A major new European regulatory framework for anti-money laundering and counter terrorism financing is coming into force in 2027. The regulatory package consists of Regulation (EU) 2024/1624 (’AMLR’), Directive (EU) 2024/1640 (’AMLD6’), and a new, union-level Anti-Money Launering Authority (AMLA). This set of leglisation was adopted in 2024, and is expected to come fully into force in July, next year.
The central pillar of this new system, the AMLR will apply directly to obligated persons, replacing the separate national legislation which until now has implemented the requirements of the Anti-Money Laundering Directive. The goal is to ensure a uniform framework of AML/CTF rules across the EU, and minimize any variations in its implementation between member states.
While the AMLR will take the central spot for businesses, the AMLD will continue to provide the rules for member states in how to set up their supervisory authorities and exercise regulatory oversight.
The third pillar, the AMLA will have both oversight and advisory functions – it will exercise direct oversight over a limited set of selected financial institutions and high-risk intermediaries with EU-wide significance, and will also issuing technical and supervisory standards for the implementation of the AMLR. These standards will lay the foundation for further implementing legislation.
From AMLD to AMLR – what’s new for obliged businesses
In addition to shifting the legislative model from national implementation to direct regulation, the AMLR will also introduce new requirements for AML compliance.
While the essence of these obligations remains largely unchanged, obliged entities will have to consider some significant changes to their compliance model going forward:
Expanded scope of obliged entities
The AMLR expands the list of entities who will be required to comply with AML/CTF rules.
More specifically, the regulation adds art dealers and intermediaries, investment migration operators, crowdfunding service providers and intermediaries to the list of obliged entities. The list is further expanded with agents representing football players, and football clubs when engaged in player transfers or transactions with sponsors or owners. The AMLR also introduces more specific provisions around casinos and gambling service providers.
Internal compliance function
The regulation expands the requirements for the internal compliance functions that obliged persons must establish. In place of the previous single role of the compliance officer, the AMLR now requires that two compliance roles be established:
The compliance manager must be a member of the management body, who is responsible for compliance with the AMLR, the Travel Rule Regulation, and any acts on their implementation.
The compliance officer should be responsible for day-to-day operations, such as the filing of suspicious transaction reports, and acts a contact point for supervisory authorities.
The AMLR exempts some entities, such as individual professionals and single shareholder entities from the obligation to appoint two separate compliance officials.
Customer due diligence
The new regulation will establish fixed update intervals for customer due diligence (CDD) documentation for low, medium and high-risk customers respectively.
Simplified due diligence measures are also explicitly detailed, with obliged entities now being limited as to what simplifications to their customer due diligence process are permitted, among other changes to the CDD requirements.
Beneficial ownership
The 25% threshold for establishing beneficial ownership remains, but it will also cover any rights to a share of profits, other internal resources or the liquidation balance. These are economic rights without votes, and would not usually show on a share register.
For indirect ownership, the percentage will continue to be calculated through multiplication, but any holdings by the same individual through different ownership chains will be added to determine the total controlling stake of the person
Retention and erasure of AML records
Personal data protection provisions aim to ensure that following customer due diligence and beneficial ownership requirements remains consistent with data protection principles.
More specifically, the AMLR introduces an explicit retention period for customer records, and a new obligation is introduced to delete such records after the period expires.
The retention period commences upon execution of an occasional transaction, termination of a business relationship, or the refusal to enter into a business relationship or execute an occasional transaction – meaning records must be kept even if there’s no client relationship established.
What the new AML regime means for your business
The new Regulation does not significantly alter the current compliance regime, but does introduce additional and sometimes stricter requirements. Existing internal policies and controls will need to be assessed though the AMLR need not be treated as a wholly new regulatory framework.
If your business is one of those newly added to list of obliged entities, you have until July 10, 2027 to ensure that it complies with the requirements of the AMLR.
Contact us now for expert compliance advice. We can help you ensure that your business meets all requirements prior to the July 2027 deadline.