the offence.

A robust compliance programme — risk assessment, policies, training, internal control, monitoring — is the defence against both regulatory and criminal exposure.

FAQ

Who is subject to AML rules in Italy? Banks, financial institutions, payment institutions, crypto-asset service providers, professionals (lawyers, accountants, notaries) in specified activities, real estate intermediaries, gaming operators and dealers in gold, antiques and works of art.

What is the role of the AMLA? The EU AML Authority, headquartered in Frankfurt, will directly supervise selected high-risk cross-border obliged entities from 2028; it already coordinates national supervisors and FIUs and issues technical standards.

What is a Suspicious Transaction Report (STR)? A confidential report to the Italian FIU (UIF, within Banca d’Italia) of facts suspected of relating to money laundering or terrorism financing. Reporting is mandatory; informing the customer (tipping off) is prohibited.

Do AML rules apply to crypto assets? Yes. Italian implementation of EU AML rules extends CDD and reporting obligations to crypto-asset service providers, which must now be authorised under the MiCA Regulation (EU) 2023/1114 (the former OAM register was transitional).

Can compliance failures lead to criminal liability? Yes. They can trigger administrative sanctions, specific criminal offences for individuals (art. 55 D.Lgs. 231/2007), and corporate criminal liability under D.Lgs. 231/2001 for the entity.

When to contact the firm

If you operate as an obliged entity or face investigations linked to AML failures or to the criminal offence of money laundering, contact the firm. Early specialist support is decisive for both regulatory and criminal exposure.

Request a confidential consultation — response within 24 hours. Phone: %%TEL%%.