What are the anti-money laundering (AML) laws in Italy?
The Bank of Italy's eight AML fines dated 9 September 2025 to 29 September 2026 show what its inspectors test. All eight cite due diligence gaps, seven weak active cooperation (detecting and reporting suspicious transactions), four customer profiling. So an inspector asks how this customer was profiled, and how a suspicious case would reach the UIF.
Understanding the answers starts with Legislative Decree 231/2007, amended by Decrees 90/2017, 125/2019 (5AMLD), 210/2025 and 122/2026.
Decree 231/2001 is a different law, on company liability, though its art. 25-octies fines companies for the laundering offenses and receiving stolen goods.
The offenses sit in the Criminal Code (arts. 648-bis, 648-ter and 648-ter.1). Italy transposed 6AMLD, the criminal law Directive (EU) 2018/1673, through Decree 195/2021, in force 15 December 2021. AMLD6, Directive (EU) 2024/1640, is a different text: Decree 122/2026 transposed its beneficial ownership access articles 11, 12, 13 and 15.
As in most AML regulation, the layers split the work: the decree sets the duties, the Criminal Code the offenses, and the Bank of Italy's provisions of 26 March 2019 (organization and controls) and 30 July 2019 (due diligence) the method for the firms it supervises.
Which authorities regulate and enforce AML compliance in Italy?
| Body | AML role (Decree 231/2007, in force November 2026) | Who it covers |
|---|---|---|
| Bank of Italy | Sector supervisor (arts. 1(2)(c), 7); fines banks and financial intermediaries, IVASS doing so for insurers (art. 62(7)) | Banks, Poste Italiane, payment and electronic money institutions, other intermediaries |
| UIF (Unità di Informazione Finanziaria per l'Italia) | Italy's financial intelligence unit (FIU), set up at the Bank of Italy, autonomous and operationally independent (art. 6(1)); receives and analyzes reports (art. 6(4)(a)); can suspend a suspicious transaction for up to five working days if investigations are not harmed (art. 6(4)(c)); inspects reporting (art. 6(4)(f)) | Every obliged entity, for reporting |
| IVASS | Sector supervisor for insurance (art. 1(2)(c)) | Life insurers and insurance intermediaries (art. 3(2)(n), (o)) |
| Consob (CONSOB) | Sector supervisor (art. 1(2)(c)); fines auditors of public interest and intermediate regime entities (art. 62(5)); authorizes CASPs in coordination with the Bank of Italy | Those auditors; CASPs |
| Guardia di Finanza, Special Currency Police Unit (NSPV), and the DIA | The NSPV checks obliged entities that no sector supervisor covers (art. 9(1)) and investigates reports the UIF passes on (art. 9(4)(b)); the NSPV and the DIA can ask the UIF to suspend a transaction (art. 6(4)(c)) | Firms outside sector supervision |
| Ministry of Economy and Finance (MEF) and the Financial Security Committee | The MEF fines firms with no sector supervisor and every cash limit breach (art. 65(1)); the Committee, set up at the MEF, implements UN, EU and national freezing measures and proposes national freezes (Decree 109/2007 arts. 3, 4) | All sectors |
| OAM (Organismo Agenti e Mediatori) | Keeps the lists of credit brokers and financial agents and the money changers' register (art. 3(3)(b) to (d)) | Those three groups |
| ADM (Customs and Monopolies Agency) | Grants gaming concessions (art. 3(6)) | Gaming operators |
The UIF supervises no sector. It analyzes suspicious transaction reports (STRs), issues anomaly indicators and reporting instructions (art. 6(4)(d), (e)) and can inspect any firm on its reporting. Where no sector supervisor is competent, the NSPV runs the checks.
Take an illustrative professional gold dealer in Arezzo. No sector supervisor covers it, so the NSPV checks it and the MEF imposes any fine. Its reports still go to the UIF.
Which sectors are subject to AML obligations in Italy?
Article 3 sorts obliged entities into five groups, plus trust and company service providers.
- Banking and financial intermediaries (art. 3(2)). Banks, Poste Italiane, payment and electronic money institutions, investment firms, asset managers, life insurers, CASPs authorized in Italy (crypto advice excepted).
- Other financial operators (art. 3(3)). Other trust companies, credit brokers, financial agents, money changers.
- Professionals (art. 3(4)). Accountants, labor consultants, tax services, auditors; notaries and lawyers for named transactions.
- Non financial operators, the DNFBPs (art. 3(5)). Antiques dealers, art dealers and intermediaries at €10,000 or more, gold operators, real estate agents (rentals only from €10,000 a month), cash in transit firms, civil mediators, debt collectors.
- Gaming providers (art. 3(6)). Online and land based operators, casinos.
Italian branches of foreign firms are covered (arts. 3(2)(t), 3(7)).
For crypto asset service providers, the VASPs of the old national regime, MiCA authorization is the only route from 1 July 2026. Consob and the Bank of Italy listed nine enabled firms on 30 June 2026: eight CASPs, Conio Srl and Hercle Srl among them, and Banca Sella by notification.
Which AML requirements apply in Italy, article by article?
Each of the 12 duties below carries its article and paragraph from the Normattiva text read on 4 November 2026. complead, formerly Sanction Scanner, fills the last column with the platform record an inspector can ask for.
| Obligation | Legal basis (in force, November 2026; Decree 231/2007 unless noted) | What a program must do | How complead does it |
|---|---|---|---|
| Risk assessment and organization | Arts. 15(2) to (4), 16(1), 16(2)(b), 16(2-bis) | Assess risk by customer, geography, channel and product, with procedures that follow the supervisor's criteria; document it and keep it current unless a supervisor exempts the category (15(3)); size controls and an AML function to the firm; never exclude whole customer categories in advance only for their potential risk. | Rules are scoped per product, segment or jurisdiction; each change carries a version and a record of who made it, when and why. |
| Customer due diligence | Arts. 17(1)(a) to (c), 17(2), 18(1)(a) to (c), 18(2) | Identify and verify the customer, the executor and the beneficial owner before the relationship starts; also for occasional transactions of €15,000 or more, single or linked, transfers of funds or crypto assets above €1,000 and gaming operations; always on suspicion, or when earlier identification data is in doubt. | Onboarding, screening and monitoring share one engine, which leaves each customer with one risk score. |
| Beneficial owners | Arts. 20(1) to (3), 20(5), 20(6); register access art. 21-ter | In a company with share capital, identify each individual holding more than 25 percent directly or through controlled companies, trust companies or nominees; if ownership gives no clear answer, whoever controls the votes or exerts dominant influence by contract; failing both, the legal representatives or managers, with the reasons recorded; consult the register once declared operational (Decree 122/2026 art. 2(4)); keep a trace of the checks. | Owners are followed up the chain until natural persons are reached: KYB and UBO verification sets no fixed depth cap and reports any unresolved layer as unresolved. |
| Politically exposed persons | Arts. 1(2)(dd), 24(5)(c), 24(6), 25(4) | Risk based procedures to find PEPs among customers and owners; enhanced due diligence, except where the PEP acts as an organ of public administration, when measures follow the actual risk; senior approval, source of wealth and funds, closer monitoring. A person stays a PEP for a year after leaving office; past that, enhanced measures continue where risk is high. | Each PEP list carries its own fuzzy matching threshold, set per list type or per list, and the reviewer decides every match. |
| Enhanced due diligence | Arts. 24(1), 24(3), 24(5)(a), (b), 25(4-bis) | Enhanced due diligence whenever risk is high; always for high risk third countries, with the added steps of art. 25(4-bis), and for cross border correspondent relationships with a third country institution that involve payments or crypto asset services; examine the context and purpose of unusually large transactions. | A rule scoped to a jurisdiction can raise the customer's score, and the alert names the rule that fired and the signals that matched. |
| Suspicious transaction report | Arts. 35(1), (2), (5), 39(1); UIF instructions from 1 July 2026 | Report to the UIF without delay, before executing the transaction, when the firm knows, suspects or has reasonable grounds to suspect laundering, terrorist financing or funds of criminal origin, whatever the amount; no tipping off, within art. 39's exceptions; professionals are exempt for information received in legal advice or court proceedings (35(5)). | Agents gather the evidence and write a narrative with a work log; the regulatory compliance solution adds reporting support within case management, and the STR delegate decides and files. |
| Asset freezing | Decree 109/2007 art. 7(1) to (3); UN, EU and national measures | Freeze designated funds; tell the UIF within 30 days of the measure entering into force or, if later, of holding the funds; report linked operations and relationships promptly; reports on economic resources also go to the NSPV. A duty separate from STRs. | The connections graph searches up to six hops around a customer by default (configurable) for paths to sanctioned parties, and every hop is sourced and kept as evidence. |
| Ongoing monitoring | Arts. 18(1)(d), 19(1)(d) | Keep the relationship under constant review for its whole life: check transactions against what the firm knows, update the data, and ask for source of funds where risk requires. | API triggers start and stop ongoing monitoring per name. |
| Aggregate data and threshold reports | Arts. 33(1), (2), 47(1), (3); UIF instructions | Banks and financial intermediaries, minus the categories art. 33(1) excludes, and trust companies under art. 3(3)(a) send aggregate data at the cadence the UIF sets; banks, Poste Italiane, payment and electronic money institutions send monthly cash reports, and the UIF names the cases in which such a report excludes an STR (art. 47(3)). | Thresholds and conditions go into rules without code, each one versioned. |
| Travel Rule for transfers of funds and crypto assets | Regulation (EU) 2023/1113; art. 62(7) | Payer and payee information travels with each transfer of funds, and originator and beneficiary information with each crypto asset transfer, outside the exclusions of art. 2 (among them card payments used exclusively for goods or services and person to person crypto transfers without a crypto asset service provider); the Bank of Italy sanctions breaches. | Sender and receiver are both screened through the API by transaction screening while the transfer is in process. |
| Record keeping | Arts. 31(2), (3) | Keep due diligence copies and transaction records, any register consultation included, for 10 years from the end of the relationship or professional service, or from the occasional transaction. | The search audit trail stores every screening search with the user, the terms, the time and the result, no match results included. |
| Training | Art. 16(3) | Run permanent training programs, proportionate to the firm's risks, nature and size, so staff apply the decree correctly. | Live alerts, each showing the rule and the matched signals behind it, can double as training cases; the program itself stays with the firm. |
What is the cash limit in Italy in 2026?
The cash limit in Italy is €5,000 in 2026. Article 49 holds every other euro line too, and transfers in which banks, Poste Italiane, payment or electronic money institutions take part fall outside it (art. 49(13)).
| Line (in force, November 2026) | What it covers | Basis |
|---|---|---|
| €5,000 | Cash and bearer securities passing between different persons, artificially split payments included, since 1 January 2023; larger sums go through banks, Poste Italiane, payment or electronic money institutions | Art. 49(1), (3-bis) |
| €3,000 | Spot currency exchange by registered money changers | Art. 49(3) |
| €1,000 | Money remittance services; cheques from €1,000 carry the payee's name and a non transferable clause | Art. 49(2), (5) |
| €10,000 | Monthly cash reports to the UIF by banks, Poste Italiane, payment and electronic money institutions, branches and EU contact points included: cash operations totaling €10,000 or more in a calendar month, counting operations of €1,000 or more, sent by the 15th of the second following month | Comunicazioni oggettive (UIF page); art. 47(1), (3) |
How does a suspicious transaction report reach the UIF?
Article 35 sets the trigger, and the UIF sets the format in instructions that apply from 1 July 2026. Until it has reported, the firm does not carry out the transaction, unless the law obliges it to receive the act, the operation cannot be deferred in normal business or delay would hinder an investigation; then it informs the UIF at once (art. 35(2)). It is Italy's form of a suspicious activity report.
| Stage | Input | Output | Who decides |
|---|---|---|---|
| Detection | Alert, UIF anomaly indicator or staff referral; frequent or unjustified cash use even under the art. 49 limit, above all withdrawals or deposits out of line with the customer's risk profile (art. 35(1)) | A case opened with the trigger recorded | First line staff or the system |
| Assessment | The customer's economic capacity and activity, and linked or split operations (art. 35(1)) | An analysis of why the activity is or is not suspicious | AML function analyst |
| Decision | The analysis and the evidence | A dated decision to report or not, with reasons | STR delegate |
| Filing | Data, operations and reasons for suspicion (art. 35(3)) | The report on the Infostat-UIF portal, before execution save the art. 35(2) cases | STR delegate |
| UIF response | The report and any further UIF request | Analysis; suspension for up to five working days (art. 6(4)(c)) | UIF |
How do risk assessment, customer due diligence and penalties work in Italy?
The firm rates its own risks and sizes each check to them; KYC in Italy goes by adeguata verifica della clientela.
- A written self assessment. Art. 15(2) covers customer, geography, channel and product.
- Proportionate measures. Under art. 17(3) the firm must show supervisors and self regulatory bodies that its customer due diligence (CDD) fits the risk found.
- Identity first. Customer, executor and beneficial owner are verified before onboarding (art. 18(2)); at low risk, where business needs it, checks may follow within 30 days, identity data taken at once (art. 18(3)).
- Purpose and nature. Art. 18(1)(c) records why the relationship exists.
- Constant monitoring. Art. 18(1)(d) keeps the file current.
- Abstention. If due diligence is objectively impossible, the firm does not start or continue the relationship and weighs an STR (art. 42(1)); professionals examining a client's legal position or defending or representing a client in court proceedings are exempt (art. 42(3)).
How do you identify beneficial owners while the register is unavailable?
The Council of State suspended access to the beneficial ownership register, the Registro dei Titolari Effettivi, on 15 October 2024 (FATF, para. 334). Decree 122/2026 rewrote access in arts. 21-bis to 21-septies; under its art. 2(4), the Ministry of Enterprises and Made in Italy declares the system operational by a measure due within 60 days of 23 July 2026, after two technical updates.
Until a firm can point to that measure, the evidence is its own:
- The chain. Ownership and control reconstructed with reasonable reliability (art. 18(1)(b)).
- The declaration. The customer supplies owner details under its own responsibility (art. 19(1)(a)); a beneficial ownership declaration template records them.
- The fallback. Where no owner emerges, art. 20(5) names the legal representatives or managers and art. 20(6) asks for the reasons, the hidden UBO problem.
Once access opens, firms report discrepancies (art. 21-ter(7)), keep proof of each entry (art. 21-ter(12)) and still assess risk themselves (art. 21-ter(11)).
How is AML non-compliance penalized in Italy?
| Breach | Basis | Range (in force, November 2026) |
|---|---|---|
| Serious, repeated, systematic or multiple breaches of the due diligence, record keeping and reporting duties or of arts. 7, 15 and 16, by banks and financial intermediaries | Decree 231/2007 art. 62(1); imposed by the Bank of Italy or IVASS (art. 62(7)) | €30,000 to €5 million, or 10% of total annual turnover when that exceeds €5 million and turnover is available and determinable |
| Managers who, by failing their duties, made those breaches possible or materially raised the firm's risk | Art. 62(2), (3) | €10,000 to €5 million; up to twice the advantage when it exceeds €5 million and is determined or determinable; a ban from office of six months to three years |
| Failure to report a suspicious transaction, unless it is a crime | Art. 58(1), (2), (4) | €3,000; €30,000 to €300,000 when serious, repeated, systematic or multiple (art. 62(1) and (5) apply instead to banks, financial intermediaries and auditors of public interest or intermediate regime entities); if those breaches bring an economic advantage, a maximum of twice it (never under €450,000), or €1 million when it cannot be determined |
| Ignoring a UIF suspension | Art. 58(6) | €5,000 to €50,000 |
| Breach of the cash limit and the other art. 49 lines (paras. 1 to 3, 5 to 7) | Art. 63(1), (1-ter), (6) | €3,000 to €50,000, minimum €1,000 for breaches committed and contested since 1 January 2022; both bounds five times higher above €250,000 |
| Laundering | Criminal Code art. 648-bis | 4 to 12 years and €5,000 to €25,000; 2 to 6 years and €2,500 to €12,500 for proceeds of a qualifying contravention; higher in professional activity; lower when the predicate crime carries a maximum under five years |
| Use of illicit money or assets in economic or financial activities | Criminal Code art. 648-ter | 4 to 12 years and €5,000 to €25,000; 2 to 6 years and €2,500 to €12,500 for proceeds of a qualifying contravention; higher in professional activity; lower in cases of particular slightness (art. 648, fourth paragraph) |
| Self laundering by the author or co author of the crime (mere personal use or enjoyment is not punished) | Criminal Code art. 648-ter.1 | 2 to 8 years and €5,000 to €25,000; 1 to 4 years and €2,500 to €12,500 for proceeds of a qualifying contravention; higher in banking, financial or professional activity; lower when the predicate crime carries a maximum under five years, unless it was committed with mafia methods or to aid a mafia group (Criminal Code art. 416-bis.1); reduced by up to half for those who act effectively to prevent further consequences or secure the evidence |
The Bank of Italy and IVASS fine supervised intermediaries and their managers; the MEF fines firms with no sector supervisor, staff and managers of intermediaries who fail to report, and every cash limit breach (art. 65(1)). For breaches of low harm, supervisors may instead order the firm to end the breach or, once it has ended, publish a statement (art. 62(4)). A qualifying contravention is one punished with arrest of over one year at most or six months at least.
What the Bank of Italy fined in 2025 and 2026
| Firm | Decision | Fine | Findings (articles cited) | Source |
|---|---|---|---|---|
| illimity Bank | 9 September 2025 | €140,000 | Due diligence and active cooperation, complex financing (arts. 7, 15 to 20, 24, 25, 35, 36) | Bank of Italy |
| Banca Profilo | 13 January 2026 | €190,000 | Profiling, due diligence, active cooperation (arts. 7, 15 to 20, 24, 25, 35, 36) | Bank of Italy |
| Banca Popolare Pugliese | 3 February 2026 | €130,000 | Profiling, due diligence, active cooperation (same articles) | Bank of Italy |
| Centotrenta Servicing | 10 February 2026 | €30,000 | Enhanced due diligence (arts. 7, 17 to 20, 24, 25) | Bank of Italy |
| Banca Progetto (in extraordinary administration) | 30 March 2026 | €30,000 | Profiling, due diligence, active cooperation (arts. 7, 15 to 20, 24, 25, 36); missed STRs (art. 35) | Bank of Italy |
| Cherry Bank | 21 April 2026 | €100,000 | Profiling, due diligence, active cooperation (arts. 7, 15 to 20, 24, 25, 35, 36) | Bank of Italy |
| Banca Popolare Commerciale | 23 June 2026 | €40,000 | Due diligence, active cooperation, AML controls (arts. 7, 16 to 19, 24, 25, 35, 36) | Bank of Italy |
| Banco di Credito Paolo Azzoaglio | 29 September 2026 | €80,000 | Due diligence and active cooperation (arts. 7, 15, 16, 24, 25, 36) | Bank of Italy |
Each decision applies art. 62 after an on site inspection; each fine sits between €30,000 and €190,000, far below the art. 62(1) ceiling. Four name customer profiling. Banca Progetto's adds reports that were never filed, and Cherry Bank was fined €100,000 against the €130,000 the Bank's supervisory staff had proposed.
Which major money laundering cases and risks does Italy face?
From 2022 to 2024, Operation Moby Dick pursued a group running fake invoices and carousel fraud through consumer IT traders in Italy and 10 other jurisdictions. The Guardia di Finanza and the State Police investigated 195 people and 144 companies, arrested 43 and executed seizure orders of €520 million; proceedings were open when FATF reported (FATF evaluation, Box 7.2).
The UIF's 2025 report counts 162,059 STRs, up 11.5 percent, a rise from newly registered reporters (online banks above all) and mostly tied to scams and cyber fraud. It sees significant risk in gaming and gold, where tracing and profiling are weak. Cash makes up 69 percent of point of sale transactions by volume, against 59 percent across the EU (FATF, para. 60).
FATF published the evaluation on 23 April 2026, after an on site visit from 23 June to 11 July 2025 and its February 2026 plenary, and placed Italy in regular follow up. Eight of 11 outcomes are Substantial, international cooperation among them; three are Moderate (non financial sector supervision, beneficial ownership, terrorist financing preventive measures and sanctions). Four of the 40 FATF Recommendations are Partially compliant: R.8, R.12, R.13 and R.24.
Which AML reforms and developments matter in Italy in 2025, 2026 and 2027?
What changed:
- 18 December 2025. The UIF adopts new instructions for suspicious transaction reports, which apply from 1 July 2026.
- 9 January 2026. Decree 210/2025 enters into force and amends Decree 231/2007 to transpose AMLD6 article 74 (beneficial ownership access).
- 24 January 2026. Decree 211/2025 enters into force and makes breaches of EU restrictive measures crimes, so their proceeds can ground a laundering suspicion.
- 30 June 2026. Consob and the Bank of Italy list nine enabled crypto firms as the MiCA transition ends from 1 July.
- 23 July 2026. Decree 122/2026 enters into force with arts. 21-bis to 21-septies, transposing the AMLD6 register access articles due on 10 July 2026.
What comes next:
- 10 July 2027. The AMLR, Regulation (EU) 2024/1624, applies (art. 90; football agents and clubs from 10 July 2029). Its €10,000 cap on cash payments for goods or services keeps lower national limits (art. 80(1), (3)), so €5,000 stays. Due diligence files then answer to AMLR articles, which an EU AMLR customer due diligence form names beside most questions.
- 10 July 2027. Most of AMLD6 falls due for transposition (art. 78).
- 2028. AMLA, the EU authority, starts supervising selected firms directly.
How can screening and monitoring tools help AML compliance in Italy?
How banks in Italy address financial crime prevention shows in what they can document: each screening, each alert and the person behind each decision. Any tool from the transaction monitoring market is judged by that record.
complead is built as an AI native platform for AML, KYC and fraud, and its client screening and ongoing monitoring product watches 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes, and each list type, or each single list, can carry its own fuzzy matching threshold. Sanction Scanner, the screening product, is part of complead.
Picture an illustrative payment institution building the €10,000 monthly cash line in transaction monitoring: it writes the rule without code, backtests it on 90 days of history, and each change records who and why. Agents handle the routine cases and leave the evidence, a narrative and a work log on each; anything else goes to the STR delegate, and the record names who decided.
Until the Ministry declares the register operational, each firm decides what file stands in for the register extract, and who signs it. The decree names the parts: the customer's declaration (art. 19(1)(a)), the chain to natural persons (art. 18(1)(b)) and the reasons for any fallback (art. 20(6)).
The PDF. The 16 page 2026 edition adds three working documents: a 14 point checklist with the legal basis of each check, an Italian customer risk factor template and a record for each suspicious transaction decision. The form beside this page sends it.
