EU AMLR, AMLD6 & AMLA: Host FIU Reporting Rules for Cross-Border MiFID Branches

While prudential capital under EU IFR/IFD consolidates at the home regulator, European anti-money-laundering law enforces strict territoriality over physical establishments: under Directive (EU) 2015/849 Article 33(2) and its successor EU AML Package—Regulation (EU) 2024/1624 (AMLR), Directive (EU) 2024/1640 (AMLD6), and Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority (AMLA) in Frankfurt—every MiFID II Article 35 branch and host-established tied agent must transmit Suspicious Transaction Reports (STRs) directly to the Financial Intelligence Unit (FIU) of the host member state where that establishment sits.

Within our MiFID II EEA passporting cornerstone guide and the EEA passporting hub, failing to register a local branch on the host FIU's goAML portal (such as Germany's FIU in Cologne, France's Tracfin, Spain's SEPBLAC, or the Estonian Financial Intelligence Unit) ranks among the fastest triggers for host-state on-site sanctions.

Territorial STR Routing: Remote Article 34 Passports vs Physical Article 35 Establishments#

Cross-border compliance architectures must route suspicious transaction alerts according to the exact MiFID II channel used:

1. Physical Establishments & Host Tied Agents (Article 35): Host AML supervisors audit the local branch directly for AML/CFT compliance, local PEP/sanctions screening, and mandatory STR filing to the host FIU without tipping off the client.
2. Remote Cross-Border Freedom of Services (Article 34): Where an EEA broker such as Bitpanda, CoinGate, or Change serves clients remotely with zero physical footprint in the host state, the firm files STRs with its home FIU, which is legally required under AMLD6 Article 53 to forward cross-border intelligence spontaneously and promptly to the relevant host FIU via FIU.net.
3. Host Central Contact Point (CCP) Mandate: Under AMLD6 (expanding legacy payment/crypto rules to wider cross-border structures where proportionate thresholds are met), host member states may require out-of-state firms operating through local agents or establishments to appoint a resident Central Contact Point inside the host country to interface with the host AML supervisor and FIU.

How Frankfurt's AMLA Reshapes Cross-Border Financial Groups (Regulation 2024/1620)#

Prior to the 2024 EU AML Single Rulebook, an investment firm passporting into 20 member states had to reconcile 20 divergent national transpositions of CDD, UBO verification, and video-KYC onboarding rules (e.g., BaFin strict live-video Videoident rules vs NFC e-passport chip flows permitted by Bank of Lithuania or Austria's FMA). Under Regulation (EU) 2024/1624 (AMLR, directly applicable July 2027) and AMLA Regulation (EU) 2024/1620:

Modeling Cross-Border AMLA Selection Score & KYC Funnel Friction#

Under Article 12 of Regulation (EU) 2024/1620, an obliged credit or financial institution becomes eligible for direct AMLA Joint Supervisory Team oversight when it operates (via establishments or freedom to provide services above materiality thresholds of 20,000 host customers or EUR 50,000,000 transaction volume) in at least 6 Member States and scores in the highest residual-risk tier.

Central Contact Point (CCP) Powers Under Commission Delegated Regulation 2018/1108#

Where an EEA financial institution operates across host borders through networks of local agents or establishments meeting turnover and headcount triggers, host supervisors can mandate appointment of a locally resident AML Central Contact Point empowered to answer host FIU subpoenas within 24 hours and halt non-compliant local onboarding.

Avoiding Dual-FIU Tipping-Off Traps in Intragroup Escalations#

When a Madrid or Milan Article 35 branch files an urgent STR with Spain's SEPBLAC or Italy's UIF, the local branch MLRO must immediately notify the group-level MLRO at head office (for example, at UniCredit Bank Austria or Bitpanda) so the customer cannot simultaneously drain funds via a remote digital wallet in another country—unless the host FIU issues an explicit case-specific confidentiality restriction, aligning financial-crime freezes with MiFIR Article 26 T+1 transaction reporting.