EU AMLR and AMLA Explained: What SMEs Need to Know Before July 2027
What the EU's AMLR and AMLA mean for SMEs: two-sentence definitions, a dated timeline, who's in scope, and what changes before 10 July 2027.
The AMLR is the EU's Anti-Money Laundering Regulation, Regulation (EU) 2024/1624. It applies directly in every member state from 10 July 2027, with no national law needed. AMLA is the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, the EU's new anti-money laundering authority in Frankfurt. The AMLR sets the rules. AMLA helps make sure they are applied the same way everywhere.
This guide is current as of 27 September 2026. Every legal claim below cites the regulation or directive text itself.
What is the EU AMLR?
The AMLR is a single EU rulebook for preventing money laundering and terrorist financing. It tells businesses in scope (called "obliged entities") what checks they must run on customers, what records they must keep, and what they must report. It applies from 10 July 2027 [AMLR Art. 90]. On the same day, the current EU directive, Directive (EU) 2015/849, is repealed [AMLD6 Art. 77]. The AMLR and AMLD6 take its place.
Until now, EU anti-money laundering rules came as directives. A directive sets goals, and each member state writes its own law to meet them. That produced 27 slightly different rulebooks. A business operating in France and Germany had to follow two sets of rules that said nearly the same thing in different words.
The AMLR ends that for the rules businesses follow day to day. The same text applies in every member state on the same day. National regulators still supervise and enforce it, but the core duties no longer vary from country to country.
The AMLR is one of four laws in the EU's 2024 anti-money laundering package. The package was published in the Official Journal on 19 June 2024 [European Commission]. The other three are:
- Regulation (EU) 2024/1620, which creates AMLA.
- Directive (EU) 2024/1640, often called AMLD6 (the sixth anti-money laundering directive), which covers national supervisors, financial intelligence units and registers.
- Regulation (EU) 2023/1113, which covers the information that must travel with transfers of funds and crypto-assets.
What is AMLA?
AMLA is the EU's new anti-money laundering authority, based in Frankfurt am Main. It has existed in law since 26 June 2024 and began operating in summer 2025 [AMLA Reg. Arts. 4, 108; AMLA]. It has three main jobs. It directly supervises a small group of large, high-risk financial firms. It writes technical standards and guidance that apply across the EU. It also supports and coordinates national financial intelligence units.
AMLA is not a police force and it does not prosecute crimes. It is a supervisor and a standard-setter, similar in shape to the EU's existing banking and markets authorities.
For most businesses, AMLA's influence arrives indirectly. The AMLR asks AMLA to write detailed standards on many topics. One example is the information businesses must collect during customer checks. AMLA had to submit draft standards on that topic to the European Commission by 10 July 2026 [AMLR Art. 28]. National regulators then apply those standards when they supervise local firms. So a small business may never deal with AMLA, but it will follow rules that AMLA helped write.
What is the difference between the AMLR and AMLA?
The AMLR is a law. AMLA is an institution. The AMLR says what businesses must do. AMLA helps make sure supervisors across the EU enforce those duties consistently, and it directly supervises a few large financial groups itself. Confusing the two is common because they arrived in the same package and have similar names.
| AMLR | AMLA | |
|---|---|---|
| What it is | A regulation (a law) | An EU authority (an institution) |
| Legal source | Regulation (EU) 2024/1624 | Created by Regulation (EU) 2024/1620 |
| Main role | Sets the anti-money laundering duties of businesses | Supervises, writes standards, coordinates supervisors and FIUs |
| Applies to | Every obliged entity in the EU | Directly supervises only selected financial institutions |
| Key date | Applies from 10 July 2027 | Operating since 2025; direct supervision during 2028 |
| Who a small business deals with | Its national supervisor, applying the AMLR | Usually no one at AMLA directly |
Why is the AMLR a regulation and not a directive?
A regulation applies directly in every member state, word for word, with no national law needed. A directive only sets goals, and each country writes its own law to meet them. The EU chose a regulation for the AMLR so that the duties on businesses stop varying between countries.
The package still includes a directive. AMLD6 covers the parts that depend on national institutions. It sets rules for national supervisors, national financial intelligence units, and the registers of beneficial owners and bank accounts [AMLD6 Art. 1]. (A beneficial owner is the person who ultimately owns or controls a company.) Member states must write AMLD6 into national law, mostly by 10 July 2027 [AMLD6 Art. 78].
For a small business, the split is simple. The AMLR tells you what to do. AMLD6 tells your government how to supervise you. Your national anti-money laundering law does not disappear, but its role shrinks to the parts AMLD6 leaves to member states. Those include which authority supervises you and how penalties work.
When does the AMLR apply?
The AMLR applies from 10 July 2027 for almost everyone. Football agents and professional football clubs are the exception, and come into scope on 10 July 2029 [AMLR Art. 90]. AMLA begins choosing the firms it will directly supervise by 1 July 2027 and starts supervising them during 2028 [AMLA Reg. Art. 13; AMLA].
| Date | What happens | Who it affects |
|---|---|---|
| 19 June 2024 | AML package published in the Official Journal | Everyone (the clock starts) |
| 26 June 2024 | AMLA exists in law | AMLA |
| 1 July 2025 | Main body of the AMLA Regulation applies | AMLA, national supervisors |
| By 1 July 2027 | AMLA starts selecting firms for direct supervision (up to 6 months) | Large cross-border financial institutions |
| 10 July 2027 | AMLR applies; Directive 2015/849 repealed; main AMLD6 deadline | Every obliged entity |
| During 2028 | AMLA's direct supervision begins | The selected financial institutions only |
| 10 July 2029 | AMLR applies to football agents and professional football clubs | Football sector |
The dates for the AMLR, the repeal and AMLD6 are fixed in the legal text. Moving them would take new legislation. AMLA's operating milestones, such as when each guidance document appears, depend on its own work plan and are more likely to move.
Who does the AMLR apply to?
The AMLR applies to banks and financial firms, and to a long list of non-financial businesses whose work carries money laundering risk. Examples include accountants, tax advisers, lawyers, estate agents, dealers in high-value goods and art dealers [AMLR Art. 3]. Some sectors are new or more widely covered than before. There is no size exemption, but the rules scale with the size of the business.
Businesses in scope include:
- Financial firms: banks, payment and e-money institutions, investment firms, some insurers, and crypto-asset service providers [AMLR Arts. 2(1)(6), 3].
- Professionals: auditors, accountants, tax advisers, notaries, lawyers in certain transactions, and trust or company service providers.
- Property: estate agents, including letting agents for rents of €10,000 or more a month.
- Goods dealers: traders in precious metals and stones, and traders in high-value goods as a regular or main activity. High-value goods include jewellery and watches over €10,000, and cars over €250,000 [AMLR Annex IV].
- Others: gambling providers, crowdfunding platforms, art and cultural-goods dealers at €10,000 or more, investment-migration operators, and, from 2029, football agents and clubs.
A detailed checklist, with every threshold, is the subject of a separate guide in this series.
Size does not exempt a business, but it does shape what is expected. The AMLR says a firm's policies and controls must be "proportionate to the nature of the business, including its risks and complexity, and the size of the obliged entity" [AMLR Art. 9(1)]. A two-person jeweller is not expected to run a bank's compliance department. In a small firm, one person may cover both compliance roles alongside other work [AMLR Art. 11(7)].
What does the AMLR require a business to do?
An obliged entity must assess its own risk, name the people responsible for compliance, check its customers, monitor them over time, report suspicions, and keep records. Customer checks include screening customers and their beneficial owners against sanctions lists and for politically exposed persons [AMLR Art. 20(1)(d), (g)]. Every duty scales with the size and risk of the business.
| Duty | What it means in practice | Where |
|---|---|---|
| Business-wide risk assessment | A written assessment of your money laundering, terrorist financing and sanctions-evasion risks | Art. 10 |
| Compliance functions | A compliance manager on the management body and a compliance officer; one person in a small firm | Art. 11 |
| Customer due diligence | Identify and verify the customer and its beneficial owners; understand the purpose of the relationship | Art. 20 |
| Sanctions check | Verify whether the customer or its beneficial owners are subject to targeted financial sanctions | Art. 20(1)(d) |
| PEP check | Determine whether the customer or beneficial owner is a politically exposed person, a family member or a close associate | Art. 20(1)(g) |
| Ongoing monitoring | Keep watching the relationship; refresh customer data at least every year (higher risk) or every 5 years (others) | Art. 26 |
| Suspicious activity reporting | Report suspicions to the national financial intelligence unit | Art. 69 |
| Record keeping | Keep customer due diligence and transaction records for 5 years after the relationship ends | Art. 77 |
| Cash limit | Do not accept or make cash payments above €10,000 | Art. 80 |
Two of these terms need a definition. Targeted financial sanctions are asset freezes and dealing bans on named people and companies, such as those on the EU and UN sanctions lists. A politically exposed person (PEP) is someone entrusted with a prominent public function, such as a minister or a senior judge. Being a PEP is not a ban. It means extra checks. Our guide to PEP screening covers the categories and risk levels.
The sanctions check does not end at onboarding. Every obliged entity must "regularly verify" whether customers and beneficial owners have become subject to sanctions. How often depends on its sanctions-evasion risk. Banks and other financial institutions must also re-check "upon any new designation" [AMLR Art. 26(4)]. That makes list-change-driven monitoring a legal duty for them, not just good practice.
Will AMLA supervise my business?
Almost certainly not, if you are a small or medium-sized business. AMLA can only directly supervise credit and financial institutions that operate in at least six member states and whose risk is rated high [AMLA Reg. Art. 12(1), 13(1)]. A non-financial business, such as a dealer, agency or accounting firm, cannot be selected at all. It stays with its national supervisor.
The first selection starts by 1 July 2027 and must finish within six months. Direct supervision starts six months after AMLA publishes the list [AMLA Reg. Art. 13]. If more than 40 firms qualify, AMLA may cap the list, but the cap must be above 40. In any member state where no firm qualifies, AMLA also selects one extra firm.
For the non-financial sector, AMLA works through national supervisors rather than over them. It reviews how well they supervise, coordinates supervisory colleges, issues warnings and settles disputes between supervisors [AMLA Reg. Arts. 35–38]. For a small business, this matters in one way. National supervisors will face more outside scrutiny of how firmly they apply the rules.
What changes compared with the current rules?
Most AMLR duties already exist under the current directive. What changes is that they become one EU-wide text, with sharper detail in several places that small businesses will notice. The table below lists changes that come straight from the text. Each one is a difference in wording, not only in form.
| Area | Current directive (2015/849) | AMLR from 10 July 2027 |
|---|---|---|
| Legal form | 27 national laws built on one directive | One regulation, identical in every member state |
| Cash payments | National limits only, where a country set one | EU-wide limit of €10,000; lower national limits stay [Art. 80] |
| Beneficial ownership threshold | More than 25% | 25% or more, counted through every level of ownership [Art. 52(1)] |
| Sanctions checks in CDD | Not listed as a CDD measure | Written into CDD for every obliged entity [Art. 20(1)(d)] |
| Customer data refresh | Risk-based, no fixed maximum | At most 1 year (higher risk) or 5 years (others) [Art. 26(2)] |
| PEP family members | Spouse, children and their spouses, parents | Adds siblings, but only for heads of state, heads of government, and ministers, including deputy and assistant ministers [Art. 2(1)(35)] |
| Sectors | Existing list | Adds football agents and clubs (from 2029), investment-migration operators, and others |
The beneficial ownership change is small in wording and real in effect. Under the current directive, holding exactly 25% was not an indicator of ownership. Under the AMLR, it is. A company with four equal shareholders now has four beneficial owners to identify and screen.
What happens if a business ignores the AMLR?
National supervisors can impose fines, and the AMLD6 sets a high minimum for how large those fines must be able to go. For serious, repeated or systematic breaches, the maximum available fine must be at least twice the benefit gained or €1,000,000, whichever is higher [AMLD6 Art. 55(2)]. For credit and financial institutions, it must reach at least €10,000,000 or 10% of annual turnover [AMLD6 Art. 55(3)].
Those are the maximum amounts a supervisor must be able to impose. They are not typical fines. Each member state sets its own penalty rules within that frame, and supervisors must match a penalty to how serious the breach was. For a small firm, the likelier first consequence is a supervisory finding and an order to fix its controls. Unchecked sanctions exposure is a separate risk. Dealing with a sanctioned person breaks EU sanctions law whether or not the AMLR applies to you. Our guide to sanctions screening legal requirements covers that distinction.
What should an SME do before July 2027?
Confirm whether you are in scope, then build the basics in order: risk assessment, responsible people, customer checks. Just over nine months remain as of this writing. That is enough time for a small firm to put a proportionate programme in place, if it starts now rather than in June 2027.
- Check whether you are an obliged entity. Compare your activities against AMLR Article 3 and its thresholds. If you are unsure, ask your national supervisor or a qualified adviser.
- Write a business-wide risk assessment. Cover your customers, products, delivery channels and countries, plus sanctions-evasion risk [Art. 10].
- Name your compliance manager and compliance officer. In a small firm, this can be one person [Art. 11(7)].
- Set up customer due diligence. That means identity checks, beneficial ownership checks, and sanctions and PEP screening, applied to new and existing customers [Art. 20]. Our guide to how sanctions screening works explains the process.
- Plan ongoing monitoring. Decide how often you re-check customers and why, and write the reason down [Art. 26].
- Watch AMLA's standards. Much of the detail arrives through AMLA's technical standards and guidance. Check AMLA's site for which have been adopted.
Frequently asked questions
Is AMLA a new EU police force? No. AMLA is a supervisory and standard-setting authority. It does not investigate or prosecute crimes. It directly supervises a small number of financial institutions and coordinates national supervisors and financial intelligence units.
Does the AMLR replace national anti-money laundering law? Mostly, for the duties businesses follow. From 10 July 2027, the AMLR applies directly and the old directive is repealed. National law keeps a role in the areas AMLD6 leaves to member states, such as which authority supervises you and how penalties are set.
What happens to AMLD6? AMLD6 is part of the same package and applies alongside the AMLR. Member states must write it into national law, mostly by 10 July 2027. It governs supervisors, financial intelligence units and registers, not the day-to-day duties of businesses.
Is there a size threshold that exempts small businesses? No. The AMLR has no general size exemption. It does require controls to be proportionate to a firm's size and risk. It also lets one person hold both compliance roles in a small firm.
Does the AMLR apply to a business outside the EU? The AMLR applies to obliged entities operating in the EU. A business based outside the EU that serves EU customers should take advice on its own position. The answer depends on how and where it operates. EU sanctions law can apply to it separately.
Citations
- Regulation (EU) 2024/1624 (AMLR), Articles 2, 3, 9, 10, 11, 20, 26, 28, 52, 69, 77, 80, 90 and Annex IV, https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng
- Regulation (EU) 2024/1620 (AMLA Regulation), Articles 4, 12, 13, 35–38 and 108, https://eur-lex.europa.eu/eli/reg/2024/1620/oj/eng
- Directive (EU) 2024/1640 (AMLD6), Articles 1, 55, 77 and 78, https://eur-lex.europa.eu/eli/dir/2024/1640/oj/eng
- Directive (EU) 2015/849 (AMLD4, the current directive until 10 July 2027), https://eur-lex.europa.eu/eli/dir/2015/849/oj/eng
- AMLA, About AMLA (seat, start of operations, selection and direct supervision timing), https://www.amla.europa.eu/about-amla_en
- European Commission, Anti-money laundering and countering the financing of terrorism at EU level (package components and publication date), https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-eu-level_en
Getting the screening part right
Of everything the AMLR asks, sanctions and PEP screening is the duty most businesses cannot do by hand. The lists change often, and the law now expects you to re-check, not just check once.
DeRisk Hub screens customers against sanctions, export-control and PEP list sources, re-screens automatically when lists change, and records every decision in an audit trail you can show a supervisor. It is one part of a compliance programme, not the whole of one. See what screening costs, start your free trial (15 days, 100 entities, no credit card required), or go to DeRiskHub.com.
This article is informational and does not constitute legal advice. It describes the EU's anti-money laundering package as verified against the legal texts and AMLA's own published material on 27 September 2026. Implementation is ongoing, and national rules and AMLA standards will add detail. Confirm your specific obligations with your national supervisor or qualified counsel.