Compliance Teams Face Reset as EU Delays Its Money Laundering Risk Map

Compliance officers at banks, payment companies and fintechs across the European Union are rebuilding their money laundering defenses around outdated guidance after the European Commission failed to deliver a scheduled update to its central threat map. The supranational risk assessment, or SNRA, was expected in October 2024, was pushed to June 2025, and slipped again by six months in January 2026. As of June 2026 it remained under internal review.

The Commission, the bloc's executive arm, is required to refresh the assessment every two years. The document draws on the national risk assessments of all 27 member states, along with input from academics, the private sector and agencies such as Europol, and runs to roughly 300 pages. It examines threats attached to dozens of businesses, products and services, including private banking, crowdfunding, cash-intensive operations, free trade zones and citizenship-by-investment programs.

What the outdated map leaves out

The most recent complete edition dates from October 2022, after earlier versions in June 2017 and July 2019. It flags familiar channels such as large cash deposits, cryptocurrencies and online gaming but says nothing about newer risks, including virtual IBANs and banking-as-a-service arrangements. Cross-border firms subject to anti-money laundering rules say they now work from a picture they know is behind events. One compliance officer in Luxembourg described the gap as a problem, saying firms rely on information they know is not current and fill the rest with other sources. The head of compliance at a Maltese payment service provider operating in all 27 member states made a similar point.

Some of the slack is being taken up by mutual evaluation reports from the Financial Action Task Force and by independent research from nongovernmental organizations and advocacy groups. These materials are partial substitutes at best, specialists say, because they are not built to the same scale or structure as the bloc-wide assessment. For compliance staff, the result is more manual work: mapping internal controls to older threat categories, documenting the alternative sources used, and explaining the approach to auditors and supervisors.

Supervisors push on analytics

The delay comes as international supervisors sharpen their focus on how banks assess and monitor risk. The Basel Committee on Banking Supervision issued a supervisory newsletter on money laundering and terrorist financing on October 19. According to Japan's Financial Services Agency and the Bank of Japan, which publicized the document on October 28, it summarizes a survey of how authorities collect data and apply risk assessment methods, and the findings of a workshop on the role of artificial intelligence and machine learning in transaction monitoring. Both institutions pointed readers to the full text published by the Bank for International Settlements.

That emphasis on analytics reflects a squeeze inside compliance departments. Detection systems are deliberately sensitive, and industry analyses cited in recent commentary suggest that as many as 90 percent of alerts generated by traditional transaction monitoring systems turn out to be false positives. Each one must be reviewed, investigated, documented and closed by an analyst. As sanctions lists, watchlists and other risk indicators change more frequently, ongoing monitoring has moved to the center of how firms keep an accurate view of customer risk.

What to watch next

The immediate question is timing. The Commission has not set a new publication date beyond confirming the document is still under internal review, leaving compliance teams without a clear signal on when a fresh edition will land. When it does, banks and payment firms will need to compare it against the national assessments, refresh their business-wide risk assessments and update customer due diligence procedures where new threats appear.

For people working in risk assessment operations, the episode shows how much of the job depends on external reference points that can move without warning. Analysts who can document alternative sources, justify the assumptions behind a control framework and explain gaps to a supervisor are likely to be in demand while the official picture lags.