Which anti-money-laundering rules apply to us today?

The obligations that bind you now come from the Union anti-money-laundering directive as transposed into the national law of the Member State concerned, so the detail differs between Member States and supervision is national. The 2024 package moves much of this into a directly applicable regulation and establishes a Union authority, but from a later date set in those instruments.

AML & DORA authorisation in the EU

Direct answer

Anti-money-laundering rules and DORA are two frameworks, not one. Neither is an authorisation regime in its own right.1 4 Anti-money-laundering obligations reach a firm through the Union directive as transposed into national law, so the detail differs by Member State; the 2024 package replaces much of that with a directly applicable regulation, but from a later date set in the instruments themselves.4 5 6 DORA applies to the closed list of financial entities in Article 2(1), excludes some entities entirely and applies a simplified framework to others.1 2 A firm does not become subject to DORA by applying for an authorisation, so what an authority examines at application is the ICT and security evidence the sectoral framework itself requires. An applicant that already holds another authorisation may already be a listed financial entity in that other capacity, and DORA already binds it there.1 8

Who this applies to

Firms that are obliged entities under national anti-money-laundering law4
The financial entities listed in Article 2(1) of DORA, which is a closed list1
ICT third-party service providers to those financial entities3

Regulated activities

Customer due diligence, monitoring and sanctions screening under national anti-money-laundering law4
Business-wide risk assessment and governance
ICT risk management, incident reporting and resilience testing under DORA, for entities within its scope1
ICT third-party risk management and the register of information3

Routes to market

Evidence built into the authorisation file

Build the financial-crime framework and the ICT and security evidence the sectoral application actually asks for, rather than a generic programme that may not yet bind you.1 8

Remediation programme

Close gaps identified in a readiness review before submission or supervision.

Capital and substance

Anti-money-laundering: a compliance function with local substance and independence, sized to the national obligations that apply.4
DORA, for entities within its scope: ICT governance, a register of information on ICT third-party arrangements, incident reporting and resilience testing.3
Some entities are outside DORA entirely, and others are subject to a simplified ICT risk management framework, so the depth required is not uniform.1 2
At application stage, the security and ICT evidence required by the sectoral framework, such as the security policy document a payment institution applicant must submit.1 8

Authorisation stages

1
Establish which framework binds you
Confirm your national anti-money-laundering obligations, and whether you are a listed financial entity under DORA already, in full or in simplified form.1 4
2
Risk assessment
Complete the business-wide financial-crime risk assessment and, where DORA applies, the ICT risk assessment.1
3
Framework build
Implement controls, policies and monitoring.
4
Evidence and ongoing supervision
Prepare documentation and testing results, and maintain reporting over time.

Where applications commonly fail

Treating anti-money-laundering and DORA as one combined regime with one uniform standard1 4
Planning against the 2024 anti-money-laundering package as though it already applied5 6
Assuming an application by itself brings a firm inside DORA, or that holding another authorisation keeps it outside1 8
Weak sanctions screening and transaction monitoring
Incomplete register of information and third-party oversight3

Frequently asked questions

It depends on entity type. DORA applies to the financial entities listed in Article 2(1), which is a closed list, and to ICT third-party service providers. Article 2(3) excludes certain entities entirely, and Article 16 applies a simplified ICT risk management framework to others. It is not a general obligation on every regulated firm.

Applying does not by itself bring you inside DORA. What an authority examines at application is the ICT and security evidence the sectoral framework requires, for example the security policy document a payment institution applicant must submit. If you already hold another authorisation that makes you a listed financial entity, DORA already binds you in that capacity, independently of the application.

Primary sources for this page

8 citations, each to the article or section the statement rests on. The numbers beside a statement point to the citation behind it. Always confirm against the current official text.

Last updated 2026-08-21. 3 min read, calculated from 656 words.

AML and DORA: two separate frameworks, not one regime