Demand in 2026 is the inspection calendar, not a generic compliance backlog. Banca d’Italia, in its management and sustainability report dated 29 May 2026, put 356 intermediaries through the annual anti-money-laundering and counter-terrorist-financing supervision cycle in 2025, and analyzed 32 banking groups at group level as well. The same report records 552 interventions, 38 inspections, and 3 thematic inquiries, in line with the previous year. The Bank also extended its supervisory provisions to crypto-asset service providers and took up the European Banking Authority guidelines on restrictive measures. Those are public supervision facts. They are not a list of Sartori clients.
The financial-intelligence unit is a second reader of the same banks. The UIF annual report for 2025, dated Rome, May 2026, records 162,059 suspicious-transaction reports, up 11.5 percent on 2024. Lombardy, the region Milan sits in, accounted for 31,552 of those reports, 19.5 percent of the national total. Banks and Poste accounted for 58.4 percent of reports received, up 26.8 percent on 2024. The UIF opened 20 inspections in 2025, 18 of them general and 2 targeted, and closed 7 inspections that had been opened the year before, 4 of those desk-based. The report’s inspection chapter describes gaps in onboarding, alert handling, and the split of reporting duties inside Italian branches of foreign groups. A Milan brief that still says “compliance lawyer” is usually one of two bank seats: the responsabile della conformità, or the responsabile antiriciclaggio who owns the report to the UIF. Those two CVs are not interchangeable.
The forward date is already in the statute. Regulation (EU) 2024/1624 of 31 May 2024, published in the Official Journal on 19 June 2024, applies from 10 July 2027 under Article 90, except for football agents and professional football clubs, to which it applies from 10 July 2029. A Milan bank that waits for the regulation to become the daily rule will hire the officer after the rule is in force. A professional football club in the city is on the later date. It is not on the bank’s date, and it is not hired with a bank antiriciclaggio CV.
Listed issuers are a third supervisor. CONSOB, in its press release of 25 July 2026 publishing Statistical Bulletin no. 29 and the mid-year Capital Markets in Italy report, counted 416 supervised companies at the end of June 2026. The English bulletin splits that count into 401 companies with an Italian headquarters and 15 headquartered abroad, down from 427 at the end of December 2025 and 424 at the end of June 2025. Euronext Milan listed 195 companies, down from 198 at the end of 2025, with no IPO on that market in the first half of 2026 and one translisting from Euronext Growth Milan. Euronext Growth Milan listed 203 companies, down from 211. Vorvel stayed at 18. Capitalization of supervised issuers reached 1,209 billion euro. A listed-issuer compliance seat in Milan answers to that perimeter. An asset-manager compliance seat answers to CONSOB as well, and it is not the Banca d’Italia antiriciclaggio file with a different letterhead.
Privacy is the fourth. The Garante, in the press note of 2 July 2026 on its 2025 activity, recorded 807 collegial measures, 506 corrective and sanctioning measures, and sanctions collected of more than EUR 37 million. It received 2,415 data-breach notifications, up 10 percent on 2024, and carried out 130 inspections. In the same note it records that it suspended the FaceBoarding facial-recognition system at Milan Linate airport after finding biometric data of more than 24,500 passengers stored in a centralized archive, without the control and safeguards the GDPR requires. A DPO is hired against that control program. The seat is not a responsabile antiriciclaggio who has sat a UIF visit.
Corporate criminal liability is the file beside those four supervisors. Legislative Decree No. 231 of 8 June 2001 makes a company liable for specified offenses committed in its interest or to its advantage. Article 6 ties the defense to an organizational model that was adopted and effectively implemented before the offense, and to an oversight body with autonomous powers of initiative and control. The internal officer who keeps that model, the risk map, the training, and the whistleblowing channel current is a 231 seat. It is not an IVASS insurance-compliance seat, and it is not a CONSOB issuer seat. Insurers in the city answer to IVASS. That compliance lead is not the bank’s responsabile antiriciclaggio, and it is not the 231 officer.
Of the 4 Milan compliance searches, 2 were bank or insurer officers, 1 was a DPO at a listed fashion group, and 1 was a Legislative Decree 231 officer. Two plus one plus one is four. All four are inside the 17. Private-practice context for the city sits on legal recruitment in Milan. The market article beside it is Milan as a base for international law firms. Company-side counsel seats that are not this compliance cut are on in-house counsel recruiting in Milan.
The buyers are visible without being our clients. Banking and insurance concentrate in the city center and Porta Nuova: groups such as Intesa Sanpaolo, UniCredit, Banco BPM, Mediobanca, and the Italian operations of insurers that run a Milan compliance desk under IVASS. Asset managers and listed issuers sit with CONSOB. Fashion and luxury groups that run legal and compliance from Milan carry a 231 model and a DPO, often in the same building and never in the same job. A sponsor-backed company adds a first compliance officer when the fund’s reporting pack and an Italian supervisor arrive in the same quarter. Across 250 structured interviews on the Milan in-house line, 39 percent said they would not take a compliance seat whose reporting line stopped at the general counsel, with no access to the board or the amministratore delegato. That is one cohort. It is the only interview count for the city.