ENRegulation
The anti-money laundering regulatory framework
Updated as at 30 settembre 2026
This page summarises the anti-money laundering rules in force in Italy and those the European Union has already adopted. It is meant to help you find your bearings. It does not replace the official texts, which you will find at the bottom, or an opinion on your case.
Who is obliged
Article 3 of Legislative Decree no. 231 of 21 November 2007 divides the obliged entities into five categories.
- Banking and financial intermediaries: banks, Poste Italiane, payment and electronic money institutions, SIMs, SGRs, intermediaries entered on the register under article 106 of the Consolidated Banking Act, Cassa depositi e prestiti, insurance undertakings and intermediaries in the life classes, trust companies (fiduciarie) entered on the register, financial advisers, crypto-asset service providers. The list in the law is longer.
- Other financial operators: trust companies (fiduciarie) not entered in the register, credit brokers, financial agents, currency exchangers.
- Professionals: accountants and bookkeeping experts, labour law consultants, those who provide services in accounting and tax matters (including tax assistance centres and patronati), statutory auditors. Notaries and lawyers when they carry out financial or real estate transactions on behalf of the client, or assist them in real estate, financial and corporate transactions.
- Other non-financial operators: dealers in works of art and antiques, professional gold operators, estate agents, those who hold and transport valuables, civil mediators, those who recover debts on behalf of third parties.
- Gambling service providers: online and land-based gambling under licence, casinos.
Providers of services relating to companies and trusts whose activity is subject to a national licensing or registration regime are also obliged entities (paragraph 6-bis).
What they must do
Assess their own money laundering risk and put in place proportionate organisation, procedures and controls (articles 15 and 16).
Carry out customer due diligence (articles 17 et seq.): identify the customer, the person acting on its behalf and the beneficial owner (article 20), understand the purpose and nature of the relationship, and monitor it for as long as it lasts. Verification is simplified where the risk is low (article 23) and enhanced where it is high (article 24), for example with politically exposed persons or with customers linked to high-risk third countries.
Refrain from entering into the relationship or carrying out the transaction when customer due diligence cannot be completed (article 42).
Keep documents, data and information for ten years from the end of the relationship, the professional service or the occasional transaction (article 31).
Report suspicious transactions to the UIF without delay, where possible before carrying them out (article 35), and without letting the customer or third parties know that a report has been made (article 39).
Send the UIF the objective communications, where provided for (article 47).
Who supervises
The sector supervisory authorities, that is the Bank of Italy, IVASS and Consob, issue the implementing provisions and supervise the entities within their remit. For professionals this is done by self-regulatory bodies, such as professional associations.
The UIF, the Financial Intelligence Unit for Italy, operates within the Bank of Italy. It receives and analyses suspicious transaction reports, and publishes the indicators of anomaly and the instructions for reporting.
The Ministry of Economy and Finance is responsible for prevention policies and relies on the Financial Security Committee. The Guardia di Finanza, with its Special Currency Police Unit, and the Anti-Mafia Investigation Directorate examine the reports in depth.
Outside Italy the FATF sets the international standards, its 40 Recommendations, and evaluates the systems of individual countries. In Europe there is now also AMLA, discussed further below.
The Provisions of the Bank of Italy and of the UIF
- Provisions on customer due diligence (30 July 2019), amended in 2023 and extended in 2025 to crypto-asset service providers.
- Provisions on organisation, procedures and internal controls (26 March 2019), updated several times since 2023.
- Provisions on the retention and making available of documents, data and information (2020).
- UIF: the indicators of anomaly (measure of 12 May 2023, in force from 1 January 2024), the instructions for reporting suspicious transactions and those on objective communications.
The new European framework
In 2024 the Union adopted three acts that change the structure of the rules.
Regulation (EU) 2024/1624 brings the obligations of obliged entities into a single regulation, identical and directly applicable throughout the Union. It applies from 10 July 2027; to football agents and professional football clubs from 10 July 2029.
Directive (EU) 2024/1640, the sixth, concerns supervisory authorities, financial intelligence units and registers of beneficial owners. It must be transposed by 10 July 2027; different deadlines are set for some provisions. From the same date Directive (EU) 2015/849 is repealed.
Regulation (EU) 2024/1620 establishes AMLA, the European Authority for Anti-Money Laundering and Countering the Financing of Terrorism, based in Frankfurt. It has applied since 1 July 2025. AMLA coordinates the national authorities and from 2028 will directly supervise a small group of credit and financial institutions: those with a high risk profile operating in several Member States. The first selection begins by 1 July 2027.
Until 10 July 2027 the obligations remain those of the 2007 decree and its implementing provisions, which will have to be adapted to the new framework.
Sanctions
Administrative sanctions under decree 231/2007:
- customer due diligence omitted (article 56), record keeping omitted or late (article 57): 2,000 euros; if the breaches are serious, repeated, systematic or multiple, from 2,500 to 50,000 euros;
- suspicious transaction not reported (article 58), unless the act constitutes an offence: 3,000 euros; in serious, repeated, systematic or multiple cases, from 30,000 to 300,000 euros. If the breach produced an economic advantage, the maximum may rise to twice the advantage and in any case be not less than 450,000 euros; if the advantage cannot be determined, it may reach one million euros;
- banks and financial intermediaries (article 62), for serious, repeated, systematic or multiple breaches: from 30,000 to 5,000,000 euros, or 10% of total annual turnover, where this amount exceeds 5 million and the turnover can be determined. Those with administration, management or control functions are liable to from 10,000 to 5,000,000 euros and may be barred from the function for six months to three years.
Criminal sanctions under the same decree (article 55):
- falsifying customer due diligence or record keeping data, using false data, and the customer who provides it: imprisonment from six months to three years and a fine from 10,000 to 30,000 euros;
- revealing to the customer or to third parties that a report has been made: detention from six months to one year and a fine from 5,000 to 30,000 euros.
In the Criminal Code, money laundering (article 648-bis) and the use of money, assets or benefits of illicit origin (article 648-ter) are punished with imprisonment from four to twelve years and a fine from 5,000 to 25,000 euros. Self-laundering (article 648-ter.1) with imprisonment from two to eight years and a fine from 5,000 to 25,000 euros. The penalty increases if the offence is committed in the exercise of a professional activity, and for self-laundering also a banking or financial one. It decreases when the money comes from less serious offences.
The company itself is also liable for these offences (Legislative Decree 231/2001, article 25-octies): a fine of 200 to 800 quotas, 400 to 1,000 when the offence from which the assets derive is punishable by imprisonment of more than five years at the maximum, and disqualification sanctions of up to two years.
Sources
See the 30 settembre 2026.
- EUR-Lex: Regulation (EU) 2024/1624, Directive (EU) 2024/1640, Regulation (EU) 2024/1620.
- Normattiva: Legislative Decree no. 231 of 21 November 2007; Criminal Code, articles 648-bis, 648-ter and 648-ter.1; Legislative Decree no. 231 of 8 June 2001, article 25-octies.
- Bank of Italy: archive of anti-money laundering rules.
- UIF: indicators of anomaly.