From 10 July 2027 the EU replaces 27 national versions of its anti-money laundering rules with one directly applicable regulation, and most obliged entities are not yet ready for the detail. The 2024 package has three parts: the Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), the sixth Anti-Money Laundering Directive (AMLD6, Directive (EU) 2024/1640) and the regulation creating the Anti-Money Laundering Authority (AMLA, Regulation (EU) 2024/1620), all published in the Official Journal on 19 June 2024. This guide sets out who is covered, the obligations that change day-to-day customer due diligence (CDD), the dated timeline, penalties, and what the rules mean for automated decisioning, AI agents and the machine identities that run KYC pipelines. It is written for compliance officers, MLROs, KYC product owners and the security and identity teams that build the systems behind them. Our AML programme and transaction monitoring guide covers programme design and monitoring in general; this page goes deep on the EU instruments.
Key takeaways
- One rulebook, directly applicable: the AMLR applies from 10 July 2027 without national transposition, while AMLD6 (supervision, FIUs, registers, sanctions) must be transposed by the same date.
- Crypto is fully inside: crypto-asset service providers apply full CDD to occasional transactions of EUR 1,000 or more and may not keep anonymous crypto-asset accounts or accounts that allow anonymisation, including through anonymity-enhancing coins.
- Hard numbers replace national variation: a EUR 10,000 cap on cash payments by traders, CDD refresh at least every year for high-risk customers and every five years for others, and five-year record retention.
- AMLA supervises the biggest risks directly: up to 40 high-risk, cross-border financial groups are selected in a process that must start by 1 July 2027, with direct supervision beginning in 2028.
- Automation needs a human in the loop: Article 76 requires meaningful human intervention before an automated or AI-driven decision to onboard, refuse, exit or change the due diligence level of a customer.
Scope: who and what is covered
The AMLR is a regulation, so its text applies directly in every Member State. It defines the obliged entities in Article 3 and the CDD, reporting, record-keeping and beneficial ownership obligations they must meet. AMLD6 covers what still needs national machinery: supervisors, Financial Intelligence Units (FIUs), central beneficial ownership registers and the sanctions regime. The AMLA Regulation sets up the new authority, seated in Frankfurt and legally established on 26 June 2024. The Transfer of Funds Regulation (EU) 2023/1113, which applies the travel rule to crypto-asset transfers, has applied since December 2024 and sits beside the package; see the Crypto Travel Rule Compliance Guide.
| Obliged entity group (AMLR Article 3) | Examples | Notes |
|---|---|---|
| Credit institutions (3(1)) | Banks | Candidates for AMLA direct supervision |
| Financial institutions (3(2)) | Payment and e-money institutions, investment firms, insurers, crypto-asset service providers | CASPs are brought fully inside the CDD rules (recitals 7, 14, 16) |
| Accountants, tax advisers, lawyers, notaries, trust and company service providers (3(3)(a) to (c)) | Firms forming companies or handling client money | Legal professionals only when taking part in listed transactions |
| Real estate (3(3)(d)) | Estate agents, letting intermediaries | Includes rentals of at least EUR 10,000 a month |
| High-value goods and cultural goods (3(3)(e), (f), (i), (j)) | Precious metals and stones, luxury vehicles, art galleries, auction houses, free zone storage | Cultural goods at EUR 10,000 or more |
| Gambling and crowdfunding (3(3)(g), (h)) | Online casinos, crowdfunding platforms and intermediaries | Gambling CDD at EUR 2,000 |
| New entrants (3(3)(k) to (o)) | Credit intermediaries, investment migration operators, non-financial mixed activity holding companies, football agents, professional football clubs | Football agents and clubs apply from 10 July 2029 |
Not covered: the AMLR does not regulate customers directly, apart from the cash limit and the bearer share rules in Article 79, which bind companies. Payments between private individuals not acting in a professional capacity are exempt from the cash cap.
Key obligations
Customer due diligence triggers and thresholds
Article 19 sets one set of triggers for the whole Union. CDD applies when a business relationship is established, when there is suspicion "regardless of any derogation, exemption or threshold", when previously obtained identification data is doubtful, and at the thresholds below.
| Situation | Threshold | Requirement |
|---|---|---|
| Occasional transaction (single or linked) | EUR 10,000 or more | Full CDD, or a lower value set by AMLA standards for higher-risk sectors |
| Transfer of funds by a credit or financial institution | EUR 1,000 or more | Full CDD |
| Crypto-asset service provider occasional transaction | EUR 1,000 or more | Full CDD; below EUR 1,000, at least identification under Article 20(1)(a) |
| Occasional cash transaction | EUR 3,000 or more | At least identification of the customer |
| Gambling stakes or winnings | EUR 2,000 or more | CDD |
| Non-reloadable e-money instrument | Up to EUR 150 | Supervisors may exempt some CDD measures on proven low risk |
Identification and verification
Article 22 lists the data to collect: for individuals all names, place and full date of birth, nationalities, usual residence and tax identification number where available; for legal entities legal form, registered office, legal representatives, registration and tax numbers, Legal Entity Identifier where available and nominee holders. Verification uses an identity document or passport, or electronic identification means that meet eIDAS assurance level "substantial" or "high" together with relevant qualified trust services. That is a direct link to the eIDAS 2.0 and the European Digital Identity Framework Guide and makes wallet-based onboarding a compliant route. Beneficial owners must also be checked against the central registers.
Beneficial ownership
Recital 107 explains the 25% ownership or voting threshold for beneficial ownership, with Member States able to propose lower thresholds that should generally not be set above 15%. Legal entities must update beneficial ownership information immediately after any change (recital 124), and the information is retained for five years.
Ongoing monitoring and refresh
- Refresh cycle: Article 26(2) caps the interval between updates of customer information at 1 year for customers under enhanced due diligence and 5 years for all others. These are maximums; the interval must reflect risk.
- Event-driven review: updates are also required when relevant circumstances change or the entity learns a relevant fact, which is the legal basis for event-driven or Perpetual KYC.
- Sanctions screening: credit and financial institutions must re-verify targeted financial sanctions exposure upon any new designation (Article 26(4)). See CDD, EDD, PEP and sanctions screening.
Reporting, records and prohibitions
- Suspicious activity reporting: Article 69 requires reports with no minimum amount, including attempted transactions and suspicions arising because CDD could not be completed. Entities must answer FIU requests within 5 working days, and the FIU can shorten this to under 24 hours in urgent cases.
- Record retention: Article 77 requires 5 years from the end of the relationship, the occasional transaction or the refusal, kept unredacted, including records of every suspicious activity assessment whether or not a report was filed. Personal data must then be deleted unless other law requires longer.
- Anonymous accounts: Article 79 bans anonymous accounts, passbooks, safe-deposit boxes and crypto-asset accounts, and any account that allows the holder to be anonymised or transactions obfuscated, including through anonymity-enhancing coins.
- Cash cap: Article 80 limits cash payments made or accepted by traders in goods and service providers to EUR 10,000, single or linked. Member States may keep or set lower limits.
- Outsourcing: Article 18 allows outsourcing with prior notice to the supervisor, but not the approval of the business-wide risk assessment, policies, a customer's risk profile, the decision to onboard, suspicious activity reporting or the approval of detection criteria. The entity stays fully liable.
Timeline and current status
Status checked on 8 November 2026 against EUR-Lex and AMLA. Level 2 standards are still being adopted, so dates for those may move.
| Date | Milestone | Source |
|---|---|---|
| 30 May 2024 | Council adopts the AML/CFT package | European Commission |
| 19 June 2024 | AMLR, AMLD6 and AMLA Regulation published in the Official Journal | AMLA, European Commission |
| 26 June 2024 | AMLA legally established | AMLA |
| December 2024 | Transfer of Funds Regulation applies to crypto-asset transfers | European Commission |
| 10 July 2025 | Transposition of AMLD6 Article 74 | AMLD6 Article 78 |
| 10 July 2026 | Transposition of AMLD6 Articles 11, 12, 13 and 15; AMLA due to deliver draft standards on lower CDD thresholds, report formats and monitoring guidelines | AMLD6 Article 78; AMLR Articles 19, 26, 69 |
| 1 October 2026 | AMLA submits final draft RTS on CDD, business relationships and linked transactions, and group-wide requirements to the Commission | AMLA press release |
| By 1 July 2027 | First AMLA selection of directly supervised entities must start | AMLA Regulation Article 13 |
| 10 July 2027 | AMLR applies; AMLD6 general transposition deadline | AMLR Article 90; AMLD6 Article 78 |
| 2028 | AMLA direct supervision begins | AMLA |
| 10 July 2029 | AMLR applies to football agents and professional football clubs; AMLD6 Article 18; bearer shares must be converted or immobilised | AMLR Articles 79 and 90; AMLD6 Article 78 |
AMLA held its first public hearing on the CDD and business relationship standards on 24 March 2026 and, as announced on 1 October 2026, has sent the final drafts to the Commission for adoption. AMLA states that it proposes these standards apply six months after their entry into force. Read the final reports before freezing onboarding data models, because they set the exact information to collect for standard and lower-risk CDD, remote identification and PEP screening.
Enforcement and penalties
National supervisors enforce the AMLR for most entities; AMLA directly supervises the selected groups and indirectly oversees the rest. AMLA Regulation Article 13 caps the default list at 40 credit or financial institutions or groups with a high residual risk profile, ranked by the number of Member States they operate in and then by the share of third-country transactions. Selection repeats every three years, and supervision begins six months after the list is published.
| Who | Minimum maximum pecuniary sanction (AMLD6 Article 55) |
|---|---|
| Obliged entities in general (serious, repeated or systematic breaches) | At least twice the benefit derived, where determinable, or at least EUR 1,000,000, whichever is higher |
| Credit and financial institutions (legal persons) | At least EUR 10,000,000 or 10% of total annual turnover, whichever is higher |
| Natural persons in credit and financial institutions | At least EUR 5,000,000 |
These are floors for the maximum that national law must allow; Member States may go higher. Breaches of the cash cap are penalised under national measures required by Article 80.
What it means for AI agents and non-human identities
Modern KYC is a machine pipeline: document verification APIs, screening services, risk scoring models and, increasingly, AI agents that draft case narratives or chase customers for documents. The AMLR speaks to this directly.
- Human intervention is mandatory for key decisions: Article 76 permits decisions from automated processes, profiling or AI systems only if they use data collected under the CDD chapter, and decisions to enter, refuse or maintain a relationship, carry out or refuse an occasional transaction, or raise or lower due diligence require "meaningful human intervention". Customers can obtain an explanation and challenge the decision, except for suspicious activity reports. An agent can recommend; a named analyst must decide.
- Agents cannot be the outsourced decision maker: Article 18 forbids outsourcing the risk profile decision, onboarding decision and reporting. A third-party AI service doing these is outsourcing under another name.
- Machine credentials reach the most sensitive data: the service accounts and API keys that call screening providers, central registers and FIU portals hold special category and criminal data that Article 76 says must be protected at the GDPR Article 32 level. Scope each to one integration, store keys in a vault and rotate them. See the AI Agents in Financial Services Security Guide.
- Audit trail as evidence: Article 77 requires records of every suspicious activity assessment, including the information considered. Log which model version, prompt or rule produced each alert disposition and which human approved it, and keep it for five years.
- AI Act overlap: Article 76 refers to AI systems as defined in the EU AI Act; firms using AI in creditworthiness or similar decisions should check high-risk classification. See the EU AI Act High-Risk AI Systems Guide.
- Agentic payments: where an AI agent initiates payments for a customer, the customer remains the CDD subject; bind agent credentials to the verified customer and monitor agent-initiated transactions with the same scenarios. See the Agent Payments Protocols Guide.
| AMLR requirement | Control for automated and machine identities | NIST mapping |
|---|---|---|
| Art. 76 human intervention | Approval step in case tooling; agents hold no permission to close or onboard | SP 800-53 AC-6 |
| Art. 76 data protection | Per-integration service identities, vaulted keys, rotation | SP 800-53 IA-5, AC-2; CSF PR.AA-01 |
| Art. 77 records | Immutable decision logs with model and approver, retained 5 years | SP 800-53 AU-12, AU-11 |
| Art. 18 outsourcing | Written agreements, supervisor notice, regular control testing of KYC vendors | SP 800-53 SA-9; CSF GV.SC-05 |
| Overall compliance | Legal requirements register owned by compliance | CSF GV.OC-03 |
Compliance steps
- Confirm scope (now): map each legal entity and product to an Article 3 category. New entrants (investment migration operators, mixed activity holding companies, football) need programmes from scratch.
- Gap the CDD data model: compare onboarding fields with Article 22 and AMLA's final draft CDD standard; add Legal Entity Identifier, nominee status and register checks where missing.
- Re-cut thresholds: set occasional transaction, CASP EUR 1,000 and cash EUR 3,000 rules in the transaction engine, with linked-transaction logic that follows AMLA's Article 19(9) standard.
- Rebuild refresh scheduling: 1-year and 5-year maximum cycles plus event triggers; measure the backlog now so it can be cleared before July 2027.
- Review automation: inventory every model, rule and agent that touches a CDD decision, prove the human approval step, and document the explanation route for customers.
- Review outsourcing: list KYC and screening vendors, check written agreements, notify supervisors and keep the non-outsourceable decisions in house.
- Close anonymity gaps: crypto businesses review support for anonymity-enhancing coins and any account that obfuscates transactions; traders implement the EUR 10,000 cash cap.
- Prepare for AMLA: large cross-border groups model whether they are likely to be selected and prepare for supervisory data requests in 2027.
- Test and fall back: run old and new CDD rules in parallel on a sample before cut-over, and keep the national rule set available until 10 July 2027.
Small versus large firms: a small trader or estate agent mainly needs the Article 19 triggers, Article 22 data set, reporting route and five-year records. Large groups add AMLA selection readiness, group-wide standards under Articles 16 and 17, and the governance to prove human oversight of automated decisioning at scale.
Measures that show readiness
- Percentage of active customers with CDD data refreshed inside the Article 26 maximum interval.
- Percentage of automated CDD decisions with a recorded human approver.
- Median time to answer FIU requests against the 5 working day limit.
- Percentage of outsourced KYC tasks with a written agreement and a control test in the last year.
- Number of open gaps against the AMLA final draft CDD standard.
Practitioner checklist
- Map every entity and product to an AMLR Article 3 category and record the application date (2027 or 2029).
- Align onboarding data with Article 22 and the AMLA CDD standard, including eIDAS-based verification.
- Configure CDD thresholds: EUR 10,000 occasional, EUR 1,000 transfers and CASP transactions, EUR 3,000 cash, EUR 2,000 gambling.
- Set refresh cycles at no more than 1 year (EDD) and 5 years (others), with event triggers and sanctions re-screening on new designations.
- Prove meaningful human intervention for every automated or AI-driven onboarding, exit or due diligence level decision.
- Scope, vault and rotate the service credentials used by KYC, screening and FIU integrations.
- Retain unredacted CDD and alert assessment records for 5 years, then delete.
- Check outsourcing agreements and keep non-outsourceable decisions in house.
- Remove anonymity-enhancing coins or obfuscating account features if you are a CASP.
- Track AMLA standards and national AMLD6 transposition until July 2027.
Standards and references
- EUR-Lex: Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation)
- EUR-Lex: Directive (EU) 2024/1640 (sixth Anti-Money Laundering Directive)
- EUR-Lex: Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority
- AMLA: About AMLA
- AMLA: AMLA finalises key standards for the private sector
- AMLA: First public hearing on draft regulatory technical standards
- European Commission: Anti-money laundering and countering the financing of terrorism at EU level
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: AML programme and transaction monitoring · Identity Proofing and KYC Guide · MiCA and DORA for Crypto-Asset Service Providers Guide · Fraud Operations and Case Management Guide. This guide summarises the EU AML Regulation, AMLD6 and the AMLA Regulation and is not legal advice.