The Italian AML framework beyond UIF

The Italian AML framework is more than the UIF SOS report. Alongside the suspicious-operation report and the daily Archivio Unico Antiriciclaggio (both already covered), Italian law imposes asset-freeze obligations coordinated by the Comitato di Sicurezza Finanziaria, centralised beneficial-owner data through the Registro Imprese, and a sectoral overlay through Banca d’Italia inspections with the Guardia di Finanza on the criminal-enforcement side. Passporting PSPs routinely build for the SOS and the archive and discover the other three streams during their first inspection or first sanctions match. This piece walks through the parts of the Italian AML framework that firms most often underestimate — with worked examples of how each stream bites in practice.

1. The full framework — five streams

Italian AML obligations sit in Decreto Legislativo 231/2007, refreshed through successive amendments transposing the EU AML directives. Five distinct streams flow out of it:

1. Suspicious-operation reporting — the SOS to UIF (already covered)
2. Daily AML archive — the Archivio Unico Antiriciclaggio (already covered)
3. Asset freezes — the sanctions regime coordinated by the Comitato di Sicurezza Finanziaria (CSF)
4. Beneficial-owner-register obligations — the Registro Imprese UBO data
5. Sectoral overlay — Banca d’Italia supervision and inspections, with Guardia di Finanza for criminal enforcement

2. The Comitato di Sicurezza Finanziaria

Operational implications for PSPs:

• Customer-base screening against the EU consolidated sanctions list and the national CSF listings
• Immediate freeze of matched assets, plus notification to the Ministry of Economy and Finance
• Reporting of declined transactions where the decline was driven by a sanctions match
• The sanctions-screening shift introduced by the IPR applies in Italy with this additional national overlay on top

Facts: an EU-passported payment institution operating in Italy runs its nightly customer-base rescreen and gets a strong-name match between an Italian-resident business customer and a designation on a national listing coordinated through the CSF — a listing that does not appear on the EU consolidated list.

What the rule says: screening against the EU list alone is not enough in Italy. A match against the national framework triggers the same operational consequence as an EU-list match: freeze the assets immediately and notify the competent national authorities, and do not tip off the customer.

What the practitioner does: freezes the balance at match confirmation, files the notification, records the decision trail, and — critically — verifies that the screening vendor’s list package actually includes the Italian national listings. Firms that configured “EU + UN + OFAC” and stopped there have a coverage gap that only surfaces on exactly this scenario.

3. The Italian beneficial-owner register

Italy implements the EU AML directives’ UBO-register obligation through Decreto Legislativo 90/2017 and subsequent implementing decrees. The register operates within the Registro Imprese (Chamber of Commerce) infrastructure, with a dedicated UBO section accessible to obligated subjects performing AML due diligence.

Post-CJEU access reality:

• The 2022 CJEU ruling (joined cases C-37/20 and C-601/20) invalidated the general-public-access regime
• Obligated subjects performing AML due diligence retain access on their statutory function
• Public authorities access independently
• Journalists and civil-society organisations access on a legitimate-interest basis

The Italian register interconnects with the EU Business Registers Interconnection System (BRIS), allowing cross-border access for obligated subjects performing due diligence on entities incorporated in other member states.

Facts: during onboarding of an Italian S.r.l., a PSP’s KYC analyst finds that the ownership chain documented by the customer names a different ultimate beneficial owner than the one the analyst identifies from the corporate documents.

What the rule says: the register is a verification aid, not a substitute for the firm’s own due diligence — the EU AML framework is explicit that obligated subjects cannot rely exclusively on register data, and expects discrepancies between a firm’s findings and register data to be flagged through the applicable reporting mechanism.

What the practitioner does: resolves the ownership question with the customer before activating the relationship, documents both sources and the conclusion in the file, and raises the discrepancy through the prescribed channel rather than silently adopting whichever version is more convenient. If the discrepancy pattern suggests deliberate concealment, the analyst escalates for SOS assessment.

4. Banca d’Italia’s sectoral overlay

Banca d’Italia supervises whether the firm has the right framework to detect and file — not just whether it filed. Inspections look at:

• The entity-level risk assessment (valutazione del rischio)
• The internal-control framework — conformità, controllo permanente, controllo periodico
• The transaction-monitoring rules, calibrated to the firm’s actual risk profile
• The investigation workflow — alert generation, triage, decision, filing
• The named-officer arrangement — responsabile antiriciclaggio, delegato per le segnalazioni, and AML oversight at board level
• The training programme

Banca d’Italia can impose administrative sanctions on the firm and personally on the responsabile antiriciclaggio under the D.Lgs 231/2007 sanction provisions. A monitoring rulebook copied from the home state without Italian calibration — no Italian typologies, no UIF anomaly indicators mapped — is a standard inspection finding.

5. The Guardia di Finanza coordination

The Guardia di Finanza is the Italian financial-police force with criminal-investigation jurisdiction over money-laundering and terrorism-financing offences. UIF disseminates intelligence to the Guardia di Finanza; the Guardia di Finanza may request additional information from obligated subjects under formal investigation powers.

Facts: a passporting PSP receives a formal Guardia di Finanza request for account records and transaction history on two customers, referencing an ongoing investigation.

What the rule says: formal requests under investigation powers must be answered within the terms set in the request; the confidentiality regime applies — the customers must not be informed, and the response sits alongside (not instead of) the firm’s own SOS obligations if the firm’s review of the same facts raises suspicion.

What the practitioner does: routes the request to the delegato and legal counsel, verifies authenticity, answers completely and on time from the AML archive, and runs an internal review of the named customers — if that review surfaces suspicion the firm had missed, it files the SOS now rather than waiting to be asked why it never did.

6. For passporting PSPs

An IMEL or IP authorised elsewhere in the EU and operating in Italy is an obligated subject under D.Lgs 231/2007 for Italian-attributable activity. The full framework applies — all five streams, not just the SOS. The AML representative for Italian activity (the responsabile antiriciclaggio) should typically be Italy-resident — see our AML representative across the EU piece.

FAQ

What to do, today

• MLRO: map your AML programme against the five Italian streams and identify which ones your home-state framework never built for.
• Screening owner: confirm the customer-base screening covers the EU consolidated list plus the Italian national listings, and test the freeze-and-notify runbook.
• KYC lead: integrate Registro Imprese UBO queries into legal-entity onboarding and periodic review, with a documented discrepancy procedure.
• Compliance: document the entity-level valutazione del rischio with Italian typologies and refresh it annually — it is the first document an inspection asks for.
• Board / country manager: coordinate the responsabile antiriciclaggio appointment with the UIF and Banca d’Italia notifications, and define the intake process for Guardia di Finanza requests before the first one arrives.

Related: UIF anomaly indicators · Filing a SOS via Infostat-UIF · UIF Italy · AML representative across the EU · Sanctions screening at instant-payment speed · Comunicazioni oggettive — the monthly UIF cash return · The EU AML package — AMLR, AMLD6 and AMLA