EU AMLR and AMLA: What Changes for Compliance Teams and When
Last reviewed: October 2026.
The EU is replacing the AML framework it has built up since 1991 with a new one. Instead of directives that each member state transposes in its own way, most AML rules will soon sit in a single regulation that applies directly across the EU. A new EU authority — AMLA — will coordinate national supervisors and directly supervise some of the largest and riskiest firms.
For compliance teams at EU firms, and at firms outside the EU with EU operations, this is the biggest change in a generation. This guide summarises what the package contains, what changes in practice, and the key dates to plan around.
The package at a glance
The EU AML package, adopted in 2024, has three main parts:
- The Anti-Money Laundering Regulation (AMLR) — Regulation (EU) 2024/1624. The "single rulebook": the obligations on firms, such as customer due diligence, beneficial ownership, reporting and internal controls. It applies directly in every member state, so national variations shrink considerably.
- The Sixth Anti-Money Laundering Directive (AMLD6) — Directive (EU) 2024/1640. Covers the national framework: supervisors, financial intelligence units, beneficial ownership registers and cooperation between authorities. Member states transpose it into national law.
- The AMLA Regulation — Regulation (EU) 2024/1620. Establishes the Anti-Money Laundering Authority, based in Frankfurt.
The package sits alongside the recast Transfer of Funds Regulation, which already requires information to accompany cryptoasset transfers.
Key dates
| Date | What happens |
|---|---|
| 2025 | AMLA begins operations in Frankfurt and starts building its supervisory framework and technical standards |
| 10 July 2027 | The AMLR applies, and most of AMLD6 must be transposed into national law |
| 2028 | AMLA begins direct supervision of selected financial sector firms |
| 10 July 2029 | AMLR obligations begin to apply to professional football clubs and agents |
Much of the detail will come from technical standards and guidelines that AMLA and the European Commission are developing in the run-up to 2027. Track those publications closely — they will determine exactly how many of the new requirements work in practice.
What changes for firms
Many AMLR obligations will be familiar — the framework still rests on the FATF Recommendations and the risk-based approach. But there are important changes in detail.
A single rulebook
Because the AMLR is a regulation, the same text applies in every member state. For groups operating across the EU, that should reduce the patchwork of national rules — though national supervisors, guidance and some member state options will still matter.
Expanded scope
The list of firms covered grows. Among other changes, crypto-asset service providers are fully covered as financial institutions, coverage of high-value goods dealers expands, and professional football clubs and agents come into scope from 2029. If you are a non-financial business, check whether the change affects you.
More prescriptive customer due diligence
The AMLR sets out CDD requirements in more detail than the previous directives, which left more to member states. Notable changes include:
- Maximum review intervals. Customer information must be updated at least once a year for higher-risk customers and at least every five years for others, alongside trigger-based updates. If your current periodic KYC review cycles are longer, they will need to change.
- Beneficial ownership. More detailed rules on identifying beneficial owners through both ownership and control, with a 25% ownership threshold and the possibility of lower thresholds for higher-risk sectors.
- Enhanced due diligence. More detailed rules on when EDD applies and what it involves, including for high-risk third countries.
Internal controls and governance
The AMLR specifies the internal policies, controls and procedures firms must have, including a business-wide risk assessment, and requires a member of the management body to be responsible for AML compliance alongside a compliance officer. Group-wide policies are required for groups.
A cash payment limit
The AMLR introduces an EU-wide limit on cash payments for goods and services by traders, set at EUR 10,000. Member states can set a lower limit.
AMLA supervision
AMLA will directly supervise a limited number of selected credit and financial institutions — up to 40 at the start — chosen on the basis of their risk profile and cross-border activity. For all other firms, national supervisors remain in charge, but AMLA will coordinate them and issue standards and guidance intended to make supervision more consistent across the EU.
How to prepare
With the AMLR applying from 10 July 2027, firms should be well into their preparation. A practical sequence:
- Confirm scope. Check whether your firm — or new parts of your business — fall within the expanded scope, and whether you could be selected for direct AMLA supervision.
- Run a gap analysis. Compare current policies and procedures against the AMLR, area by area: CDD, beneficial ownership, EDD, review cycles, reporting, record keeping and governance.
- Prioritise data and systems changes. Changes to review frequencies, beneficial ownership data and customer risk methodology often need system changes with long lead times.
- Watch the technical standards. Plan for the detail to change as AMLA and the Commission finalise their rules, and build in time to adjust.
- Update governance. Identify the management body member responsible for AML and confirm the compliance officer's role.
- Plan the transition. Existing customers may need remediation to meet the new standards. Size the effort early.
- Train staff on the changes before they apply. See AML training requirements.
- Put the milestones on the calendar. Gap analysis, policy rewrites, system changes and training all need start dates and owners, not just the July 2027 deadline. Once the new rules apply, your recurring obligations will change too — a directory like Regmindr's regulatory deadlines can help keep track of what falls due and when.
Key takeaways
- The EU AML package replaces most of the directive-based framework with a directly applicable regulation, the AMLR, from 10 July 2027.
- AMLA, based in Frankfurt, will directly supervise selected high-risk financial institutions from 2028 and coordinate national supervisors.
- Key changes include expanded scope, more prescriptive CDD and beneficial ownership rules, maximum review intervals, governance requirements and an EUR 10,000 cash payment limit.
- Detailed technical standards are still being developed, so plan for change.
- Start with scope and a gap analysis, and prioritise changes with long lead times.
Regpin helps compliance teams keep their AML program — risk assessment, policies, customer risk methodology and controls — up to date as the rules change. Talk to us about preparing for the AMLR.
This article is general information, not legal advice. The EU AML package is subject to further technical standards and guidance, and national implementation may vary. Confirm the requirements that apply to you with your supervisor's guidance or a qualified adviser.