Perspective

The EU AML Package

Reshaping the fight against financial crime

In 2021, the European Commission set out to bolster the EU’s defences against financial crime with an ambitious package of legislative proposals. This package aimed at strengthening the EU's anti-money laundering and countering terrorism financing (AML/CFT) rules and bridge legislative gaps across Member States. A key element of this package was the proposal for a new EU authority - the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) - a central authority coordinating national competent authorities acting in the AML/CFT ecosystem, such as supervisors and Financial Intelligence Units (FIUs).

The EU Council’s adoption of the AML/CFT Package in May and June 2024, and its subsequent publication in the Official EU journal, mark a turning point for both public and private entities across the EU. This package introduces a wave of upcoming milestones, with nearly 100 due dates over the next 8 years, concentrated particularly in July 2026, 2027, and 2029. These deadlines encompass a range of requirements, including AMLA guidelines, regulatory and implementing technical standards, member state notification, and reports, introducing additional obligations and interpretations for obliged entities and other stakeholders.

What’s in the AML Package?

The AML Package comprises four key legal acts:

Anti-Money Laundering Authority (AMLA)

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) stands as a pivotal institution in the EU’s reformed AML/CTF framework.

⚙️ Operational since July 2025

📍 Based in Frankfurt, Germany

👤 Chaired by Bruna Szego

📈 Expected to grow to 400+ staff by 2027

Its core responsibilities include:

Direct supervision: starting in 2028, AMLA will directly supervise a select group of high-risk financial entities (approx. 40) operating across multiple EU member states, identified through a harmonized risk assessment methodology.
Indirect supervision and coordination: AMLA will indirectly supervise other financial and non-financial sectors by coordinating national authorities and establishing common standards and practices, fostering a unified supervisory culture.
FIU support: AMLA will support Financial Intelligence Units (FIUs) by facilitating joint analyses of cross-border suspicious activities, managing the FIU.net information system, and promoting the exchange of best practices.

· A more data-driven, comparable, and consistent supervisory model.

Importantly, AMLA will not replace national supervisors or FIUs. Instead, it will act as a central coordinating body to ensure the effective and consistent application of AML/CFT rules throughout the EU.

Anti-Money Laundering Regulation (AMLR)

Effective from July 2024, the Anti-Money Laundering Regulation (AMLR) marks a significant evolution in the EU's fight against financial crime. Replacing the previous directive-led approach, the AMLR is a directly applicable regulation, ensuring consistency across all EU member states.

Key impacts of the AMLR include:

Applicability and scope: the new AMLR regulation will be directly applicable by all EU member states starting July 2027 (with some exceptions effective from July 2029), eliminating the need for separate national legislations and ensuring consistency. Additionally, the regulation expands its scope to include previously unregulated entities like crowdfunding platforms, football clubs and agents, and other high-risk sectors, broadening the scope of obliged entities.
Harmonised CDD: the regulation standardises CDD requirements across all EU member states, ensuring a consistent approach to identifying and verifying customers. Upcoming regulatory and implementing technical standards will elaborate on the requirements in greater detail, while AMLA guidelines will ensure a shared understanding among all obliged entities. Standardized formats for reporting suspicious transactions and submitting information to beneficial ownership registers will further streamline AML efforts across the EU.
Clarity on beneficial ownership: the definition and threshold for beneficial owners are harmonised across the EU. Now, individuals holding 25% or more (compared to the previous ‘more than 25%’) of shares, voting rights, or control are considered beneficial owners.
Enhanced due diligence (EDD): the AML regulation introduces EDD obligations to mitigate risks associated with high-risk customers and transactions, including those involving countries posing a threat to the EU. At the same time, Member States retain the flexibility to impose additional requirements beyond EU-wide measures if deemed necessary. Furthermore, the regulation broadens the definition of Politically Exposed Persons (PEPs) to include heads of regional and local authorities, and family member now encompass siblings, acknowledging the potential for financial crime risks within a wider family circle. Recognising the heightened risks often associated with significant wealth, the regulation also mandates enhanced scrutiny for high-net-worth individuals. This includes more rigorous and thorough checks on the origin of their funds and overall wealth.
Cash payment limit: a maximum limit of €10,000 is set for cash payments across the EU. Member states can choose to implement lower thresholds based on their national risk assessments.

By harmonizing rules on beneficial ownership and enhancing scrutiny of high-risk third countries, the AMLR, along with AMLA’s supervisory role, underscores the EU’s commitment to a robust and unified AML/CTF regime and emphasizes the importance of transparency and compliance in safeguarding the EU’s financial system.

The sixth Anti-Money Laundering Directive (AMLD6)

While the AMLR introduces directly applicable rules, AMLD6 focuses on the institutional AML/CFT framework, requiring transposition into national law. by 10 July 2027. Whilst the Directive's provisions have varying transposition deadlines depending on the specific issue, generally Member States must implement the Directive by 10 July 2027, at which point AMLD 4, as amended by AMLD 5, will be repealed.

Key aspects of AMLD6 include:

Central beneficial ownership registers: AMLD6 introduces requirements for more robust registers for beneficial ownership, bank accounts, and real estate, facilitating information sharing and access for national authorities and other stakeholders. These registers must be verified for accuracy and interconnected across the EU and will be accessible to authorities, obliged entities, and individuals with legitimate interest, such as journalists and civil society organizations.
Strengthened FIU role: the directive empowers FIUs with greater access to information and enhanced analytical capabilities. This includes immediate access to financial, administrative, and law enforcement data, the ability to suspend transactions, and improved collaboration through an upgraded FIU.net system.
Risk-based supervision: AMLD6 requires supervisory authorities to adopt risk-based approach when overseeing obliged entities. This includes the power to impose sanctions and the obligation to report suspicious activities. Additionally, AMLD6 emphasizes risk assessments at both EU and national levels, encouraging member states to mitigate identified risks actively.

Overall, AMLD6 aims to reinforce the EU's AML/CFT infrastructure by implementing harmonized mechanisms and enhancing cooperation among member states.

Wire Transfer Regulation II (WTR II)

On 9 June 2023, the EU published the recast Wire Transfer Regulation II (WTR II), which came into effect on 30 December 2024. This regulation repeals the existing revised Wire Transfer Regulation and extends the travel rule to include transfers of crypto assets alongside traditional funds, ensuring comprehensive regulatory alignment across the EU.

In essence, WTR II mandates that information about the sender and receiver must accompany all transfers, whether they involve traditional funds or crypto assets. Crypto-Asset Service Providers (CASPs) must provide this information to national authorities to support Anti-Money Laundering (AML) and Counter the Financing of Terrorism (CFT) investigations. Exclusions apply for person-to-person transfers that don't involve a CASP and transfers between CASPs acting on their own behalf.

The regulation also imposes obligations on CASPs regarding self-hosted wallets and mandates compliance with Know Your Customer (KYC) processes, particularly for transactions exceeding EUR 1,000. The European Banking Authority (EBA) will provide guidance on implementation, including data retention requirements.

While WTR II enhances oversight of financial transactions, challenges may arise in cross-border transactions when EU CASPs engage with non-EU entities lacking comparable AML/CFT measures.

What does this mean for your organization?

The Great Harmonization

What exactly does this mean?

A fundamental shift of the AML-Framework: EU-wide, uniform AML rules as of 10 July 2027.

Until now: Directives, national laws, and significant room for national interpretation.

Going forward: One AML Regulation with direct applicability – a true EU Single Rulebook.

How the new framework works:

The AML Regulation overrides national law.
Guidelines and technical standards issued by AMLA – binding for all.
Supervision becomes more centralized; expectations become more consistent

The objective is clear: More consistency. More comparability. More harmonized requirements.

More sectors in focus

🚨 From banks to businesses: AML expands itsreach.

With the new EU AML Regulation, the regulatory spotlight is clearly widening. More and more sectors are moving onto the AML radar, and many are underestimating what this really means in practice.

💡 What does this mean for affected sectors?

Sectors such as luxury dealers, football clubs, and other non-financial sectors are clearly brought into scope of AML requirements
AML obligations are being raised to near-banking standards
Greater comparability across these industries
Increasing expectations from supervisors and auditors

🔔 Why this matters:
For many non-financial sectors, this is not just a compliance update - it is a fundamental operational transformation challenge.

🚀 Now is the time to act.

AMLA Data Collection Exercise

🚨 AMLA is moving from concept to execution.

In March 2026, the new Anti-Money Laundering Authority (AMLA) launched a data collection exercise to determine which institutions may fall under direct AMLA supervision.

➡️ This is far more than a regulatory survey. It marks the beginning of a data-driven supervisory model that will shape how AML risks are assessed and supervised across the EU.

➡️ For financial institutions, the message is clear: AML supervision in Europe is becoming analytical, model-based and data-driven.

AML-Package: Top 10 changes

🚨 The biggest reform of Europe’s anti-money laundering framework in decades?

With the new EU AML package, the European Union is fundamentally reshaping the fight against money laundering and terrorist financing.

➡️ These changes go far beyond mere adjustments to existing anti-money laundering rules.

New institutions, more harmonized rules and expanded obligations for obliged entities aim to create a far more integrated European AML framework.

➡️ For financial institutions, the message is clear:
For financial institutions, companies and supervisors alike, this will bring significant changes in governance, compliance and cooperation. They must completely overhaul their anti-money laundering measures – as soon as possible!

The most significant changes are listed below:

Change #1 – Unified updating intervals with applicability from 10 July 2027

Medium/Low risk: every 5 years

High risk: annually (to be completed by 10 July 2028)

Change #2 – Harmonization of Beneficial Ownership (BO)

Threshold of 25% (max 15%) including new look-through-methodology

Expansion of Central BO-registers with 14 days reporting deadline of incorrect entries

Change #3 – Redefinition of Politically Exposed Persons (PEPs)

Future PEP-definition to include local public officials (50000+ inhabitants) and siblings (family members)

Enhanced due diligence on occasional transaction with PEPs

Harmonization of PEP classification permitting national extensions

Change #4 – Integration of targeted financial sanctions into the EU-AML-Framework

Mandatory sanction risks in risk assessments and their end-to-end consideration across AML processes

Internal governance strengthened through clearer responsibilities and reporting lines

Change #5 – New Governance Requirements

Clear accountability of the “Compliance Manager” (= designated board member)

Fit & proper assessments for AML-relevant staff

Robust processes to prevent, identify and manage conflicts of interest

Change #6 – Cross-border cooperation of FIUs

AMLA support in joint analyses of cross-border suspicious activity reports (SARs)

Mandatory FIU response in 3 working days n reported transactions

FIU.net (central EU system for operational data exchange) managed by AMLA

Change #7 – New thresholds

Identification requirement on occasional ≥ EUR 3 000 cash transactions

Ban on commercial > EUR 10 000 cash payments

Mandatory transaction reporting to FIU on

Luxury vehicles ≥ EUR 250 000

Watercraft or aircraft ≥ EUR 7.5 million

Change #8 – AMLAs data collection exercise

AMLA calibration exercises (March-April 2026) across ~5000 institutions

250+ quantitative data points for risk assessments

Comparable EU-wide AML/CFT risk assessment framework

Change #9 – EU Single Rulebook = EU AML Regulation and increased focus on data

Less fragmentation, clearer requirements, strong harmonization of due diligence obligations, narrower national options

Increase focus on data availability and analysis to manage AML risks

Change #10 – Direct AMLA supervision of high-risk entities

AMLA to directly supervise 40 high-risk cross-border entities, local authorities to oversight all other entities

Publications of uniform inspection, sanction and oversight standards

A new Supervisory Risk Assessment of Institutions under Article 40 AMLD

🚨 Risk-based supervision is becoming reality.
A core element of the new EU AML framework is the consistent expansion of the risk-based approach and with it a fundamental evolution of the supervisory oversight of obliged entities.

➡️ The basis of supervision?
The risk assessment of institutions pursuant to Article 40 AMLD, further defined by harmonized Regulatory Technical Standards (RTS).

➡️ The objective?
An EU-wide consistent methodology for assessing inherent and residual ML/TF risks.

➡️ The main changes?

Risk assessments will become comparable and consistent across Europe.
Assessments will be datapoint-driven, based on a clearly defined set of quantitative and qualitative information.
The frequency and intensity of supervision will systematically align with the risk profile, size and complexity of institutions.

➡️ What this means for obliged entities:
Risk models, data quality, and governance will become decisive factors in supervisory classification.

EU AML Package & Suspicious Activity Reports

🚨 Lower reporting thresholds. Higher expectations.
With the EU AML Package, the framework for suspicious activity reporting is fundamentally reshaped across Europe. The objective is greater harmonization and earlier identification of risks.

➡️ What are the key changes?

The EU AML Regulation will apply directly in all Member States – reducing national differences in the handling of suspicious activity reports.
Suspicion no longer needs to be explicitly linked to a specific criminal offence. A possible connection to money laundering or terrorist financing may be sufficient.
Duty to provide information to the FIU: Requests must generally be answered within 5 business days; in urgent and well substantiated cases, within < 24 hours.
More harmonized requirements for the content, structure, and quality of reports – clearly reasoned, data based and ascertainable.

➡️ What does this mean for obliged entities?
Suspicious activity reports are becoming an even more central risk and supervisory management instrument. Processes, data quality, decision logic, and training move further into focus, while reporting thresholds are lowered at the same time.

Crypto in the AML Spotlight

🚨 You wonder what ‘s at stake and why preparation matters?
From MiCAR, the Transfer of Funds Regulation, and AMLR, the following should be on your dashboard:

👉 Crypto-asset service providers are being regulated like banks.
➡️ Why is crypto moving into the spotlight?

Borderless by design – beyond traditional jurisdictions
Real-time transactions enabled by blockchain
Anonymity features and related risks
New abuse typologies (e.g. DeFi, cross-chain, mixers, etc.)

➡️ What is really new under the EU AML framework?

Single Rulebook
- One unified AML/CFT framework for all CASPs across the EU
- Expected further guidance on operational aspects
Level Playing Field
- CASPs ≈ banks (no more special treatment)
Supervisory Shift
- AMLA + national supervisors significantly increase pressure

➡️ What does this mean for crypto-asset service providers?
Every CASP will see increasing AML expectations under the EU AML Regulation, driven by AMLA and national supervisors.

👉 Compliance = long-term market viability.

Deloitte is here to guide your organization through this complex regulatory landscape. Our team of experienced professionals offers deep market knowledge and extensive operational transformation expertise to guide your organization through a seamless transition to the new AML/CFT requirements.

Ready to embark on your compliance journey with confidence? Contact us for tailored assistance and guidance.

Yes

No

The EU AML Package