Demand in 2026 is the inspection calendar, not a generic compliance backlog. The Financial Services and Markets Authority published its 2025 annual report on 29 June 2026. In that year it accepted 27 settlements in administrative sanction procedures. Those settlements were published by name on the FSMA website, and they brought EUR 2,247,955 to the Treasury. The same report says the FSMA checked 2,686 entities for compliance with anti-money-laundering and counter-terrorist-financing legislation, and that its whistleblower contact point received 306 reports of potential or actual breaches of financial legislation. It also used mystery shopping for the first time, sending inspectors in as consumers to test conduct-of-business rules on the ground. Those are public enforcement facts. They are not a list of Sartori clients.
Prudential AML sits with the National Bank of Belgium, not with the FSMA. The Bank’s 2025 prudential report, published 5 March 2026, records five on-site KYC inspections in 2025, with similar on-site inspections planned at the start of 2026 at additional financial institutions. The first findings the Bank was already willing to state are specific: periodic updates of customer data are not always respected and are sometimes done poorly; identification of beneficial owners is sometimes missing; and the origin of wealth is sometimes barely established, and therefore barely checked. The same chapter records the FATF plenary of 23 October 2025. On technical compliance, the Belgian legal and institutional framework was judged largely in line with the FATF recommendations. On effectiveness, the framework was judged significant for 2 of the 11 immediate outcomes and moderate for the other 9. The FATF was critical of how the Bank sanctions and remediates AML breaches by financial institutions, and it will look again in three years. The Bank also records that the supervisor for crypto-asset service providers, undesignated since MiCA took effect on 30 December 2024, has since been designated. A Brussels chief operating officer who waits for the job title to settle will hire after the inspection letter, not before it.
Privacy is a third supervisor. The Belgian Data Protection Authority, in its 2025 annual report, recorded 1,394 complaints, up from 837 in 2024, and 117 inspection files, down from 157. It received 1,216 data-breach notifications and 1,161 DPO notifications. At 31 December 2025, 8,533 organisations had an active data protection officer on the Authority’s register. The litigation chamber took 214 decisions in 2025, of which 213 were published. A data protection officer is hired against that control program. The seat is not an AML officer who has sat a National Bank visit, and it is not hired from the January payslip median below.
Of the 3 Brussels compliance searches, 1 was a bank or insurer AML officer, 1 was an FSMA conduct or intermediary officer, and 1 was a data protection officer. One plus one plus one is three. All three are inside the 7 broader seats, and those seven are inside the 15. The 8 filing-manager seats are a different cut of the same 15. They are not added again here. All 3 compliance files reached an accepted offer. The city hub is legal recruitment in Brussels. Company-side counsel seats that are not this compliance cut are on in-house counsel recruiting in Brussels.
The buyers are visible without being our clients. Banks and insurers concentrate where the National Bank’s AML calendar and the FSMA’s conduct calendar meet the same legal department. Asset managers, intermediaries, and market infrastructure sit on the FSMA side of that split. Listed groups and the Brussels offices of industrial and chemical companies carry a data-protection officer because the Authority’s register, not a job title, says they must. A sponsor-backed company adds a first compliance officer when a Belgian licence and a fund reporting pack arrive in the same quarter. Across 250 structured interviews with Brussels counsel, 58 said they would not take a compliance seat whose reporting line stopped at the general counsel, with no access to the audit committee. That is one cohort. It is the only interview count for the city.