The EU AML Package

What does this mean in practice?

From 10 July 2027, uniform rules for AML will apply throughout the EU.

Today: EU directive, national legislation and differing approachs to implementation.

New: one AML regulation with direct effect in all Member States, i.e. a genuine European a single set of rules (Single Rulebook).

How will the new system work?

• The AML regulation will take precedence over national provisions.
• Technical standards, guidelines and recommendations prepared of AMLA will  intended for entities in all Member States.
• Supervision will be more centralised and the expectations of regulatory authorities more uniform.

The objective is clear: greater consistency, better comparability and more uniform regulatory requirements across Europe.

What is AMLA?

AMLA (Anti-Money Laundering Authority) is the new established European authority for combating money laundering, terrorist financing and enforcing targeted financial sanctions.

• Functions from July 2025.
• Is based in Frankfurt am Main.
• The head of the AMLA is Bruna Szego.
• All EU Member States are involved in its functioning.

What does AMLA bring?

• The first EU-wide supervisory authority in the field of AML/CFT.
• From 2028 direct supervision of approximately 40 high-risk financial institutions.
• Closer coordination with national regulators, financial intelligence units (FIU) and European institutions (e.g. ECB, the European Commission).
• A unified, data-driven and comparable supervision model across the EU.

Why is this important?

AML is ceasing to be primarily a national agenda and is becoming a truly European matter.

AML is no longer purely a banking matter.

The new EU AML Regulation significantly expands the range of entities to which regulatory requirements will apply. Many For the regulated sectors, still underestimate how fundamental a change in particular this will mean in practice it will bring.

What does this mean in concrete terms?

• AML rules will newly focus much more also on dealers in luxury goods, football clubs and other non-financial sectors.
• Obligations in the area of AML will, in a number of sectors sectors, approach the standards established in the financial sector.
• The comparability of requirements between individual sectors will increase.
• The expectations of regulators and auditors  will increase.

Why this matters:

For a number of non-financial sectors sectors it is not just about updating compliance, but about a fundamental operational transformation task.

In March 2026, the European authority for combating money laundering (AMLA) started the collection of data intended for testing and calibrating risk assessment models. The results of this process will subsequently also be used when selecting institutions or groups, which will be subject to the direct supervision of AMLA..

This step thus represents one of the first concrete elements data-  of the data-driven Europeandriven supervision model components, model, whose aim isto ensure:

• Uniform and comparable assessment of the risks of money laundering and terrorist financing (ML/TF) across the EU.
• Greater importance of risk models and data quality in the regulatory assessment of financial institutions.

For financial institutions this means:

AML supervision in Europe will increasingly be based on data, standardised methodologies and comparable results. We summarise the key areas on which institutions should already focus today in our article AML Insight Hub.

Start preparing in good time and systematically.

The biggest reform of the European AML framework in the last decade? The new EU AML package fundamentally changes the approach to combating money laundering and terrorist financing.

It is not just an adjustment of existing rules. New institutions are being created, further harmonisation of requirements is taking place and the obligations of regulated entities are expanding. The result is intended to be a significantly more integrated European system.

For financial institutions the message is clear:

The changes will affect governance, compliance and cooperation with supervisory authorities. Organisations will have to fundamentally reconsider their AML processes and control mechanisms and prepare for the new regulatory framework.

From 10 July 2027 the new European AML Regulation will start to apply, which will fundamentally transform the nature of AML regulation throughout the European Union.

The direction of development is already clear. AMLA started collecting data in March 2026, thereby sending a clear signal: the future of AML supervision will be built on data.

The new AML framework is not merely a regulatory update. It is a transformational change.

Institutions should focus in particular on:

• AML governance and the control framework.
• Risk models and methodologies.
• Data quality and data architecture.
• Cooperation between the first and second lines of defence.

The first step should be a systematic gap analysis, which identifies deficiencies and helps define a clear implementation plan.

One of the fundamental pillars of the new European AML framework is the consistent application of a risk-based approach. This is also linked to a fundamental transformation of the way in which supervised entities will be assessed by supervisory authorities.

On what will supervision be based?

On the assessment of the risks of individual institutions under Art. 40 of the AMLD, further elaborated in harmonised regulatory technical standards (RTS).

What is the objective?

To create a uniform European methodology for assessing inherent and residual risks of money laundering and terrorist financing.

What will change in practice?

• Risk assessments will be more uniform across the entire EU and more comparable.
• Assessments will be based on clearly defined qualitative and quantitative indicators.
• The intensity and frequency of supervision will correspond more closely to the risk profile, size and complexity of the institution.

What are the practical impacts?

Risk models, data quality and governance will
become key factors in the assessment of institutions from the perspective of
supervision.

The obligation to report will arise more frequently

The new EU AML package brings fundamental changes in the area of reporting suspicious transactions. The aim is greater uniformity across Europe and earlier identification of risks.

What is changing?

• The AML Regulation will be directly applicable in all Member States, thereby limiting national differences in reporting practice.
• Suspicion will no longer have to be linked to a specific criminal offence. A possible connection to money laundering or terrorist financing will be sufficient.
• Requests from financial intelligence units (FIUs) will normally have to be responded to within five working days, and in urgent cases within 24 hours.
• Requirements are increasing and are being harmonised  for the quality, structure and justification of submitted reports.

What are the practical impacts?

Reports of suspicious transactions will become important  supervisoryt tools. Processes, data quality, decision-making mechanisms and employee training will come to the fore.

What is changing and why it is important to prepare

The MiCA Regulation, the Regulation on the information accompanying transfers  monetary  of funds (TRF Regulation) and the new AML framework send a clear signal: providers of crypto-assets will be subject to regulatory requirements similar to those for traditional financial institutions.

Why is the cryptocurrency sector in the spotlight?

• The global nature of transactions.
• The high speed of transfers through blockchain technologies.
• Elements of anonymity.
• New forms of abuse, such as DeFi, cross-chain transactions or mixing of cryptocurrencies (mixing/tumbling).

What does the new AML framework bring?

• Single set of rule s   in the area of AML/CFT for all CASPs in the EU,
• Comparable regulatory conditions to traditional banks,
• Significantly more intensive supervision by AMLA and national regulators.

What does this mean for providers of crypto services?

AML compliance is becoming one of the key conditions for  the granting and retention of a licence. Pressure from regulators will continue to grow.

Compliance with regulatory requirements is no longer a competitive advantage, but a necessary prerequisite for doing business.

Without shared data it is not possible to manage group risks effectively.

The draft regulatory technical standards (RTS) to Art. 16(4) of the AML Regulation, which concerns the exchange of information within the group, clearly shows that effective AML management will in future be possible only if data are shared and used throughout the entire group.

What does this mean in practice?

• AML policies, processes and controls must be set up uniformly within the group.
• Data used for KYC, transaction monitoring, risk assessment, reporting of suspicious transactions and compliance must be shared in accordance with regulatory requirements.
• It will not be sufficient merely to collect data; they must also be used effectively in risk management and decision-making.
• Information sharing must be proportionate to the risk, properly documented, and auditable.

Why is this important?

Regulators no longer expect an isolated view of individual entities. They require a unified view of clients, risks, and transactions across the entire group.

Fragmented data storage becomes a significant regulatory risk.