The European Anti-Money Laundering Authority (AMLA) has set 10 July 2026 as the deadline for compliance with the majority of its 23 regulatory and implementing technical standards, creating immediate obligations for a wide range of obliged entities operating in Luxembourg. These standards form the operational backbone of the EU's overhauled AML/CFT framework and will directly affect financial institutions, crypto-asset service providers, SOPARFIs, and other regulated entities supervised by the CSSF or other competent authorities. Businesses with Luxembourg operations should assess their exposure now, as the window for structural and procedural adjustment is narrowing.
What Changed and When: A Compressed Timeline
The AMLA framework has been assembled in rapid succession. AMLA itself became operational on 1 July 2025, establishing its Frankfurt headquarters and beginning staff recruitment and governance. On 1 January 2026, the EBA formally transferred its AML/CFT mandates to AMLA, consolidating EU-level supervisory and standard-setting authority in a single body for the first time. AMLA's Single Programming Document 2026–2028, published on 4 February 2026, confirmed the scope and sequencing of its work across supervision, policy, and data.
The most immediately consequential date is 10 July 2026: the deadline by which most of the 23 AMLA regulatory technical standards (RTS) and implementing technical standards (ITS) are expected to apply. These standards cover, among other areas, customer due diligence methodologies, beneficial ownership verification, group-wide policies, and risk classification frameworks.
Looking further ahead, the substantive legislation – Regulation (EU) 2024/1624 (AMLR) and Directive (EU) 2024/1640 (AMLD6) – applies from 10 July 2027. Direct AMLA supervision of selected high-risk obliged entities across the EU is scheduled to begin in 2028. Luxembourg entities should not treat these later dates as a reason to defer preparation: many of the 2027–2028 requirements flow directly from the technical standards taking effect in July 2026.
Who Is Affected in Luxembourg
Luxembourg's position as a major hub for investment funds, holding structures, and increasingly crypto-asset activities means that a substantial number of local entities fall within scope. The following categories are among those most directly concerned:
- CSSF-supervised financial institutions – credit institutions, payment institutions, investment firms, and fund managers regulated under the CSSF's AML/CFT supervisory remit.
- Crypto-asset service providers (CASPs) – entities operating under or applying for a CASP licence under MiCA (Regulation (EU) 2023/1114), which are explicitly included in the AMLR's list of obliged entities. MiCA and the AML framework interact directly, and CASPs must ensure their due diligence and monitoring procedures meet the new AMLA standards.
- SOPARFIs and holding structures – Luxembourg holding companies (sociétés de participations financières) registered at the RCS Luxembourg and subject to beneficial ownership disclosure obligations. The AMLR sets the beneficial ownership threshold at 25% or more, and verification procedures under the forthcoming technical standards will need to reflect this.
- Notaries, lawyers, accountants, and trust and company service providers – professional obliged entities subject to AMLD6 and national transposition rules. Luxembourg's transposition of AMLD6 remains subject to national legislative process; specific domestic rules should be monitored as they develop.
- Entities with cross-border group structures – groups operating across multiple EU member states will need group-wide AML/CFT policies that satisfy AMLA's technical standards, with the Luxembourg entity bearing responsibility for local compliance.
Other AML supervisors exist alongside the CSSF for certain professional sectors in Luxembourg; obliged entities should confirm which competent authority oversees their specific activities.
What the Technical Standards Require in Practice
While the full text of all 23 RTS/ITS continues to be finalised, the framework they establish is clear in its direction. Obliged entities should expect detailed requirements across the following areas:
- Standardised customer due diligence (CDD) processes, including enhanced due diligence triggers and simplified CDD conditions.
- Beneficial ownership identification and verification procedures aligned with the 25%-or-more threshold under the AMLR, with specific evidentiary expectations.
- Internal policies, controls, and procedures at group level, including the role of the compliance function and senior management accountability.
- Risk factor guidelines and risk assessment methodologies, replacing the existing EBA guidelines that obliged entities have used since their adoption.
- Transaction monitoring parameters and suspicious transaction reporting standards.
- Interfaces between AML obligations and sectoral licencing requirements, most notably for CASPs under MiCA.
Where specific national implementation details have not yet been published by Luxembourg authorities, entities should treat their compliance planning as iterative: build to the AMLA standard, and adjust for domestic rules as they are transposed.
For a detailed analysis of how these standards interact with fund management obligations in Luxembourg, the AMLA Rulebook for Fund Managers in Luxembourg provides further context on the applicable requirements and supervisory expectations.
Beneficial Ownership and Register Implications
The AMLR establishes a beneficial ownership threshold of 25% or more as the primary criterion for identifying natural persons who ultimately own or control a legal entity. For Luxembourg companies registered at the RCS Luxembourg – including SOPARFIs and structures held through chains of entities – this threshold must be applied consistently with the technical standards once they take effect.
AMLD6 governs the rules on beneficial ownership registers and the obligations of competent authorities, including the conditions for access to register data and the obligations on entities to keep that data accurate and current. Luxembourg's transposition of AMLD6 into national law is pending; entities with complex ownership structures and those that maintain register entries at the Tribunal d'arrondissement de Luxembourg (in its role in commercial registry matters) should monitor national developments closely.
If your entity's beneficial ownership disclosures or internal registers have not been reviewed in the past twelve months, the July 2026 deadline makes this a priority. Questions about the interaction between AMLA standards and Luxembourg tax structuring considerations can be addressed with reference to our tax law practice in Luxembourg.
Immediate Action Items for International Companies
Given the July 2026 deadline and the complexity of the AMLA framework, the following steps represent a practical starting point for entities with Luxembourg operations:
- Map your obliged entity status. Confirm which AMLA RTS/ITS apply to your entity type – financial institution, CASP, professional obliged entity, or group holding structure – and identify the competent authority responsible for your supervision in Luxembourg.
- Review your AML/CFT policies and procedures. Assess whether existing documentation meets the direction of the forthcoming technical standards, particularly on beneficial ownership verification, CDD triggers, and group-wide policy architecture.
- Audit your beneficial ownership records. Verify that your records at the RCS Luxembourg and internal compliance files reflect the 25%-or-more threshold and are supported by adequate documentation.
- Assess MiCA and CASP licence interactions. If your business operates as or intends to operate as a crypto-asset service provider, ensure your compliance framework integrates both MiCA licencing conditions and AMLA AML/CFT requirements, which apply in parallel.
- Establish a monitoring process for remaining RTS/ITS finalisation. Not all 23 technical standards will be finalised simultaneously; designate responsibility within your compliance function for tracking publication dates and updating internal procedures accordingly.
For entities that have not yet reviewed their AML/CFT framework in light of the new AMLA architecture, detailed guidance on what the standards require in practice is available through our AML compliance practice in Luxembourg.
The Broader Regulatory Shift: What July 2026 Signals
The July 2026 deadline is not a standalone event. It marks the point at which AMLA's technical authority becomes directly operational across obliged entities in all EU member states – replacing a patchwork of national guidelines and EBA guidance with a single, directly applicable standard. For Luxembourg, a jurisdiction whose financial sector spans fund administration, holding structures, fintech, and cross-border wealth management, the shift is structural rather than incremental.
Entities that have historically relied on minimal-touch compliance programmes, or that have deferred updating their procedures since the last EBA guideline cycle, face the greatest adjustment burden. The transition to direct AMLA supervision of selected entities from 2028 adds a further dimension: entities identified as high-risk or systemically significant could find themselves subject to AMLA's direct scrutiny within a matter of years.
The question for most international companies operating in Luxembourg is not whether the AMLA framework will affect them, but how significantly – and how much runway remains to address the gaps. If you would like to discuss the implications for your specific structure or operations, please contact our team at info@ferrazwhitmore.com or visit our contacts page.
Ferraz & Whitmore advises international companies, funds, and investors on AML/CFT compliance, regulatory licensing, and cross-border structuring in Luxembourg and across the EU. To understand how the AMLA technical standards apply to your entity, we welcome an initial discussion – reach us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.