The EU Anti-Money Laundering Regulation (EU) 2024/1624 (AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6, Directive (EU) 2024/1640) apply from 10 July 2027, replacing the patchwork of national transpositions with a single, directly applicable rulebook across all Member States. Businesses operating in the EU – including crypto-asset service providers holding or seeking a CASP licence under MiCA, payment institutions, fund managers, and professional service firms – must complete gap analyses, update policies, and restructure compliance programmes well before that date. The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), now operational in Frankfurt, is already developing the technical standards that will define the detail of those obligations.
The Regulatory Architecture: AMLR, AMLD6 and AMLA
For the first time, the EU's AML/CFT framework rests on a directly applicable Regulation rather than a Directive. The AMLR sets harmonised rules on customer due diligence, beneficial ownership, internal controls, and risk assessment without requiring national implementing legislation. AMLD6 sits alongside it, governing the organisation of national supervisors, the maintenance of beneficial ownership registers, and cooperation between Financial Intelligence Units (FIUs). Together they constitute the most significant overhaul of EU AML/CFT rules since the Fourth AML Directive.
AMLA became operational on 1 July 2025 and assumed AML/CFT mandates previously held by the EBA on 1 January 2026. Its Single Programming Document 2026–2028, published on 4 February 2026, sets out the authority's priorities, staffing targets, and supervisory methodology for the run-up to July 2027. The deadline for most of the 23 regulatory technical standards (RTS) and implementing technical standards (ITS) that AMLA is drafting is 10 July 2026 – one year before application. Direct AMLA supervision of the highest-risk selected entities across the EU is expected to begin in 2028.
Businesses should monitor EUR-Lex and ESMA publications, as well as AMLA's own consultations, throughout 2026. Technical standards that miss the July 2026 deadline will still be binding once finalised; building systems around draft versions therefore carries implementation risk.
Who Is Obliged: Scope of the AMLR
The AMLR covers a broad range of obliged entities, including:
- Credit and financial institutions, including payment service providers and e-money institutions
- Crypto-asset service providers (CASPs) authorised or required to be authorised under MiCA
- Investment fund managers and alternative investment fund managers
- Insurance undertakings and intermediaries operating in life and other investment-related insurance
- Real estate agents, including letting agents above specified transaction thresholds
- Auditors, accountants, tax advisers, and legal professionals when involved in specified transactions
- Trust and company service providers
- High-value goods dealers, including art market participants
Foreign groups with EU-based subsidiaries or branches are within scope from the moment their EU entity qualifies as an obliged entity. Groups headquartered outside the EU should assess whether any entity in their corporate structure triggers AMLR obligations, since AML/CFT compliance responsibilities attach at the entity level and cannot be fully delegated upward to a non-EU parent.
Beneficial Ownership: The 25% Threshold and What It Requires
The AMLR maintains the beneficial ownership threshold at 25% or more of ownership interest or voting rights. Obliged entities must identify, verify, and record beneficial ownership information for all customers that are legal persons, arrangements, or structures, and must update that information on a risk-sensitive basis. Where no individual can be identified at or above the 25% threshold, the AMLR provides for fall-back mechanisms, typically identifying senior managing officials as a last resort.
AMLD6 requires Member States to maintain central beneficial ownership registers and to ensure interconnection through the Business Registers Interconnection System (BRIS). Obliged entities must not rely solely on register data; they are required to take reasonable measures to verify that register information is accurate and current. Discrepancies must be reported to the competent authority. For further analysis of how the UBO threshold operates in practice and how pending AMLA RTS may refine the identification methodology, see our detailed note at AMLR UBO Threshold – EU Analysis.
Step-by-Step Compliance Preparation
Given the July 2027 deadline and the volume of technical standards expected by July 2026, a phased approach is advisable. The following sequence reflects how well-prepared organisations are structuring their programmes.
Phase 1: Scoping and Gap Analysis (now – Q2 2026)
Identify every EU legal entity in your group that qualifies as an obliged entity under the AMLR. Map existing AML/CFT policies against the AMLR's requirements, noting that obligations previously set at Member State level through national transpositions of AMLD4 and AMLD5 are now superseded by a directly applicable standard. Gaps between current policies and the AMLR's text should be recorded with a remediation owner and a target date.
At this stage, CASPs should also confirm the status of their MiCA authorisation. A CASP licence is a precondition for lawful operation; without it, the question of AMLR compliance becomes secondary to the more immediate risk of operating without authorisation.
Phase 2: Technical Standards Monitoring (Q1–Q3 2026)
AMLA's 23 RTS and ITS cover critical areas including enhanced due diligence for high-risk third countries, standardised customer due diligence formats, and criteria for the classification of obliged entities. Most of these are due by 10 July 2026. Compliance teams should designate a regulatory monitoring lead to track AMLA consultations and European Commission endorsements as they are published on EUR-Lex. Building compliance systems around draft standards that may be amended is a known implementation risk; where possible, design for flexibility.
Phase 3: Policy and Procedure Redrafting (Q3–Q4 2026)
Once the majority of technical standards are finalised, update or redraft:
- The group-wide AML/CFT policy and any entity-level variations required by national law under AMLD6
- Customer due diligence (CDD) and enhanced due diligence (EDD) procedures, incorporating the harmonised formats from AMLA's ITS
- Beneficial ownership identification and verification procedures, including discrepancy reporting workflows
- Transaction monitoring parameters and suspicious transaction/activity report (STR/SAR) escalation procedures
- Record-keeping policies (the AMLR sets harmonised retention periods; check against any longer national requirements under AMLD6)
- Training programmes updated to reflect AMLR-specific requirements
Phase 4: Systems, Controls and Testing (Q4 2026 – Q2 2027)
Implement technology changes – screening, transaction monitoring, case management – and run parallel testing against legacy and new standards. Internal audit or a qualified third party should conduct an end-to-end review before 10 July 2027. Identify and resolve any residual gaps. Engage with your national competent authority if your sector supervisor has issued sector-specific guidance under AMLD6.
Phase 5: Go-Live and Ongoing Supervision (from 10 July 2027)
From this date, the AMLR is enforceable and supervisors may open proceedings for non-compliance. Entities in the highest-risk category should also prepare for potential direct AMLA supervision beginning in 2028, which will involve more intensive reporting, on-site inspections, and supervisory expectations aligned with AMLA's own methodology rather than solely national practices.
Key Documents Your Organisation Should Prepare
Competent authorities and, where relevant, AMLA will expect obliged entities to hold documented evidence of their compliance. Core documents include:
- An enterprise-wide risk assessment (EWRA), updated to reflect AMLR methodology
- Written AML/CFT policies, procedures, and controls approved at senior management level
- Documented beneficial ownership identification and verification records for customers
- Records of CDD and EDD measures applied, including the rationale for risk classification
- Training records for all relevant staff
- Audit trail of STR/SAR submissions and the decisions underlying them
- Evidence of regular independent review of the AML/CFT programme
Cost Drivers and Realistic Timelines
The cost of AMLR compliance varies substantially by entity type, size, and existing programme maturity. The principal cost drivers are technology (screening and monitoring systems), personnel (compliance officers, training), external legal and advisory fees, and regulatory filing costs where national competent authorities require updated compliance notifications under AMLD6. Organisations that deferred investment in compliance infrastructure during the AMLD4/5 cycle will face proportionally larger remediation costs.
On timing: the window between the final AMLA technical standards (expected July 2026) and the application date (July 2027) is twelve months. For larger, more complex organisations, twelve months is a tight implementation window for system changes. Starting the gap analysis and policy drafting now – before all standards are final – allows teams to build on a stable structural foundation even if some technical parameters are later refined.
For groups with significant Irish operations, our AML compliance practice in Ireland provides entity-level support aligned with both the AMLR and AMLD6 national implementation: AML Compliance – Ireland.
Common Errors by Foreign Clients
Businesses headquartered outside the EU frequently encounter the same set of difficulties when preparing for AMLR compliance. These include:
- Assuming national law still governs: The AMLR is directly applicable and overrides divergent national rules in areas it harmonises. Teams familiar with AMLD4/5 national transpositions must rebase their knowledge against the Regulation's text.
- Delegating compliance to a single jurisdiction: A group-wide AML/CFT programme must address the AMLR requirements at each EU entity level; a policy drafted for one Member State does not automatically satisfy obligations in another, particularly where AMLD6 national implementation introduces additional requirements.
- Underestimating beneficial ownership complexity: Foreign corporate structures with multiple tiers of holding companies, nominee arrangements, or bearer instruments may struggle to satisfy the 25% threshold identification requirement in the time available. Restructuring beneficial ownership disclosure takes time.
- Treating MiCA and AMLR as separate workstreams: For CASPs, MiCA authorisation and AMLR compliance are legally distinct but operationally intertwined. Supervisors will assess both simultaneously.
- Waiting for all technical standards before starting: As noted, the final RTS/ITS may not all land by July 2026. The structural requirements of the AMLR – risk assessment, CDD, record-keeping, internal controls – are clear in the Regulation itself and can be addressed without waiting for every technical standard.
- Overlooking tax law interaction: AML/CFT obligations for tax advisers and professionals involved in tax structuring transactions intersect with EU and national tax transparency rules. Our tax law practice advises on the interaction between these regimes for professional service firms.
Decision Checklist Before July 2027
Use this checklist to assess preparedness at an organisational level:
- Has each EU entity in the group been assessed against the AMLR's definition of obliged entity?
- Is a regulatory monitoring process in place to track AMLA's RTS/ITS as they are finalised on EUR-Lex?
- Has a gap analysis been completed comparing current AML/CFT policies against the AMLR's text?
- Has the beneficial ownership identification process been mapped against the AMLR's 25% threshold and fall-back rules?
- Is a discrepancy reporting workflow in place for beneficial ownership register inconsistencies under AMLD6?
- Have CASPs confirmed MiCA authorisation status and integrated AMLR requirements into their compliance programme?
- Is a compliance officer or equivalent function identified at the level of each obliged entity?
- Has a timeline for policy redrafting, systems changes, and independent review been approved by senior management?
- Is the organisation prepared for direct AMLA supervision in 2028 if it falls within the selected entities category?
If your organisation has identified gaps or uncertainties in answering these questions, early engagement with specialist counsel is advisable. The complexity of the AMLR – particularly for groups with multi-jurisdictional structures, crypto-asset activities, or professional service obligations – means that last-minute remediation carries significant regulatory and operational risk. Ferraz & Whitmore advises obliged entities across EU jurisdictions on AMLR readiness, beneficial ownership structuring, and engagement with competent authorities. To discuss your organisation's specific situation, please contact us at info@ferrazwhitmore.com or visit our contacts page.
Looking Ahead: AMLA Supervision from 2028
The July 2027 application date is not the end of the compliance journey. AMLA will assume direct supervisory responsibility over selected obliged entities – those assessed as posing the highest AML/CFT risk across multiple Member States – beginning in 2028. The criteria for selection are being developed through AMLA's technical standards and supervisory methodology. Entities that may fall within scope should begin engaging now with what AMLA-supervised compliance will require, including the level of documentation, responsiveness to requests, and cross-border cooperation that AMLA's methodology will demand.
EBA retains a coordinating role in the period before full AMLA operational capacity, and ESMA continues to engage on MiCA-related AML/CFT matters. Organisations should track publications from both authorities alongside AMLA's own outputs throughout the 2026–2027 transition period.
Ferraz & Whitmore's AML/CFT practice supports clients through each stage of the preparation process described above, from initial scoping to independent programme review. If you would like to discuss your organisation's AMLR readiness or have questions about how the new framework applies to your specific sector or structure, please reach out to our team at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.