6AMLD Explained: Key Changes for EU Financial Institutions
The Sixth Anti-Money Laundering Directive (6AMLD, Directive 2018/1673) harmonised the criminal-law foundation of EU AML. Member States transposed it into national law by 3 December 2020, with credit and financial institutions covered from 3 June 2021. The Directive remains the criminal-law anchor of the EU AML regime even as the EU AML Regulation (AMLR) and the Anti-Money Laundering Authority (AMLA) layer on top. This guide explains what 6AMLD changed and what compliance teams still need to focus on.
6AMLD often gets less compliance-team attention than its predecessors because it operates at the criminal-law layer rather than the regulated-entity-obligations layer. That framing underplays its operational significance. The Directive changed which activities constitute predicate offences for ML purposes; it created criminal exposure for firms themselves where compliance failures contribute to laundering; and it set the baseline penalty framework that national authorities apply when they prosecute.
Compliance teams in EU financial institutions need to understand 6AMLD for three operational reasons. First, the harmonised predicate offence list determines which underlying crimes trigger SAR/STR filing obligations — broader predicate offence coverage means broader filing scope. Second, the corporate criminal liability provisions create direct exposure for the institution where systemic AML failings facilitate underlying crimes. Third, with the AMLR and AMLA framework now layered on top, understanding what 6AMLD continues to do (versus what is now in the AMLR) matters for the compliance team's mental model of the regime.
What 6AMLD Changed
Five substantive changes distinguish 6AMLD from prior EU AML instruments:
- Harmonised list of 22 predicate offences. Article 2(1) sets out the offences whose proceeds, when laundered, trigger criminal money-laundering liability. The list includes participation in organised crime, terrorism, trafficking in human beings, sexual exploitation, illicit trafficking in narcotic drugs, illicit arms trafficking, illicit trafficking in stolen goods, corruption, fraud, counterfeiting currency, counterfeiting and piracy of products, environmental crime, murder/grievous bodily injury, kidnapping/illegal restraint/hostage-taking, robbery/theft, smuggling, tax crimes, extortion, forgery, piracy, insider trading and market manipulation, and cybercrime. The 22-category list extended the prior framework, with environmental crime and cybercrime being notable additions.
- Criminal liability for legal persons. Article 7 establishes that legal persons (companies, partnerships, other entities) can be held criminally liable for ML offences where the offence was committed for the legal person's benefit by a person with a leading position, or where supervisory failures by such persons enabled the offence. The Member State has discretion in how it implements this — some apply administrative penalties, others true criminal sanctions — but the principle is established at EU level.
- Aiding, abetting, attempting. Article 4 requires criminalisation of aiding, abetting, inciting, and attempting any of the predicate ML offences. The accessory liability provisions extend criminal exposure beyond the principal launderer to those who assist or attempt.
- Minimum maximum sentences. Article 5 sets a minimum maximum sentence of four years' imprisonment for ML offences. Member States may impose higher maxima; the floor ensures cross-Member-State consistency in the severity of sanctions.
- Dual criminality narrowed. Article 3(3) limits the dual-criminality requirement (where the predicate offence must be criminal both in the place it was committed and in the prosecuting Member State). 6AMLD removes dual criminality for several specified offence categories, enabling prosecution of cross-border laundering where the predicate occurred in a jurisdiction with different criminal law.
How the EU AML Framework Layers Together
Understanding 6AMLD operationally requires understanding how it fits with the rest of the EU AML framework. Five instruments operate together:
- 4AMLD (Directive 2015/849) — the foundational regulated-entity obligations directive. CDD, EDD, beneficial ownership registers, suspicious activity reporting, supervisory framework.
- 5AMLD (Directive 2018/843) — amended 4AMLD to extend obligations to crypto-asset service providers, art dealers above EUR 10,000 transactions, and prepaid card issuers. Tightened beneficial ownership disclosure and introduced public registers.
- 6AMLD (Directive 2018/1673) — criminal-law harmonisation, covered above. Does not replace 4AMLD/5AMLD obligations.
- EU AML Regulation (AMLR, Regulation 2024/1624) — entered into force 9 July 2024, directly applicable in Member States from 10 July 2027. Replaces the bulk of 4AMLD/5AMLD with a directly-applicable regulation removing Member State implementation variance. Covers CDD, beneficial ownership, transparency, and obligations for regulated entities.
- EU AML Authority (AMLA, Regulation 2024/1620) — entered into force 26 June 2024, operational from 1 July 2025 in Frankfurt. AMLA directly supervises the largest cross-border financial institutions in the EU (initially ~40 entities), coordinates national supervisors, and operates the EU FIU support framework.
For compliance teams: 4AMLD/5AMLD obligations remain in force until the AMLR transition completes in 2027. 6AMLD's criminal-law provisions sit alongside throughout. After July 2027, the AMLR replaces most of 4AMLD/5AMLD; 6AMLD continues as the criminal-law instrument. AMLA's direct supervision applies to designated cross-border institutions but the supervisory framework affects every EU-regulated institution.
Predicate Offence Implications for SAR/STR Filing
The expanded predicate offence list affects which underlying conduct triggers SAR/STR filing obligations. Three categories that materially changed the filing landscape:
- Environmental crime. 6AMLD added environmental offences (illegal wildlife trafficking, illegal logging, illegal fishing, illegal waste shipment, pollution offences) to the predicate list. Compliance teams now consider customer activity linked to these patterns as triggering filing — for example, customers in extractive industries with proceeds patterns inconsistent with their declared operations, or trade-finance documentation suggesting unauthorised wildlife or timber exports.
- Cybercrime. The category covers offences against information systems, including illegal access, illegal interception, data interference, system interference, and misuse of tools. Customer activity linked to ransomware proceeds, business email compromise, fraud-as-a-service operations, and dark-market settlement triggers filing where suspicion is reasonable.
- Tax crimes. 6AMLD codified tax offences within the predicate list, harmonising what had previously been a fragmented Member State approach. Customer activity suggesting tax evasion — particularly structures with no commercial substance whose primary purpose appears to be tax mitigation — triggers filing obligations.
The operational implication for compliance teams: typology coverage in the firm's risk assessment should explicitly address the full 6AMLD predicate offence list. Programmes that filter SAR/STR filing through a narrower predicate-offence mental model are under-filing relative to the regime's expectations.
Corporate Criminal Liability
The corporate criminal liability provisions create direct institutional exposure where supervisory failings contribute to underlying laundering. The standard varies by Member State but the EU-level principle is clear: an institution can be held liable where (a) the ML offence was committed for the institution's benefit by a person with a leading position, or (b) the lack of supervision or control by such a person made it possible to commit the offence.
Three operational implications:
- Governance documentation matters. Where corporate liability arises from "lack of supervision or control", the institution's documented governance — board oversight, MLRO authority, control framework, internal audit findings — becomes evidence of whether supervision was adequate. Substantive governance documentation reduces liability risk; weak documentation increases it.
- Compliance investment becomes a liability-management activity. Investment in AML controls is not just about regulatory compliance — it is about reducing the probability of corporate criminal liability where laundering passes through the institution. The cost-benefit framing should reflect both.
- Director and officer exposure intersects. Member State implementations of 6AMLD vary in how they apportion liability between the institution and individual directors/officers, but the principle that senior individuals can be personally liable for AML supervisory failings is increasingly common across EU jurisdictions. Senior management training and authority documentation are inspection-relevant for this reason.
Operational Compliance Priorities
Five operational priorities for EU financial institutions working under the layered framework:
- Map typology coverage to the full 22 predicate offences. The firm's risk assessment, transaction monitoring rule library, and STR filing criteria should explicitly cover the expanded predicate offence list. Gaps in coverage of environmental, cyber and tax-related predicates are recurring inspection findings.
- Document corporate governance substantively. The "lack of supervision or control" liability standard makes governance documentation an active liability-management priority. Board reports, MLRO authority, control-framework artefacts and internal audit findings should be substantive and current.
- Prepare for AMLR transition. The AMLR's direct applicability from July 2027 removes Member State implementation variance and introduces new specific obligations (most notably around UBO transparency and risk classification). Institutions should be tracking the implementing technical standards and preparing operational changes.
- Understand AMLA's supervisory remit. Institutions designated for direct AMLA supervision face a different supervisory experience from those remaining under national supervision. Even institutions not designated should expect indirect AMLA influence through harmonised supervisory expectations.
- Maintain cross-border investigation readiness. The narrowed dual-criminality framework increases the likelihood of cross-border investigations. Institutions should be able to respond to requests from multiple Member State authorities and AMLA with consistent, timely information.
For broader AML platform context see our AML/CFT solution overview and the FATF Grey List 2026 guide for the jurisdictional risk dimension that intersects with EU regime application.
EU AML Compliance Built for the Layered Framework
One Constellation supports EU institutions across 4AMLD/5AMLD, 6AMLD predicate-offence coverage, and the AMLR transition — with CDD, EDD workflow, transaction monitoring and STR-ready case management.
