What does the AMLR mean for your organisation?

Does the AMLR apply to you?

The AMLR applies to the obliged entities listed in Article 3: banks and other financial institutions such as lenders, leasing and factoring companies, payment and e-money institutions, investment firms and fund managers, life insurers and crypto-asset service providers, and beyond the financial sector trust and company service providers, notaries, lawyers, accountants, tax advisers, estate agents, dealers in goods and gambling operators. Football clubs and agents follow from 10 July 2029. If your organisation falls under your national AML law today, the AMLR almost certainly applies to you from 10 July 2027.

What changes for every obliged entity

The AMLR replaces national AML obligations with one EU text and adds requirements that most national laws did not have. The changes that affect almost every organisation:

• A compliance manager at the level of the management body, next to the compliance officer, responsible for compliance and accountable to the board (Articles 9 and 11).
• A business-wide risk assessment built on the AMLR risk factors and AMLA's guidelines, approved by the management body (Article 10).
• Customer due diligence to one EU standard: which identity data you collect and verify, when and how, in Articles 19 to 22 and detailed in an RTS (Article 28).
• Beneficial ownership from a 25 percent interest and through control by other means, with the ownership and control structure documented (Articles 51 to 67).
• Harmonised enhanced due diligence, among others for customers with wealth above 50 million euro, high-risk third countries, crypto-asset service providers and politically exposed persons (Articles 29 to 47).
• Reporting of suspicious transactions to the FIU on an EU-wide template, which replaces national models such as the Dutch reporting of unusual transactions (Articles 69 to 74).
• A Union-wide limit of 10,000 euro for cash payments to traders in goods and services, with lower national limits allowed (Article 80).
• Five years of record retention, with the balance against data protection documented (Articles 77 and 78).
• Limits to outsourcing: the risk assessment, the compliance functions and decisions on suspicious transactions stay in-house (Article 18).

What differs by type of organisation

The obligations are the same; their weight is not:

• Banks, payment and e-money institutions, investment firms and insurers: the heaviest work is in data, from the due diligence data set and beneficial ownership evidence to transaction monitoring and the reporting template. Institutions active in six or more Member States also deal with AMLA: selection data, possibly direct supervision and an annual fee.
• Crypto-asset service providers: enhanced measures for correspondent relationships and self-hosted addresses come on top of the Travel Rule that already applies.
• Trust and company service providers: the beneficial owners of legal arrangements, nominees and complex structures are the core of the work.
• Notaries, lawyers, accountants and tax advisers: client acceptance and risk classification move to the AMLR standard; the compliance manager role and the business-wide risk assessment may be proportionate, but must be in place and documented.
• Estate agents and dealers in high-value goods: customer due diligence on the parties to a transaction and, for dealers, the cash limit.
• Football clubs and agents: the same obligations from 10 July 2029.

What AMLA means for you

AMLA, the new EU authority in Frankfurt, writes the detailed rules you will work with and supervises a first group of up to 40 high-risk cross-border financial institutions itself from 2028. For everyone else the national supervisor stays in charge. The page on AMLA, linked below, explains what that means per type of organisation.

What is AMLA, and what does it mean for your organisation?

What to do now, in this order

A sequence that works for most organisations:

• Confirm your scope: which type of obliged entity, which countries, which licences, and whether AMLA's six-country test applies to you.
• Appoint the compliance manager at management-body level, because most other decisions depend on that role.
• Run a gap analysis per topic against the AMLR articles and the AMLA drafts that apply to you.
• Plan the remediation: policies, due diligence data and systems, monitoring and reporting, training. Most organisations need four to six quarters.
• Track the AMLA standards from consultation to publication, and adjust the plan when they change.

How AMLR Monitor helps

The free dashboard filters every RTS, guideline and ITS by type of organisation and shows where each one stands. A workspace adds an AI impact assessment from your company profile (the topics with the most work and the documents that matter to you), country-specific points for every country you operate in, a readiness tracker with owners and dates, an AI consultant and a board report.