AML regulation (AMLR) in the EU, explained for practitioners

The AML regulation (AMLR) is Regulation (EU) 2024/1624. Article 90 says it applies from 10 July 2027. Because it is a Regulation and not a Directive, a Maltese company, a German one and an Irish one read the same text. Local supervisors still enforce it, and Directive (EU) 2024/1640 deals with the national machinery around it.

Who is covered

Article 3 lists the obliged entities. Credit institutions and financial institutions come first. The definition of financial institution in Article 2(1)(6) names crypto-asset service providers, investment firms, funds and managers, life insurers and others. A third group covers businesses acting in a professional capacity: auditors, external accountants and tax advisors; notaries, lawyers and other independent legal professionals in listed transactions; trust or company service providers; estate agents; traders in precious metals and stones and in high-value goods; gambling providers; crowdfunding platforms; and several more. Football agents and clubs are on the list too, with a later start date of 10 July 2029.

Each sector has its own page: crypto, payments and e-money, gambling, real estate and legal, accounting and TCSPs.

The numbers worth remembering

• Article 19(1): customer due diligence for occasional transactions of EUR 10,000 or more, and always where there is suspicion.
• Article 19(3): crypto-asset service providers start at EUR 1,000.
• Article 19(5): gambling providers at EUR 2,000.
• Article 19(4): at least basic identification for occasional cash transactions of EUR 3,000 or more.
• Article 80: cash payments for goods or services capped at EUR 10,000, with Member States free to set a lower limit.

Technical standards under Article 19(9) may set lower values for higher-risk sectors. AMLA, the new EU authority created by Regulation (EU) 2024/1620, has been drafting those standards. Draft status changes, so check the AMLA website before you build anything on a draft figure.

A practitioner view

The date that matters in your plan is not 10 July 2027. It is the day your customer files have to match the new identification and monitoring standards, and for a book of ten thousand customers that day is much earlier. Start with a sample of files, not with the policy rewrite.

What this means for you

Work out first which Article 3 category you sit in, because that decides the thresholds and the special rules. Then compare your current procedures against them. If you want a second pair of eyes, send us a short description through the enquiry form or schedule a no-obligation call.

General information, not legal advice. For the European Commission’s overview of the package, see its AML/CFT page.

Talk to an expert