Regulation on prevention of use of financial system for ML/TF purposes (AMLR)

(AMLR)

Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR).

Setting out EU rules that will be directly applicable in Member States including in the areas of customer due diligence and beneficial ownership.

Level 1

Entry into force

10 July 2024

AMLR: a new EU-wide level playing field through increased harmonisation (14 May 2025)

2026

10 July 2026

Level 3

Scope of internal policies, procedures and controls

AMLA to issue guidelines on the elements that obliged entities should take into account, based on the nature of their business, including its risks and complexity, and their size, when deciding on the extent of their internal policies, procedures and controls, in particular as regards the staff allocated to the compliance functions.

The guidelines must also identify situations where, due to the nature and size of the obliged entity:

  • internal controls are to be organised at the level of the commercial function, of the compliance function and of the audit function;
  • the independent audit function can be carried out by an external expert.

10 July 2026

Level 3

Business-wide risk assessment

AMLA to issue guidelines on the minimum requirements for the content of the business-wide risk assessment drawn up by the obliged entity pursuant to Article 10(1) (Business-wide risk assessment), and on the additional sources of information to be taken into account when carrying out the business-wide risk assessment.
_
Update 16 April 2026: AMLA consultation paper on business-wide risk assessment. The consultation closed for feedback on 15 July 2026.

10 July 2026

Level 2

Group-wide requirements

AMLA to develop draft regulatory technical standards specifying the minimum requirements of group-wide policies, procedures and controls, including minimum standards for information sharing within the group, the criteria for identifying the parent undertaking in the cases covered by Article 2(1), point (42)(b) (groups whose head office is located outside of the EU, where at least two subsidiary undertakings are obliged entities established in the EU), and the conditions under which the provisions of Article 16 (Group-wide requirements) apply to entities that are part of structures which share common ownership, management or compliance control, including networks or partnerships, as well as the criteria for identifying the parent undertaking in the EU in those cases.

_
Update 12 March 2024: EU Commission provisional request for advice to the EBA regarding regulatory technical standards and guidelines under the future AML/CFT framework.

Update 30 October 2025: EBA published its response to the EU Commission’s call for advice on six AMLA mandates, and issued, among others, technical advice to AMLA on group-wide policies and procedures. 

Update 16 April 2026: AMLA consultation paper on draft regulatory technical standards on group-wide requirements under Article 16(4) and on additional measures on branches and subsidiaries in third countries under Article 17(3). The consultation closed for feedback on 15 June 2026.

10 July 2026

Level 2

Branches and subsidiaries in third countries

AMLA to develop draft regulatory technical standards specifying the type of additional measures referred to in Article 17(2) (Branches and subsidiaries in third countries), including the minimum action to be taken by obliged entities where the law of a third country does not permit the implementation of measures required under Article 16 (Group-wide requirements) and the additional supervisory actions required in such cases.
_
Update 16 April 2026: AMLA consultation paper on draft regulatory technical standards on group-wide requirements under Article 16(4) and on additional measures on branches and subsidiaries in third countries under Article 17(3). The consultation closed for feedback on 15 June 2026.

10 July 2026

Level 2

Application of customer due diligence measures

AMLA to develop draft regulatory technical standards specifying:

  • the obliged entities, sectors or transactions that are associated with higher money laundering and terrorist financing risk and to which a value lower than the value set out in Article 19(1)(b) (Application of customer due diligence measures) applies;
  • the related occasional transaction values;
  • the criteria to be taken into account for identifying occasional transactions and business relationships;
  • the criteria to identify linked transactions.

_
Update 9 February 2026: AMLA consultation paper on draft regulatory technical standards on criteria for business relationships, occasional transactions and linked transactions, as well as lower thresholds under Article 19(9). The consultation closed for feedback on 8 May 2026.

10 July 2026

Level 3

Customer due diligence measures

AMLA to issue guidelines on the risk variables and risk factors to be taken into account by obliged entities when entering into business relationships or carrying out occasional transactions.

10 July 2026

Level 3

Ongoing monitoring

AMLA to issue guidelines on ongoing monitoring of a business relationship and on the monitoring of the transactions carried out in the context of such relationship.
_
Update 3 June 2026: AMLA consultation paper on draft guidelines on ongoing monitoring of a business relationship under Article 26(5). The consultation closes for feedback on 3 September 2026.

10 July 2026

Level 2

Regulatory technical standards on the information necessary for the performance of customer due diligence

AMLA to develop draft regulatory technical standards specifying:

  • the requirements that apply to obliged entities pursuant to Article 20 (Customer due diligence measures) and the information to be collected for the purpose of performing standard, simplified and enhanced due diligence pursuant to Articles 22 (Identification and verification of the identity of customers and beneficial owners) and 25 (Identification of the purpose and intended nature of a business relationship or occasional transaction) and Articles 33(1) (Simplified due diligence measures) and 34(4) (Scope of application of enhanced due diligence measures), including minimum requirements in lower-risk situations;
  • the type of simplified due diligence measures which obliged entities may apply in lower-risk situations pursuant to Article 33(1), including measures applicable to specific categories of obliged entities and products or services, having regard to the results of the risk assessment at EU level conducted by the EU Commission pursuant to Article 7 (Risk assessment at Union level) of Directive (EU) 2024/1640, known as AMLD 6;
  • the risk factors associated with features of electronic money instruments that should be taken into account by supervisors when determining the extent of the exemption under Article 19(7) (Application of customer due diligence measures);
  • the reliable and independent sources of information that may be used to verify the identification data of natural or legal persons for the purposes of Article 22(6) and (7);
  • the list of attributes which electronic identification means and relevant qualified trust services referred to in Article 22(6)(b) must feature in order to fulfil the requirements of Article 20(1)(a) and (b) (Customer due diligence measures), in the case of standard, simplified and enhanced due diligence.

_

Update 6 March 2025: EBA consultation paper on proposed regulatory technical standards in the context of the EBA’s response to the EU Commission’s call for advice on new AMLA mandates.

Update 30 October 2025: EBA published its response to the EU Commission’s call for advice on six AMLA mandates, and issued, among others, the draft regulatory technical standards on customer due diligence. 

Update 9 February 2026: AMLA consultation paper on draft regulatory technical standards under Article 28(1). The consultation closed for feedback on 8 May 2026.

No specific timeline

Level 2

Identification of third countries with significant strategic deficiencies in their national AML/CFT regimes

EU Commission to adopt delegated acts where:

  • significant strategic deficiencies in the legal and institutional AML/CFT framework of a third country have been identified;
  • significant strategic deficiencies in the effectiveness of the third country’s AML/CFT system in addressing money laundering and terrorist financing risks or in its system to assess and mitigate risks of non-implementation or evasion of UN financial sanctions relating to proliferation financing have been identified;
  • the significant strategic deficiencies identified under the above points are of a persistent nature and no measures to mitigate them have been taken or are being taken.

The delegated acts must identify, among the countermeasures listed in Article 35 (Countermeasures to mitigate money laundering and terrorist financing threats from outside the EU), the specific countermeasures mitigating specific risks stemming from each high-risk third country. EU Commission to review the delegated acts on a regular basis to ensure that the specific countermeasures take account of the changes in the AML/CFT framework of the third country and are proportionate and adequate to the risks.

No specific timeline

Level 2

Identification of third countries with compliance weaknesses in their national AML/CFT regimes

EU Commission to adopt delegated acts where:

  • compliance weaknesses in the legal and institutional AML/CFT framework of a third country have been identified;
  • compliance weaknesses in the effectiveness of the third country’s AML/CFT system in addressing money laundering and terrorist financing risks or in its system to assess and mitigate risks of non-implementation or evasion of UN financial sanctions relating to proliferation financing have been identified.

No specific timeline

Level 2

Identification of third countries posing a specific and serious threat to the EU’s financial system 

EU Commission to adopt delegated acts identifying third countries where, in exceptional cases, it considers it indispensable to mitigate a specific and serious threat to the EU’s financial system and the proper functioning of the internal market posed by those third countries, and which cannot be mitigated pursuant to Articles 29 (Identification of third countries with significant strategic deficiencies in their national AML/CFT regimes) and 30 (Identification of third countries with compliance weaknesses in their national AML/CFT regimes).

EU Commission may adopt an implementing act setting out the methodology for the identification of third countries pursuant to Article 31 (Identification of third countries posing a specific and serious threat to the EU’s financial system). The implementing act must set out, in particular: 

  • how the criteria referred to in Article 31(2) are assessed;
  • the process for interaction with the third country under assessment;
  • the process for involvement of Member States and AMLA in the identification of third countries posing a specific and serious threat to the EU’s financial system.

10 July 2026

Level 2

Penalties

EU Commission to adopt delegated acts defining

  • the categories of breaches that are subject to penalties and the persons liable for such breaches;
  • indicators to classify the level of gravity of breaches that are subject to penalties;
  • the criteria to be taken into account when setting the level of penalties.

10 July 2026

Level 2

Reporting of suspicions

AMLA to develop draft implementing technical standards specifying the format to be used for the reporting of suspicions pursuant to Article 69(1)(a) (Reporting of suspicions) and for the provision of transaction records to the FIU pursuant to Article 69(1)(b).
_

Update 2 July 2026: AMLA consultation paper on draft implementing technical standards on the format for reporting suspicions and providing transaction records (interpretative note || Annexes to the draft implementing technical standards). The consultation closes on 20 September 2026.

10 July 2026

Level 2

Cooperation between FIUs and the EPPO

AMLA to develop draft implementing technical standards, in consultation with the European Public Prosecutor’s Office (EPPO), specifying the format to be used by FIUs for reporting information to the EPPO. 
_

Update 18 June 2026: AMLA final report on draft implementing technical standards under Article 81(1). The draft implementing technical standards are pending adoption by the EU Commission.

Level 1

Entry into application

10 July 2027

With the exception of football agents (Article 3(3)(n)) and, in certain circumstances, football clubs (Article 3(3)(o)), to which the AMLR applies from 10 July 2029.

2027

10 July 2027

Level 3

Outsourcing

AMLA to issue guidelines to obliged entities on:

  • the establishment of outsourcing relationships, including any subsequent outsourcing relationship, in accordance with Article 18 (Outsourcing), their governance and procedures for monitoring the implementation of functions by the service provider and in particular those functions that are to be regarded as critical;
  • the roles and responsibility of the obliged entity and the service provider within an outsourcing agreement;
  • supervisory approaches to outsourcing, as well as supervisory expectations regarding the outsourcing of critical functions.

10 July 2027

Level 3

Inability to comply with the requirement to apply customer due diligence measures

AMLA to issue joint guidelines with the EBA on the measures that may be taken by credit institutions and financial institutions to ensure compliance with AML/CFT rules when implementing the requirements of Directive 2014/92/EU, including in relation to business relationships that are most affected by de-risking practices.

10 July 2027

Level 3

Guidelines on money laundering and terrorist financing risks, trends and methods

AMLA to issue guidelines defining the money laundering and terrorist financing risks, trends and methods involving any geographical area outside the EU to which obliged entities are exposed. AMLA must in particular take into account the risk factors listed in Annex III (Higher risk factors). Where situations of higher risk are identified, the guidelines must include enhanced due diligence measures that obliged entities must consider applying to mitigate such risks.

10 July 2027

Level 3

Scope of application of enhanced due diligence measures

AMLA to issue guidelines on the measures to be taken by credit institutions, financial institutions and trust or company service providers to establish whether a customer holds total assets with a value of at least EUR 50,000,000 (or the equivalent) in financial, investable or real estate assets and how to determine that value.

No specific timeline

Level 2

Scope of application of enhanced due diligence measures

EU Commission to adopt delegated acts where it identifies additional cases of higher risks referred to in Article 34(1) (Scope of application of enhanced due diligence measures) that affect the EU as a whole and enhanced due diligence measures that obliged entities are to apply in those cases, taking into account the notifications by Member States pursuant to Article 34(6), first subparagraph.

10 July 2027

Level 3

Specific enhanced due diligence measures for cross-border correspondent relationships for crypto-asset service providers

AMLA to issue guidelines to specify the criteria and elements that crypto-asset service providers must take into account for conducting the assessment referred to in Article 37(1) (Specific enhanced due diligence measures for cross-border correspondent relationships for crypto-asset service providers) and the risk mitigating measures referred to in Article 37(2), including the minimum action to be taken by crypto-asset service providers upon identification that the respondent entity is not registered or licensed.

10 July 2027

Level 3

Measures to mitigate risks in relation to transactions with a self-hosted address

AMLA to issue guidelines to specify the mitigating measures referred to in Article 40(1) (Measures to mitigate risks in relation to transactions with a self-hosted address), including:

  • the criteria and means for identification and verification of the identity of the originator or beneficiary of a transfer made from or to a self-hosted address, including through reliance on third parties, taking into account the latest technological developments;
  • criteria and means for the verification of whether or not the self-hosted address is owned or controlled by a customer.

10 July 2027

Level 3

Specific provisions regarding politically exposed persons

AMLA to issue guidelines on:

  • the criteria for identifying persons known to be close associates of politically exposed persons;
  • the level of risk associated with a particular category of politically exposed person, family member or person known to be a close associate, including guidance on how such risks are to be assessed where the person is no longer entrusted with a prominent public function for the purposes of Article 45 (Measures for persons who cease to be politically exposed persons).

No specific timeline

Level 2

List of prominent public functions

EU Commission may adopt an implementing act setting out the format for the establishment and communication of the Member States’ list of prominent public functions pursuant to Article 43(1) (List of prominent public functions).


EU Commission to adopt delegated acts to supplement Article 2(1), point (34) on politically exposed persons where the lists notified by Member States under Article 43(1) identify common additional categories of prominent public functions of relevance for the EU.

_

Update 6 October 2025: EU Commission included the delegated acts in its list of non-essential Level 2 acts that it will not adopt before 1 October 2027. 

10 July 2027

Level 3

Guidelines on reliance on other obliged entities

AMLA to issue guidelines addressed to obliged entities on

  • the conditions which are acceptable for obliged entities to rely on information collected by another obliged entity, including in the case of remote customer due diligence;
  • the roles and responsibility of the obliged entities involved in a situation of a reliance on another obliged entity;
  • supervisory approaches to reliance on other obliged entities.

10 July 2027

Level 3

Reporting of suspicions

AMLA to issue guidelines on indicators of suspicious activity of behaviours.
_

Update July 2026: AMLA consultation paper (including interpretative note and annexes) on draft implementing technical standards specifying the format to be used for the reporting of suspicions and for the provision of transaction records under Article 69(3). The consultation closes on 20 September 2026.

No specific timeline

Level 2

Identification of beneficial owners for legal entities similar to express trust

EU Commission may adopt an implementing act listing types of legal entities governed by the law of Member States which should be subject to the requirements of Article 57 (Identification of beneficial owners for legal entities similar to express trust).

No specific timeline

Level 2

Identification of beneficial owners for express trusts and similar legal arrangements

EU Commission may adopt an implementing act listing types of legal arrangements governed under the law of Member States which should be subject to the same beneficial ownership transparency requirements as express trusts, accompanied by the information referred to in Article 58(4), second subparagraph (Identification of beneficial owners for express trusts and similar legal arrangements).

Level 1

Full entry into application

10 July 2029

2029

10 July 2029

Level 2

Beneficial ownership through ownership interest

EU Commission to assess whether the risks associated with categories of corporate entities that are exposed to higher money laundering and terrorist financing risks are relevant for the internal market and, where it concludes that a lower threshold is appropriate to mitigate those risks, to adopt delegated acts by identifying:

  • the categories of corporate entities that are associated with higher money laundering and terrorist financing risks and for which a lower threshold must apply;
  • the related thresholds.

_

Update 6 October 2025: EU Commission included the delegated acts in its list of non-essential Level 2 acts that it will not adopt before 1 October 2027.

2030

10 July 2030

Milestone

Reports

EU Commission to report to the EU Parliament and the Council of the EU assessing the necessity and proportionality of:

  • lowering the 25% threshold for the identification of beneficial ownership of legal entities through ownership interest;
  • extending the scope of high-value goods to include high-value garments and accessories;
  • extending the scope of the threshold-based disclosures under Article 74 (Threshold-based reports of transactions in certain high-value goods) to cover the sale of other goods, of introducing harmonised formats for the reporting of those transactions based on the usefulness of those reports for FIUs, and of extending the scope of information collected from persons trading in free-trade zones;
  • adjusting the limit for large cash payments.
2032

10 July 2032

Milestone

Review

EU Commission to review the application of the AMLR and submit a report to the EU Parliament and the Council of the EU assessing:

  • the national systems for reporting of suspicions pursuant to Article 69 (Reporting of suspicions) and obstacles and opportunities to establish a single reporting system at EU level;
  • the adequacy of the beneficial ownership transparency framework to mitigate risks associated with legal entities and legal arrangements.

EU Commission to review the application of the AMLR every three years thereafter.