One rulebook instead of 27 national laws
For thirty years EU anti-money-laundering law worked through directives: Brussels set the frame, and each country transposed it into its own statute — with its own thresholds, carve-outs and interpretations. The 2024 package breaks that construction. Its core is Regulation (EU) 2024/1624, the AMLR: from 10 July 2027 it applies directly in every member state, with no transposition; the one deferred exception is professional football clubs and agents, whose obligations start on 10 July 2029. Directive (EU) 2024/1640, AMLD6, leaves national legislators only the institutional layer — supervisors, financial intelligence units, registers — with the same 10 July 2027 transposition deadline; the beneficial-ownership register access rules bite earlier, by 10 July 2026. The third element is Regulation (EU) 2024/1620, which created AMLA, the supranational supervisor in Frankfurt.
The search for a "convenient jurisdiction" inside the EU ends here: source-of-funds questions in Vilnius, Limassol and Luxembourg become identical as a matter of law. A bank, an EMI or a CASP rebuilds compliance once for the whole Union instead of 27 local variants — under considerably more detailed rules than today's.
The 2026–2029 calendar
| Date | What happens |
|---|---|
| 1 January 2026 | EBA hands its AML/CFT mandate to AMLA: the EuReCA database, risk assessments, methodologies; EBA guidelines stay in force until AMLA replaces them |
| 10 July 2026 | Deadline for AMLA to submit the first batch of AMLR technical standards to the Commission; transposition deadline for AMLD6 rules on access to beneficial-ownership registers (Arts. 11–13, 15) |
| during 2027 | Selection of roughly 40 groups for AMLA's direct supervision under a harmonised methodology |
| 10 July 2027 | AMLR applies directly; general AMLD6 transposition deadline; AMLA guidance on valuing assets for the €50m wealth threshold |
| during 2028 | Direct AMLA supervision begins; about 70% of the authority's funding comes from financial-sector fees |
| 10 July 2029 | AML duties for football clubs and agents; deadline to convert bearer shares; single access point for real-estate data (Art. 18 AMLD6) |
AMLA: mandate, staff, money
AMLA was legally established on 26 June 2024; its Frankfurt office opened in the first quarter of 2025, and on 21 January 2025 Bruna Szego — previously head of AML supervision at the Bank of Italy — was appointed its first Chair. Staff numbers run from about 120 at the end of 2025 to a cruising capacity of about 430 by the end of 2027, over 200 of them in direct supervision; the 2024–2027 budget is just above €119 million, and from 2028 roughly 70% of funding will come from supervisory fees charged to the financial sector — figures from the AMLA FAQ.
The mandate is wider than supervision. AMLA drafts technical standards (RTS/ITS) and guidelines, coordinates national supervisors, supports the network of financial intelligence units and hosts FIU.net — without being an FIU itself. On 1 January 2026 it took over the EBA's entire AML/CFT mandate, including the EuReCA database; existing EBA guidelines remain in force until AMLA replaces them with its own.
Direct supervision: how the 40 groups get picked
From 2028 AMLA becomes the day-to-day supervisor of selected credit and financial institutions — potentially including large CASPs. The criteria are set by regulation: activity in at least six member states plus a high residual risk profile under a harmonised methodology; selection takes place during 2027 and yields roughly 40 groups. AMLA published the final draft RTS on the selection methodology (Art. 12(7) of the AMLA Regulation) and on risk-profile assessment (Art. 40(2) AMLD6) on 23 December 2025 and submitted them to the Commission; a data collection exercise to test the risk models started in January 2026, and on 12 May 2026 national supervisors received a reporting package to identify candidates. According to AML Intelligence, the materiality thresholds are 20,000 customers or €50 million in transaction volume per country — press and working-document figures that only become final once the Commission adopts the RTS.
For everyone outside the forty, little changes on the nameplate and much in substance: national supervisors must apply the same risk-assessment methodologies, and where local supervision systematically fails, AMLA can take an institution over.
The single rulebook: what banks, EMIs and CASPs must rebuild
The obligations of obliged entities move from national statutes into the regulation and are fleshed out by technical standards. AMLA opened consultations on 9 February 2026 on the first AMLR batch: an RTS on customer due diligence (Art. 28(1) AMLR — which data to collect and how to verify it, with priority for eIDAS-compliant remote identification), on the line between occasional transactions and business relationships (Art. 19(9) AMLR) and on pecuniary sanctions (Art. 53(10) AMLD6); Herbert Smith Freehills Kramer has a good digest. The deadline to submit final texts to the Commission was 10 July 2026.
The perimeter of obliged entities widens: CASPs, crowdfunding platforms and dealers in luxury goods for transactions above €10,000 come under the full AML regime, professional football follows in 2029 — where the regulatory boundary is drifting overall is covered in the perimeter review. Inside firms the package requires a board-level compliance manager and group-wide application of policies, including branches outside the EU; what has to physically exist to satisfy that — policies, risk assessment, training, independent review — is set out in the licensed operator's compliance stack. The rebuild runs in parallel with DORA, making 2026–2027 the years of two simultaneous gap analyses.
Everyday thresholds: cash, beneficial owners, anonymity
Three AMLR rules touch the most people. First, cash: persons trading in goods or services may no longer accept more than €10,000 per operation, linked payments included; member states may keep or introduce lower limits, and customer identification is mandatory from €3,000. Payments between private individuals acting outside a professional context are not caught — European Parliament press release.
Second, beneficial owners: a single threshold of "25% or more" of ownership or control (tighter than the old "more than 25%") and a parallel ownership-and-control test; the Commission may lower the threshold to 15% for higher-risk categories of corporate entities by delegated act — see Deloitte Legal. Access to the registers for holders of a legitimate interest — journalists, NGOs, counterparties — becomes immediate, free and at least five years deep.
Third, anonymity: Art. 79 AMLR prohibits anonymous bank, payment and crypto accounts, anonymous passbooks and safe-deposit boxes; bearer shares must be converted or immobilised by 10 July 2029.
EDD for wealth above €50 million
For the first time, European law creates a dedicated regime for very large private capital. Under Art. 34(5) AMLR, where a business relationship classified as higher-risk involves handling at least €5 million through personalised services (private banking, wealth management, trust services) for a customer whose total wealth — financial and investable assets plus real estate, excluding the main residence — is at least €50 million, enhanced due diligence becomes an obligation: additional source-of-funds information, specific procedures for the risks of personalised services, and prevention of conflicts of interest between the customer and staff. AMLA will set out the wealth-valuation methodology in guidance by 10 July 2027.
This is neither a ban nor a tax — it is the default regime for the UHNW segment. The practical consequence: the source-of-funds and wealth file stops being a one-off onboarding folder and becomes a continuously maintained dossier that a private bank will check on a rolling basis.
Crypto: CASPs held to bank standards
For providers licensed under MiCA, the AML package is the second half of their regulation. CASPs become full obliged entities: customer due diligence for occasional transactions from as little as €1,000, mitigating measures for transfers to self-hosted wallets, and enhanced checks on relationships with unregulated third-country venues — details in Freshfields' review. The Art. 79 prohibition covers anonymous crypto accounts and accounts allowing the anonymisation of transactions, including anonymity-enhancing coins: privacy coins leave the regulated perimeter, although self-custody holdings as such are not banned. The Travel Rule under Regulation (EU) 2023/1113 has applied since 30 December 2024 — our explainer. Large CASPs go through the same selection for AMLA's direct supervision as banks; getting your own licence is covered in the CASP guide, operating under someone else's in the white-label review.
Golden visas and other high-risk markers
Annex III AMLR expressly lists as a higher-risk factor a customer who is a third-country national applying for residence rights in exchange for any kind of investment: an applicant under any residence-by-investment programme lands in EDD automatically, and the operators of such programmes become obliged entities themselves. Together with mandatory enhanced due diligence for countries on the Commission's high-risk list and the FATF lists, this formalises what banks were already doing through de-risking — only now under uniform rules. List screening sits alongside it but runs on its own logic and its own clocks: how it works inside an operator is covered in sanctions screening. What to do when a bank closes your account is a separate guide. Nothing is prohibited for golden-visa holders, but the combination of one country's passport, another's investment residency and a third's bank account will demand an impeccable file. Regulators already have the data to cross-check it: the CRS and CARF frameworks cover accounts and crypto-assets through automatic exchange.
Q/A
Will our bank, EMI or CASP end up under AMLA's direct supervision?
The odds are low: roughly 40 groups will be selected across the whole EU, each active in at least six member states with a high residual risk profile; press reports put the materiality thresholds at 20,000 customers or €50 million in transactions per country. But the risk-assessment methodologies become uniform for national supervisors too, and AMLA can take over any institution where local supervision systematically fails — everyone will feel the effect.
What changes for a private banking client with wealth above €50 million?
Where at least €5 million is handled through personalised services, enhanced due diligence becomes mandatory: an extended source-of-funds and source-of-wealth file, specific procedures, conflict-of-interest controls. The questions themselves are familiar from today's EDD — what is new is that they become obligatory, deeper and regularly refreshed.
Will cash still buy a watch or a painting in the EU?
From a professional seller — only up to €10,000, and less in countries with lower national limits; from €3,000 the seller must identify the buyer. Payments between private individuals outside a professional context are not covered by the cap.
Does the package ban privacy coins?
There is no direct ban on holding them. But CASPs will not be able to maintain anonymous accounts or accounts involving anonymity-enhancing coins, so the regulated exchange points for such assets inside the EU close. The practical upshot: converting privacy coins through licensed providers becomes unavailable, and documenting their provenance ever harder.