EU AML Regulation: What Changes on 10 July 2027
From 10 July 2027, AML obligations for firms across the EU come from a single, directly applicable regulation instead of national laws transposing a directive. This guide sets out who is newly in scope, what changes in customer due diligence, beneficial ownership, enhanced due diligence and governance, the dates around it, and where AMLA's technical standards stand.
The AML package has three parts: the AMLR, which sets the rules for obliged entities; the Sixth AML Directive, Directive (EU) 2024/1640, which covers national supervisors, FIUs and registers and must mostly be transposed by 10 July 2027; and Regulation (EU) 2024/1620, which established AMLA in Frankfurt. Because the AMLR is a regulation, national gold-plating gives way to one rulebook, with Member State options only where the text allows them.
For the background to the current directives, see our EU AML framework page and our guide to the criminal-law directive (6AMLD).
Key Dates
| Date | What happens |
|---|---|
| 9 July 2024 | AMLR enters into force (it does not yet apply to firms) |
| 1 July 2025 | AMLA Regulation applies; AMLA starts operating |
| 10 July 2026 | Member States apply the AMLD6 rules on access to beneficial ownership registers; AMLA's first technical standards were due |
| 10 November 2026 | Beneficial ownership registers must answer legitimate-interest access requests within 12 working days |
| By 1 July 2027 | AMLA starts selecting the financial groups it will supervise directly |
| 10 July 2027 | AMLR applies; Directive (EU) 2015/849 is repealed; most of AMLD6 must be transposed |
| 10 January 2028 | Non-EU entities that own EU real estate on 10 July 2027 must register their beneficial owners |
| 2028 | AMLA begins direct supervision of the selected entities |
| 10 July 2029 | AMLR applies to football agents and professional football clubs; bearer shares must be converted or immobilised |
Who Is Newly in Scope
Article 3 and the definition of financial institution widen the list of obliged entities. The main additions and changes:
- All crypto-asset service providers authorised under MiCA (except those only giving advice), replacing the narrower exchange and custodian wallet categories. See our guide to KYC for crypto exchanges.
- Crowdfunding service providers and intermediaries, and mortgage and consumer credit intermediaries.
- Dealers in precious metals and stones as a regular or principal activity, with no value threshold.
- Dealers in high-value goods: jewellery and watches over €10,000, motor vehicles over €250,000, and aircraft and watercraft over €7,500,000.
- Investment migration operators and certain non-financial mixed activity holding companies.
- Football agents and professional football clubs, from 10 July 2029.
- Estate agents, including letting intermediaries for monthly rents of €10,000 or more — see our real estate AML page.
Customer Due Diligence: What Changes
Article 19 harmonises when CDD applies. The thresholds are lower than under the directives in several places:
| Situation | AMLR requirement |
|---|---|
| Occasional transaction (single or linked) | CDD at €10,000 or more (previously €15,000 in the directive) |
| Occasional transfer of funds by a credit or financial institution | CDD at €1,000 or more |
| Crypto-asset service provider, occasional transaction | Full CDD at €1,000 or more; below that, at least identification and verification |
| Occasional cash transaction | At least identification and verification at €3,000 or more (unless the national cash limit is €3,000 or lower) |
| Gambling | CDD on stakes or winnings of €2,000 or more |
| Forming a legal entity or arrangement | CDD regardless of value |
- Sanctions are part of CDD. Article 20 requires firms to check whether the customer or beneficial owner is subject to targeted financial sanctions, including control by or more than 50% ownership by a sanctioned person.
- Identification data is prescribed (Article 22), including nominee shareholders and directors for legal entities, and beneficial owner verification must include consulting the central register.
- Verification comes first (Article 23): before the relationship or transaction, with limited exceptions — real estate agents verify after an offer is accepted and before funds or property move.
- Register discrepancies must be reported within 14 calendar days of detection (Article 24).
- Ongoing monitoring (Article 26): customer information must be updated at least every year for higher-risk customers and every five years for others, and credit and financial institutions must re-screen against every new sanctions designation.
Beneficial Ownership
- Threshold. A beneficial owner through ownership holds 25% or more of the shares, voting rights or other ownership interest (Article 52) — exactly 25% now counts.
- Calculation. Indirect ownership is calculated by multiplying holdings along each chain and adding the results across chains, taking every level into account. Where control and ownership mix in a chain, Article 54 attributes ownership through the controlled entities.
- Control. Control through ownership means 50% plus one; control by other means always includes majority voting rights, the right to appoint or remove most of the board, and relevant veto or decision rights (Article 53), and is assessed in parallel with ownership.
- Lower thresholds. By 10 July 2029 the Commission may set a lower threshold, of at most 15%, for higher-risk categories of entity (Article 52(2)).
- Entities' own duties. Legal entities must obtain beneficial ownership information within 28 days of creation, update it within 28 days of any change and verify it at least annually (Articles 62–63). Nominees must disclose their nominator (Article 66), and non-EU entities must register when they buy EU real estate or start a relationship with an EU obliged entity that presents medium-high or high risk (Article 67).
See our worked examples of UBO calculations for how multiplication and control attribution play out in real structures.
Enhanced Due Diligence
- Third countries. The AMLR distinguishes high-risk third countries (Article 29, with EDD and countermeasures), countries with compliance weaknesses (Article 30) and countries posing a specific and serious threat (Article 31).
- Standard EDD measures (Article 34(4)): more information on the customer, beneficial owners and the relationship, source of funds and wealth, reasons for transactions, senior management approval, enhanced monitoring, and a first payment through an account in the customer's name.
- High-net-worth customers. Credit and financial institutions and trust or company service providers must apply specific measures to higher-risk relationships that handle assets of €5 million or more for customers with total assets of €50 million or more (Article 34(5)).
- Correspondent relationships now expressly include crypto-asset service providers (Article 37), and transfers involving self-hosted addresses get their own risk measures (Article 40).
- PEPs. Senior management approval, source of wealth and funds, and enhanced monitoring (Article 42). Measures continue after a person leaves office until the risk ends, and in any case for at least 12 months (Article 45), and apply equally to family members and close associates.
Simplified Due Diligence, Reliance and Outsourcing
- Simplified due diligence (Article 33) lets firms postpone verification, but it must be completed within 60 days of the relationship starting.
- Outsourcing (Article 18) must be notified to the supervisor before it starts. Some tasks can never be outsourced, including approving the business-wide risk assessment, decisions to onboard and suspicious transaction reporting outside the group.
- Reliance (Articles 48–50) covers only identification, beneficial ownership and purpose of the relationship; the relied-on firm must provide information within five working days, and responsibility stays with the relying firm.
The review cycle in Article 26 makes event-driven and periodic refresh mandatory; our perpetual KYC guide explains how firms are building it.
Governance, Controls and Reporting
- Compliance functions (Article 11): a compliance manager on the management body and a compliance officer of sufficiently high standing, with an annual report to the management body.
- Business-wide risk assessment (Article 10): drawn up by the compliance officer, approved by the management body, and updated before launching new products, channels or markets.
- Group-wide policies (Article 16), training (Article 12), staff integrity checks (Article 13) and whistleblowing channels (Article 14).
- Suspicious transaction reports must be filed promptly (Article 69); firms must answer FIU requests within five working days and refrain from a suspicious transaction for up to three working days pending FIU instructions (Article 71).
- Records are kept for five years from the end of the relationship or transaction, or from a refusal to onboard (Article 77).
- Cash and anonymity. Cash payments for goods or services are capped at €10,000, with lower national limits allowed (Article 80); anonymous accounts, including anonymous crypto-asset accounts and anonymity-enhancing coins, are prohibited (Article 79).
- Penalties under the Sixth AML Directive for credit and financial institutions reach at least €10 million or 10% of annual turnover.
AMLA's Technical Standards: Where They Stand
Much of the operational detail sits in AMLA's regulatory technical standards and guidelines. As of early October 2026:
- Submitted to the Commission (1 October 2026): the standards on customer due diligence (see our news summary), on business relationships and linked transactions, and on group-wide requirements. AMLA proposes that they apply six months after entry into force; they become final only when adopted and published in the Official Journal. AMLA's summary of the CDD standard includes remediation of existing customers within one year for higher-risk and five years for other customers.
- Consultations closed, final versions pending: guidelines on the business-wide risk assessment and on ongoing monitoring, and the standard on the format of suspicious transaction reports.
- Due by 10 July 2027: guidelines on outsourcing, de-risking, non-EU risks, the €50 million wealth test, crypto correspondent relationships, self-hosted addresses, PEPs, reliance and suspicious-transaction indicators.
- Direct supervision: credit and financial institutions operating in at least six Member States with a high residual-risk score are eligible. AMLA expects to select up to 40 in the first round during the second half of 2027, with supervision starting in 2028.
Our EU AML framework page summarises how One Constellation maps to the EU rules.
Readiness Checklist
- Confirm whether any of your entities or activities become obliged for the first time, and when.
- Map current CDD triggers and thresholds to Article 19, including the €10,000, €1,000 and €3,000 figures.
- Build sanctions checks, including the 50% ownership test, into CDD and re-screen on every new designation.
- Update beneficial ownership logic to "25% or more", chain multiplication and control attribution, and add register consultation and 14-day discrepancy reporting.
- Set review cycles of at most one year for higher-risk and five years for other customers, and plan remediation of the existing book.
- Appoint the compliance manager and compliance officer, and refresh the business-wide risk assessment.
- Review outsourcing and reliance arrangements against Articles 18 and 48–50, and notify the supervisor where required.
- Track AMLA's final standards and guidelines, and the Commission's adoption of them.
Frequently Asked Questions
When does the EU AML Regulation apply?
The AMLR (Regulation (EU) 2024/1624) applies from 10 July 2027, when Directive (EU) 2015/849 is repealed. It applies to football agents and professional football clubs from 10 July 2029.
What is the CDD threshold for occasional transactions under the AMLR?
CDD applies to occasional transactions of €10,000 or more, single or linked. For occasional transfers of funds by credit and financial institutions, and for crypto-asset service providers, the threshold is €1,000.
What is the beneficial ownership threshold under the AMLR?
25% or more of the shares, voting rights or other ownership interest, calculated by multiplying holdings along each ownership chain and adding chains together. The Commission may set a lower threshold, of at most 15%, for higher-risk categories by 10 July 2029.
Does the AMLR introduce a cash payment limit?
Yes. Persons trading in goods or providing services may not accept cash payments of €10,000 or more, single or linked. Member States can keep or set lower limits.
How often must customer information be reviewed under the AMLR?
At least every year for higher-risk customers and at least every five years for others, and whenever relevant circumstances change.
Which firms will AMLA supervise directly?
Credit and financial institutions or groups operating in at least six Member States whose residual risk is classified as high. AMLA expects to select up to 40 in the first round, starting by 1 July 2027, with direct supervision from 2028.
Sources
- Regulation (EU) 2024/1624 (AMLR), Official Journal
- Directive (EU) 2024/1640 (AMLD6), Official Journal
- Regulation (EU) 2024/1620 (AMLA Regulation), Official Journal
- AMLA: regulatory instruments
- AMLA: finalised standards for the private sector (1 October 2026)
- AMLA: explainer on direct supervision
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
Get Ready for the Single Rulebook
One Constellation brings KYC, KYB, beneficial ownership, sanctions screening and risk-based review cycles into one platform, configurable to the AMLR's thresholds as they take effect.
