🇪🇺The EU AML Package: AMLR, AMLD6 and AMLA — What Actually Changes in 2027–2028

The 2024 EU AML package changes the way the Union regulates anti-money laundering itself. Until now Brussels set a minimum through directives, and each member state rewrote it into its own statute with its own thresholds, carve-outs and supervisory culture. From 10 July 2027 most of the obligations of banks, payment and crypto firms, lawyers, estate agents and dealers in expensive goods will sit in a single directly applicable regulation, and from 2028 the largest cross-border financial groups will be supervised by a new European authority in Frankfurt.

For a licensed firm this means one compliance model for the whole Union and considerably more detailed requirements than today. For a client it means identical questions about source of funds, ownership structure and PEP status in Vilnius, Limassol and Luxembourg.

Concept

The package consists of four acts. Its core is Regulation (EU) 2024/1624, the AMLR: a single rulebook for obliged entities — whom to check, which data to collect, when to apply enhanced measures, how beneficial ownership works, where cash stops. It needs no transposition and applies directly. The second is Directive (EU) 2024/1640, AMLD6, which leaves member states the institutional infrastructure: national supervisors, financial intelligence units (FIUs), beneficial-ownership registers, bank-account registers and penalties. The third is Regulation (EU) 2024/1620, which established the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, AMLA. The fourth, adopted a year earlier, is the recast Regulation (EU) 2023/1113 on information accompanying transfers of funds and crypto-assets (TFR), which extended the Travel Rule to crypto-assets.

The split follows a simple logic. Everything about the relationship between an obliged entity and its customer must be identical in all 27 member states, otherwise money flows to wherever checks are lighter — hence a regulation. Everything about how public bodies are organised still depends on national law — hence a directive. And supervision of the largest cross-border groups moves to EU level, because a national supervisor sees only its own slice of a group — hence AMLA.

The previous model (Directive 2015/849 and its amendments, known as AMLD4 and AMLD5) left member states too much latitude: different beneficial-ownership thresholds, different lists of PEP functions, different verification standards, different intensity of supervision. Regulatory arbitrage inside the Union became part of business models: firms licensed where it was easiest and passported across the market. The package closes that route on three fronts at once — rules, institutions, supervision.

The package's key parameters in one place; each row is unpacked below by reference to the legal text.

The package does not make EU AML stricter on every front at once: many of its requirements are already met by banks with a mature compliance culture. The main change is predictability. What was yesterday the practice of an individual bank becomes tomorrow a rule of the regulation, checked by supervisors and available for the customer to point to.

The acts and the calendar

All three 2024 acts are dated 31 May 2024. The AMLA Regulation entered into force on 26 June 2024 and has applied since 1 July 2025. The TFR has applied since 30 December 2024 — together with MiCA, under Art. 40 TFR; the EBA Travel Rule guidelines apply from the same date.

Under Art. 90 AMLR the regulation applies from 10 July 2027, except for the entities in Art. 3, points (3)(n) and (o) — football agents and professional football clubs — for which the date is 10 July 2029. Under Art. 78 AMLD6 the general transposition deadline is 10 July 2027, with three exceptions: Art. 74 (amending Directive 2015/849 to replace public access to beneficial-ownership registers with access on a legitimate interest) by 10 July 2025, Arts. 11, 12, 13 and 15 on access to beneficial-ownership registers by 10 July 2026, and Art. 18 on a single access point to real-estate information by 10 July 2029.

The transition calendar, from the AMLA Regulation's entry into force to the cancellation of unconverted bearer shares.

The dates come from the texts of the acts and from AMLA's official material. As of September 2026 no postponement of 10 July 2027 has been adopted, so every implementation plan runs from that date.

What changes in substance

A regulation instead of a directive

Under a directive the obligation arose from national law: a bank in Latvia lived by the Latvian text and its Lithuanian competitor by the Lithuanian one. Under the AMLR there is one rule, and national differences are allowed only where the regulation expressly permits them. There are few such places, but they matter: member states may keep or introduce a cash limit below €10,000; under Art. 34(6) AMLR they may require enhanced due diligence in higher-risk situations identified nationally, notifying the Commission and AMLA within a month; and they still set penalties and organise their supervisors and FIUs.

The second consequence is granularity. The regulation relies on regulatory technical standards (RTS), adopted by the Commission as delegated acts on the basis of AMLA drafts, and these are directly applicable too. For a licensed firm, "the new rules" therefore means the AMLR plus a set of RTS and guidelines, while national provisions that conflict with them cease to apply.

Who becomes an obliged entity

Credit and financial institutions remain at the centre of the perimeter; under Art. 2 AMLR financial institutions expressly include crypto-asset service providers (CASPs) within the meaning of MiCA. For CASPs this is not news: the TFR brought them into the perimeter of the old directive from 30 December 2024. The non-financial list in Art. 3(3) AMLR is wider than before and drafted more precisely.

High-value goods are defined in Annex IV AMLR: jewellery and gold- and silversmiths' articles and watches above €10,000; motor vehicles above €250,000; aircraft and watercraft above €7.5 million. For the last three Art. 74 adds a separate duty: when a car of €250,000 or more, or a yacht or aircraft of €7.5 million or more, is bought for non-commercial use, the seller reports it to the FIU, and a bank or financial institution involved in the purchase reports its customer. For the supercar, yacht and business-jet markets this means the deal becomes visible to financial intelligence regardless of any suspicion.

CDD: when and what

Customer due diligence is triggered on establishing a business relationship and on occasional transactions above the thresholds in Art. 19 AMLR — for the first time in one text for every member state.

Beyond thresholds, CDD applies on suspicion of money laundering, on doubts about previously obtained data, and when participating in the creation of a legal entity or a transfer of ownership. Art. 20 sets out the measures: identifying and verifying the customer and the beneficial owner, understanding the purpose and nature of the relationship, ongoing monitoring — plus two items the directive did not contain in this form. The first is checking whether the customer or the beneficial owners are subject to targeted financial sanctions and, for a legal entity, whether sanctioned persons control it or hold more than 50% of it, individually or collectively. The second is determining whether the customer, the beneficial owner or the person on whose behalf a transaction is carried out is a PEP, a family member or a close associate. Sanctions screening, which used to run as a separate regime, becomes part of CDD; how it works technically is covered in sanctions screening.

The identification data set is now uniform. Under Art. 22, for a natural person it comprises all names and surnames, place and full date of birth, all nationalities (or statelessness, refugee or subsidiary-protection status), national identification number where applicable, usual residence or postal address, and tax identification number where available. For a legal entity: legal form and name, registered office and country of creation, legal representatives, registration and tax numbers, LEI where available, and information on nominee shareholders and directors. Verification may rely on an identity document and reliable independent sources, or on eIDAS electronic identification at assurance level "substantial" or "high".

Art. 21 restates the old rule of "no CDD, no relationship": where the measures cannot be completed, the transaction is not carried out, the relationship is terminated and a suspicious transaction report is considered. What is new is that AMLA must issue guidelines on de-risking by 10 July 2027 — on when refusing whole categories of customers stops being risk management. For anyone who has faced a bank account closure, this is the first European document on the subject.

Refreshing the file is no longer a matter of internal policy. Art. 26(2) sets maximum intervals: 1 year for higher-risk customers, 5 years for all others, plus ad hoc updates on material changes.

Beneficial ownership: 25%, chains and senior managing officials

Under Arts. 51–53 AMLR a beneficial owner is a natural person who owns or controls a legal entity; the two tests run in parallel and neither displaces the other. Ownership means 25% or more of the shares, voting rights or other ownership interest, directly or indirectly. The directive spoke of "more than 25%", so in some member states a person with exactly a quarter was not a beneficial owner; now that person is one everywhere.

For multi-layered structures Art. 52 introduces arithmetic: holdings along each chain are multiplied, and the results of different chains are added. The diagram shows how a person with two sub-threshold holdings ends up as a beneficial owner.

The chain through the holding gives 60% × 40% = 24%, the direct stake 10%, a total of 34%: the individual is a beneficial owner of the operating company, even though neither holding reaches the threshold on its own. Control "via other means" under Art. 53 covers a majority of votes, the right to appoint or remove a majority of the board, veto rights and rights over profit distribution, as well as informal agreements, family relationships and nominee arrangements, which the regulation defines as an instruction from a nominator to a nominee to act on their behalf, including as director, shareholder or settlor. How such arrangements are assessed in practice is covered in beneficial ownership and nominee arrangements.

The threshold may come down. Under Art. 52(2) member states notify the Commission of higher-risk categories of corporate entities, and by 10 July 2029 the Commission assesses whether a lower threshold is warranted and, if so, sets it by delegated act — at a maximum of 15%, unless risk justifies a higher figure, which must in any case stay below 25%. Nobody is subject to 15% automatically.

Where, after exhausting all means, no beneficial owner can be identified, or there are doubts, the obliged entity identifies and verifies all senior managing officials — the executive members of the management body and the persons with executive functions responsible for day-to-day management (Arts. 22 and 63). This is a fallback and does not replace the search for the beneficial owner. Legal entities themselves must keep their beneficial-ownership information current, report changes to the central register within 28 calendar days and verify it at least annually; the data are kept for 5 years after dissolution.

EDD, PEPs and customers with €50m or more

Enhanced due diligence is mandatory for high-risk third countries, correspondent relationships, PEPs and other higher-risk cases (Art. 34). The toolkit is familiar: additional information on the customer and beneficial owner and on the nature of the relationship, source of funds and source of wealth, senior-management approval, enhanced monitoring, a first payment through an account at a bank with comparable CDD standards.

For PEPs, Art. 42 requires senior-management approval, procedures to establish source of wealth and source of funds, and enhanced ongoing monitoring. The PEP perimeter is now pinned down by national lists: under Art. 43 each member state keeps a list of the exact positions that count as prominent public functions, international organisations keep their own, and the Commission compiles them into a single list published in the Official Journal and on AMLA's website. The definition in Art. 2 expressly includes heads of regional and local authorities, including groupings of municipalities and metropolitan regions, with at least 50,000 inhabitants. A former PEP stays under the measures for at least 12 months after leaving office (Art. 45), and thereafter on the basis of residual risk. AMLA guidelines on criteria for close associates and on PEP risk categories are due by 10 July 2027. The status and its consequences are covered in PEP.

For the first time very large private wealth gets its own regime. Under Art. 34(5), where a relationship already identified as higher-risk involves handling at least €5 million through personalised services for a customer whose total assets — financial, investable and real-estate, excluding the private residence — are at least €50 million, credit institutions, financial institutions and TCSPs apply further measures: specific procedures for the risks of personalised services, additional source-of-funds information and management of conflicts of interest between the customer and staff. AMLA will publish the wealth-valuation methodology in guidelines by 10 July 2027.

This is a regime of additional measures for higher-risk UHNW customers, with no prohibitions attached. The practical consequence: the source-of-funds and wealth file stops being a one-off onboarding folder and becomes a continuously maintained dossier that a private bank reviews at least once a year.

High-risk third countries

The EU keeps its own list of high-risk countries, and the FATF lists serve as its baseline. Under Art. 29 AMLR the Commission identifies, by delegated act, countries with strategic deficiencies in their AML/CFT regime, taking into account calls by international bodies for countermeasures; EDD and specific countermeasures from Art. 35 apply to them. Art. 30 separately covers countries with compliance weaknesses, using jurisdictions under increased monitoring as the baseline, with EDD measures tailored to each country. Art. 31 adds a third category — countries posing a specific and serious threat to the Union's financial system. The timetable is tight: the act must be adopted within 20 calendar days of the criteria being met. How the FATF lists and the plenary cycle work is covered in FATF.

Until 10 July 2027 the old mechanism applies — Delegated Regulation 2016/1675 — and it already shows how the list behaves in practice. The three amendments of the past eighteen months, by date of entry into force:

The last two rows matter most for private clients. The BVI is one of the most widely used holding-company jurisdictions, and a relationship with a BVI-incorporated company now falls under mandatory EDD at EU obliged entities. The Commission added Russia on its own assessment, in a separate section for countries whose FATF membership is suspended, and the recitals of Act 2026/46 cite the suspended FATF membership and deficiencies in FIU independence, beneficial-ownership transparency and the regulation of crypto-assets. Relationships and transactions linked to Russia through residence, place of establishment or origin of funds require enhanced due diligence at any EU obliged entity, whatever the sanctions status of the individual concerned.

Cash and anonymous instruments

Art. 80 AMLR introduces an EU-wide ceiling: persons trading in goods or providing services may accept or make a cash payment only up to €10,000, whether in a single operation or in several operations that appear to be linked. Member states may set a lower limit after consulting the ECB, and existing lower limits stay in place. The ceiling does not cover payments between natural persons not acting in a professional capacity, or payments and deposits at the premises of banks, e-money issuers and payment service providers; deposits above the limit are reported to the FIU. An obliged entity, such as a dealer in high-value goods, must identify and verify a customer in an occasional cash transaction from €3,000 (Art. 19(4)). Details are in the European Parliament press release.

Art. 79 prohibits credit institutions, financial institutions and CASPs from keeping anonymous bank and payment accounts, anonymous passbooks, anonymous safe-deposit boxes and anonymous crypto-asset accounts, as well as any account that allows the anonymisation of the account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins — crypto-assets with built-in anonymisation features. Acquirers may not accept payments with anonymous prepaid cards issued in third countries unless the RTS recognise a specific product as low-risk. Companies may no longer issue bearer shares (except securities admitted to trading on a regulated market, held in immobilised or dematerialised form); existing ones must be converted into registered form, immobilised or deposited by 10 July 2029, and unconverted shares are cancelled on 10 July 2030.

Inside the firm: governance, groups, outsourcing

The regulation describes an obliged entity's internal controls in more detail than any national rule before it. Under Art. 11 the management body appoints from among its members a compliance manager responsible for compliance with the AMLR and the TFR, and a compliance officer with enough seniority to run day-to-day AML/CFT controls and act as contact point for supervisors. Both, like the head of internal audit, must be able to report directly to the management body. Smaller firms may combine the roles.

Groups, under Art. 16, carry out a group-wide risk assessment, extend policies to branches and subsidiaries including those in third countries, and share within the group information on customers, beneficial owners, transactions and suspicions; the group compliance manager reports annually to the parent's management body. AMLA details the minimum requirements for third-country branches and subsidiaries in a separate RTS.

Outsourcing under Art. 18 is allowed with prior notice to the supervisor, but several functions cannot be outsourced: approving the business-wide risk assessment and internal policies, assigning a customer risk profile, deciding to enter a relationship, reporting to the FIU (with a narrow intra-group exception within one member state) and approving the criteria for detecting suspicious transactions. The obliged entity remains fully liable for outsourced tasks, and outsourcing to providers in third countries listed under Arts. 29–31 is possible only within the group.

Art. 75 for the first time legalises partnerships for information sharing — data exchange between obliged entities on higher-risk customers. The conditions are strict: notice to the supervisor, a data protection impact assessment under Art. 35 GDPR, no sole reliance on what partners provide, and a log of every exchange. CDD records are kept for 5 years after the relationship ends, and the supervisor may extend this by up to 5 more (Art. 77). How all of this fits into a working system — policies, EWRA, training, independent review — is set out in the licensed operator's compliance stack.

Beneficial-ownership registers after Sovim

AMLD5 required company beneficial-ownership registers to be open to any member of the public. On 22 November 2022, in joined Cases C-37/20 and C-601/20 (WM and Sovim v Luxembourg Business Registers), the Court of Justice declared that provision invalid: unrestricted public access is a serious interference with the rights to private life and to the protection of personal data under Articles 7 and 8 of the Charter, going beyond what is strictly necessary. Several member states then closed their registers, and access for journalists and NGOs effectively stopped.

AMLD6 builds a legitimate-interest model, and its rules had to be transposed by 10 July 2026. Under Art. 12 AMLD6 a legitimate interest is presumed for journalists and the media, civil-society organisations and academia connected with the fight against money laundering, persons likely to enter into a transaction with the legal entity, obliged entities in third countries and a range of public bodies. They may see the beneficial owner's name, month and year of birth, country of residence and nationality, and the nature and extent of the interest. Journalists, civil-society organisations and third-country counterpart authorities also see historical ownership information, including for entities dissolved in the preceding 5 years, and a description of the ownership or control structure. Access is granted without alerting the entity concerned.

The procedure is in Art. 13: from 10 November 2026 a register answers a request within 12 working days (extendable by another 12 at peak times), issues an access certificate valid for 3 years, handles repeat requests within 7 working days and recognises another member state's decision. Fees are allowed but limited to the cost of keeping the data accurate. Authorities, FIUs and obliged entities have access under Art. 11 without any interest test. National registers and their practice are compared in UBO registers.

AMLA: mandate and direct supervision

The authority

AMLA was established on 26 June 2024 and sits in Frankfurt am Main. The Council appointed Bruna Szego as its first Chair on 21 January 2025, and Nicolas Vasse became Executive Director in July 2025. Staff is due to reach 432 by the end of 2027, more than 200 of them in direct supervision. The 2024–2027 budget is just above €119 million; from 2028 about 70% of funding will come from fees on supervised entities, estimated at €65 million for 2028 — all per the AMLA FAQ.

Its powers go beyond direct supervision. AMLA drafts RTS and ITS, issues guidelines, coordinates and assesses national supervisors in the financial and non-financial sectors, supports the FIU network and develops FIU.net without being an FIU itself. On 1 January 2026 the EBA transferred to AMLA its entire AML/CFT mandate, including the EuReCA database; EBA guidelines and standards remain in force until AMLA replaces them.

Who gets selected for direct supervision

Direct supervision covers only credit and financial institutions, CASPs included. The selection conditions: activity in at least six member states and a high residual risk under a harmonised methodology, yielding about 40 groups. AMLA set out the methodology in December 2025 in the final draft RTS under Art. 12(7) of the AMLA Regulation and Art. 40(2) AMLD6, submitted to the Commission. Activity in a member state under the freedom to provide services, without a branch or subsidiary, counts as material if, at 31 December of the previous year, the entity has more than 20,000 resident customers there or annual incoming and outgoing transactions above €50 million. Inherent risk is scored from 1 to 4, and combined with control quality to give a residual risk of low, medium, substantial or high.

Preparation is on schedule. In March 2026 AMLA launched a test data collection to calibrate its models; on 12 May it published the reporting package for identifying provisionally eligible entities; on 21 July it finalised the ITS on cooperation with national supervisors in selection and supervision: national authorities collect and check the data, AMLA assesses the risk and decides, and the results are published on its website. In August the EBA released a draft reporting framework for the 2027 eligibility data collection. Selection takes place in 2027; direct supervision starts in 2028.

Firms outside the forty stay with national supervisors, but those supervisors work to common risk-assessment methodologies. Where a national supervisor fails to react adequately, AMLA may ask the Commission to transfer supervision of the entity to it for a limited period. The standards AMLA writes for "its own" banks therefore quickly become expectations for everyone.

Technical standards and guidelines: status in September 2026

AMLA put its first major set of AMLR RTS out to consultation on 9 February 2026, building on drafts the EBA had prepared by 30 October 2025. The status of the main documents, per AMLA's consultations page:

The final texts still have to be adopted by the Commission, so as of September 2026 they remain drafts. The direction is already clear from the consultation paper on the CDD RTS. Remote verification gives priority to eIDAS means at assurance level "substantial" or "high" and to qualified trust services; other solutions are acceptable where these are unavailable. Files of existing customers are brought into line on a risk-sensitive schedule, but no later than the Art. 26(2) periods — one year for higher risk, five years for the rest. Acceptable evidence of source of funds and wealth includes tax returns, payslips, audited accounts, loan agreements and information from reputable media and commercial databases.

Crypto: CASPs in the general regime

For providers licensed under MiCA, the AML package is the other half of their regulation. CASPs are financial institutions under the AMLR: CDD for occasional transactions from €1,000, the full EDD and PEP toolkit, and the Art. 79 ban on anonymous accounts and anonymity-enhancing coins. The Travel Rule has applied since 30 December 2024: transfers carry originator and beneficiary information, and for transfers to or from a self-hosted address above €1,000 the CASP checks whether the address is owned or controlled by its customer (Arts. 14(5) and 16(2) TFR); the mechanics are in Travel Rule.

Large CASPs active in six or more member states go through the same selection for AMLA direct supervision as banks. On 29 June 2026 AMLA issued an advisory note on money-laundering risks as the MiCA transitional period ended and unlicensed providers left the market or moved their customers. Obtaining a licence and operating under someone else's authorisation are covered in the CASP guide.

Practice

For a licensed firm: the gap analysis before July 2027

The regulation itself has no transitional period: on 10 July 2027 the AMLR starts to apply to all obliged entities at once, and the draft RTS reveal the level of detail in advance. A gap analysis is therefore usually organised around the blocks of the regulation, since the national statute is about to stop being the source of obligations.

The heaviest row is usually remediation: a bank with hundreds of thousands of customers has to bring files up to the new data set within the refresh intervals, starting with higher-risk customers whose deadline is one year. Next comes beneficial ownership in multi-layered structures, where the old "more than 25%" wording and the absence of multiplication rules produced divergent answers between banks. DORA is being implemented in parallel, and the outsourcing registers of the two regimes are conveniently built together. How correspondent banks assess an AML programme is covered in Wolfsberg questionnaires.

For a client: the questions that become standard

From July 2027 the onboarding questions at any EU obliged entity will be set by the regulation, and differences between banks will narrow. What will be asked, and on what legal basis:

Onboarding most often breaks in three places. First, a structure in which the beneficial owner emerges only once stakes are multiplied, while the client insists they hold "less than 25%". Second, a second nationality or residence permit left off the form: the regulation requires all nationalities, and databases together with CRS and CARF exchange make the discrepancy visible. Third, a source of wealth supported only by bank statements, with no documents on where the capital came from. Building such a file is covered in AML/KYC for private clients, corporate KYC and investment migration due diligence.