Commission Delegated Regulation (EU) 2024/595: The Regulatory Foundation of the EU AML/CFT Central Database
With Commission Delegated Regulation (EU) 2024/595, the European Union has created the operational and legal framework for one of the most important supervisory developments in European AML history: the EU-wide AML/CFT central database, commonly known as EuReCA.
The Regulation supplements Regulation (EU) No 1093/2010 and establishes the detailed rules governing:
- material AML/CFT weaknesses,
- supervisory reporting obligations,
- information exchange,
- supervisory coordination,
- confidentiality,
- and data protection.
Although the Regulation appears highly technical, its implications are strategic and transformational.
For the first time, the EU is creating a centralized supervisory intelligence infrastructure capable of identifying, aggregating, and disseminating AML/CFT weaknesses across the entire European financial system.
What Is the Purpose of Regulation (EU) 2024/595?
The Regulation operationalizes Article 9a of Regulation (EU) No 1093/2010 by specifying:
- what constitutes a material AML/CFT weakness,
- what information must be reported to the EBA,
- how the information must be analyzed,
- and how the information may be shared among supervisory authorities.
The goal is straightforward:
To transform fragmented national AML supervision into a coordinated European supervisory intelligence system.
The Regulation effectively establishes the legal backbone of EuReCA.
Why the EU Created the AML/CFT Central Database
The EU recognized a structural problem in AML supervision:
- national supervisors operated in silos,
- supervisory findings were not systematically shared,
- material weaknesses often remained locally contained,
- and cross-border risks were difficult to detect early.
Multiple European AML scandals exposed these weaknesses.
The solution was EuReCA:
a centralized supervisory database enabling the EBA and competent authorities to:
- monitor material AML/CFT weaknesses across Europe,
- identify recurring deficiencies,
- detect systemic risk patterns,
- and improve supervisory convergence.
What Is a “Weakness” Under the Regulation?
One of the most important aspects of the Regulation is the intentionally broad definition of a weakness.
Article 2 defines three categories:
1. Actual Breaches
A direct breach of AML/CFT requirements identified by a reporting authority.
2. Potential Breaches
Situations where supervisors have reasonable grounds to suspect:
- a breach,
- or an attempted breach
of AML/CFT obligations.
This is crucial because the reporting obligation does not depend on a finalized enforcement finding.
3. Ineffective or Inappropriate Application
This includes:
- inadequate implementation,
- weak internal controls,
- ineffective AML frameworks,
- or policies unlikely to achieve AML/CFT objectives.
This dramatically expands the supervisory scope.
The database is therefore not merely an enforcement register — it is also a control effectiveness intelligence system.
What Makes a Weakness “Material”?
Article 3 introduces the materiality framework.
A weakness is material if it:
- reveals,
- or could lead to,
significant failures in AML/CFT compliance.
The Regulation explicitly requires authorities to assess:
- repetition,
- duration,
- gravity,
- management negligence,
- wilful misconduct,
- ML/TF exposure,
- impact on financial integrity,
- impact on financial stability,
- and impact on market functioning.
This is a highly risk-oriented and forward-looking approach.
Importantly:
the weakness does not need to have already caused harm.
The mere capability to create significant AML/CFT failures can already trigger reporting obligations.
The Regulation Covers Far More Than AML Authorities
One of the most underestimated aspects of the Regulation is its extraordinarily broad supervisory scope.
The reporting framework applies not only to AML supervisors, but also to:
- prudential supervisors,
- conduct authorities,
- payment institution authorities,
- resolution authorities,
- designated authorities,
- and even the Single Resolution Board.
This means AML/CFT weaknesses may emerge from:
- authorization procedures,
- SREP reviews,
- outsourcing reviews,
- governance assessments,
- ICT risk supervision,
- fit-and-proper assessments,
- liquidity reviews,
- payment institution supervision,
- and consumer protection activities.
The result is a truly integrated supervisory intelligence model.
What Information Must Be Reported?
The Regulation requires extensive reporting obligations.
General Information
Authorities must report:
- identification of the institution,
- group structure,
- branches,
- agents and distributors,
- cross-border activities,
- college participation,
- business size,
- customer base,
- assets under management,
- distribution network size,
- and AML/CFT risk profiles.
Information on Material Weaknesses
Authorities must provide:
- the type of weakness,
- reasons for materiality,
- descriptions,
- affected products and services,
- timeline,
- origin of the information,
- cross-border impacts,
- remediation context,
- and links to natural persons where relevant.
Information on Measures Taken
Authorities must also report:
- supervisory measures,
- sanctions,
- penalties,
- remediation actions,
- publication status,
- appeals,
- and remediation timelines.
This creates unprecedented supervisory transparency across Europe.
Cross-Border Supervision Is a Core Focus
The Regulation strongly emphasizes:
- cross-border financial groups,
- branches,
- passporting structures,
- agents,
- and distributors.
Both home and host authorities are required to report material weaknesses independently.
This directly addresses historical AML failures involving:
- payment institutions,
- e-money institutions,
- fintechs,
- and cross-border distribution models.
The message is clear:
The EU wants full visibility across the entire European supervisory perimeter.
EuReCA Is an Early-Warning System
The Regulation repeatedly demonstrates that EuReCA is not a passive database.
It is designed as:
- an EU-wide early-warning mechanism,
- a centralized risk intelligence platform,
- and a supervisory coordination engine.
The EBA may:
- analyze information on a risk basis,
- combine data from other supervisory sources,
- identify systemic patterns,
- support investigations,
- and proactively disclose information to authorities.
This is one of the clearest signs of the EU’s transition toward centralized AML supervision.
The Link to AMLA
Regulation (EU) 2024/595 is strategically aligned with:
- AMLA,
- AMLR,
- and the broader EU AML reform package.
EuReCA provides the operational intelligence infrastructure necessary for:
- harmonized AML supervision,
- supervisory convergence,
- centralized risk analysis,
- and coordinated EU-wide interventions.
In practical terms:
- EuReCA becomes the supervisory intelligence backbone,
- while AMLA becomes the central supervisory authority.
Data Protection and Confidentiality
Because the database contains highly sensitive supervisory and personal data, the Regulation establishes strict confidentiality rules.
The framework incorporates:
- GDPR principles,
- proportionality,
- purpose limitation,
- data minimization,
- confidentiality,
- professional secrecy,
- and storage limitations.
The EBA may retain personal data for up to 10 years.
The Regulation also specifies which personal data categories may be processed, including:
- management body members,
- beneficial owners,
- customers,
- key function holders,
- and individuals linked to material weaknesses.
This demonstrates how seriously the EU treats supervisory data governance.
Why Financial Institutions Should Care
Many institutions still incorrectly assume that EuReCA only affects regulators.
That is a dangerous misunderstanding.
The Regulation fundamentally changes the supervisory environment.
Institutions will face:
- greater supervisory transparency,
- centralized visibility of weaknesses,
- more consistent remediation expectations,
- stronger cross-border coordination,
- and increased scrutiny of governance effectiveness.
Weak AML controls will no longer remain isolated local issues.
The Strategic Message of Regulation (EU) 2024/595
The Regulation represents a structural shift in European AML supervision.
The EU is moving:
- from fragmented supervision,
- toward centralized supervisory intelligence,
- harmonized risk assessment,
- integrated supervisory coordination,
- and data-driven AML oversight.
EuReCA is one of the first concrete operational manifestations of that new supervisory philosophy.
Key Takeaways
Commission Delegated Regulation (EU) 2024/595 is far more than a technical reporting standard.
It establishes:
- the operational architecture of EuReCA,
- harmonized definitions of material AML/CFT weaknesses,
- centralized supervisory intelligence,
- and the foundation for future AMLA-led supervision.
For financial institutions, the implications are profound:
The era of isolated national AML supervision is ending.
The future belongs to:
- centralized supervisory intelligence,
- harmonized reporting,
- cross-border transparency,
- and continuously assessable AML control effectiveness.
EuReCA is not simply a database.
It is the beginning of a new European AML supervisory operating model.
Downloads
Sources:
https://eur-lex.europa.eu/eli/reg_del/2024/595/oj/eng
https://www.eba.europa.eu/regulatory-technical-standards-central-database-amlcft-eu