AMLR explained: the EU AML Regulation that applies from July 2027
What the EU Anti-Money Laundering Regulation is, how it fits with AMLD6 and AMLA, every date from 2024 to 2029, who is covered, the main rules by article, the penalties and where the technical standards stand.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
The AMLR is Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation. It applies from 10 July 2027 and puts the anti-money laundering rules for businesses into one text that is directly applicable in every Member State.[1]
- It sits next to a directive (AMLD6) and a new authority (AMLA), each with its own dates.[2][3]
- It fixes who is covered, when customers are checked and how identity is verified.[1]
- The technical standards are final drafts on 2 October 2026, not law.[5]
From 10 July 2027, a bank, a crypto exchange and a dealer in high-value watches will work from the same anti-money laundering text, whichever Member State they are in.[1] This guide covers what the AMLR replaces, how it fits with the Sixth Anti-Money Laundering Directive (AMLD6) and the Anti-Money Laundering Authority (AMLA), the dates, who is covered, the main rules by article, the penalties and the technical standards.
What the AMLR is and what it replaces
The AMLR was published in the Official Journal on 19 June 2024 and entered into force on 9 July 2024.[1] Article 1 gives it three subjects: the measures obliged entities apply against money laundering and terrorist financing, beneficial ownership transparency, and limits on anonymous instruments.[1]
It is a regulation, not a directive. Article 90 makes it "binding in its entirety and directly applicable in all Member States" and sets the date: "It shall apply from 10 July 2027", with 10 July 2029 for football agents and professional clubs.[1] The Council said it "exhaustively harmonises anti-money laundering rules for the first time throughout the EU".[4]
Directive (EU) 2015/849, the current directive, is repealed with effect from 10 July 2027, and until that day the national laws that transposed it remain the applicable law.[2]
Note
In force and applicable are different dates: in force since 9 July 2024, binding from 10 July 2027.[1]
How AMLR, AMLD6 and AMLA fit together
Three acts were adopted together in 2024, and each does a different job.[1]
Rules for businesses
AMLR, Regulation (EU) 2024/1624
- Who is an obliged entity
- Due diligence, beneficial ownership, reporting, records
- The EU cash payment cap
Applies from 10 July 2027
Rules for Member States
AMLD6, Directive (EU) 2024/1640
- Supervisors and financial intelligence units (FIUs)
- Beneficial ownership and bank account registers
- Penalties on obliged entities
Transposed by 10 July 2027
The authority
AMLA, Regulation (EU) 2024/1620
- Seat in Frankfurt am Main
- Drafts technical standards and guidelines
- Directly supervises selected financial entities
Applies since 1 July 2025
The three 2024 acts and what each one holds.[1][2][3]
AMLD6 is addressed to Member States. Most of it is due by 10 July 2027.[2] See our post on AMLD6 and onboarding.
AMLA does not replace national supervisors. In its own words, "From 2028, AMLA will directly supervise 40 of the most complex high-risk financial institutions or groups in the EU."[11] Eligible firms operate in at least six Member States with a high residual risk profile; 40 is the first-round cap.[3] For the rest, "National supervisors and FIUs will continue playing their roles".[10] See our guide to AMLA.
Watch out
AMLA approves no product and no provider. Its FAQ says it "does not issue any documents or certificates".[10]
The AMLR timeline, 2024 to 2029
Two clocks run side by side: the regulation and the authority.
- 19 June 2024PublishedThe AMLR appears in the Official Journal.
- 9 July 2024In forceTwentieth day after publication.
- 10 July 2027AppliesThe rules bind; the old directive is repealed.
- 10 July 2029FootballFootball agents and professional clubs join.
The regulation, from publication to full application.[1][2]
- 1 July 2025AMLA startsThe AMLA regulation applies.
- 10 July 2026DeadlineLegal deadline for AMLA's first standards.
- 30 September 2026Final draftAMLA's final report on the due diligence standards.
- 1 July 2027SelectionLatest start of the first selection.
- 2028SupervisionDirect supervision begins.
The authority and its standards.[1][3][6][11]
Who is an obliged entity under the AMLR
Article 3 names three groups: credit institutions, financial institutions, and a list of businesses and professions outside finance.[1]
| Category | Who it covers | Threshold or limit |
|---|---|---|
| Credit and financial institutions | Banks, investment firms, funds, life insurers, currency exchange offices, crypto-asset service providers (CASPs) | None |
| Legal and accounting professions | Auditors, accountants, tax advisors; notaries and lawyers on financial, real estate and company work | By type of work |
| Real estate | Estate agents acting as intermediaries, including lettings | Lettings: monthly rent of at least EUR 10,000 |
| Precious metals and stones | Regular or principal traders | Annex V list |
| High-value goods | Regular or principal traders | Jewellery and watches above EUR 10,000; motor vehicles above EUR 250,000; aircraft and watercraft above EUR 7,500,000 |
| Cultural goods | Dealers, galleries and auction houses | Transactions of at least EUR 10,000 |
| Gambling | Providers of gambling services | National exemptions possible, never for casinos |
| Other categories | Trust or company service providers, crowdfunding providers, credit intermediaries, investment migration operators, non-financial mixed activity holding companies | None |
| Football | Football agents and professional clubs | From 10 July 2029; clubs for four transaction types |
Obliged entities under Article 3, with Annexes IV and V.[1]
On what is new, the Council said the regulation "extends the anti-money laundering rules to new obliged entities, such as most of the crypto-sector, traders of luxury goods and football clubs and agents".[4] AMLA's list adds crowdfunding providers, investment migration operators, credit intermediaries and mixed-activity holding companies.[12]
CASPs are covered as financial institutions, not as a separate line of Article 3.[1] The AMLR guide for crypto and the checklist by type of obliged entity take each sector in turn.
The headline AMLR requirements, article by article
Customer due diligence (CDD) is the core of the regulation. Each headline rule, with its article:
| Topic | What the regulation says | Article |
|---|---|---|
| Due diligence triggers | A new business relationship; an occasional transaction of EUR 10,000; EUR 1,000 for transfers of funds and for CASPs; EUR 2,000 in gambling; identification for cash of EUR 3,000 | Art. 19 |
| Identification | Person: all names, place and full date of birth, nationalities, residence. Legal entity: legal form, name, registered office, legal representatives | Art. 22(1) |
| Verification | An identity document, or electronic identification (eID) at assurance level substantial or high and qualified trust services | Art. 22(6) |
| Beneficial ownership | 25% or more of ownership, direct or indirect, with control tested in parallel; registers consulted; discrepancies reported within 14 calendar days | Arts. 51, 52, 22(7), 24 |
| Politically exposed persons (PEPs) | Senior management approval, source of wealth and funds, enhanced monitoring; family and close associates included; measures last 12 months or more after office ends | Arts. 42, 45, 46 |
| Sanctions | Customer, beneficial owners and controllers checked against EU targeted financial sanctions, regularly | Arts. 20(1)(d), 26(4) |
| Refresh | Update at most every 1 year for higher-risk customers, every 5 years for the rest | Art. 26 |
| Records | 5 years after the relationship or transaction ends, then deletion | Art. 77 |
| Cash cap | EUR 10,000 for traders in goods or services; lower national limits stay | Art. 80 |
| Outsourcing | Prior notice to the supervisor, written agreement, regular controls; six tasks never | Art. 18 |
| Automated decisions | Onboarding and refusal decisions need "meaningful human intervention" | Art. 76(5) |
All articles are in Regulation (EU) 2024/1624.[1]
Two rules shape how onboarding is built. First, how identity is verified.
Article 22(6)Regulation (EU) 2024/1624
"[...] through either of the following means: (a) the submission of an identity document, passport or equivalent [...]; (b) the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high' and relevant qualified trust services as set out in that Regulation."
Source: EUR-Lex, Regulation (EU) 2024/1624[1]
AMLA's final draft standards keep those two means as the default. Remote document-based solutions are an alternative for a person who cannot reasonably present the document face to face and has no access to qualifying eID, and the obliged entity must justify using them.[6] See AMLR identity verification and the EUDI Wallet under the AMLR.
Second, who answers when a provider does part of the work.
Article 18(2)Regulation (EU) 2024/1624
"The obliged entity shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks that are carried out by service providers."
Source: EUR-Lex, Regulation (EU) 2024/1624[1]
Six tasks stay in-house: the business-wide risk assessment, policy approval, the customer's risk profile, the onboarding decision, FIU reporting and the approval of detection criteria.[1] Go deeper on Article 18 outsourcing, the 25% beneficial ownership rule, the EUR 10,000 cash limit and the Article 26 refresh cycle.
Penalties: the amounts sit in AMLD6
The AMLR sets no fine for a due diligence breach. AMLD6 sets what national law must allow for "serious, repeated or systematic breaches" of the AMLR rules on internal policies, due diligence, reporting and record retention.[2]
Article 55(2)Directive (EU) 2024/1640
"[...] the maximum pecuniary sanctions that can be imposed amount at least to twice the amount of the benefit derived from the breach where that benefit can be determined, or at least EUR 1 000 000, whichever is higher"
Source: EUR-Lex, Directive (EU) 2024/1640[2]
- Credit and financial institutions: a maximum of at least EUR 10,000,000 or 10% of total annual turnover, whichever is higher; at least EUR 5,000,000 for natural persons.[2]
- Beyond fines: supervisors can name the firm publicly and withdraw or suspend its authorisation; senior management can be sanctioned too.[2]
Watch out
These are floors for the national maximum, not the fine itself. Member States may go higher, and the 10% level is an EU minimum for credit and financial institutions only.[2]
Where the technical standards stand on 2 October 2026
AMLA drafts regulatory technical standards (RTS) for the Commission to adopt. On 1 October 2026 it announced three final drafts: "Once adopted and published in the Official Journal of the EU, they are proposed to apply six months after their entry into force."[5] No calendar date is fixed.[6]
| Instrument | Legal basis | Status on 2 October 2026 |
|---|---|---|
| RTS on customer due diligence | Art. 28(1) | Final draft of 30 September 2026, sent to the Commission. Not adopted.[5][6] |
| RTS on occasional and linked transactions | Art. 19(9) | Final draft sent to the Commission. No new lower thresholds.[5][7] |
| RTS on group-wide requirements | Arts. 16(4), 17(3) | Final draft sent to the Commission.[5] |
| Guidelines on business-wide risk assessment | Art. 10(4) | Draft. Consultation closed 15 July 2026.[9] |
| Guidelines on ongoing monitoring | Art. 26(5) | Draft. Consultation closed 3 September 2026.[12] |
| Guidelines on due diligence risk factors | Art. 20(3) | Not yet known. No entry on AMLA's tracker of 30 September 2026.[8] |
| Guidelines on outsourcing and PEPs | Arts. 18(8), 42(2) | Due by 10 July 2027. No draft found on 2 October 2026.[1][9] |
Note
A final report is a final draft. It becomes law only once the Commission adopts it and publishes it in the Official Journal. We found none published there as of 2 October 2026.[5][8]
Until AMLA's instruments take over, certain European Banking Authority guidelines continue to apply, including those on remote customer onboarding.[8] The full reading is in AMLA's final customer due diligence standards.
Common misconceptions about the AMLR
Four common statements, checked against the text.
Misconception
"Everything starts on 10 July 2027." Football follows in 2029, AMLA's direct supervision starts in 2028, and each technical standard will carry its own date.[1][5][11]
Misconception
"The EU bans cash above EUR 10,000." The cap binds persons trading in goods or providing services, not payments between natural persons outside a professional capacity. EUR 3,000 is the cash amount at which a customer must be identified.[1]
Misconception
"The ownership threshold dropped to 15%." The text says "25 % or more". A 15% threshold needs a delegated act that the Commission will not adopt before 1 October 2027.[1][13]
Misconception
"Remote onboarding with a document is banned." AMLA's final draft says obliged entities "may continue using existing remote onboarding tools that meet those requirements", as a justified alternative.[6]
How Didit helps with AMLR due diligence
Didit supplies the checks and the evidence; the decisions and the liability stay with the obliged entity. The AMLR solution page maps each article to a check, and the AMLR guide in the docs shows the setup.
Identity verification runs on a document or on an eID integration such as MitID, BankID Sweden or Smart-ID; EU Digital Identity (EUDI) Wallet support is coming soon. Business verification returns company registry data and links an identity check to each owner or officer. AML screening covers 1,300+ sanctions, PEP and watchlists at $0.20 per check, with daily re-screening at $0.07 per person per year. Transaction monitoring and pricing have their own pages.
Didit provides
- Identity checks by national eID or by document
- Business verification with linked owner checks
- Sanctions and PEP screening, re-screened daily
- Session records with retention you configure
Stays with you
- The risk assessment and the policies
- Each customer's risk profile
- The decision to onboard or refuse
- Reports to the FIU, and the liability
Map your AMLR checks in one workflow
Set up identity verification, business verification, screening and the evidence trail, and pay per check.
Key takeaways
- The AMLR applies from 10 July 2027; football agents and professional clubs follow on 10 July 2029.
- The AMLR holds the rules for businesses; AMLD6 holds the penalties; AMLA is the authority.
- AMLA's due diligence standards are a final draft of 30 September 2026, not yet adopted.
- Outsourcing is allowed, but the obliged entity remains fully liable.
Frequently asked questions
When does the AMLR apply?
The AMLR applies from 10 July 2027 under Article 90. Football agents and professional football clubs follow on 10 July 2029. Until then, the national laws that transposed Directive (EU) 2015/849 remain the applicable law.
What is the difference between AMLR, AMLD6 and AMLA?
The AMLR, Regulation (EU) 2024/1624, holds the rules for businesses and applies directly. AMLD6, Directive (EU) 2024/1640, is addressed to Member States and covers supervisors, registers and penalties. AMLA is the EU authority in Frankfurt am Main that drafts the technical standards.
Does AMLA replace my national supervisor?
No. From 2028 AMLA will directly supervise a selected group of high-risk financial institutions, capped at 40 in the first round. National supervisors and financial intelligence units keep their roles for everyone else.
Who is an obliged entity under the AMLR?
Article 3 covers credit institutions, financial institutions including crypto-asset service providers, and a list of other businesses and professions. That list runs from auditors, lawyers and estate agents to traders in high-value goods and gambling providers. Football agents and professional clubs join on 10 July 2029.
Is remote onboarding with an identity document still allowed under the AMLR?
Yes, on the current texts, as an alternative that must be justified. Article 22(6) names two means: an identity document, or electronic identification at assurance level substantial or high. AMLA's final draft of 30 September 2026 allows other remote solutions where neither can reasonably be used, and it is not yet adopted.
Is the beneficial ownership threshold 25% or 15%?
It is 25% or more of the ownership interest, direct or indirect, under Article 52(1), with control tested in parallel. A 15% threshold would need a Commission delegated act, which the Commission has said it will not adopt before 1 October 2027.
Are AMLA's technical standards final?
AMLA's drafting is finished for three of them, but they are not law. On 1 October 2026 AMLA sent final drafts to the Commission. They bind only once the Commission adopts them and publishes them in the Official Journal.
What are the penalties for breaching the AMLR?
National law sets the amounts, within floors laid down in AMLD6. The national maximum must be at least twice the benefit from the breach or EUR 1,000,000, whichever is higher. For credit and financial institutions it is at least EUR 10,000,000 or 10% of total annual turnover.
Sources
- Regulation (EU) 2024/1624 (AMLR), EUR-Lex, Official Journal of 19 June 2024.
- Directive (EU) 2024/1640 (AMLD6), EUR-Lex, Official Journal of 19 June 2024.
- Regulation (EU) 2024/1620 (AMLA regulation), EUR-Lex, Official Journal of 19 June 2024.
- Anti-money laundering: Council adopts package of rules, Council of the EU, press release, 30 May 2024.
- AMLA finalises key standards for the private sector, AMLA, press release, 1 October 2026.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- Final Report, draft RTS under Article 19(9) AMLR, AMLA, announced 1 October 2026.
- Regulatory Instruments tracker, AMLA, last update 30 September 2026.
- Public consultations, AMLA, read on 2 October 2026.
- Frequently asked questions, AMLA.
- AMLA takes major step toward harmonised EU supervision, AMLA.
- AMLA consults on draft guidelines on ongoing monitoring of business relationships, AMLA, 3 June 2026.
- De-prioritisation of Level 2 acts in financial services legislation, European Commission, 6 October 2025.
To map each requirement to a check, open the AMLR solution page.
Build your AMLR onboarding flow before July
Configure the checks your risk assessment calls for and keep the evidence of each one.