Skip to content
EBA · EU-wide

AML data returns compared — beyond the SAR

Fintech Passport
August 20, 2026 · 5-min read
AML data returns compared — beyond the SAR

If your AML reporting inventory contains only suspicion reports, it is incomplete in every market in this cluster. Alongside the SAR sit systematic declarations, aggregate statistical returns, threshold-driven communications and maintained archives — obligations that are owed whether or not anything suspicious happened. That is what makes them dangerous: none of them generates a signal by not being filed.

1. What each market asks for beyond the SAR

MarketObligations beyond suspicion reporting
ItalyThree: SARA monthly aggregate statistics, comunicazioni oggettive on objective criteria, and the Archivio Unico Antiriciclaggio
SpainThe monthly systematic declaration, the account-ownership file, and aggregated mule-account reporting
FranceThe COSI systematic-communications regime
NetherlandsA different threshold rather than a different return — the unusual-transaction standard with objective indicators
GermanyA registration duty that binds even where no report is ever filed
LuxembourgFiling through goAML with the abstention and blocking powers attached

2. Four trigger types, four controls

The useful way to organise a multi-market AML reporting inventory is not by country but by trigger, because the trigger determines the control:

  • Suspicion. Control: evidence that assessments are being recorded — including the negative ones. Under the AMLR, the record of an assessment is retained whether or not it results in a report.
  • Calendar. Control: a due-date monitor with an acknowledgement check. This is the only trigger type a conventional reporting calendar handles well.
  • Objective criteria or threshold. Control: a reconciliation between the population that should have generated a filing and the population that did. A due-date monitor cannot detect a missing criteria-driven filing.
  • Maintained archive or register. Control: periodic completeness reconciliation against an independent source, plus a change trigger between reconciliations.

3. The threshold question is the sharpest one

The Dutch position is worth isolating because it changes detection rather than reporting. The standard is unusual, not suspicious, and it is supported by objective indicators as well as subjective ones. That is a lower and differently framed trigger than most member states apply.

The consequence is architectural: a monitoring model calibrated to a suspicion standard and deployed in the Netherlands will under-report by design, and no amount of reporting-process discipline fixes it — the gap is upstream of the filing. Firms passporting into the Netherlands should calibrate to the Dutch standard from launch rather than retro-fitting, because retro-fitting means re-reviewing the whole period since launch.

4. Registration duties that bind before anything else

Two markets attach express obligations to enrolment rather than to filing. Germany’s goAML registration duty binds obliged entities whether or not a suspicion report is ever made. Italy requires registration on the reporting portal within 30 days of commencing activity, independently of any filing deadline.

These are breached by inaction rather than by lateness, so they generate no reminder and appear on no calendar. The control for a state rather than an event is a periodic attestation — someone confirming, on a cycle, that the enrolment exists and works.

5. Building a multi-market inventory

Facts: a firm operating in five markets maintains one AML reporting procedure describing SAR filing.

What is missing: in Italy, three further obligations. In Spain, a systematic declaration and an account file. In France, the systematic-communications regime. In the Netherlands, a materially different detection threshold. In Germany, a registration duty.

What the practitioner does: rebuilds the inventory as a matrix of market against trigger type, assigns each cell a named owner and the control appropriate to its trigger, and treats the detection layer as a separate question from the filing layer — because the Dutch threshold and the Italian objective criteria are both detection problems dressed as reporting problems.

FAQ

Which market has the most AML data obligations?

Italy, with four distinct obligations to one intelligence unit on four different triggers — only one of which is suspicion-based.

What makes the Dutch regime different?

The threshold. The standard is “unusual” rather than “suspicious”, supported by objective indicators, so detection has to be calibrated differently rather than the filing process changed.

Why organise by trigger rather than by country?

Because the trigger determines the control. Calendar obligations need a due-date monitor; threshold obligations need a population reconciliation; registers need a completeness check; suspicion obligations need evidence that assessments are recorded.

Which of these fail silently?

All of the non-suspicion ones. A systematic declaration, an aggregate statistical return and a maintained archive each produce no signal when they stop being produced.

6. Detection and filing are different projects

The closing point is the one that determines whether any of this works. Two of the obligations compared above — the Dutch unusual-transaction standard and Italy’s objective criteria — are detection requirements wearing reporting clothes. No amount of filing discipline compensates for a monitoring model that never surfaces the population in the first place.

That argues for splitting the inventory in two when it is built. One half asks what must we detect, and is owned by the financial-crime function. The other asks what must we send, to whom, on what trigger, and is owned by reporting. Firms that keep them in one document consistently under-invest in the first half, because the second half is the one with visible deadlines.


Related: SARA in Italy · Reporting suspicions under the AMLR · The Italian reporting calendar

Related reads.