The EU AML package and AMLA: what changes and when

For two decades the EU fought money laundering through directives. Each Member State transposed them in its own way, so a bank in Lisbon and an e-money institution in Vilnius could read the same text and run different controls. The package adopted on 31 May 2024 replaces much of that with a single rulebook, a slimmer directive and a new supervisor.

This guide covers what each instrument does, the dates that matter, and the practical changes for credit institutions, payment and e-money firms, investment firms, funds, crypto-asset service providers and the non-financial sectors.

Three instruments, three jobs

Instrument	Legal form	Main job	Applies from
Regulation (EU) 2024/1624 (AMLR)	Regulation, directly applicable	Obligations on firms: risk assessment, due diligence, beneficial ownership, reporting, record keeping, cash limit	10 July 2027 (football sector 10 July 2029)
Directive (EU) 2024/1640 (AMLD6)	Directive, transposed nationally	Obligations on Member States: supervisors, financial intelligence units (FIUs), registers, sanctions	Transposition by 10 July 2027, with earlier and later dates for specific articles
Regulation (EU) 2024/1620 (AMLA Regulation)	Regulation	Creates the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA)	1 July 2025, with some articles from 26 June 2024

The practical consequence of moving firm-level rules into a regulation is that national gold-plating shrinks. Member States keep some room, for example to set lower cash limits or to exempt low-risk gambling, but the core obligations read the same everywhere.

The timeline

1. 26 June 2024. AMLA is legally established. Selected articles of the AMLA Regulation apply from this date under Article 108.
2. 1 July 2025. The AMLA Regulation applies in general. AMLA reports that its first Chair, Bruna Szego, took office on 16 February 2025.
3. 10 July 2025. Member States had to apply the AMLD6 amendments to the existing directive on access to beneficial ownership information (AMLD6, Articles 74 and 78).
4. 10 July 2026. Deadline for the AMLD6 rules on access to beneficial ownership registers by authorities, obliged entities and persons with a legitimate interest (Articles 11, 12, 13 and 15).
5. By 1 July 2027. AMLA starts its first selection of entities for direct supervision and must finish it within six months (AMLA Regulation, Article 13(4)).
6. 10 July 2027. The AMLR applies (Article 90) and AMLD6 must be transposed in general.
7. 2028. AMLA begins direct supervision, six months after it publishes the list of selected entities. AMLA’s own timeline places full operation in 2028.
8. 10 July 2029. The AMLR applies to football agents and professional football clubs. Bearer shares must have been converted, immobilised or deposited (AMLR, Article 79), and the AMLD6 single access point for real estate information is due (Article 18).

Who is an obliged entity

AMLR Article 3 lists credit institutions, financial institutions and a long list of professions. The definition of financial institution now names crypto-asset service providers expressly, alongside payment and e-money firms, investment firms, life insurers, UCITS and their management companies, and alternative investment funds and their managers.

The non-financial list includes several additions or clarifications that matter for licensed groups and their clients:

• trust or company service providers, tax advisers, auditors, lawyers and notaries in defined transactions;
• crowdfunding service providers and crowdfunding intermediaries;
• investment migration operators that represent applicants for residence rights in exchange for investment;
• traders in high-value goods and in cultural goods above EUR 10,000;
• non-financial mixed activity holding companies;
• football agents, and professional football clubs for transactions with investors, sponsors, agents and for player transfers.

Gambling remains in scope. Member States may exempt low-risk gambling services under Article 4, but not casinos and not providers whose principal activity is online gambling or sports betting, other than state-operated or state-regulated online services.

What changes for firms

Governance

Article 11 requires two named roles. A compliance manager is a member of the management body in its management function and is responsible for compliance with the AMLR and the Transfer of Funds Regulation. A compliance officer, appointed by that body with sufficiently high standing, runs day-to-day AML and sanctions controls and is the contact point for authorities.

The compliance officer may only be removed after notice to the management body, and the supervisor must be told. Smaller firms may combine the two roles where size and risk justify it. Boards should expect supervisors to test whether the compliance manager genuinely owns the subject.

When due diligence is triggered

Article 19 sets the same triggers across the EU:

Situation	Threshold for customer due diligence
Establishing a business relationship	Always
Occasional transaction, general rule	EUR 10,000 or more, single or linked
Occasional transfer of funds by banks and financial institutions (not CASPs)	EUR 1,000 or more
Occasional transaction by a crypto-asset service provider	EUR 1,000 or more; identification measures below that
Occasional cash transaction	At least identification and verification from EUR 3,000
Gambling stakes or winnings	EUR 2,000 or more
Suspicion of money laundering or terrorist financing	Always, regardless of threshold

Keeping files current

Under Article 26, customer information must be updated at intervals that reflect risk but never longer than one year for higher-risk customers and five years for all others. Firms that rely on event-driven reviews only will need a calendar-driven backstop.

Credit and financial institutions must also screen their customer base against targeted financial sanctions upon every new designation, in addition to risk-based periodic checks.

Beneficial ownership

The 25% test is now in the regulation itself. Under Article 52, ownership of 25% or more of shares, voting rights or other ownership interest, direct or indirect, makes a person a beneficial owner, and holdings on every level of the chain are counted. The Commission may set a lower threshold, of at most 15%, for categories of entity it identifies as higher risk.

Article 53 adds a separate control test. Control through ownership means 50% plus one of the shares or votes, and control by other means includes rights to appoint or remove a majority of the board, veto rights and decisions on profit distribution.

Wealthy clients

Article 34(5) adds specific enhanced measures for higher-risk relationships that involve handling at least EUR 5 million in assets through personalised services for a customer with total assets of at least EUR 50 million, excluding the private residence. It applies to credit institutions, financial institutions and trust or company service providers, which places private banks, wealth managers and fiduciaries squarely in scope. AMLA must issue guidelines on measuring that wealth by 10 July 2027.

Crypto-assets

Crypto-asset service providers face three distinct rules. Article 19 lowers their occasional-transaction threshold to EUR 1,000. Article 40 requires them to assess and mitigate risks of transfers to or from self-hosted addresses. Article 79 prohibits anonymous accounts and accounts that allow anonymisation or increased obfuscation of transactions, “including through anonymity-enhancing coins”.

Records, cash and requests from the FIU

• Record retention: five years from the end of the relationship or the occasional transaction, or from a refusal to onboard, extendable by authorities for up to five more years (Article 77).
• Cash limit: persons trading in goods or providing services may not accept or make cash payments above EUR 10,000, and Member States may set lower limits (Article 80). Payments and deposits at the premises of banks, e-money issuers and payment service providers are exempt but must be reported to the FIU above the limit.
• FIU requests: firms must reply within five working days, and FIUs may shorten this to less than 24 hours in urgent cases (Article 69).

High-risk third countries

The Commission continues to identify third countries with significant strategic deficiencies by delegated act, taking FATF calls for action into account (Article 29). Business relationships and occasional transactions involving persons from listed countries require the enhanced measures in Article 34(4). For institutions outside the EU, a listing of their home jurisdiction directly raises the cost of every EU correspondent and counterparty relationship.

AMLA: what the new authority does

AMLA has its seat in Frankfurt am Main (AMLA Regulation, Article 4). It has three broad roles: direct supervision of a small number of high-risk financial groups, indirect oversight of national supervisors, and support and coordination for national FIUs.

Who AMLA will supervise directly

Selection follows a formula set in Articles 12 and 13:

1. AMLA periodically assesses credit and financial institutions, and groups, that operate in at least six Member States, including the home State, whether through establishments or cross-border services, and whether physically or remotely.
2. It classifies inherent and residual risk as low, medium, substantial or high, using separate methodologies for categories that include credit institutions, e-money institutions, payment institutions, investment firms, collective investment undertakings and crypto-asset service providers.
3. Entities whose residual risk is high qualify. In the first round, if more than 40 qualify, AMLA takes the 40 that operate in the highest number of Member States.
4. Where no entity in a given Member State qualifies, an additional process selects the highest-risk entity there, although this does not apply in the first round.

The first selection must start by 1 July 2027, and the list is reviewed every three years. A cross-border payment or e-money group with weak controls and wide passporting is therefore as plausible a candidate as a large bank.

AMLA’s powers

For directly supervised entities, AMLA can impose pecuniary sanctions. For serious, repeated or systematic breaches of customer due diligence, internal or group-wide controls, or reporting obligations, the maximum is 10% of total annual turnover in the preceding business year. For serious breaches of other requirements, the cap after adjustments is EUR 10 million (Article 22).

AMLA also drafts the technical standards that will fill in the AMLR. It consulted on draft regulatory technical standards on customer due diligence from 9 February to 8 May 2026 and published the consultation outcome on 6 October 2026 (AMLA). Firms should track these standards closely, because they will define the data fields that onboarding systems must collect.

AMLD6: what Member States must build

The directive is less visible to firms but shapes the environment they operate in.

• Fit and proper checks: supervisors must verify that senior management and beneficial owners of credit institutions, financial institutions and other listed obliged entities are of good repute and act with honesty and integrity, and may request removal or divestment (AMLD6, Article 6).
• Beneficial ownership registers: central registers with defined access rules for authorities, obliged entities and persons with a legitimate interest (Articles 10 to 15).
• Account registers: centralised mechanisms identifying holders of payment and bank accounts, including virtual IBANs, securities accounts, crypto-asset accounts and safe-deposit boxes, directly accessible to FIUs (Article 16).
• Sanctions: for credit and financial institutions, maximum pecuniary sanctions of at least EUR 10 million or 10% of annual turnover, whichever is higher, and at least EUR 5 million for natural persons (Article 55).

Effects outside the EU

The AMLR binds entities established in the EU, but its reach is wider in practice.

• Groups with EU subsidiaries must meet the AMLR in those subsidiaries and apply group-wide policies, which in turn shapes controls at the parent.
• EU correspondents and counterparties will apply the harmonised due diligence and beneficial ownership tests to their non-EU clients, with enhanced measures for listed high-risk third countries.
• Neighbouring regimes are moving in parallel. Switzerland, for example, brought its revised Anti-Money Laundering Act and a new Act on the Transparency of Legal Persons and the Identification of Beneficial Owners into force on 1 October 2026, starting transition periods for registering entities in a new transparency register (Swiss Federal Council).

Preparing for 10 July 2027

1. Map scope. Confirm which group entities are obliged entities under Article 3 and which national exemptions, if any, will lapse.
2. Appoint the two roles. Name the compliance manager and the compliance officer, and document their reporting lines to the board.
3. Gap-analyse due diligence. Compare current thresholds, data fields, refresh cycles and beneficial ownership logic against Articles 19, 26, 52 and 53, then against AMLA’s technical standards as they are adopted.
4. Check products. Review cash acceptance, anonymous or privacy-enhancing features, bearer instruments and self-hosted wallet flows.
5. Assess AMLA exposure. Count the Member States in which the group operates, including by passport, and test residual risk honestly against the published methodology.
6. Plan data. Expect more structured requests from FIUs and supervisors, and short deadlines to answer them.

The package does not change the basic logic of AML: know who you deal with, understand why, and report what does not fit. It does remove much of the room that differing national rules once gave, and it places a European supervisor directly over the riskiest cross-border groups.