# The EU AML Package: AMLR, AMLD6 and AMLA — What Actually Changes in 2027–2028 > A single rulebook from 10 July 2027, AMLA supervision from 2028, a €10,000 cash cap, a 25% beneficial-ownership threshold and EDD for €50m+ clients — the map. Author: Maria Plotnikova — Lawyer, Family Office (https://wiki.private.law/en/authors/plotnikova) Last modified: 2026-08-14T13:12:00.000Z Canonical: https://wiki.private.law/en/eu-aml-package Topics: banking Jurisdictions: eu Product tags: compliance, banking Semantic tags: compliance, banking --- ## One rulebook instead of 27 national laws For thirty years EU anti-money-laundering law worked through directives: Brussels set the frame, and each country transposed it into its own statute — with its own thresholds, carve-outs and interpretations. The 2024 package breaks that construction. Its core is [Regulation \(EU\) 2024/1624, the AMLR](https://eur-lex.europa.eu/eli/reg/2024/1624/oj): from 10 July 2027 it applies directly in every member state, with no transposition; the one deferred exception is professional football clubs and agents, whose obligations start on 10 July 2029. [Directive \(EU\) 2024/1640, AMLD6](https://eur-lex.europa.eu/eli/dir/2024/1640/oj), leaves national legislators only the institutional layer — supervisors, financial intelligence units, registers — with the same 10 July 2027 transposition deadline; the beneficial-ownership register access rules bite earlier, by 10 July 2026. The third element is [Regulation \(EU\) 2024/1620](https://eur-lex.europa.eu/eli/reg/2024/1620/oj), which created AMLA, the supranational supervisor in Frankfurt. The search for a "convenient jurisdiction" inside the EU ends here: source-of-funds questions in Vilnius, Limassol and Luxembourg become identical as a matter of law. A bank, an EMI or a CASP rebuilds compliance once for the whole Union instead of 27 local variants — under considerably more detailed rules than today's. ## The 2026–2029 calendar | **Date** | **What happens** | | --- | --- | | 1 January 2026 | EBA hands its AML/CFT mandate to AMLA: the EuReCA database, risk assessments, methodologies; EBA guidelines stay in force until AMLA replaces them | | 10 July 2026 | Deadline for AMLA to submit the first batch of AMLR technical standards to the Commission; transposition deadline for AMLD6 rules on access to beneficial-ownership registers \(Arts. 11–13, 15\) | | during 2027 | Selection of roughly 40 groups for AMLA's direct supervision under a harmonised methodology | | 10 July 2027 | AMLR applies directly; general AMLD6 transposition deadline; AMLA guidance on valuing assets for the €50m wealth threshold | | during 2028 | Direct AMLA supervision begins; about 70% of the authority's funding comes from financial-sector fees | | 10 July 2029 | AML duties for football clubs and agents; deadline to convert bearer shares; single access point for real-estate data \(Art. 18 AMLD6\) | ## AMLA: mandate, staff, money AMLA was legally established on 26 June 2024; its Frankfurt office opened in the first quarter of 2025, and on 21 January 2025 Bruna Szego — previously head of AML supervision at the Bank of Italy — was appointed its first Chair. Staff numbers run from about 120 at the end of 2025 to a cruising capacity of about 430 by the end of 2027, over 200 of them in direct supervision; the 2024–2027 budget is just above €119 million, and from 2028 roughly 70% of funding will come from supervisory fees charged to the financial sector — figures from the [AMLA FAQ](https://www.amla.europa.eu/faqs_en). The mandate is wider than supervision. AMLA drafts technical standards \(RTS/ITS\) and guidelines, coordinates national supervisors, supports the network of financial intelligence units and hosts `FIU.net` — without being an FIU itself. On 1 January 2026 it [took over the EBA's entire AML/CFT mandate](https://www.eba.europa.eu/publications-and-media/press-releases/eba-and-amla-complete-handover-amlcft-mandates), including the EuReCA database; existing EBA guidelines remain in force until AMLA replaces them with its own. ## Direct supervision: how the 40 groups get picked From 2028 AMLA becomes the day-to-day supervisor of selected credit and financial institutions — potentially including large CASPs. The criteria are set by regulation: activity in at least six member states plus a high residual risk profile under a harmonised methodology; selection takes place during 2027 and yields roughly 40 groups. AMLA [published the final draft RTS](https://fiaumalta.org/news/amla-publishes-final-report-on-draft-regulatory-technical-standards-under-article-402-amld-and-article-127-amlar/) on the selection methodology \(Art. 12\(7\) of the AMLA Regulation\) and on risk-profile assessment \(Art. 40\(2\) AMLD6\) on 23 December 2025 and submitted them to the Commission; a [data collection exercise](https://www.amla.europa.eu/amla-launch-data-collection-exercise-test-risk-assessment-models-financial-sector_en) to test the risk models started in January 2026, and on 12 May 2026 national supervisors received a reporting package to identify candidates. According to AML Intelligence, the materiality thresholds are 20,000 customers or €50 million in transaction volume per country — press and working-document figures that only become final once the Commission adopts the RTS. For everyone outside the forty, little changes on the nameplate and much in substance: national supervisors must apply the same risk-assessment methodologies, and where local supervision systematically fails, AMLA can take an institution over. ## The single rulebook: what banks, EMIs and CASPs must rebuild The obligations of obliged entities move from national statutes into the regulation and are fleshed out by technical standards. AMLA [opened consultations on 9 February 2026](https://www.amla.europa.eu/policy/public-consultations/consultation-draft-rts-customer-due-diligence_en) on the first AMLR batch: an RTS on customer due diligence \(Art. 28\(1\) AMLR — which data to collect and how to verify it, with priority for eIDAS-compliant remote identification\), on the line between occasional transactions and business relationships \(Art. 19\(9\) AMLR\) and on pecuniary sanctions \(Art. 53\(10\) AMLD6\); Herbert Smith Freehills Kramer has a good digest. The deadline to submit final texts to the Commission was 10 July 2026. The perimeter of obliged entities widens: CASPs, crowdfunding platforms and dealers in luxury goods for transactions above €10,000 come under the full AML regime, professional football follows in 2029 — where the regulatory boundary is drifting overall is covered in the [perimeter review](https://wiki.private.law/en/regulatory-perimeter-trends). Inside firms the package requires a board-level compliance manager and group-wide application of policies, including branches outside the EU; what has to physically exist to satisfy that — policies, risk assessment, training, independent review — is set out in [the licensed operator's compliance stack](https://wiki.private.law/en/compliance-stack). The rebuild runs in parallel with [DORA](https://wiki.private.law/en/dora-eu), making 2026–2027 the years of two simultaneous gap analyses. ## Everyday thresholds: cash, beneficial owners, anonymity Three AMLR rules touch the most people. First, cash: persons trading in goods or services may no longer accept more than €10,000 per operation, linked payments included; member states may keep or introduce lower limits, and customer identification is mandatory from €3,000. Payments between private individuals acting outside a professional context are not caught — [European Parliament press release](https://www.europarl.europa.eu/news/en/press-room/20240419IPR20586/). Second, beneficial owners: a single threshold of "25% or more" of ownership or control \(tighter than the old "more than 25%"\) and a parallel ownership-and-control test; the Commission may lower the threshold to 15% for higher-risk categories of corporate entities by delegated act — see Deloitte Legal. Access to the [registers](https://wiki.private.law/en/ubo-registers) for holders of a legitimate interest — journalists, NGOs, counterparties — becomes immediate, free and at least five years deep. Third, anonymity: Art. 79 AMLR prohibits anonymous bank, payment and crypto accounts, anonymous passbooks and safe-deposit boxes; bearer shares must be converted or immobilised by 10 July 2029. ## EDD for wealth above €50 million For the first time, European law creates a dedicated regime for very large private capital. Under Art. 34\(5\) AMLR, where a business relationship classified as higher-risk involves handling at least €5 million through personalised services \(private banking, wealth management, trust services\) for a customer whose total wealth — financial and investable assets plus real estate, excluding the main residence — is at least €50 million, enhanced due diligence becomes an obligation: additional source-of-funds information, specific procedures for the risks of personalised services, and prevention of conflicts of interest between the customer and staff. AMLA will set out the wealth-valuation methodology in guidance by 10 July 2027. This is neither a ban nor a tax — it is the default regime for the UHNW segment. The practical consequence: the [source-of-funds and wealth file](https://wiki.private.law/en/source-of-funds) stops being a one-off onboarding folder and becomes a continuously maintained dossier that a [private bank](https://wiki.private.law/en/private-banking) will check on a rolling basis. ## Crypto: CASPs held to bank standards For providers licensed under [MiCA](https://wiki.private.law/en/mica-eu), the AML package is the second half of their regulation. CASPs become full obliged entities: customer due diligence for occasional transactions from as little as €1,000, mitigating measures for transfers to self-hosted wallets, and enhanced checks on relationships with unregulated third-country venues — details in Freshfields' review. The Art. 79 prohibition covers anonymous crypto accounts and accounts allowing the anonymisation of transactions, including anonymity-enhancing coins: privacy coins leave the regulated perimeter, although self-custody holdings as such are not banned. The Travel Rule under Regulation \(EU\) 2023/1113 has applied since 30 December 2024 — [our explainer](https://wiki.private.law/en/travel-rule). Large CASPs go through the same selection for AMLA's direct supervision as banks; getting your own licence is covered in the [CASP guide](https://wiki.private.law/en/casp-license-guide), operating under someone else's in the [white-label review](https://wiki.private.law/en/white-label-casp). ## Golden visas and other high-risk markers Annex III AMLR expressly lists as a higher-risk factor a customer who is a third-country national applying for residence rights in exchange for any kind of investment: an applicant under any residence-by-investment programme lands in EDD automatically, and the operators of such programmes become obliged entities themselves. Together with mandatory enhanced due diligence for countries on the Commission's high-risk list and the FATF lists, this formalises what banks were already doing through de-risking — only now under uniform rules. List screening sits alongside it but runs on its own logic and its own clocks: how it works inside an operator is covered in [sanctions screening](https://wiki.private.law/en/sanctions-screening). What to do when a bank [closes your account](https://wiki.private.law/en/bank-account-closure) is a separate guide. Nothing is prohibited for golden-visa holders, but the combination of one country's passport, another's investment residency and a third's bank account will demand an impeccable file. Regulators already have the data to cross-check it: the [CRS](https://wiki.private.law/en/crs-overview) and [CARF](https://wiki.private.law/en/carf-practice) frameworks cover accounts and crypto-assets through automatic exchange. > 🍓 The AML package introduces no new prohibitions for clean capital — it makes verification identical across all 27 member states and moves discretion from national law into the regulation and AMLA's standards. A source-of-funds and ownership file is worth assembling and maintaining before the questions are asked: from July 2027 they will be asked everywhere, identically. Obliged entities are well advised to run a gap analysis against the AMLR and the draft RTS now, without waiting for national statutes: a directly applicable regulation leaves no transposition slack. The bar is no longer set by the softest EU country, but by Frankfurt. ## Q/A ### **Will our bank, EMI or CASP end up under AMLA's direct supervision?** The odds are low: roughly 40 groups will be selected across the whole EU, each active in at least six member states with a high residual risk profile; press reports put the materiality thresholds at 20,000 customers or €50 million in transactions per country. But the risk-assessment methodologies become uniform for national supervisors too, and AMLA can take over any institution where local supervision systematically fails — everyone will feel the effect. ### **What changes for a private banking client with wealth above €50 million?** Where at least €5 million is handled through personalised services, enhanced due diligence becomes mandatory: an extended source-of-funds and source-of-wealth file, specific procedures, conflict-of-interest controls. The questions themselves are familiar from today's EDD — what is new is that they become obligatory, deeper and regularly refreshed. ### **Will cash still buy a watch or a painting in the EU?** From a professional seller — only up to €10,000, and less in countries with lower national limits; from €3,000 the seller must identify the buyer. Payments between private individuals outside a professional context are not covered by the cap. ### **Does the package ban privacy coins?** There is no direct ban on holding them. But CASPs will not be able to maintain anonymous accounts or accounts involving anonymity-enhancing coins, so the regulated exchange points for such assets inside the EU close. The practical upshot: converting privacy coins through licensed providers becomes unavailable, and documenting their provenance ever harder. --- ## FAQ ### Will our bank, EMI or CASP end up under AMLA's direct supervision? The odds are low: roughly 40 groups will be selected across the whole EU, each active in at least six member states with a high residual risk profile; press reports put the materiality thresholds at 20,000 customers or €50 million in transactions per country. But the risk-assessment methodologies become uniform for national supervisors too, and AMLA can take over any institution where local supervision systematically fails — everyone will feel the effect. ### What changes for a private banking client with wealth above €50 million? Where at least €5 million is handled through personalised services, enhanced due diligence becomes mandatory: an extended source-of-funds and source-of-wealth file, specific procedures, conflict-of-interest controls. The questions themselves are familiar from today's EDD — what is new is that they become obligatory, deeper and regularly refreshed. ### Will cash still buy a watch or a painting in the EU? From a professional seller — only up to €10,000, and less in countries with lower national limits; from €3,000 the seller must identify the buyer. Payments between private individuals outside a professional context are not covered by the cap. ### Does the package ban privacy coins? There is no direct ban on holding them. But CASPs will not be able to maintain anonymous accounts or accounts involving anonymity-enhancing coins, so the regulated exchange points for such assets inside the EU close. The practical upshot: converting privacy coins through licensed providers becomes unavailable, and documenting their provenance ever harder. --- ## Factual claims - For thirty years EU anti-money-laundering law worked through directives: Brussels set the frame, and each country transposed it into its own statute — with its own thresholds, carve-outs and interpretations. - The search for a "convenient jurisdiction" inside the EU ends here: source-of-funds questions in Vilnius, Limassol and Luxembourg become identical as a matter of law. - AMLA was legally established on 26 June 2024; its Frankfurt office opened in the first quarter of 2025, and on 21 January 2025 Bruna Szego — previously head of AML supervision at the Bank of Italy — was appointed its first Chair. - From 2028 AMLA becomes the day-to-day supervisor of selected credit and financial institutions — potentially including large CASPs. - The obligations of obliged entities move from national statutes into the regulation and are fleshed out by technical standards. - For the first time, European law creates a dedicated regime for very large private capital. - For providers licensed under MiCA, the AML package is the second half of their regulation.