EU: Money laundering rules are changing: is your business ready for 10 July 2027?

Key takeaways

• A major overhaul of the EU's anti-money laundering (AML) rules applicable from 10 July 2027.
• Almost every stage of the compliance process is changing, from internal risk assessments and client due diligence to the identification of ultimate beneficial owners.
• A powerful new EU regulator, the Anti-Money Laundering Authority (AMLA), will directly supervise major institutions and establish standards.
• Penalties for non-compliance are significantly more severe.

What is changing and why

For the first time in years, the anti-money laundering and counter-terrorist financing rules are being rewritten from the ground up. While the existing framework functioned adequately in certain respects, it left each Member State considerable discretion in how they applied the rules. That fragmentation created gaps that money laundering, which rarely observes national borders, could readily exploit. The Commission's response is a single AML package that applies the same core rules across the European Union. It consists of three principal components:

• Regulation (EU) 2024/1624 (the AML Regulation, or AMLR): the heart of the package, setting out most of the substantive rules directly across every Member State;
• Regulation (EU) 2024/1620 (AMLAR), which establishes the new Anti-Money Laundering Authority (AMLA);
• Directive (EU) 2024/1640 (AMLD6), which covers framework matters such as national supervisory bodies and the sanctions for non-compliance.

These three instruments are supplemented by secondary measures adopted under them, namely regulatory technical standards (RTS) and implementing technical standards (ITS), together with guidelines issued by the AMLA, which constitute non-binding guidance rather than directly applicable legislation. 

The objective is clear: to replace a fragmented set of national regimes with a single, consistent rulebook.

What is actually changing

The underlying logic remains unchanged. Businesses subject to the rules must verify the identity of their clients before and throughout a relationship (a process known as "know your customer" or KYC), identify the natural persons who own or control them (their "beneficial owners"), and report any suspicious activity. What has changed is the level of detail, and it is at this level that compliance succeeds or fails.

Obliged entities

Banks and other financial institutions remain the primary focus. However, the scope of the regime has broadened. Crypto-asset service providers now qualify as financial institutions, placing them firmly among the principal addressees of the regime. The list of obliged entities has also been extended to include, among others, professional football clubs and football agents, traders in high-value goods such as precious metals and stones, luxury cars, aircraft and yachts, and operators involved in investment migration schemes. The clear message is that AML obligations are extending further into the wider economy.

Who really owns the business? Beneficial owners

The rules on beneficial ownership have been set out in considerably greater detail, and businesses will be expected to investigate ownership and control far more thoroughly than before. Under the current approach, where no beneficial owner can be identified, the managing director is typically treated as the beneficial owner. The new regime is markedly less accommodating of this practice: designating a senior managing official will become an exceptional measure of last resort, available only where the business can demonstrate and document why it was genuinely unable to identify the true beneficial owner. The package also strengthens the supporting infrastructure, including beneficial ownership registers, which have not always proved reliable in practice. 

A powerful new supervisory authority: the AMLA

Arguably the single most significant change is the creation of the AMLA, the new authority tasked with coordinating AML efforts across the European Union. Its role has two principal strands.

• First, it will set the standards. The AMLA will issue detailed rules on how businesses assess risk, both their own and that of their clients, and on how they conduct due diligence, among other matters.
• Second, the AMLA will directly supervise a limited number of selected credit and financial institutions. Under the AMLA regulation, an institution is selected only where its residual risk profile is classified as high and it operates in at least six Member States.

Other important changes

The package also creates two new compliance roles. At senior management level, a compliance manager will ensure that the business has adequate human and material resources to meet its legal obligations and will oversee compliance more broadly. Below this sits a compliance officer, responsible for day-to-day AML operations and absorbing the current designated person's functions. Similar to a data protection officer, this role carries reporting duties and must document its activities accordingly.

Internal policies and procedures

As before, key policies and procedures, covering risk assessment, customer due diligence, reporting, compliance officers and related matters must be recorded in writing. The difference is that they will now need to be updated to reflect both the new regulation and the AMLA's standards. This represents an opportune moment to assess whether your existing procedures remain fit for purpose.

The consequences of non-compliance

AMLD6 established a framework of sanctions for breaching the rules, which each national legislature will flesh out by specifying the applicable penalties. Once again, the direction of travel is unmistakable: the penalties are more severe than under the previous directive. For serious, repeated or systematic breaches, Member States must provide for maximum pecuniary sanctions that include, among others:

• a maximum fine of at least twice the benefit derived from the breach, or at least EUR 1m;
• for credit and financial institutions, a maximum fine of at least 10 % of total annual turnover, or at least EUR 10m;
• withdrawal or suspension of the authorisation needed to operate.

Recommended next steps

Although 10 July 2027 may seem distant, the changes are substantial and preparation takes time. Businesses will need to get to grips with the new requirements and ready themselves for direct supervision. Whatever your field, be it real estate, M&A, commercial contracts or procurement, the new AML regime will change how you verify counterparties.

Authors: László Krüpl, Viktória Magyar and Bence Hanzik