AMLR from July 2027: a shift in the AML Compliance landscape

With the Anti-Money Laundering Regulation (AMLR) becoming applicable in July 2027, the rules for AML Compliance will change fundamentally. Obliged (financial) entities such as banks, investment firms, crypto-asset and payment service providers as well as investment fund managers should tackle the new challenges head-on as a strategy project and not purely a compliance challenge. And time is running out.

New EU Wide Rules for AML Compliance

The AMLR tightens the regulatory framework for the prevention of money laundering, terrorist financing and the avoidance of financial sanctions.

It is noteworthy that the AMLR as regulation leaves little to no room for national provisions. It will also replace most provisions of the German Money Laundering Act (GwG).

This EU-wide level playing field simplifies compliance for cross-border business models. So far, German institutions regularly faced challenges with for example very strict national video-identification requirements, including in-person video calls. This was due to the German Federal Financial Supervisory Authority’s (BaFin) specific requirements, based on the national AML regime. Going forward, the discussion about rules, official guidance and interpretation will happen at EU level and no longer within the fragmented landscape of different national regulators.

What AMLA is currently preparing

The new EU Anti-Money Laundering Authority (AMLA) is currently preparing several regulatory technical standards (RTS) and guidelines as Level 2 and Level 3 acts to specify AMLR provisions. This includes, among other aspects, specific rules for:

• the business-wide risk assessment as basis of obliged entities’ overall AMLR-compliance framework (see AMLA’s Consultation on the draft Guidelines on business-wide risk assessment)

• customer due diligence obligations (see AMLA’s Final Report of the RTS on Customer Due Diligence)

• ongoing business relationship monitoring (see AMLA’s Consultation on the draft Guidelines on ongoing monitoring of a business relationship)

This, in addition to other Level 2 and Level 3 acts and more than 50 AMLR articles relevant for obliged entities define a tight-knit regulatory framework. While the establishment of EU-wide rules helps avoid regulatory frictions between different EU jurisdictions, the many new provisions also lead to a significantly increased administrative burden for obliged entities.

New Rules for Business-Wide Risk Assessment

While the overall structure of the business-wide risk assessment remains similar to what German financial entities are used to, based on GwG, Bafin guidelines and best practices, the complexity will increase under AMLR.

When people speak of increasingly “data-driven” processes and the future relevancy of data quality and quantity under AMLR, what they are usually referring to is AMLA’s expectation for the evaluation, collection and gathering of external sources and internal data points as part of the business-wide risk assessment – combined with high expectations regarding the ongoing monitoring of business relationships.

The business-wide risk assessment is the foundation of AML compliance, determining the overall risk situation of the entity and helping define appropriate safeguards.

In their draft guidelines, AMLA clarifies that many different sources and a minimum of specific datapoints must be considered for this purpose.

Required data points include:

• externally: several analyses and publications by regulatory authorities and bodies

• internally: the number of customers further clustered into natural persons, companies, politically exposed persons, beneficial owners qualifying as politically exposed persons, complex shareholding structures, and number of transactions with existing and new customers

• sector-specific points, for example the total value of client (crypto) assets during the previous year; or the ratio of retail to professional clients

• business, risk and regulatory developments, dynamically incorporating their operative insights as “lessons learned”

• the risk of circumvention of financial EU sanctions, newly introduced as part of the risk assessment

The newly introduced risk of circumvention of financial EU sanctions adds another dimension, expanding the scope and, hence, increasing the complexity of the assessment.

Overall, the business-wide risk assessment becomes significantly more complex. In their consultation, AMLA also mentions the preferred use of “commercially available tools” to ensure the assessment considers all relevant criteria.

New Rules for Customer Due Diligence and KYC

Regarding Know Your Customer (KYC) processes, AMLR introduces several new requirements on which data obliged entities must collect and verify.

More importantly, the rules for remote customer identification have been amended.

Remote identification under eIDAS 2.0

AMLR now specifically requires that customers are identified with remote processes that are compliant with the requirements of the updated eIDAS Regulation, also referred to as eIDAS 2.0. This includes:

• electronic identification means with assurance level “substantial” or “high” under eIDAS 2.0, or

• qualified trust services in accordance with eIDAS 2.0.

Both require official recognition or certification in accordance with eIDAS 2.0 and national implementing law. In a nutshell, the German eID, the EUDI Wallet and specific qualified electronic signature (QES) processes are feasible identification processes. The traditional German video-identification process is no longer sufficient.

EUDI Wallet and European Business Wallet

The EUDI Wallet deserves specific attention. It has the potential to become more than an onboarding tool, for example in payment processes or even as the foundation for agentic payment authorization in the future. Just recently, the European Payments Council has launched the “SCARLET” initiative to standardize EUDI Wallets as instrument for secure payment authentication. In any case, hopes are high, but it might take some time for EUDI Wallet solutions to be widely accepted throughout the EU. We already discussed central challenges and chances regarding the EUDI Wallet in a webinar on September 2, 2026.

In addition to the EUDI Wallet, the development of a “European Business Wallet” as an EUDI equivalent for legal entities is also being discussed.

New Rules for Ongoing Monitoring

While the requirement to monitor the ongoing business relationship with a customer is not new, AMLR and the AMLA Guidelines clarify that regulatory expectations are increasing. AMLA explicitly expects obliged entities to thoroughly assess whether the “use of automated or advanced analytical tools, including algorithms, machine learning, artificial intelligence” can improve their monitoring framework.

Also, similar to the business-wide risk assessment, AMLA expects obliged entities to consider a broad range of available external sources and internal indicators to implement a thorough monitoring system and gain a “holistic understanding” of customer behavior. When using third-party tools, they are required to customize these to their individual needs.

New Rules for  determining beneficial owners

As part of KYC or KYB (Know Your Business) processes, beneficial owners must be identified. For entities as customers, this requires identification of natural persons that directly or indirectly hold or control shares at a relevant threshold of at least 25% (which can be lowered in individual cases) or exercise a similar form of control. Hence, the standard threshold has been lowered to exactly 25%, while under GwG, it currently is “more than 25%”.

What changes under AMLR:

• the standard beneficial ownership threshold is exactly 25% (or, in certain cases, can be lower), instead of „more than 25%“ under GwG

• a new „look-through“ approach applies, whereby shares (or voting rights) are multiplied along the chain of ownership

• new forms of ownership are included, for example profit participation rights

•  existing customers must be re-analyzed and updated, most likely within 1 to 5 years depending on the individual risk category of the customer

The rules for determining beneficial owners under AMLR have been re-structured fundamentally and, essentially, expanded and will include far more persons than under the current AML regime.

The new rules are complex, and AMLR dedicates a large section solely to the determination of beneficial ownership. Obliged entities and their AML personnel require a thorough understanding of the new beneficial ownership logic and available (software) tools to help them manage the new challenges.

It should be noted that obliged entities are required to re-analyze and update even existing customers, most-likely within 1-5 years depending on the individual risk category of the customer.

New Opportunities and Tools for AML compliance

While the requirements for obliged entities are increasing under AMLR, there are also several new tools and automated solutions available in the market to help tackle the challenges. Or at least that’s the common promise of the service providers.

A significant part of the preparation will be the selection and integration of appropriate (automated) solutions. This may include own (in-house) developments but also the selection and onboarding of service providers, which then in turn triggers service provider due diligence and management requirements, including the ICT service provider regime under the Digital Operational Resilience Act. For the use of artificial intelligence components, additional requirements must be observed including compliance with the AI Act, as well as dedicated rules like the German Minimum Requirements for Risk Management (MaRisk).

AMLR in context: eIDAS 2.0, AI Act and DORA

Overall, the AMLR must be considered in the broader context of regulatory initiatives at EU level, with interdependencies regarding particularly eIDAS 2.0, the AI Act, and DORA. This, in addition to the Level 2 and Level 3 measures by new supervisory bodies like AMLA lead to a fundamental shift of the compliance landscape.

Hence, obliged entities require a good understanding of the new regulatory regimes, the challenges ahead but also the broader strategic opportunities in the context of compliance as well as “digital identity” as a whole.

Key terms at a glance

• AMLR (Anti-Money Laundering Regulation): EU regulation that becomes applicable in July 2027 and replaces most provisions of the German Money Laundering Act (GwG).

• AMLA (EU Anti-Money Laundering Authority): new EU authority preparing regulatory technical standards (RTS) and guidelines as Level 2 and Level 3 acts to specify AMLR provisions.

• Obliged entities: entities subject to AML obligations, including banks, investment firms, crypto asset and payment service providers and investment fund managers.

• Business-wide risk assessment: the foundation of AML compliance, determining the overall risk situation of an entity and helping define appropriate safeguards.

• Beneficial owner: natural person who directly or indirectly holds or controls shares at a threshold of at least 25% or exercises a similar form of control.

• eIDAS 2.0: updated EU eIDAS Regulation setting the requirements that AMLR compliant remote customer identification must meet.

• EUDI Wallet: EU digital identity wallet and a feasible identification process under AMLR.

• GwG (Geldwäschegesetz): German Money Laundering Act, largely replaced by AMLR.

• BaFin: German Federal Financial Supervisory Authority.

• DORA (Digital Operational Resilience Act): EU regulation containing the ICT service provider regime relevant when onboarding service providers.