Country-specific guidance Current

What's EU-wide and what your member state sets independently

Treating the EU as one uniform jurisdiction is the single most common mistake in this area.

It's tempting to treat "EU rules" as one uniform standard, but the EU genuinely isn't a single national jurisdiction. This guide sets out what actually applies uniformly across every member state, and what each member state still sets on its own. It is general information, not legal or compliance advice.

Action plan

1 Know what's genuinely uniform across the EU A Regulation applies the same way everywhere, automatically; a Directive doesn't.

GDPR is a Regulation, and its own text confirms it is binding in its entirety and directly applicable in every member state, with no national transposition step. The EU's new Anti-Money Laundering Regulation is also a Regulation with the same direct-applicability text, though it only becomes directly applicable from 10 July 2027. Until that date, the equivalent AML rules sit in each member state's own transposed national law.

  • Treat GDPR as genuinely uniform, EU-wide, directly applicable law today
  • Treat the new EU AML Regulation as becoming equally uniform, but only from 10 July 2027
  • Don't assume every EU compliance rule works the same way as GDPR does

Done when: The distinction between a directly applicable EU Regulation and a nationally transposed EU Directive is understood and applied correctly

EUR-Lex: General Data Protection Regulation (EU) 2016/679, Article 99
2 Know what each member state still sets on its own A Directive sets a minimum standard; each member state writes its own law to meet it, and supervises it.

The EU's anti-money laundering directive layer requires member states to transpose its minimum standards into their own national law, including which specific authority supervises each type of obliged entity. The EU's new supervisory authority, AMLA, coordinates national authorities and, by its own description, directly supervises a limited number of significant, cross-border financial institutions from 2028; it does not replace the member-state-level supervisors most professional-services firms deal with. Company-law registration and record-keeping detail, and professional-conduct rules for accountants, auditors, and lawyers, are also set at member-state level.

  • Expect a different national AML supervisor depending on your profession and member state
  • Don't expect AMLA itself to directly supervise most professional-services obliged entities
  • Confirm company-law and professional-conduct detail against your own member state's rules, not a generic EU summary

Done when: The specific national supervisory authority and professional-conduct body relevant to your firm's member state and profession have been confirmed

AMLA: Authority for Anti-Money Laundering and Countering the Financing of Terrorism
3 Never assume one member state's specific rule applies to another Even within a single member state, supervision can differ by profession.

In Germany, for example, AML supervision is split by profession: banks and other financial institutions answer to BaFin, lawyers and legal advisers to their local Bar Association, notaries to the president of the relevant regional court, and auditors, registered accountants, and tax advisers to their own professional chamber. That kind of variation exists within one member state alone, which is why a specific national rule confirmed for one profession, or one country, should never be assumed to carry over to another.

  • Confirm the specific national supervisor for your own profession in your own member state
  • Don't reuse a rule confirmed in one member state as if it applied in another
  • Re-check this whenever your firm takes on a client or engagement involving a different member state

Done when: The firm confirms member-state and profession-specific detail directly, rather than generalising from one example