The EU AML Regulation (AMLR), Regulation (EU) 2024/1624, applies from 10 July 2027. It moves the duties of obliged entities, including payment institutions, electronic money institutions (EMIs) and crypto-asset service providers (CASPs), from national laws into one regulation that applies directly in every member state. The sixth AML Directive covers supervisors, registers and financial intelligence units, and the Anti-Money Laundering Authority (AMLA) coordinates supervision and will directly supervise 40 selected institutions from 1 January 2028.
This readiness plan is written for MLROs and compliance teams. It sets out what to change, in what order, and what evidence supervisors will expect.
The package and its dates
| Instrument | Content | Date |
|---|---|---|
| AMLR, Regulation (EU) 2024/1624 | Duties of obliged entities | Applies 10 July 2027 |
| AMLD6, Directive (EU) 2024/1640 | Supervisors, registers, FIUs | Largely by 10 July 2027 |
| AMLA Regulation (EU) 2024/1620 | AMLA's tasks and powers | Direct supervision from 1 January 2028 |
| Transfer of Funds Regulation (EU) 2023/1113 | Travel rule for funds and crypto-assets | In force since 30 December 2024 |
| AMLA and Commission standards | CDD detail, selection criteria and more | Adopted through 2026 and 2027 |
Workstream 1: governance
The AMLR requires the management body to approve internal policies, procedures and controls, and one of its members to be responsible for AML compliance. A compliance officer runs day-to-day compliance with sufficient seniority and direct access to the management body. Group parents must implement group-wide policies and information sharing.
- Name the responsible member of the management body and document the role.
- Confirm the compliance officer's mandate, reporting line, resources and access.
- Map group entities and design one group framework with local annexes only where national law still applies.
- Set board reporting on AML at least annually, with interim reporting on material issues.
Workstream 2: the business-wide risk assessment
Each obliged entity must maintain a documented business-wide risk assessment covering customers, products, services, transactions, delivery channels and geographies, taking account of the EU supranational risk assessment, national risk assessments and AMLA guidance. Rebuild the assessment on the AMLR's structure, use the firm's own data and link each risk to controls. For groups, aggregate entity assessments into a group view.
The assessment must be kept up to date and made available to the supervisor on request, so treat it as a living document. Set triggers for review, such as a new product, a new market, a material incident or an EU list update, and keep a version history. Supervisors increasingly test whether the assessment drives decisions: the allocation of compliance resources, monitoring scenarios and customer risk ratings should all trace back to it.
Workstream 3: customer due diligence and beneficial ownership
| Area | AMLR position | Work required |
|---|---|---|
| Identification and verification | Harmonised information and timing, with AMLA standards | Review onboarding data fields and verification methods |
| Purpose and nature | Required for every business relationship | Update forms and risk scoring |
| Ongoing monitoring | Proportionate to risk, with periodic updates | Recalibrate refresh cycles by risk |
| Beneficial ownership | 25% threshold plus control by other means | Update procedures for layered and complex structures |
| Register discrepancies | Must be reported | Build a discrepancy reporting process |
| Simplified due diligence | Defined conditions | Re-test eligibility of products, including low-value e-money |
| Reliance and outsourcing | Clearer limits | Review reliance agreements and outsourcing of CDD |
AMLA's technical standards on CDD will specify information requirements in more detail, including for remote and electronic onboarding. Plan system changes so they can be adjusted when the standards are final.
Two areas usually need the most work for payment firms and EMIs. The first is business customers with layered ownership, where procedures often stop at the first layer and do not document control by other means. The second is periodic review, where refresh cycles were set years ago and do not reflect current risk ratings. Both can be addressed with procedure changes and a remediation plan for existing customers, prioritised by risk.
Workstream 4: enhanced due diligence and high-risk countries
The EU identifies high-risk third countries and sets the measures that apply, distinguishing countries that trigger full enhanced due diligence from those that trigger specific measures. Apply the EU lists directly. For payment institutions with remittance corridors and CASPs with customers or counterparties abroad, map exposure by country, set measures by list category and plan the response to each update. Cross-border correspondent relationships with respondents outside the EU require enhanced measures, including senior management approval and assessment of the respondent's controls; this applies to relationships between CASPs as well as to traditional correspondent banking.
Workstream 5: crypto-specific rules
For CASPs, the AMLR adds specific requirements:
- customer due diligence for occasional transactions of EUR 1,000 or more;
- a ban on anonymous accounts, including anonymous crypto-asset accounts;
- risk-based measures for transfers involving self-hosted wallets;
- enhanced measures for cross-border correspondent relationships with other CASPs.
These sit alongside the travel rule under the Transfer of Funds Regulation and the MiCA authorisation conditions. Review onboarding thresholds, wallet ownership checks, blockchain analytics coverage and counterparty due diligence together. Our comparison of MiCA and the UK cryptoasset regime covers the authorisation side, and our MiCA CASP licence page covers the application.
Workstream 6: AMLA selection readiness
AMLA will directly supervise 40 selected obliged entities. Eligible institutions are credit and financial institutions, including CASPs, payment institutions and EMIs, operating in at least six member states through establishments or cross-border services, and among those with the highest risk under AMLA's methodology. The first selection runs for six months from 1 July 2027; direct supervision begins on 1 January 2028; the selection is reviewed every three years.
| Question | Why it matters |
|---|---|
| Do we operate in six or more member states? | The threshold for eligibility |
| How would our risk profile score under AMLA's methodology? | Selection depends on risk |
| Is our data consistent across entities? | AMLA will compare and aggregate |
| Is group governance ready for a joint supervisory team? | Direct supervision is led by AMLA with national supervisors |
Institutions near the threshold should assess their position early, because selected institutions face more intensive supervision and higher expectations on data.
Workstream 7: training, testing and evidence
Train the management body, compliance staff and first line on the regulation. Management body training should cover the responsibilities the AMLR places on directors and the responsible member, the firm's risk profile and the main changes from national law. First line training should focus on onboarding, monitoring and escalation under the new procedures. Scope the next independent audit to test against the AMLR. Keep a file showing the gap analysis, decisions, policy approvals, system changes and testing, so that supervisors can see the path from the old rules to the new.
Groups with UK entities should remember that the AMLR does not apply in the UK, where the Money Laundering Regulations, amended in 2026, continue to apply. Keep the two frameworks aligned where possible and record the differences, including high-risk country lists and thresholds. Our checklist on the UK MLR amendments covers the UK side.
A timeline to 10 July 2027
| Period | Milestones |
|---|---|
| Q4 2026 | Gap analysis; governance roles confirmed |
| Q1 2027 | Risk assessment rebuilt; CDD and EDD procedures drafted |
| Q2 2027 | System changes tested; training delivered; policies approved |
| 10 July 2027 | AMLR applies |
| H2 2027 | AMLA selection; first supervisory reviews under the AMLR |
How it fits with PSD3
EU payment institutions and EMIs will prepare PSD3 re-authorisation files in 2027 and 2028, and the authorisation file includes AML internal controls. Complete the AMLR work first and describe the result in the PSD3 file. Our guide to PSD3 re-authorisation explains the process, and our financial crime team runs AMLR gap analyses.