AMLR checklist by obliged entity, with the article behind every line
An ungated AMLR checklist: the twelve core lines every obliged entity shares, then sector blocks for banks, crypto, crowdfunding, gambling, high-value goods, real estate and football, each with its article.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
An AMLR checklist has two layers: a core that every obliged entity under Regulation (EU) 2024/1624 must have in place, and a short block of rules that depend on the sector. The regulation applies from 10 July 2027, and from 10 July 2029 for football agents and professional football clubs.[1]
- Thresholds change by sector: EUR 10,000 for occasional transactions, EUR 1,000 for transfers of funds and crypto, EUR 3,000 in cash, EUR 2,000 in gambling.[1]
The EU Anti-Money Laundering Regulation (AMLR) is directly applicable in every Member State, so the same articles will bind a bank, a crypto exchange and a watch dealer.[1] Until 10 July 2027, the national laws that transpose the current directive still apply.[7]
Run the scope flow, tick the core lines, then add your sector. Use the result as a gap analysis and confirm it with counsel.
Who is an obliged entity under Article 3: a decision flow
Article 3 names three groups: credit institutions, financial institutions, and a list of professions and traders in point (3).[1] Crypto-asset service providers (CASPs) come in through the definition of financial institution in Article 2(1).[1]
1List what the business does, activity by activity
Several Article 3 entries cover only named activities or transactions.
Does an activity appear in Article 3
Credit or financial institution
In scope. CASPs sit here.
Profession or trader in Article 3(3)
In scope if the attached condition is met: the value of the goods, a EUR 10,000 transaction or monthly rent, or the type of transaction.
Not an obliged entity
The EUR 10,000 cash cap of Article 80 still binds anyone trading in goods or providing services.
2Check the national exemptions
Member States may exempt some gambling services and some football clubs on proven low risk (Articles 4 and 5).
3Fix your date
10 July 2027, or 10 July 2029 for football.
Scope under the AMLR.[1]
The core AMLR checklist every obliged entity shares
These twelve lines apply whatever the sector, scaled to the nature, risks and size of the business (Article 9(1)).[1]
| Line | What must be in place | AMLR article[1] |
|---|---|---|
| Risk assessment | A documented business-wide risk assessment, sanctions evasion included, drawn up by the compliance officer and approved by the management body. | Art. 10 |
| Policies | Written policies, procedures and controls, approved by the management body and independently tested. | Art. 9 |
| Compliance roles | A compliance manager from the management body, and a compliance officer who reports to the financial intelligence unit (FIU). One person may hold both where size and risk justify it. | Art. 11 |
| Customer due diligence | The nine customer due diligence (CDD) measures of Article 20(1) at every Article 19 trigger, finished before the relationship or transaction starts. | Arts. 19 to 23 |
| Beneficial owners | Owners at 25% or more, with control tested in parallel. Register discrepancies reported within 14 calendar days. | Arts. 22(7), 24, 51, 52 |
| Sanctions screening | EU targeted financial sanctions checked on the customer, its beneficial owners and its controllers, then re-checked regularly. | Arts. 20(1)(d), 26(4) |
| Politically exposed persons | Politically exposed person (PEP) status determined, family and close associates included. Enhanced measures for at least 12 months after office ends. | Arts. 20(1)(g), 42, 45, 46 |
| Monitoring and refresh | Transactions monitored. Customer information updated at most every year for higher risk and every 5 years for the rest. | Art. 26 |
| Reporting | Suspicions reported to the FIU whatever the amount. FIU requests answered within 5 working days. No tipping off. | Arts. 69, 73 |
| Records | CDD files and transaction records kept unredacted for 5 years after the relationship, transaction or refusal, then deleted. | Art. 77 |
| Training and staff | Ongoing, documented training. Skills and integrity of compliance staff assessed. | Arts. 12, 13 |
| Outsourcing register | For each outsourced task: a written agreement, notice to the supervisor before the provider starts, and regular controls. | Art. 18 |
Article 20(4)Regulation (EU) 2024/1624
"Obliged entities shall at all times be able to demonstrate to their supervisors that the measures taken are appropriate in view of the risks of money laundering and terrorist financing that have been identified."
Source: EUR-Lex, Regulation (EU) 2024/1624[1]
Breaches are sanctioned under national law: the sixth Anti-Money Laundering Directive (AMLD6) sets floors for the maximum fine, EUR 1,000,000 in general and EUR 10,000,000 or 10% of turnover for credit and financial institutions.[7]
Go deeper on identity verification, beneficial ownership and the Article 26 refresh cycle.
AMLR compliance checklist by sector
Lines marked "final draft" come from the standards that AMLA, the EU Anti-Money Laundering Authority, sent to the Commission on 1 October 2026. They are not adopted and not law.[3]
Banks, payment and e-money firms
- Apply CDD to any occasional transfer of funds of EUR 1,000 or more (Art. 19(2)).[1]
- Re-run the sanctions check on every new designation (Art. 26(4)).[1]
- Identify and verify the users of every virtual IBAN (Art. 22(3)).[1]
- Treat the merchant as the customer in payment initiation services (Art. 19(6)).[1]
- Use the EUR 150 exemption for non-reloadable e-money instruments only where the supervisor grants it (Art. 19(7)).[1]
- Count the group's Member States: at least six, including the home one, plus a high residual risk profile, means AMLA may select it.[8]
Crypto-asset service providers
- Apply full CDD to occasional transactions of EUR 1,000 or more, and identify and verify the customer below that amount too (Art. 19(3)).[1]
- Keep no anonymous crypto-asset accounts, nor accounts that allow anonymisation, anonymity-enhancing coins included (Art. 79(1)).[1]
- Assess transfers to or from self-hosted addresses and apply at least one mitigating measure (Art. 40).[1]
- Screen wallet addresses where sanctions lists include them (final draft, Art. 25).[2]
- For crypto-asset exchange, treat two or more occasional transactions within one month as linked (final draft).[4][5]
The detail is in AMLR for crypto and our Travel Rule guide.
Crowdfunding platforms
- Check which label fits: a licensed crowdfunding service provider, or an intermediary that matches funders and project owners online without that licence. Both are obliged entities (Arts. 2(1)(16), 3(3)(h)).[1]
- Run CDD on both sides: the person seeking funding and the person providing it are both customers (Art. 19(6)).[1]
Gambling operators
- Apply CDD when winnings are collected, a stake is wagered, or both, for transactions of EUR 2,000 or more (Art. 19(5)).[1]
- Decide whether to identify at the door: casinos may verify customers on entry if they can attribute transactions to them (Art. 19(8)).[1]
- Check for a national exemption. Casinos, and operators whose main activity is online gambling or sports betting, cannot be exempted, apart from carve-outs for state-operated or state-regulated online gambling (Art. 4).[1]
- Treat a voluntary membership at physical premises as a sign of a business relationship (final draft).[4][5]
Traders in high-value goods: jewellers, watch, car and art dealers
For precious metals, precious stones and high-value goods, a trader is in scope when the trade is a regular or principal professional activity (Art. 3(3)(e) and (f)). For cultural goods, the test is the transaction value.[1]
| Goods | In scope when | AMLR source[1] |
|---|---|---|
| Jewellery, gold and silver articles, clocks and watches | Value above EUR 10,000 | Annex IV |
| Motor vehicles | Price above EUR 250,000 | Annex IV |
| Aircraft and watercraft | Price above EUR 7,500,000 | Annex IV |
| Precious metals and stones | Any value: the eight metals and four stones listed | Annex V |
| Cultural goods, galleries and auction houses included | Transaction or linked transactions of EUR 10,000 or more | Art. 3(3)(i) |
- Refuse cash above EUR 10,000 (Art. 80(1)).[1]
- Check your country's cash limit: lower national limits continue to apply (Art. 80(3)).[1]
- Identify and verify the customer for an occasional cash transaction of EUR 3,000 or more (Art. 19(4)).[1]
- Apply full CDD to an occasional transaction of EUR 10,000 or more (Art. 19(1)).[1]
- Report to the FIU each non-commercial sale of a motor vehicle at EUR 250,000 or more, or of a watercraft or aircraft at EUR 7,500,000 or more (Art. 74).[1]
Article 80(1)Regulation (EU) 2024/1624
"Persons trading in goods or providing services may accept or make a payment in cash only up to an amount of EUR 10 000 or the equivalent in national or foreign currency, whether the transaction is carried out in a single operation or in several operations which appear to be linked."
Source: EUR-Lex, Regulation (EU) 2024/1624[1]
Watch out
The cash cap binds any person trading in goods or providing services, obliged entity or not. It does not cover payments between private individuals (Art. 80(4)).[1] See the EUR 10,000 cash limit explained.
Real estate and other professionals
- Estate agents: apply the core when acting as intermediary in a real estate transaction, lettings included when the monthly rent is EUR 10,000 or more (Art. 3(3)(d)).[1]
- Notaries and lawyers: apply it when taking part in financial or real estate transactions, or when creating and running companies and trusts (Art. 3(3)(b)).[1]
- Apply CDD when helping to create a legal entity or transfer its ownership, whatever the value (Art. 19(1)(c)).[1]
- Measure thresholds on the value of the underlying asset or transaction, not on your fee (final draft).[4][5]
Football clubs and agents, from 10 July 2029
- Agents: apply the core to your intermediary services (Art. 3(3)(n)).[1]
- Clubs: map the four transaction types in scope, with an investor, a sponsor, an agent or other intermediary, and for a player's transfer (Art. 3(3)(o)).[1]
- Ask whether your Member State exempts top-division clubs with annual turnover under EUR 5,000,000, or clubs in lower divisions (Art. 5).[1]
AMLR readiness plan, month by month, to 10 July 2027
Nine months remain. The order is our suggestion, not a legal sequence. Article numbers refer to the AMLR.[1]
- Oct to Nov 2026Scope and gapsScope flow, roles, gap analysis.
- Dec 2026 to Jan 2027Risk and policiesBoth approved by the management body.
- Feb to Mar 2027ChecksIdentity, ownership, screening, monitoring.
- Apr to Jun 2027Contracts and proofOutsourcing, records, training, testing.
- 10 July 2027AppliesFootball follows on 10 July 2029.
| Month | Work | Article |
|---|---|---|
| October 2026 | Run the scope flow. Name the compliance manager and officer. | Arts. 3, 11 |
| November 2026 | Tick both checklists against current controls. | All |
| December 2026 | Draft the business-wide risk assessment. | Art. 10 |
| January 2027 | Rewrite policies against the AMLR articles and get them approved. | Art. 9 |
| February 2027 | Rebuild onboarding: identity data, both verification routes, the 25% ownership test. | Arts. 20 to 23, 51, 52 |
| March 2027 | Set up screening and monitoring. Approve the detection criteria in-house. | Arts. 20, 26, 42 |
| April 2027 | Sign provider agreements. Notify the supervisor before each provider starts. | Art. 18 |
| May 2027 | Set retention and deletion timers. Test the FIU reporting path. | Arts. 69, 77 |
| June 2027 | Train staff. Test the controls independently and close the findings. | Arts. 9, 12 |
Still moving on 2 October 2026
AMLA's CDD standards are a final draft dated 30 September 2026, with no fixed application date.[2][3] AMLA's guidelines on the business-wide risk assessment and on ongoing monitoring are consultation drafts.[6] Its outsourcing guidelines are due by 10 July 2027.[1] More in AMLA's final CDD standards.
What a tool can cover and what stays with the firm
Software can run most of the checks on this list. It cannot take the decisions. Article 18(3) names six tasks that can never be outsourced, and Article 76(5) requires meaningful human intervention on automated decisions to accept or refuse a customer.[1]
Article 18(2)Regulation (EU) 2024/1624
"The obliged entity shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks that are carried out by service providers."
Source: EUR-Lex, Regulation (EU) 2024/1624[1]
Recital 47 adds that using third-party software, databases or screening services, while the firm performs the requirement itself, is not considered outsourcing.[1] See what Article 18 lets you outsource and what to build and what to buy.
How Didit helps with the checklist
Didit covers the check-running lines in one workflow, mapped article by article on the AMLR solution page. 4,000+ companies use it. It helps you meet the regulation; the decisions and the liability stay with you.
Identity runs on both routes: eID integrations such as MitID, BankID Sweden and Smart-ID (EUDI Wallet support is coming soon), and document verification in 220+ countries and territories. A full Know Your Customer (KYC) check costs $0.33. AML screening against 1,300+ sanctions, PEP and watchlists costs $0.20 per check, and daily re-screening $0.07 per person per year. Add business verification and transaction monitoring. See the pricing page and the AMLR docs guide.
Didit provides
- Identity checks by national eID or by document
- Business verification with a linked check on each owner
- Sanctions and PEP screening, re-screened daily
- Transaction monitoring, alerts and FIU report preparation
- Questionnaires for purpose and source of funds
- Session records with retention you configure
Stays with you
- The business-wide risk assessment
- Approval of policies and controls
- The risk profile of each customer
- The decision to onboard or refuse
- Filing reports with the FIU
- Approval of monitoring criteria, and the liability
Turn the checklist into a working flow
Configure identity, business verification, screening and monitoring in one workflow, and pay per check.
Key takeaways
- An AMLR checklist is a shared core of twelve lines plus a sector block, each with its article.
- The AMLR applies from 10 July 2027, and from 10 July 2029 for football agents and professional clubs.
- Tools run checks. Six decisions, and the liability, stay with the obliged entity.
Frequently asked questions
What should an AMLR checklist include?
The controls that bind every obliged entity: risk assessment, policies, compliance roles, customer due diligence, beneficial ownership, screening, monitoring, FIU reporting, records, training and outsourcing. Then the rules of your sector, such as the EUR 1,000 threshold for crypto or EUR 2,000 for gambling.
Who is an obliged entity under the AMLR?
Article 3 lists credit institutions, financial institutions and a set of professions and traders. Financial institutions include crypto-asset service providers. The third group runs from auditors, lawyers and estate agents to traders in high-value goods, gambling providers, crowdfunding platforms, football agents and professional football clubs.
Do jewellers, watch dealers and car dealers have to verify customers?
Yes, when trading in high-value goods is a regular or principal professional activity (Article 3(3)(f)). Annex IV defines which goods count as high-value: jewellery and watches above EUR 10,000, motor vehicles above EUR 250,000, and so on. Due diligence applies to occasional transactions of EUR 10,000 or more, and identification to occasional cash transactions of EUR 3,000 or more.
When does the AMLR apply to football clubs and agents?
From 10 July 2029, two years after everyone else. Professional clubs are covered only for transactions with investors, sponsors, agents or other intermediaries, and for player transfers.
Can the compliance manager and the compliance officer be the same person?
Yes, where the nature of the business, its risks and its size justify it. Article 11(7) allows one natural person to perform both functions. The compliance manager must be a member of the management body.
Which parts of the checklist can a tool or provider handle?
A tool or provider can collect and verify identity data, screen against sanctions and PEP lists, run monitoring rules and store evidence. Six tasks can never be outsourced under Article 18(3), among them the customer risk profile, the onboarding decision and FIU reporting. The obliged entity remains fully liable either way.
Are AMLA's technical standards final, and should we wait for them?
No on both counts. AMLA's customer due diligence standards are a final draft dated 30 September 2026, sent to the Commission, and are not law until the Commission adopts and publishes them. The 10 July 2027 date is fixed in the regulation itself, so the core can be built now and adjusted later.
What are the penalties for failing these requirements?
The AMLR sets no fine amounts. AMLD6 sets floors for national maximum sanctions: twice the benefit of the breach or EUR 1,000,000, and for credit and financial institutions EUR 10,000,000 or 10% of annual turnover, in each case whichever is higher. National law sets the real figures.
Sources
- Regulation (EU) 2024/1624 (AMLR), EUR-Lex, Official Journal of 19 June 2024.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- AMLA finalises key standards for the private sector, AMLA press release, 1 October 2026.
- Final Report, draft RTS under Article 19(9) AMLR, AMLA, announced 1 October 2026.
- Factsheet on the RTS under Article 19(9) AMLR, AMLA.
- Regulatory instruments tracker, AMLA, last update 30 September 2026.
- Directive (EU) 2024/1640 (AMLD6), EUR-Lex, Official Journal of 19 June 2024.
- Regulation (EU) 2024/1620 (AMLA Regulation), EUR-Lex, Official Journal of 19 June 2024.
The full article map is on the AMLR solution page.
Start on the lines a tool can cover
Set up the checks your risk assessment calls for and keep the evidence of each one.