Article 55 sets a floor on the maximum, doubles the fixed amount for small institutions, and measures turnover at the top of the group.
Under Article 55 of AMLD6, the maximum fine available for a serious, repeated or systematic AML breach by a credit or financial institution must be at least the higher of €10 million and 10 per cent of total annual turnover, measured on the ultimate parent's consolidated accounts where the entity belongs to a group. For an illustrative bank with €2.4 billion of turnover that is €240 million. For other obliged entities it is at least the higher of twice the benefit derived from the breach and €1 million.
Worked in full in The EU AML Handbook by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
The figures below are the floors on the maximum that Member States must make available when they transpose the directive. They are not tariffs. A national law may set higher maxima, and the fine actually imposed in a case depends on the circumstances the supervisor weighs, such as the gravity and duration of the breach, the entity's financial strength, the benefit derived, cooperation and previous breaches, and on the entity's ability to pay. The entities are illustrative.
| Who | Maximum must be at least |
|---|---|
| Credit or financial institution, legal person | Higher of €10m and 10% of total annual turnover |
| Credit or financial institution, natural person | €5m |
| Other obliged entities | Higher of twice the benefit derived and €1m |
| For reference, AMLD4 (Directive 2015/849) Article 59(3), institutions | €5m or 10% of turnover (legal persons); €5m (natural persons) |
Institutions: maximum = MAX(€10m, 10% x total annual turnover)
Other obliged entities: maximum = MAX(€1m, 2 x benefit derived)
Turnover where the percentage takes over = €10m / 10% = €100m
Bank, turnover €2,400m: 10% = €240m, above €10m, so the maximum is €240m.
Payment institution, turnover €45m: 10% = €4.5m, below the floor, so the maximum is €10.0m.
In Excel, with turnover in € million in B2: =MAX(10, 10%*B2); for a non-financial obliged entity with the benefit in B3: =MAX(1, 2*B3).
Below €100m of turnover the fixed floor binds and the maximum is a larger share of the business the smaller the entity. Above it, the maximum is a flat 10 per cent.
| Total annual turnover | AMLD6 maximum | As % of turnover | AMLD4 (€5m floor) | Increase |
|---|---|---|---|---|
| 20 | 10.0 | 50.0% | 5.0 | 5.0 |
| 50 | 10.0 | 20.0% | 5.0 | 5.0 |
| 75 | 10.0 | 13.3% | 7.5 | 2.5 |
| 100 | 10.0 | 10.0% | 10.0 | 0.0 |
| 500 | 50.0 | 10.0% | 50.0 | 0.0 |
| 2,400 | 240.0 | 10.0% | 240.0 | 0.0 |
| 10,000 | 1,000.0 | 10.0% | 1,000.0 | 0.0 |
The AMLD4 column reads Article 59(3) of Directive 2015/849 as the higher of €5m and 10 per cent. That text says "€5m or 10% of the total annual turnover" without the words "whichever is higher" that AMLD6 now adds, so the AMLD4 figures are the common reading rather than a quotation. Most AMLD6 provisions must be transposed by 10 July 2027; until national law changes, the transposed AMLD4 figures continue to apply.
The change from AMLD4 is concentrated at the small end. Doubling the fixed floor from €5m to €10m moves the crossover from €50m of turnover to €100m. For a payment or e-money institution, a small investment firm or a crypto-asset service provider with €20m of turnover, the minimum ceiling that national law must make available has doubled, to half a year's turnover. For a large bank nothing has changed: 10 per cent was already the binding figure.
These are maxima that a breach must be capable of attracting, not expected fines. Their practical use is in a board's risk appetite statement and in a provision or contingent liability discussion, where the ceiling is the first number anyone asks for.
For estate agents, notaries, dealers in high-value goods and the other non-financial obliged entities, the maximum is tied to the benefit derived from the breach, where it can be determined, with €1m as the floor.
| Benefit derived | Twice the benefit | Maximum |
|---|---|---|
| 0.3 | 0.6 | 1.0 |
| 0.5 | 1.0 | 1.0 |
| 2.5 | 5.0 | 5.0 |
The benefit test starts to bind at €0.5m of benefit. Above that, every euro earned from the breach adds two to the exposure, which is the directive's way of making sure a breach cannot be profitable even when it is caught.
The most expensive error in an exposure estimate is to use the regulated entity's own turnover when it belongs to a group that prepares consolidated accounts. Article 55(3) points to the latest available consolidated accounts of the ultimate parent undertaking. The €45m payment institution above has a €10.0m maximum on its own accounts. If it is a subsidiary of a group with €2,400m of consolidated turnover, the maximum is €240m, 24 times larger, for the same breach in the same entity. Groups that run small regulated subsidiaries for payments or crypto-asset services should size their AML exposure on the group figure, and their governance of those subsidiaries accordingly.
A second error is to treat the figures as the most a supervisor can impose. They are floors on the maximum: Member States may empower supervisors to go higher, and natural persons in management face their own €5m figure.
The directive governs national supervisors. For the selected obliged entities that AMLA supervises directly, the authority's own founding regulation sets its sanctioning powers, so a group with an AMLA-supervised entity and smaller nationally supervised subsidiaries should map which regime applies to which entity before it sizes the exposure in one number.
For an institution, take the higher of €10m and 10 per cent of turnover, using the ultimate parent's consolidated turnover where there is one: €240m for the illustrative €2.4bn group, and €240m for its smallest subsidiary too. Sanctions sit beside the AMLR, AMLD6 and AMLA changes the book walks through; its back-book workbook and working documents are in the free workbook for this book. For the risk side of the same programme, see how to calculate a customer AML risk score.
At €100 million of total annual turnover, where 10 per cent equals the €10 million fixed amount. Below it, the €10 million floor binds and represents a larger share of the business: 20.0 per cent of turnover for a €50 million firm and 50.0 per cent for a €20 million one. On the usual reading of AMLD4, with a €5 million fixed amount, the crossover was €50 million.
Where the entity is part of a group required to prepare consolidated accounts, AMLD6 uses the turnover in the latest consolidated accounts of the ultimate parent. A €45 million payment institution has a €10.0 million maximum on its own figures but €240 million inside a €2,400 million group, 24 times more.
At least the higher of twice the benefit derived from the breach, where it can be determined, and €1 million. A breach that earned €0.3 million gives a €1.0 million maximum; one that earned €2.5 million gives €5.0 million. Member States may set higher maxima.
This article is one calculation from The EU AML Handbook. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: regulation, compliance and banking → · All 453 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.