AMLR Requirements: What to Have Ready by July 2027

If you run anti-money laundering compliance at an EU bank, payment institution, e-money institution or crypto-asset service provider, this guide gives you the whole of the AML Regulation, Regulation (EU) 2024/1624, in one place: what each chapter asks of your firm, what changes from the Directive you work under today, the deadlines that run inside the text, what AMLA still has to publish and what a supervisor will ask to see. Use it to brief your management body, to plan the nine months left before 10 July 2027 and to test your programme against the articles one at a time.

What is the EU AML Regulation (EU) 2024/1624?

Regulation (EU) 2024/1624, usually shortened to AMLR, is the first time the EU has set the core anti-money laundering duties of obliged entities in a directly applicable regulation. It was adopted on 31 May 2024, published in the Official Journal on 19 June 2024 and entered into force on 9 July 2024, the twentieth day after publication. Its duties start to apply on 10 July 2027 (Article 90). Because it is a regulation, it binds obliged entities directly: there is no national transposition, so a bank in Lisbon and a payment institution in Vilnius read the same article with the same number.

The AMLR is one of four acts that make up the EU AML package, and each has a different job. The AMLR holds the rules for firms. Directive (EU) 2024/1640, sometimes called AMLD6, organises supervisors, financial intelligence units (FIUs) and beneficial ownership registers, sets the penalty regime and repeals Directive (EU) 2015/849 from 10 July 2027 (its Article 77). Regulation (EU) 2024/1620 creates the Anti-Money Laundering Authority, AMLA, in Frankfurt. Regulation (EU) 2023/1113 sets the information that must travel with transfers of funds and of crypto-assets, and it has applied since 30 December 2024 (its Article 40).

One consequence matters for budgeting. The AMLR itself contains no fines for the duties of Chapters II, III and V. Those come from Article 55 of the Directive, transposed into national law, and from the AMLA Regulation for the small number of groups AMLA will supervise directly. The penalties section below gives the numbers.

When does the AMLR apply, and what applies until then?

The AMLR applies from 10 July 2027. Football agents and professional football clubs, which Article 3 adds to the list of obliged entities, follow two years later, on 10 July 2029. Until 10 July 2027 the national law that transposed Directive (EU) 2015/849, as amended by Directive (EU) 2018/843, applies in full, and that is the law you cite in your policies and your reports to the supervisor today.

Three other layers already move in the meantime. The EBA guidelines on risk factors, on the compliance officer and on restrictive measures apply now and stay in force until AMLA replaces them. AMLA, which took over the EBA's AML mandates on 1 January 2026, has to write most of the technical standards the AMLR calls for, and on 1 October 2026 it announced that its first three final drafts, set out in final reports dated 30 September, had gone to the European Commission. And AMLA will start selecting the groups it supervises directly by 1 July 2027.

The practical reading: run your programme under national law until 10 July 2027, and build each control so its evidence also answers the AMLR article that replaces it. Annex VI of the AMLR maps every Directive article to its successor, which is what makes that relabelling possible. The transition section below shows the main pairs.

Who has to comply with the AMLR?

Article 3 lists the obliged entities: credit institutions, financial institutions, and a set of professions and traders acting in the exercise of their professional activities. The definition of financial institution in Article 2(1)(6) is where most readers of this guide sit. It covers undertakings that carry out the activities in Annex I to Directive 2013/36/EU, which brings in payment institutions and e-money institutions, plus bureaux de change, life insurers and life insurance intermediaries, investment firms, collective investment undertakings and their managers, central securities depositories, certain creditors and credit intermediaries, and, by point (i), crypto-asset service providers.

If you are a crypto-asset service provider, the AMLR sits next to your MiCA authorisation, which our guide to MiCA requirements for CASPs covers. If you are a payment institution, your ICT duties come from DORA, set out in our guide to DORA for payment institutions.

What does the AMLR require, chapter by chapter?

The Regulation has nine chapters and 90 articles. Four parts carry the weight for a financial institution: Chapter II on internal policies and governance, Chapter III on customer due diligence, Chapter V on reporting and Chapter VII on data protection and records. They are also the parts whose breach triggers pecuniary sanctions under Article 55(1) of Directive (EU) 2024/1640, which names Chapters II, III and V and Article 77.

What internal policies, procedures and controls does Article 9 require?

Article 9(1) asks for internal policies, procedures and controls that secure compliance with the AMLR, with Regulation (EU) 2023/1113 and with any administrative act of your supervisor. They must mitigate the money laundering and terrorist financing risks identified at Union, national and firm level, and, beside the duty to apply targeted financial sanctions, the risk that those sanctions are not implemented or are evaded. They must be proportionate to the nature, risks, complexity and size of the business and cover every activity in scope.

Article 9(2)(a) then lists what the policies and procedures must cover, at a minimum:

1. carrying out and updating the business-wide risk assessment;
2. the firm's risk management framework;
3. customer due diligence under Chapter III, including how you determine whether a customer, beneficial owner or person on whose behalf a transaction is made is a politically exposed person, a family member or a close associate;
4. reporting suspicious transactions;
5. outsourcing and reliance on due diligence carried out by other obliged entities;
6. record retention and the processing of personal data under Articles 76 and 77;
7. monitoring compliance with the policies, identifying deficiencies and carrying out remedial action;
8. checking the good repute of staff, agents and distributors when you recruit or appoint them, proportionate to the risk of their tasks;
9. communicating the policies internally, including to agents, distributors and service providers;
10. a training policy for employees and, where relevant, agents and distributors.

Article 9(2)(b) adds internal controls and an independent audit function that tests the policies, procedures and controls; a firm without an independent audit function may use an external expert. Everything must be recorded in writing. The approval levels are explicit: internal policies are approved by the management body in its management function, and internal procedures and controls at least at the level of the compliance manager. Article 9(3) requires you to keep them current and to strengthen them where weaknesses are found.

Article 9(4) asked AMLA for guidelines, by 10 July 2026, on how far the policies should go given a firm's nature and size, including the staffing of the compliance functions and when the audit may be external. In its consultation paper on the business-wide risk assessment, AMLA lists those guidelines among the instruments it is still developing. Today, the equivalent duties sit in Article 8(3) to (5) of the Directive as transposed in your Member State.

What must the business-wide risk assessment contain?

Article 10(1) requires you to identify and assess the money laundering and terrorist financing risks you are exposed to, and the risk that targeted financial sanctions are not implemented or are evaded. The assessment must take into account at least six sources: the risk variables in Annex I and the risk factors in Annexes II and III; the Commission's Union-level risk assessment; the national and sectoral risk assessments of the Member States; publications of international standard setters, the Commission and AMLA; information from competent authorities; and information on your own customer base. Before you launch a new product, service, delivery channel or technology, or enter a new customer segment or country, you assess its risks first.

Article 10(2) sets the governance. The assessment is documented, kept up to date and regularly reviewed, including when an internal or external event significantly changes your risks, and it is made available to supervisors on request. It is drawn up by the compliance officer, approved by the management body in its management function and communicated to the management body in its supervisory function where there is one. Article 10(3) lets supervisors waive documented assessments for sectors whose risks are clear, but never for credit institutions, financial institutions or crowdfunding providers.

Two documents shape the method. AMLA consulted from 16 April to 15 July 2026 on draft guidelines under Article 10(4), built around four minimum requirements: a business and operational overview, the inherent risks, the quality of the controls and the residual risks; AMLA's paper says the final guidelines will be issued in Q4 2026. For credit and financial institutions, Guideline 1.7 of EBA/GL/2021/02 already asks you to set a date each calendar year for the next update. Our step-by-step guide to the AML business-wide risk assessment covers the method, the scoring and the sign-off in detail.

Who must hold the compliance manager and compliance officer roles?

Article 11 creates two roles and keeps them distinct. The compliance manager is a member of the management body in its management function who is responsible for compliance with the AMLR, Regulation (EU) 2023/1113 and supervisory acts. That person makes sure the policies match the firm's risk exposure and are implemented, makes sure the compliance work has enough people and money, and receives information on significant or material weaknesses. Under the Directive the closest equivalent was the member of the management board identified under Article 46(4).

The compliance officer is appointed by the management body, must have sufficiently high hierarchical standing and runs the policies, procedures and controls day to day, including the implementation of targeted financial sanctions. The compliance officer is the contact point for competent authorities and files suspicious transaction reports with the FIU under Article 69(6). Every obliged entity must have one. Where size and low risk justify it, a group member may share the compliance officer of another group entity, and where the nature, risks and size of the business justify it, one person may hold both roles (Article 11(7)).

The protections are specific. The compliance officer may be removed only after prior notification to the management body, and the firm must notify the supervisor of the removal and say whether it relates to the AML tasks (Article 11(2)). The firm must protect the compliance officer from retaliation and from commercial pressure (Article 11(4)), and both the compliance officer and the head of audit must be able to report directly to the management body in both its functions (Article 11(5)). Once a year, the compliance manager submits to the management body a report on the implementation of the policies, drawn up by the compliance officer (Article 11(6)).

Until AMLA replaces it, EBA/GL/2022/05 sets out what supervisors expect of these roles today, including the content of the compliance officer's annual activity report in its paragraph 50. Our guide to AML compliance officer requirements takes the two texts paragraph by paragraph.

What do the training, integrity and whistleblowing articles require?

Article 12 requires staff, agents and distributors whose function needs it to know the AMLR, the business-wide risk assessment and the firm's policies. They must take part in specific, ongoing training that helps them recognise operations linked to money laundering or terrorist financing and tells them what to do; the training must fit their role and the firm's risks, and it must be documented.

Article 13 makes the integrity check a stand-alone duty. Anyone directly involved in compliance, agents and distributors included, is assessed for skills, knowledge and expertise and for good repute, honesty and integrity before starting, and again at regular intervals set by the risk of the role; the compliance officer approves the content of the assessment. Staff must tell the compliance officer about any close private or professional relationship with a customer or a prospective customer and are then kept off compliance tasks for that customer. Article 14 requires internal whistleblowing channels that meet Directive (EU) 2019/1937.

How do the group and outsourcing rules change?

Article 16 makes a parent undertaking carry out a group-wide risk assessment that takes into account the business-wide assessments of its branches and subsidiaries, and run group-wide policies, including on data protection and on sharing information within the group. Compliance functions sit at group level too, with a group compliance manager reporting at least once a year to the parent's management body. Entities in the group must share information where it is relevant to due diligence and risk management, including suspicions reported to the FIU and the analyses behind them, unless the FIU says otherwise. Article 17 covers branches and subsidiaries in third countries whose law falls short. AMLA's final draft standards on group-wide requirements under Articles 16(4) and 17(3) went to the Commission with AMLA's final report of 30 September 2026.

Article 18 is new. You may outsource tasks, but you must notify your supervisor before the provider starts, you remain fully liable, and for each task you must be able to show the supervisor that you understand what the provider does and why it mitigates your risks. Before outsourcing you check that the provider is qualified, you lay the terms down in a written agreement and you run regular controls whose frequency depends on how critical the task is. You may not outsource to providers in high-risk third countries unless they belong to your own group and the group conditions in Article 18(6) are met. Six decisions stay inside the firm in every case:

Point (f) deserves attention if you buy transaction monitoring or screening from a vendor: the criteria that detect suspicious or unusual activity must be approved by your firm. Our guide to performing a third-party risk assessment covers the vendor side of that work. AMLA's guidelines on outsourcing are due by 10 July 2027 (Article 18(8)).

When must customer due diligence be applied?

Article 19 sets the triggers. You apply customer due diligence when you establish a business relationship; when you carry out an occasional transaction of at least EUR 10,000, alone or through linked transactions; whenever there is a suspicion of money laundering or terrorist financing, whatever the amount; and when you doubt the data you hold or whether the person in front of you is the customer or is authorised to act for them. The Directive's threshold was EUR 15,000 (its Article 11), so a transaction between the two amounts that needs no due diligence today will need it from 10 July 2027.

Lower thresholds apply in places. Credit and financial institutions other than crypto-asset service providers apply due diligence to an occasional transfer of funds of at least EUR 1,000 (Article 19(2)). Crypto-asset service providers apply it to occasional transactions of at least EUR 1,000 and must at least identify and verify the customer below that amount (Article 19(3)). Any obliged entity must identify and verify the customer for an occasional cash transaction of at least EUR 3,000 (Article 19(4)). Supervisors may exempt low-risk e-money products from some measures where, among other conditions, the instrument is not reloadable and holds no more than EUR 150 (Article 19(7)).

AMLA's final draft standards under Article 19(9), sent to the Commission with a final report dated 30 September 2026, set the criteria for telling business relationships from occasional transactions, for identifying linked transactions and for the sectors that get lower values. Once adopted, they will decide edge cases such as a series of small payments by the same customer.

What does customer due diligence involve under Article 20?

Article 20(1) lists nine measures and says that obliged entities shall apply all of them. You scale how far each goes by an individual analysis of the risk (Article 20(2)), and you must be able to show the supervisor that what you did fits the risk (Article 20(4)).

Point (d) is the visible change. You must verify whether the customer or its beneficial owners are subject to targeted financial sanctions and, for a legal entity, whether sanctioned persons control it or hold more than 50% of its proprietary rights. The Directive's due diligence article had no sanctions measure. Article 26(4) adds that credit and financial institutions repeat that check whenever a new designation is made.

Around the nine measures sit the rules on execution. If you cannot complete due diligence, you refrain from the transaction or relationship, end an existing one and consider reporting to the FIU (Article 21). Identification data and the means of verification are set in Article 22, including identification of the people who use virtual IBANs, and AMLA's final draft standards under Article 28(1) specify the information to collect for standard, simplified and enhanced due diligence. Verification normally comes before the relationship starts; a credit or financial institution may open an account earlier only if no transaction can be carried out until verification is complete (Article 23).

How often must customer information be updated?

Article 26(1) requires ongoing monitoring of the relationship and its transactions against what you know of the customer, its business and its risk profile, and, where necessary, the origin and destination of the funds. Article 26(2) then sets ceilings for keeping customer information up to date: no more than one year between updates for higher-risk customers under enhanced due diligence and no more than five years for everyone else. On top of the cycle, you review the file when the customer's circumstances change, when you must contact the customer in the year about beneficial ownership or tax cooperation, and when you learn a relevant fact (Article 26(3)).

The ceilings are maximums. Your risk-based intervals may be shorter, and the evidence a supervisor looks for is the refresh schedule and the count of files past their date. AMLA consulted from 3 June to 3 September 2026 on guidelines under Article 26(5) that cover both keeping customer information up to date and the transaction monitoring framework. For credit and financial institutions, Guideline 4.75 of EBA/GL/2021/02 already expects regular ex post reviews of a sample of all processed transactions to test and improve the monitoring system.

What changes for beneficial ownership?

Article 52(1) defines ownership as direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest, with indirect ownership calculated by multiplying along each chain and adding the chains together. Under the Directive, a holding of 25% plus one share or more than 25% was the indication (Article 3(6)(a)(i) of Directive (EU) 2015/849), so a person holding exactly 25% becomes a beneficial owner. Control through other means sits in Article 53. By 10 July 2029 the Commission will assess whether some higher-risk categories of companies need a lower threshold, which could not exceed 15% unless the Commission finds a higher one more proportionate, always below 25% (Article 52(2)).

Three duties follow in daily work. When no natural person can be identified after all means are exhausted, you record that, identify all senior managing officials and verify them, and keep a record of what you tried (Article 22(2)). When the central register disagrees with what you collected, you report the discrepancy without undue delay and within 14 calendar days of detecting it (Article 24). And as a legal entity yourself, you hold accurate information on your own beneficial owners, report changes to the register within 28 calendar days and verify the information at least once a year (Article 63).

When do simplified and enhanced due diligence apply?

Simplified due diligence is available where a relationship or transaction presents a low risk, judged against Annexes II and III (Article 33). You may then postpone verification by up to 60 days after the relationship starts, update information less often, collect less on purpose and intended nature, or monitor with lower frequency or intensity, but you must still be able to detect unusual transactions, and you must re-check that the conditions for simplified treatment still hold.

Enhanced due diligence is mandatory in the cases in Articles 29 to 31 and 36 to 46 and in any other case your risk analysis rates as higher risk (Article 34). The menu in Article 34(4) includes more information on the customer and its owners, on the source of funds and source of wealth and on the reasons for transactions; senior management approval; more frequent monitoring; and a first payment through an account in the customer's name. The mandatory cases include:

• High-risk third countries. Business with persons from countries the Commission identifies triggers the enhanced measures and any countermeasures it designates (Articles 29, 30, 31 and 35).
• Correspondent relationships. Cross-border correspondent relationships with third-country respondents need information on the respondent, an assessment of its controls and senior management approval (Article 36); relationships with shell institutions are prohibited (Article 39).
• Politically exposed persons. Senior management approval, source of wealth and source of funds, and enhanced ongoing monitoring, for PEPs, their family members and close associates (Articles 42 and 46). The definition now reaches heads of regional and local authorities, including groupings of municipalities and metropolitan regions, of at least 50,000 inhabitants. After a person leaves office, the measures continue while the risk lasts and for at least 12 months (Article 45).
• Crypto-asset transfers to and from self-hosted addresses. Crypto-asset service providers assess the risk and apply mitigating measures (Article 40).
• Residence by investment. Third-country nationals applying for residence rights in exchange for an investment get at least four of the enhanced measures (Article 41).
• Very high net worth customers. Where a higher-risk relationship involves handling assets of at least EUR 5,000,000 through personalised services for a customer with total assets of at least EUR 50,000,000, credit and financial institutions and TCSPs apply extra measures (Article 34(5)).

Can you rely on another firm's due diligence?

Yes, within limits. Article 48 lets you rely on another obliged entity, in the EU or a third country, to identify and verify the customer and its beneficial owners and to understand the purpose of the relationship, provided that entity applies equivalent due diligence and record keeping and is supervised accordingly. The ultimate responsibility stays with you, and you may not rely on entities in high-risk third countries unless they are your own branches or subsidiaries that meet the group conditions. Article 49 requires you to obtain the information on the measures performed and to be able to get copies of the underlying documents without delay and within 5 working days, under a written agreement.

What are the AMLR reporting obligations?

Article 69(1) requires you to report to the FIU promptly and on your own initiative when you know, suspect or have reasonable grounds to suspect that funds or activities, of any amount, are the proceeds of criminal activity or linked to terrorist financing. Attempted transactions and suspicions arising from failed due diligence are included. You answer the FIU's requests for information within 5 working days; in justified and urgent cases the FIU may shorten that, even to less than 24 hours, and it may also extend it. The suspicion must rest on the characteristics of the customer and its counterparts, the size, nature and patterns of the activity, the links between transactions, the origin and destination of funds and their consistency with the customer's profile (Article 69(2)). The compliance officer transmits the report (Article 69(6)), and everyone involved is protected from retaliation (Article 69(7)).

Article 71 requires you to refrain from a transaction you know or suspect to be linked to crime until you have reported it and followed any FIU instruction. If no instruction arrives within 3 working days of the report, you may proceed after assessing the risk. Where refraining is impossible or would frustrate the investigation, you inform the FIU straight after the transaction. Article 73 prohibits telling the customer or a third person that a transaction is being assessed or has been reported, with exceptions for authorities, for group sharing under Article 16 and for obliged entities involved in the same transaction.

Two threshold reports are new. Credit and financial institutions that provide services for the purchase or transfer of ownership of motor vehicles priced at EUR 250,000 or more, or of watercraft and aircraft priced at EUR 7,500,000 or more, bought for non-commercial purposes, report to the FIU every transaction they carry out for customers in relation to those goods (Article 74(2)). And cash payments or deposits above the EUR 10,000 limit made at the premises of a credit institution, e-money issuer or payment service provider are reported to the FIU within the deadlines it sets (Article 80(4)). AMLA consulted from 2 July to 20 September 2026 on the implementing standards that will fix the format of suspicious transaction reports under Article 69(3).

What does the AMLR say about records and data protection?

Article 77 lists what you keep: the due diligence documents, including data obtained through electronic identification; a record of every assessment under Article 69(2), whether or not it led to a report, with the report itself if there was one; the transaction records; and copies of what you exchanged in information sharing partnerships. Records must not be redacted. You keep them for five years from the end of the relationship, the date of the occasional transaction or the refusal to enter into either, and then delete the personal data; a competent authority may require up to five more years in a specific case (Article 77(3)). Article 78 requires systems that let you answer, fully and quickly, whether you had a relationship with a given person in the previous five years.

Article 76 governs the data itself. Special categories of personal data and data on criminal convictions may be processed only where strictly necessary for AML purposes and with safeguards, including telling customers, reliable and current sources, no biased or discriminatory outcomes and security in line with Article 32 of the GDPR; using the data for commercial purposes is prohibited. Article 76(5) adds rules for automated decisions, including profiling and AI systems: a decision to take on, refuse, keep or end a customer, to carry out or refuse a transaction, or to raise or lower due diligence must involve meaningful human intervention, and the customer can ask for an explanation and challenge the decision, except where it concerns a suspicious transaction report.

What do the rules on anonymous instruments and cash require?

Article 79 prohibits credit institutions, financial institutions and crypto-asset service providers from keeping anonymous accounts, passbooks, safe-deposit boxes or crypto-asset accounts, or any account that allows the holder to be anonymised or transactions to be obscured, including through anonymity-enhancing coins. Acquirers may not accept payments made with anonymous prepaid cards issued in third countries unless the due diligence standards allow it on proven low risk. Article 80 caps cash payments for goods or services at EUR 10,000 for persons trading in goods or providing services, with lower national limits allowed; payments between private individuals and payments or deposits at the premises of banks, e-money issuers and payment service providers are outside the cap, subject to the reporting duty above.

Which Directive article does each AMLR duty replace?

Annex VI of the AMLR is a correlation table from Directive (EU) 2015/849 to the new texts. It tells you where today's evidence will land. If your business-wide risk assessment is filed against the national provision that transposed Article 8(1) of the Directive, from 10 July 2027 it answers Article 10(1) of the AMLR, and the work becomes a relabelling exercise plus the specific changes, such as adding sanctions evasion to the assessment.

The duties with no row in the table are where the new work is: the outsourcing rules in Article 18, sanctions checks inside due diligence (Articles 20(1)(d) and 26(4)), virtual IBANs (Article 22(3)), very high net worth customers (Article 34(5)), self-hosted addresses (Article 40), residence by investment (Article 41), high-value goods reports (Article 74) and the EUR 10,000 cash limit (Article 80).

What is AMLA still to publish?

Much of the operational detail of the AMLR sits in standards and guidelines that AMLA had to deliver by 10 July 2026 or will deliver by 10 July 2027. In final reports dated 30 September 2026 and announced on 1 October, AMLA sent three final draft regulatory technical standards (RTS) to the Commission: on customer due diligence under Article 28(1), on business relationships, occasional and linked transactions under Article 19(9), and on group-wide requirements under Articles 16(4) and 17(3). They become law only once the Commission adopts them and they are published in the Official Journal, and AMLA proposes that they apply six months after they enter into force (for football agents and clubs, from 10 July 2029).

The rest is in progress. The guidelines on the business-wide risk assessment were consulted until 15 July 2026, with the final version due in Q4 2026. The guidelines on ongoing monitoring closed on 3 September 2026 and the implementing standards on the format of suspicious transaction reports on 20 September 2026. AMLA's consultation paper on Article 10(4) names the guidelines on internal policies under Article 9(4) and on risk variables and risk factors under Article 20(3) as instruments it is still developing, and the guidelines on outsourcing (Article 18(8)) and on indicators of suspicious activity (Article 69(5)) are due by 10 July 2027.

Which EBA guidelines apply now?

On 1 January 2026 the EBA completed the transfer of its AML and counter-terrorist financing mandates to AMLA, and both authorities stated that all existing EBA AML guidelines and standards stay in force until AMLA replaces them. For a credit or financial institution that makes four sets of guidelines the working standard today:

• EBA/GL/2021/02, the ML/TF Risk Factors Guidelines, on the business-wide and customer risk assessments, due diligence and monitoring, with sector guidelines for e-money issuers, money remitters and payment initiation and account information services; amended by EBA/GL/2024/01 for crypto-asset service providers from 30 December 2024.
• EBA/GL/2022/05, on the AML/CFT compliance officer and the management body, applying since 1 December 2022.
• EBA/GL/2024/14, on policies, procedures and controls to implement Union and national restrictive measures, and EBA/GL/2024/15 for payment service providers and crypto-asset service providers under Regulation (EU) 2023/1113, both applying since 30 December 2025.

They also show where AMLA is heading: in its consultation paper on the business-wide risk assessment, AMLA says it aligned the draft with EBA/GL/2021/02 and EBA/GL/2024/14 wherever that made sense for all sectors.

What are the penalties for breaching the AMLR?

Article 55 of Directive (EU) 2024/1640 requires Member States to impose pecuniary sanctions for serious, repeated or systematic breaches of AMLR Chapters II, III and V and Article 77, and to allow sanctions for other breaches and for ignoring administrative measures. The maximum sanction available must be at least twice the benefit derived from the breach, where it can be determined, or at least EUR 1,000,000, whichever is higher. For a credit or financial institution it must be at least EUR 10,000,000 or 10% of total annual turnover, whichever is higher, and at least EUR 5,000,000 for a natural person. Member States may go higher (Article 55(4)).

Article 56 lets supervisors apply administrative measures as well, from recommendations onwards, where they find breaches or weaknesses in your controls that are likely to lead to breaches. For the groups AMLA supervises directly, AMLA sets its own sanctions under Article 22 of the AMLA Regulation, capped at 10% of annual turnover or EUR 10,000,000 depending on the type of breach.

When will AMLA supervise firms directly?

AMLA assesses credit and financial institutions and groups that operate in at least six Member States, including the home Member State, and classifies their residual risk as low, medium, substantial or high (Articles 12(1) and 12(3) of the AMLA Regulation). Those rated high are selected for direct supervision (Article 13(1)). In the first selection, if more than 40 qualify, AMLA takes the 40 operating in the most Member States (Article 106(2)). AMLA must begin the first selection by 1 July 2027 and finish it within six months, and direct supervision starts six months after the list is published (Article 13(4)), so in 2028. Every other firm stays with its national supervisor.

What should you have in place by 10 July 2027?

Nine months is enough if the work is sequenced. A practical order:

1. October to December 2026: map. Run a gap assessment of every AMLR duty against today's controls, name an owner for each requirement, read AMLA's final draft due diligence standards and decide who will be the compliance manager.
2. January to March 2027: rebuild the core. Refresh the business-wide risk assessment with sanctions evasion in scope, rewrite the policies against the ten areas in Article 9(2) and have them re-approved, build the outsourcing register with the written agreements and the supervisor notifications, and plan the training.
3. April to June 2027: change operations. Move due diligence standards to the final RTS, add the sanctions check to onboarding and to new designations, schedule refresh cohorts against the one and five year ceilings, and write down the design decisions behind your monitoring.
4. By 10 July 2027: go live. Minute the approvals at the right level, draft the first implementation report, file the evidence against each requirement and plan the independent audit for the first year.

Our general guide to becoming compliant step by step explains how to run a programme of this kind, and a free compliance check gives you a first baseline.

What evidence will a supervisor ask for?

A supervisor tests whether each duty works in practice, so for every requirement you need a record that shows it. The list below is built from the articles themselves; our guide to collecting audit evidence covers how to gather and file it.

What the other results get wrong

We read the pages that rank for AMLR queries and checked their claims against the Official Journal texts. These are the errors that would mislead a compliance team, in the pages' own words.

• An old threshold. FluxForce's AMLR page says that "for occasional transactions above €15,000 (lower for certain sectors), CDD must be completed before execution". EUR 15,000 was the Directive's figure. Article 19(1)(b) of the AMLR sets EUR 10,000, and uses the words "at least", so a transaction of exactly EUR 10,000 is caught.
• The wrong penalty for institutions. The same page gives credit and financial institutions a maximum of "up to €5 million or 10% of total annual turnover". Article 55(3)(a) of Directive (EU) 2024/1640 sets at least EUR 10,000,000 or 10%; EUR 5,000,000 is the figure for natural persons. The amounts are floors on the maximum, and Member States may go higher.
• A threshold that does not exist. FluxForce also says firms must "appoint a dedicated compliance officer at management level for entities above specific thresholds". Article 11 has no size threshold: every obliged entity has a compliance manager and a compliance officer, and only the possibility of combining the two roles depends on size and risk.
• The beneficial ownership change in the wrong law. A&O Shearman's AML playbook says "AMLD 6 also lowers the beneficial ownership identification threshold" to 25% or more. The threshold is in Article 52(1) of the AMLR; Directive (EU) 2024/1640 contains no ownership percentage at all. FinancialRegulations.eu places the same change in "Articles 62-63", which deal with beneficial ownership information and the obligations of legal entities.
• A wrong publication date. FinancialRegulations.eu dates the package's publication in the Official Journal to 16 June 2024. It was published on 19 June 2024.
• A start date the law does not give. Checkmarble's guide says that from 1 January 2028 AMLA "will directly supervise approximately 40" institutions and that the list "will be published by end of 2027". Article 13(4) of the AMLA Regulation starts direct supervision six months after the list is published, so a list at the end of 2027 means mid-2028.

There is also a gap they share: none of the twenty ranking pages we checked cites EBA/GL/2021/02, 2022/05, 2024/14 or 2024/15 by number, although those are the guidelines a supervisor inspects against until AMLA replaces them.

Where do you stand?

Fill this in for your firm. A blank row is a gap to close before 10 July 2027.

How Venvera runs the AML/CFT programme

Venvera gives the compliance team one place for the whole programme: every requirement, owner, task, deadline and piece of evidence in one dashboard, so the work stops living in Outlook, Excel and mail chains. The AML/CFT module carries the AMLR and the EBA guidelines as 137 requirements, each with its article or guideline paragraph, guidance on the evidence a reviewer accepts, an owner and a status, and every requirement that replaces a Directive duty names the national equivalent you cite until 10 July 2027. A 48 question gap assessment scores the judgement calls an inspection tests, 15 recurring obligations sit on the compliance calendar with owners and dates, 11 policy templates give you a starting text, and the board report gives the management body the status in one view. Where one document genuinely answers several requirements, you attach it to each of them.

Venvera manages the programme and its evidence. Customer screening, transaction monitoring, identity verification and payments run in your own systems; Venvera keeps the records that show how they are governed, such as the design decisions, the approvals of detection criteria, the sample reviews and the calibration evidence.

Plans start at EUR 399 per month for two frameworks (Basic), with Professional at EUR 899 per month for five and Enterprise on request; see pricing. You can start a 14-day Professional trial without a credit card, book a demo to see the module with your own questions, or begin with the free compliance check.

Frequently asked questions

When does the EU AML Regulation apply?

From 10 July 2027 (Article 90 of Regulation (EU) 2024/1624). For football agents and professional football clubs it applies from 10 July 2029. Until 10 July 2027 the national law that transposed Directive (EU) 2015/849 applies in full.

Does the AMLR replace the AML Directives?

For the duties of obliged entities, yes. Directive (EU) 2015/849 is repealed from 10 July 2027 by Article 77 of Directive (EU) 2024/1640, and references to it are read through the correlation tables in Annex VI of the AMLR and the Annex to that Directive. The new Directive keeps the rules for supervisors, FIUs, registers and penalties, which Member States transpose by 10 July 2027.

Is the AMLR directly applicable?

Yes. It is a regulation, binding in its entirety and directly applicable in all Member States, so there is no national transposition of the duties. Some national choices remain, such as a cash payment limit lower than EUR 10,000 under Article 80(2).

What is the customer due diligence threshold under the AMLR?

EUR 10,000 for occasional transactions, single or linked (Article 19(1)(b)). It is EUR 1,000 for transfers of funds by credit and financial institutions and for crypto-asset service providers, EUR 2,000 for gambling, and identification and verification apply to cash transactions from EUR 3,000.

What is the beneficial ownership threshold under the AMLR?

Direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest (Article 52(1)). The Commission may set a lower threshold, of at most 15% as a rule, for higher-risk categories of companies by delegated act.

How often must customer due diligence be refreshed?

At least once a year for higher-risk customers under enhanced due diligence and at least every five years for all others (Article 26(2)), plus whenever circumstances change or you learn a relevant fact (Article 26(3)). Shorter risk-based intervals are allowed.

What is the difference between the compliance manager and the compliance officer?

The compliance manager is a member of the management body who answers for compliance and resources (Article 11(1)). The compliance officer runs the policies and controls day to day, is the contact for authorities and files suspicious transaction reports (Articles 11(2) and 69(6)).

Does every obliged entity need a compliance officer?

Yes. Article 11(2) says obliged entities shall have one. A group entity may share the compliance officer of another group entity where its size and low risk justify it, and one person may hold both the compliance manager and compliance officer roles where the business justifies it (Article 11(7)).

Can AML/CFT tasks be outsourced under the AMLR?

Yes, after notifying the supervisor and under a written agreement, with the firm fully liable (Article 18). Six tasks can never be outsourced, including approving the business-wide risk assessment, deciding a customer's risk profile and approving the criteria that detect suspicious transactions.

How quickly must a firm answer an FIU request?

Within 5 working days (Article 69(1)). In justified and urgent cases the FIU may shorten the deadline, including to less than 24 hours, and it may also extend it.

What are the penalties under the AMLR?

They are set by Article 55 of Directive (EU) 2024/1640 and national law: maximums of at least twice the benefit or EUR 1,000,000, and for credit and financial institutions at least EUR 10,000,000 or 10% of total annual turnover. Member States may set higher amounts.

Will AMLA supervise my firm directly?

Only if you are a credit or financial institution, or group, operating in at least six Member States with a residual risk rated high. The first selection starts by 1 July 2027 and is capped at 40 entities, and direct supervision begins in 2028. Everyone else stays with the national supervisor.

Do the EBA AML guidelines still apply?

Yes. The EBA handed its AML mandates to AMLA on 1 January 2026, and existing EBA guidelines, such as EBA/GL/2021/02 and EBA/GL/2022/05, remain in force until AMLA replaces them.

Are AMLA's technical standards final?

Not yet. AMLA sent final drafts of the RTS on due diligence, on business relationships and on group-wide requirements to the Commission in final reports dated 30 September 2026 and announced on 1 October. They apply only after adoption and publication in the Official Journal, and AMLA proposes that they apply six months after they enter into force.

Are account information service providers obliged entities under the AMLR?

A provider of account information services only is outside the definition of financial institution: Article 2(1)(6)(a) excludes the activity in point (8) of Annex I to Directive (EU) 2015/2366. Payment initiation service providers are in scope, with the merchant as the customer (Article 19(6)(d)).

Do crypto-asset service providers fall under the AMLR?

Yes. They are financial institutions under Article 2(1)(6)(i), apply due diligence from EUR 1,000 for occasional transactions, assess transfers to and from self-hosted addresses (Article 40) and may not keep accounts that allow anonymity-enhancing coins (Article 79).

How long must AML records be kept?

Five years from the end of the relationship, the date of the occasional transaction or the refusal, after which personal data is deleted. A competent authority may require up to five more years in a specific case (Article 77(3)).

Does the AMLR ban cash payments above EUR 10,000?

For persons trading in goods or providing services, yes (Article 80(1)), and Member States may set lower limits. Payments between private individuals and deposits at banks, e-money issuers and payment service providers are outside the cap, but deposits above it are reported to the FIU.

What does the AMLR say about AI in customer due diligence?

Article 76(5) requires meaningful human intervention in automated decisions to accept, refuse, keep or end a customer, to refuse a transaction or to change the level of due diligence, and gives the customer a right to an explanation and to challenge the decision, except for suspicious transaction reports.

Primary sources

• Regulation (EU) 2024/1624 (AMLR), OJ L of 19 June 2024
• Directive (EU) 2024/1640 (AMLD), OJ L of 19 June 2024
• Regulation (EU) 2024/1620 establishing AMLA
• Directive (EU) 2015/849 (the Directive in force until 10 July 2027)
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and crypto-assets
• AMLA, press release: AMLA finalises key standards for the private sector (1 October 2026)
• AMLA, public consultations (statuses checked 19 October 2026)
• AMLA, consultation on draft Guidelines on business-wide risk assessment under Article 10(4) AMLR
• AMLA and EBA, press release: handover of AML/CFT mandates completed (19 January 2026)
• EBA/GL/2021/02, ML/TF Risk Factors Guidelines (final report)
• EBA/GL/2022/05, Guidelines on the role of the AML/CFT compliance officer
• EBA/GL/2024/14 and EBA/GL/2024/15, restrictive measures guidelines (final report)

Articles, thresholds and dates were checked against the Official Journal texts of Regulation (EU) 2024/1624, Directive (EU) 2024/1640, Regulation (EU) 2024/1620 and Directive (EU) 2015/849, and AMLA's statuses against its own website on 19 October 2026. This guide summarises the law; read the article itself before relying on a specific provision.