Get ready for the EU AML Regulation: less than one year to go

• Credit institutions, payment service providers, investment firms, life insurance undertakings and other financial sector participants
• Crypto-asset service providers (CASPs)
• Notaries and lawyers when carrying out specified transactions, auditors, accountants, tax advisers and gambling operators
• Real estate agents and other real estate professionals acting as intermediaries, including in lettings with a monthly rent of EUR 10,000 or more, and trust or company service providers
• Mortgage and consumer credit intermediaries that are not credit or financial institutions, unless they act under the responsibility of a creditor or another intermediary
• Crowdfunding service providers, crowdfunding intermediaries and investment migration operators
• Non-financial mixed activity holding companies
• Traders in precious metals and stones; traders in high-value goods such as jewellery and watches above EUR 10,000, motor vehicles above EUR 250,000, and aircraft and watercraft above EUR 7.5 million; and traders and intermediaries in cultural goods, including art galleries and auction houses, for transactions of EUR 10,000 or more
• Football agents and professional football clubs (for transactions with investors, sponsors and agents, and for player transfers), from 10 July 2029

Obliged entities in scope for the first time will have to appoint a compliance manager from the management body and a compliance officer and put in place AML policies, procedures and controls, so preparations should begin well before the application date.

The five main changes to compliance programmes are harmonised customer due diligence (CDD) triggers, harmonised politically exposed person (PEP) criteria, revised beneficial ownership rules, harmonised transaction monitoring with a common suspicious transaction reporting (STR) template, and mandatory group-wide controls. In practice, onboarding rules, PEP screening, beneficial ownership checks and reporting templates will have to follow the EU standard instead of the national one, and groups will need one set of controls across all their EU entities. For businesses outside the financial sector, two rules stand out: an EU-wide EUR 10,000 limit on cash payments for goods and services (lower national limits continue to apply), and customer due diligence for occasional transactions of EUR 10,000 or more.

Treat the time until July 2027 as a preparation period. A gap analysis of the current AML programme against the AMLR should start with governance: the management body member responsible for AML compliance, the compliance officer and the screening of AML staff. Many of the other changes will require updates to onboarding processes and IT systems, so plan time for implementation and testing, not only for policy updates. Part of the detail will only be settled when the technical standards drafted by the EU Anti-Money Laundering Authority (AMLA) are adopted by the European Commission, so plan a second review of policies once those standards are adopted rather than a single final rewrite now.

Supervisors are preparing too. AMLA has consulted, until 27 September 2026, on a common methodology that national supervisors will use to score the inherent and residual risk of each obliged entity in the non-financial sector, based on sector-specific data points, with a lighter regime for small entities (fewer than five full-time employees and annual turnover below EUR 600,000). The standards are proposed to apply from 31 December 2028 and from 31 December 2029 for football agents and clubs. Businesses should expect supervisors to request this data and should note that the quality of their controls will directly affect their risk score and how closely they are supervised. Regulators across the EU are urging market participants to start preparing now, for example through a gap analysis of their current AML measures.