EU AMLR: The Complete Guide to 2027 Compliance

What is the EU AMLR?

The EU Anti-Money Laundering Regulation, AMLR, is the European Union’s directly applicable rulebook for preventing money laundering and terrorist financing in the private sector. It tells banks, financial institutions, crypto-asset businesses and a wide range of professional and non-financial firms how to assess risk, perform customer due diligence, identify beneficial owners, monitor relationships and report suspicious activity.

AMLR is the core of what the Commission calls the EU AML single rulebook. Where earlier EU law set common principles and left each Member State to write its own version, AMLR sets the obligations directly. National supervisors, financial intelligence units (FIUs), registers and a defined set of national options remain, but the requirements themselves no longer arrive through 27 separate transpositions.

Most provisions apply from 10 July 2027.¹

Football is the one deferred sector, and it is narrower than it sounds

Two obliged-entity categories apply from 10 July 2029 rather than 2027: football agents, and professional football clubs.^{1 2}

Clubs are not in scope for everything they do. They are obliged entities only for four transaction types: transactions with an investor, with a sponsor, with football agents or other intermediaries, and for the purpose of a player’s transfer.³

Member States may also exempt clubs entirely or partly, by two separate routes. Top-division clubs qualify where total annual turnover was under EUR 5,000,000 in each of the previous two calendar years. Clubs in any lower division qualify with no turnover threshold at all. Both routes require a documented Member State risk assessment and are optional, not automatic.⁴

Why was AMLR introduced?

Earlier EU directives created common principles, but each Member State implemented them through its own national AML regulations: different definitions, thresholds, supervision and operational expectations. A group operating in eight Member States maintained eight interpretations of the same rule.

The Commission put numbers on that before it drafted AMLR. Its impact assessment for the AML package found most Member States setting the beneficial-ownership register threshold at 25%, with Latvia and Spain at 10%. It also found that national rules for calculating indirect ownership diverged far enough that the same corporate structure could produce different beneficial owners depending on which Member State assessed it.

AMLR centralises that into one rulebook, directly applicable in every EU country.

More harmonisation

Groups can design a stronger common EU baseline while retaining national overlays

Expanded scope

Additional crypto, professional, high-value and other activities expressly covered

More detailed CDD

Identity, ownership, purpose, risk and monitoring operate as one lifecycle

Stronger ownership transparency

Both ownership and control must be tested, discrepancies addressed

Lifecycle monitoring

Customer data and expected activity must remain current after onboarding

Common restrictions

Limits on anonymous instruments and large professional cash payments

What harmonisation does not remove

Direct applicability does not mean every national difference disappears. Member States retain responsibility for supervision, FIU processes, beneficial-ownership registers, sanctions machinery and the areas where AMLR permits national choices. A group operating in several Member States still needs a country overlay on top of the common baseline.

The overlay is thinner than it was. It is not gone.

How do AMLR, AMLD6, AMLA and TFR fit together?

The EU AML package contains four instruments, and each answers a different question.

Two naming traps are worth avoiding. AMLR should not be called “AMLD6”: the regulation carries the direct private-sector obligations, while the directive governs national machinery. And AMLD6 is the instrument informally called 6AMLD. It does not replace “6AMLD”; it repeals Directive (EU) 2015/849, the directive commonly called 4AMLD as amended by 5AMLD.

AMLD6 also transposes on a staggered schedule rather than a single date. General transposition is 10 July 2027, but Article 74 was due by 10 July 2025, the register-access provisions in Articles 11, 12, 13 and 15 by 10 July 2026, and the real-estate single access point by 10 July 2029.¹

The updated Transfer of Funds Regulation has applied since 30 December 2024. Its payment and crypto travel-rule requirements are already live. They are not postponed until AMLR applies.

What changes under AMLR, and what was already there?

Most AMLR coverage reads as though every requirement is new. For a firm already running a compliant 5AMLD programme, that is not useful. This section separates the genuinely new obligations from the ones that have simply moved instrument.

Start with the beneficial-ownership threshold, because it moved twice

Under the previous regime, the corporate ownership indicator read:

Under AMLR it reads:

A natural person holding exactly 25.00% was not caught by the ownership indicator before. They are now.

The second change sits in the same sentence. The old provision continued: “This applies without prejudice to the right of Member States to decide that a lower percentage may be an indication of ownership or control.” A Member State could unilaterally drop the threshold. Under AMLR it cannot. It may notify the Commission of higher-risk categories, and only the Commission sets a lower category-specific threshold, by delegated act, floored at 15% and in any case below 25%.³

So the trigger got lower and the ability of 27 Member States to diverge on it was removed. If you built country-by-country UBO threshold logic to handle national variation, you are maintaining machinery AMLR is designed to make unnecessary.

The rest of the change map

↳ Fig 04 · the UBO threshold row is the one to flag first internally, it is the single most common implementation miss.

What did not change

The risk-based approach survives intact. So does the structure of customer due diligence, the tipping-off prohibition, the duty to report suspicion irrespective of amount, and the principle that simplified due diligence is a calibration rather than an exemption. If you have a working 5AMLD programme you are not starting again. You are tightening deadlines, widening scope, and rebuilding the ownership layer.

When does AMLR apply?

AMLR entered into force in 2024, but most operative requirements have a later application date. “In force” and “fully applicable” are not the same thing.¹

One date matters most: 10 July 2027.¹ Track final law, draft Level 2 measures (the technical standards and guidelines that sit beneath the Regulation), transitional guidance and national rules as four separate workstreams. They move at different speeds, and collapsing them into one plan is how a programme ends up waiting on a standard it did not need.

Who is subject to AMLR?

AMLR applies to obliged entities. Scope can attach to an entire regulated business, or only to specified professional activities and transactions.¹

Not every person working in a listed sector is automatically covered. For legal professionals, goods traders, property businesses and football organisations, the activity and transaction conditions are decisive. Member States may also add sectors or apply defined exemptions, so test the specific activity against the Regulation first and the national overlay second.

Does AMLR apply outside the EU?

AMLR binds the 27 Member States, with EEA relevance. It is not a universal worldwide regime. A non-EU organisation should look for a specific EU nexus rather than assume it is either fully in or fully out.

Does AMLR apply to UK businesses?

For a UK business the position is interpretive rather than a single article. The UK remains under the Money Laundering Regulations 2017. But EU subsidiaries and branches of UK groups are obliged entities in their own right, and AMLR’s group-wide policy obligations reach EU-facing UK parents.^{1 2} A UK firm asked by an EU counterparty for identity, ownership or source-of-funds information is usually seeing that counterparty’s duties at work, which does not by itself make the UK firm an obliged entity.

Foreign entities can also acquire a direct register duty under Article 67, triggered by an EU business relationship, EU real estate, defined high-value goods purchases, or an EU public contract.³

When is customer due diligence required?

CDD is required when a business relationship is established, when specified occasional transactions occur, when there is suspicion, and when an obliged entity doubts previously obtained identity information or doubts who it is dealing with.¹

Transactions that appear separate must be treated together when they are linked. Controls should catch structuring across time, channels, accounts and related people.

The cash trigger has a carve-out worth knowing: it does not apply where the Member State already operates a cash payment limit of EUR 3,000 or less under Article 80(2) and (3).

The one exemption most summaries miss

Supervisors may exempt an obliged entity, fully or partly, from the Article 20(1)(a), (b) and (c) measures for electronic money on proven low risk. All four conditions must be met:³

Note who grants it. This is a supervisor-granted exemption, not one you can assess for yourself.

What does AMLR customer due diligence include?

AMLR treats CDD as a continuing process, not a one-time document check. It is also worth keeping three articles distinct, because they are routinely collapsed into one:

Calling Article 22 “the CDD article” is the most common citation error in AMLR commentary, and it will send you to the wrong provision when you need the right one.

The core measures are identifying and verifying the customer, identifying and verifying beneficial owners, assessing the purpose and intended nature of the relationship, and conducting ongoing monitoring.^{1 2 3}

What are the KYC requirements for individuals?

“Know your customer” is the operational process for performing CDD on a natural person. It is not a separate AMLR legal regime.

The required record

• Full name and any former or alternative names
• Place and date of birth
• Nationality or nationalities and legal status
• Identification or tax number, where applicable
• Usual residence and required contact information
• Any representative, and their authority to act

Verification must use reliable and independent documents, data or information. A successful document check establishes identity attributes. Purpose, occupation, source of funds, PEP exposure and overall risk still need their own evidence.^{1 2}

Where a person acts for the customer, the firm must identify and verify the representative, identify the customer behind them, and confirm the authority to act. A mandate on file is not the same as evidence that the mandate is current.

What are the KYB requirements for businesses?

“Know your business” applies CDD to legal entities and arrangements: legal existence, authority, ownership, beneficial owners, purpose and risk in one assessment.

The structural change under AMLR is that the duty is no longer one-sided. Previously the obliged entity investigated and the customer cooperated or did not. AMLR places statutory obligations on the customer entity, its beneficial owners, the entities in its ownership chain, its trustees and its nominees. KYB becomes a two-sided information exchange with deadlines on both sides.

The six KYB questions

Three data points older KYB models tend to miss

Article 22(1)(b) sets the legal-entity identification minimum, and three items in it are commonly absent from data models built for 4AMLD:

Companies, trusts, foundations, partnerships and collective-investment structures need different data models. A standard company checklist will not reliably identify all parties to a trust or similar arrangement.

Central-register information supports CDD but does not ordinarily replace independent identification and verification.

When no beneficial owner can be identified

AMLR is stricter than the old senior-managing-official shortcut. Where all means under Articles 51 to 57 are exhausted, or there is “substantial and justified uncertainty”, the entity keeps records of the actions taken and must supply:²

AMLR also defines senior managing officials, which the previous directive did not.

On the obliged-entity side, where verifying senior managing officials would signal that the firm doubts the ownership picture, it must abstain from that verification and instead record the steps taken and the difficulties encountered.³

Is “perpetual KYB” required?

No. “Perpetual KYB” and “perpetual KYC” are industry terms. Neither appears in AMLR, and neither removes the periodic duty.

The practical position is more demanding than the label suggests. AMLR stacks five clocks:

• 1. The entity updates its own BO information within 28 days of change, and annually. Art 62(2)
• 2. The entity reports register changes within 28 days and verifies at minimum annually. Art 63(2)
• 3. You refresh customer information within 5 years, or 1 year where enhanced measures apply. Art 26(2)
• 4. You review and update on three specific events, not on a schedule. Art 26(3)
• 5. You report register discrepancies within 14 days of detection. Art 24(1)

A five-year refresh cycle cannot detect a change the customer was obliged to register within 28 days, and the discrepancy clock only starts once you have looked. Event-driven KYB is not a legal requirement. It is the practical way to meet the requirements AMLR does impose.

Can customers be onboarded remotely?

Yes. Article 22(6) gives two routes and does not rank them. A proposed ranking exists, but only in draft Level 2, and the final text and the draft must be kept apart.

How eIDAS 2.0 and the EUDI Wallet connect to AMLR

AMLR never mentions the European Digital Identity Wallet. The connection runs through three instruments, and stating the chain explicitly is the difference between a claim you can defend and one you cannot.

1 AMLR Art 22(6)(b)

Accepts electronic identification means at assurance level substantial or high Art 22(6)(b)

2 Reg (EU) No 910/2014

This is eIDAS. AMLR points at it by number.

3 Reg (EU) 2024/1183

Informally eIDAS 2.0. Amends 910/2014 and creates the European Digital Identity Wallet.

4 Wallets at assurance level high

Meet Article 8 requirements Reg 2024/1183 Art 5a(4)(d), satisfying the AMLR condition by reference

Each Member State must provide at least one Wallet within 24 months of the relevant implementing acts entering into force.² The Regulation sets no calendar date, so treat any specific month you see quoted as derived from implementing-act timing rather than from the Regulation itself.

Three things the Wallet does not do. It does not create a hierarchy in Article 22(6), which remains route-neutral in final law. It does not remove the obliged entity’s decision on whether the supplied attributes and assurance level meet the CDD requirement. And it answers who, not why: purpose, beneficial ownership and source of funds still need their own evidence.^{3 4 5}

If Wallets must be “high”, what sits at “substantial”?

A fair question, and the answer matters more than it first appears. AMLR accepts electronic identification means at substantial or high. Wallets must be high. So what populates the substantial tier?

Notified national eID schemes. eIDAS 2.0 adds the Wallet; it does not abolish notification. Article 8(3) of Regulation (EU) No 910/2014, as amended, still sets minimum technical specifications for assurance levels low, substantial and high, and Article 9 still requires the Commission to publish the list of notified electronic identification schemes in the Official Journal and to publish amendments within one month.⁶

The substantial tier is therefore the existing installed base: national identity schemes, bank-identity schemes and equivalent means already notified by Member States and already listed.

There is a filter here that is easy to miss. Notified schemes span three levels of assurance. AMLR accepts only two of them.

↳ Operational note: check the Official Journal list of notified schemes and exclude anything notified at low before accepting it as an Art 22(6)(b) route.

Does a substantial-level eID need supplementing?

Not as a matter of Article 22(6)(b). Substantial is accepted on its own terms, and there is no obligation to top it up.

Whether you choose to add measures is a risk question, governed by the ordinary rule that the extent and intensity of due diligence must reflect the customer, geography, product, transaction and delivery channel. A firm may reasonably decide that for a higher-risk customer a substantial-level eID alone is not enough, and layer additional verification on top. That decision is made under Articles 20 and 34, and it is documented and justified the same way any other risk-based calibration is.^{7 8}

Qualified trust services

Qualified trust services are the second limb of Article 22(6)(b) and are not interchangeable with electronic identification means. The three that matter for identity work are the qualified electronic signature (QES), the qualified electronic seal and the qualified electronic timestamp.

None of them replaces purpose, beneficial-ownership or source-of-funds checks. Check qualified status against the national trusted list or the EU Trusted List Browser rather than a supplier’s own description.

Where video identification sits

AMLR does not name video identification as a distinct route. It falls under Article 22(6)(a) as a means of obtaining information from reliable and independent sources, which means it is governed by the general verification standard rather than by a bespoke rule. Several Member States operate detailed national video-identification requirements today, and the EBA Remote Customer Onboarding Guidelines remain relevant transitional guidance until AMLA’s replacement measures take effect.

Under the draft CDD RTS, remote capture routes of any kind would become a conditional fallback requiring justification. That status is draft.

What to keep configurable

If you are building a remote onboarding flow now, keep the following adjustable so the final RTS text can be applied without re-architecting the journey:

How does risk affect due diligence?

The extent and intensity of CDD must reflect risk, considering the customer, geography, product, transaction and delivery channel together.^{1 2}

Where verification is deferred for a qualifying low-risk relationship, it must be completed no later than 60 days after the relationship is established, and only where the specific lower risk identified justifies the postponement. Interim risk-management procedures are required in the meantime, such as limiting the amount, number or type of transactions.^{3 4}

Simplified due diligence must not be applied at all where there are doubts about veracity, where the lower-risk factors are no longer present, where monitoring excludes a lower-risk scenario, or where there is suspicion of money laundering, terrorist financing or sanctions evasion.⁵

A numerical risk score can support consistency, but you have to be able to explain the rating, any material override, and the controls that follow from it.

What screening does AMLR require?

“Screening” is several controls with different legal purposes and different consequences.

AMLR’s sanctions-risk controls do not replace the separate legal duty to freeze assets and avoid making funds available under applicable restrictive measures.^{1 2} PEP status indicates higher risk. It is not evidence of wrongdoing.³

Screening runs at onboarding, on list changes, on customer or ownership changes, at relevant transaction points, and on periodic or event-driven review. Your governance has to cover data quality, transliteration, fuzzy matching, ownership and control, alert priority, false positives, escalation and testing.

What does ongoing monitoring involve?

Article 26 requires firms to scrutinise transactions and activity, keep customer information current, and check that behaviour stays consistent with the customer’s purpose and risk profile.¹ It contains four distinct duties, and they run on different clocks.

↳ The one-year and five-year figures are maximum intervals for updating customer information, not review targets. Three named events override the calendar, and sanctions verification runs regardless of either.

Two precision points that matter when you build the schedule. First, Article 26(2) governs updates of customer information; the word “review” belongs to Article 26(3), which is a different duty with a different trigger.^{2 3} Second, the one-year band is scoped to customers under Section 4 enhanced measures, not to every customer your internal model rates as higher risk. A customer can carry a high internal score without Section 4 applying, and that customer sits on the five-year clock.⁴

Automated monitoring needs scenario ownership, reliable data, calibration, validation and controlled case closure. Manual monitoring needs defined populations, frequency, trained reviewers and evidence. Neither model should rest on unexplained backlogs or blanket alert closure.

How is beneficial ownership determined?

A beneficial owner is the natural person who ultimately owns or controls a legal entity or arrangement. AMLR runs two tests, and they are parallel rather than sequential.

The general corporate indicator is 25% or more of the shares, voting rights or other ownership interest, including rights to a share of profits, other internal resources or liquidation balance, held directly or indirectly.¹

Control is assessed “independently of and in parallel to” the existence of an ownership interest.² Control through ownership interest means 50% plus one.³ Control via other means carries no percentage floor at all: a majority of voting rights whether or not shared by persons acting in concert, the right to appoint or remove a majority of the board, relevant veto or decision rights attached to shares, decisions on profit distribution or asset shifts, and formal or informal agreements including relationships between family members and nominee arrangements.⁴

↳ The senior-managing-official fallback is not permission to call a director the UBO because a database found nothing. It requires exhausted investigation and documented uncertainty.

Indirect ownership, and the case where arithmetic does not work

Indirect ownership is calculated by multiplying holdings through each chain and adding the chains together. All shareholdings at every level count.¹

But that arithmetic is expressly disapplied where Article 54 applies. Where a multi-layered structure has ownership interest and control coexisting at different layers of a chain, the beneficial owners become the natural persons controlling the entities that hold a direct ownership interest, and the natural persons with an ownership interest in the entity that controls the corporate entity.⁵

PURE OWNERSHIP CHAIN · ARITHMETIC WORKS

Natural person

40% OWNERSHIP

Holding Co

40% OWNERSHIP

Customer 16% TOTAL · NO BENEFICIAL OWNER

OWNERSHIP + CONTROL COEXIST · ART 54 APPLIES

Natural person BENEFICIAL OWNER

40% OWNERSHIP

Holding Co CONTROLS THE CUSTOMER

60% = CONTROL ART 53(2)(C)

Customer ENTITY OF FOCUS

↳ Left: no single layer reaches control, so multiply-and-add resolves the answer. Right: 60% at the middle layer is control through ownership, so Article 54 substitutes for the arithmetic and the 40% holder becomes a beneficial owner of the customer.

Where a legal arrangement or an Article 57 entity sits in the chain, the beneficial owners are the beneficial owners of that arrangement or entity.⁷

Trusts and complex structures

Trusts and similar arrangements need function-based identification. Relevant persons can include settlors, trustees, protectors, beneficiaries or classes of beneficiaries, and any person exercising ultimate control. A company-shaped checklist will miss several of these roles entirely.⁸

For a complex structure, map each ownership layer, calculate indirect interests, identify the natural persons behind intermediate entities, examine nominee arrangements, and understand the commercial rationale. A structure whose only apparent purpose is to obscure ownership is itself a risk indicator.

Ownership deadlines to build into the operating model

Note that the initial register report differs by entity type. A legal entity reports “without undue delay after its creation” with no 28-day cap. A trustee reports without undue delay and in any case within 28 calendar days.^{9 10}

Which situations require specific enhanced measures?

Some relationships require prescribed enhanced due diligence in addition to the general customer-risk assessment.¹

Former PEPs

Mitigating measures continue until the risk no longer exists, and “in any case for not less than 12 months following the time when the individual ceased to be entrusted with a prominent public function”. The clock runs from the person leaving the function, not from your last review. The duty is to apply one or more of the Article 34(4) measures, not the full PEP regime. It applies equally to a new customer who formerly held such a function.²

The prescribed high-net-worth gate

≥ €5M in assets handled through personalised services

≥ €50M in total financial, investable or real-estate assets, excluding the customer’s private residence

Higher risk the business relationship is identified as higher-risk

All three elements required · applies only to credit/financial institutions and TCSPs

Then: prescribed EDD applies, in addition to Art 34(4) measures

↳ The Regulation contains no annual qualifier: the trigger is the value of assets handled through personalised services, not an annual flow. The duty binds only credit institutions, financial institutions and trust or company service providers, not obliged entities generally.³

Below any one of the three elements, the prescribed rule does not bite and the general risk-based approach applies.

How does AMLR apply to crypto-assets?

Crypto-asset service providers operate AMLR and the Transfer of Funds Regulation together. One customer, one transfer, two rulebooks. A third and a fourth instrument sit alongside them, and keeping the four apart is the single most useful thing a crypto compliance team can do with AMLR.

↳ Attributing a rule to the wrong instrument is the most common error in crypto AML commentary.

What AMLR does and does not prohibit

Self-hosted addresses are not banned. CASPs must identify and assess the money laundering and terrorist financing risk of transfers to or from a self-hosted address, then apply mitigating measures commensurate with that risk. One or more of:¹

There is no fixed threshold in this article.

The “verify who controls the wallet above EUR 1,000” rule that circulates in summaries is the Transfer of Funds Regulation, not AMLR.

Anonymity is where AMLR does prohibit. Credit institutions, financial institutions and CASPs are prohibited from keeping anonymous bank and payment accounts, anonymous passbooks, anonymous safe-deposit boxes or anonymous crypto-asset accounts, as well as any account otherwise allowing the anonymisation of the account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins.²

Existing anonymous accounts, passbooks, safe-deposit boxes and crypto-asset accounts must be subject to CDD before they are used in any way.²

When must suspicious activity be reported?

An obliged entity must report without delay to its national FIU when it knows, suspects or has reasonable grounds to suspect that funds or activity are connected to criminal conduct or terrorist financing. The duty applies irrespective of amount and can cover attempted transactions.¹

Unusual fact or activity

Internal assessment Preserve facts, transactions, ownership context and reasons

Suspicion threshold met?

No ↓ Yes ↓

Document and keep monitoring Escalate if the picture changes

Report promptly to the FIU Without delay, any amount Art 69

Refrain where required Three-working-day rule if no FIU instruction Art 71

No tipping off Never reveal that a report has been or will be made Art 73

Your internal assessment should preserve the relevant facts, transactions, ownership context, explanations, and the reason for the conclusion. Staff do not need to prove the underlying crime before escalating a concern, and a policy that implies otherwise suppresses reporting.

The tipping-off constraint has to be designed into customer-facing scripts, complaint handling, account-closure messaging and automated notifications, not bolted on afterwards.²

National filing portals and procedures remain important even as AMLA develops a common reporting-format standard. Firms operating in several Member States should treat filing mechanics as a per-country workstream.

What must be reported on high-value goods?

Alongside suspicion-based reporting, AMLR introduces a threshold-based reporting duty that has nothing to do with suspicion. It is easy to miss because it sits at the end of the reporting chapter.

Persons trading in high-value goods must report to the FIU all transactions involving the sale of the following goods when those goods are acquired for non-commercial purposes:¹

Two points that summaries routinely drop. The duty is not limited to the trader: credit institutions and financial institutions that provide services in relation to the purchase or transfer of ownership of these goods also report the transactions they carry out for their customers.² And there is no fixed EU deadline: reporting is carried out “within the deadlines imposed by the FIU”.³

The commercial-purpose condition does real work. A dealership buying stock is outside paragraph 1.
A private buyer at or above the threshold is inside it.

These same thresholds also appear in Article 67 as one of the triggers that pull a foreign legal entity or arrangement into an EU central register.⁴

When can AML information be shared?

AMLR permits defined information sharing within groups and through qualifying information-sharing partnerships, with a clear AML/CFT purpose, restricted access, security, governance and data-protection safeguards.^{1 2}

Each of those decisions has to rest on the obliged entity’s own assessment. Shared intelligence can direct attention, prompt a review or corroborate a finding, but the accountable decision stays with the firm that makes it.

The tipping-off prohibition still applies. Information that would disclose that a suspicious-activity report exists, or that an FIU analysis is under way, can be shared only where a specific legal exception permits it. Partnership design should assume that constraint from the start.³

How does AMLR interact with GDPR, AI and recordkeeping?

AMLR provides a legal framework for necessary AML/CFT data processing. It does not remove GDPR principles.¹

Automation can extract documents, triage alerts, score risk and identify patterns. It does not transfer accountability to the model or the provider. Where meaningful human intervention is required, the reviewer must understand the evidence and be able to alter the decision. An approval click alone is not enough.

Record keeping requirements

Personal data must be deleted on expiry of the five-year period, without prejudice to retention periods set by other Union or national law compliant with GDPR.²

Your records should be able to reconstruct what was known, which sources were used, how ownership and risk were assessed, who approved the outcome, and what monitoring or reporting action followed.

What anonymity and cash restrictions does AMLR introduce?

AMLR prohibits anonymous instruments and puts an EU-wide ceiling on professional cash payments.

Prohibited or restricted instruments

Anonymous bank and payment accounts, anonymous passbooks, anonymous safe-deposit boxes and anonymous crypto-asset accounts, plus any account allowing anonymisation or increased obfuscation of transactions.¹ Acquirers must not accept payments made with anonymous prepaid cards issued in third countries, subject to any RTS adopted under Article 28.²

Bearer shares now carry dates

Companies are prohibited from issuing bearer shares. Existing bearer shares must be converted into registered shares, immobilised, or deposited with a financial institution by 10 July 2029. Where that does not happen, all voting rights and rights to distribution are automatically suspended until conversion, immobilisation or deposit. Shares still not dealt with by 10 July 2030 are cancelled, reducing share capital accordingly. Listed companies and shares issued as intermediated securities are carved out. Bearer share warrants that are not in intermediated form are prohibited.³

The cash ceiling

The cash ceiling is not the CDD threshold. A EUR 3,000 cash transaction can trigger identification and verification even though it sits below the payment ceiling, and suspicion triggers CDD and reporting at any value.

There are two carve-outs, not one:⁴

If you operate across Member States you need a country matrix covering lower national limits, exclusions, linked payments, mixed payment methods and refund controls.

What compliance framework does AMLR require?

AMLR requires a risk-based and proportionate programme. A smaller obliged entity may use simpler controls than a cross-border bank, but it must still achieve the required outcomes and prove that the controls work.¹

The business-wide risk assessment should reflect actual customers, geographies, products, services, transactions, delivery channels and technology, and connect identified risk to control design and investment rather than read as a generic description of the sector.²

The compliance officer and the management body

AMLR separates responsibility rather than leaving it to organisational preference. The management body carries overall accountability. A member of the management body is designated as the compliance manager responsible for implementation. A compliance officer runs day-to-day compliance, reports to the management body, and must have the standing, resources and access to discharge the role.³

Training and employee integrity

Staff must be made aware of the requirements that apply to their role, with training proportionate to the risks and to what the person actually does. Employee integrity measures and protected internal reporting routes are part of the framework, not optional additions.⁴

Group-wide policies

Groups apply group-wide policies, procedures and controls, including information sharing for AML/CFT purposes within the group. Where a third country’s law prevents implementation, the conflict must be escalated and additional measures applied.⁵

Outsourcing and reliance are not the same thing

Neither route transfers accountability. In both cases the obliged entity has to produce the underlying information and evidence on request, and demonstrate that the arrangement was assessed, documented and monitored. Contractual language alone is not a control.

Who supervises AMLR, and what does AMLA do?

AMLA is the most misunderstood part of the package. The short answer is that for most obliged entities, the supervisor on 10 July 2027 is the same national authority as today.

The Anti-Money Laundering Authority was created by Regulation (EU) 2024/1620, which applies from 1 July 2025. The Commission was responsible for its establishment and initial operation until 31 December 2025.^{1 2}

For everyone outside the selected cohort, AMLA still matters, but indirectly. It writes regulatory and implementing technical standards, issues guidelines, oversees national supervisors and supports FIU cooperation. The Article 28 CDD RTS and the Article 26(5) monitoring guidelines are AMLA products, and they will shape day-to-day practice far more than direct supervision will.

What are the penalties for non-compliance?

Penalties sit in two instruments, and neither of them is AMLR.

Tier 1, national penalties for most obliged entities

AMLD6 requires Member States to make pecuniary sanctions available for serious, repeated or systematic breaches of AMLR Chapter II (internal policies), Chapter III (customer due diligence), Chapter V (reporting) and Article 77 (record retention), and for non-compliance with administrative measures.¹

Three qualifications travel with the headline number. AMLD6 says “maximum pecuniary sanctions of at least”, which makes it a floor on the ceiling. The EUR 10 million and 10% tier applies only to credit and financial institutions; every other obliged entity sits on the EUR 1 million tier. And Member States may empower authorities to exceed these amounts, while ability to pay must be taken into account.²

Tier 3 is structured differently, and the difference matters

For entities under AMLA direct supervision the structure is not “EUR 10 million or 10%, whichever is higher”. AMLA sets a basic amount within ranges that vary by breach type and by whether the breach spans one Member State or several, adjusts it using aggravating and mitigating coefficients, and then applies one of two separate caps depending on the breach category.³

Writing the two regimes as though they share a formula is the most common error in AMLR penalty commentary.

Periodic penalty payments

Less discussed, and operationally sharper. Where an obliged entity fails to comply with certain administrative measures within the deadline, supervisors may impose periodic penalty payments until it does. They are capped at 3% of average daily turnover for legal persons, or 2% of average daily income for natural persons. They run for no more than six months, extendable once by a further six months.⁴

A sanction is a single event. A periodic penalty payment accrues daily until the control is fixed.

How should organisations prepare for AMLR?

National supervisors remain responsible for most obliged entities. AMLA will coordinate the EU system and directly supervise only a selected group of higher-risk cross-border financial entities, with preparations for the 2027 selection exercise under way and direct supervision expected from 2028.

A gap analysis is the practical starting point, and it is more specific than a generic readiness assessment. Four questions produce most of the findings:

Where the work concentrates, by sector