A practical review of AML controls, from EU 6AMLD and AMLA supervision to FATF travel rule enforcement.
The AML Landscape Has Fundamentally Shifted
Anti-money laundering compliance today bears little resemblance to the checkbox exercises of a decade ago. Regulators increasingly expect firms to demonstrate that their controls are effective, risk-based, and supported by evidence. Enforcement totals and individual-liability rules differ by jurisdiction, so avoid relying on headline penalty figures without checking the underlying regulator notice. For businesses operating across borders, the EU's Sixth Anti-Money Laundering Directive (6AMLD), the United States Corporate Transparency Act (CTA), and FATF standards create a regulatory environment that rewards proactive, technology-enabled compliance programs and punishes unsupported assumptions.
Risk appetite has to reach the queue
An AML policy is easy to quote and hard to operate. The test is what a reviewer can prove on a busy Tuesday.
Effectiveness is a review question
A credible AML program is a living set of decisions. It changes when the customer, ownership, geography, product, or evidence changes, and it leaves enough context for another reviewer to understand why the firm acted.
EU 6AMLD and the New European AML Authority
- Harmonized predicate offenses: 6AMLD requires EU Member States to align the definition and penalties for money-laundering offences, including a common set of serious predicate offences. The directive still requires national transposition, so the operative wording and penalties must be checked in each Member State.
- Corporate liability: 6AMLD requires Member States to provide for liability of legal persons where offences are committed for their benefit by people in a leading position. The available sanctions, including fines and possible wind-up measures, depend on national implementation.
- The EU Anti-Money Laundering Authority (AMLA): AMLA is headquartered in Frankfurt. It spent 2025–26 building its supervisory framework; direct supervision of a selected group of high-risk institutions is expected to start in 2028. National supervisors remain responsible for other obliged entities.
- Beneficial Ownership Registers: Following the European Court of Justice ruling, access to beneficial ownership registers has been recalibrated. Obliged entities retain full access, while public access is now subject to legitimate interest tests, requiring businesses to maintain their own evidence-backed UBO verification processes.
- Cash transaction limits: Regulation (EU) 2024/1624 introduces a EUR 10,000 union-wide cap on cash payments, with lower national limits permitted, but that cap applies from 10 July 2027. Until then, follow the limits and monitoring rules in each country where you operate.
The US Corporate Transparency Act and FinCEN Reporting
- Beneficial ownership information (BOI) reporting: FinCEN's March 2025 interim final rule exempts entities created in the United States and U.S. persons from CTA reporting. A foreign entity that registers to do business in a U.S. state or tribal jurisdiction can still be a reporting company unless an exemption applies.
- Scope and exemptions: Determine whether the entity is a foreign reporting company under the current FinCEN definition and document any applicable exemption. Do not reuse the pre-March 2025 assumption that most domestic LLCs and corporations must file.
- Initial and updated reports: A foreign reporting company registered before 26 March 2025 had an April 25, 2025 initial deadline; one registered on or after that date generally has 30 calendar days after receiving notice that registration is effective. Check FinCEN's current instructions before filing or updating a report.
- Enforcement: Civil and criminal consequences can apply to willful violations, but the amounts and applicability depend on the current statute, regulations, and enforcement guidance. Keep an evidence trail and link each conclusion to the latest FinCEN notice rather than quoting a stale penalty figure.
FATF Travel Rule and Cross-Border Transaction Monitoring
The FATF travel rule requires covered financial institutions and virtual asset service providers (VASPs) to collect and transmit originator and beneficiary information when the relevant FATF standard and local law apply. FATF updated Recommendation 16 in June 2025, including a USD/EUR 1,000 information standard for peer-to-peer cross-border payments; implementation timing, local rules, and privacy safeguards still vary. The revised standard is due to take effect by the end of 2030, so map the requirement to the law and transition plan for each market.
Building an Effective Risk-Based Approach
- Enterprise-Wide Risk Assessment:
- Customer Risk Scoring:
- Enhanced Due Diligence (EDD):
- Ongoing Monitoring and Periodic Reviews:
- Suspicious Activity Reporting:
Technology Solutions for Modern AML Compliance
- Model-Assisted Transaction Monitoring: Machine learning models trained on institution-specific data can reduce false positives compared to rules-based systems while improving detection of genuinely suspicious activity. Explainable outputs ensure that alerts can be investigated and documented effectively.
- Perpetual KYC Platforms: Move beyond periodic review cycles with event-driven KYC refresh.
- Sanctions and PEP Screening Controls: Real-time screening against consolidated global sanctions lists, PEP databases, and adverse media sources, with fuzzy matching algorithms that catch transliteration variants and name permutations while minimizing false positives.
- Regulatory Reporting Controls: SARs/STRs, CTRs, and beneficial ownership reports need consistent data, filing evidence, reviewer approval, and regulator portal status tracking.
- Network Analysis and Graph Analytics: Identify hidden connections between entities, accounts, and transactions using graph-based analysis. This approach is particularly effective at detecting layering schemes, shell company networks, and trade-based money laundering patterns.
- Secure Data Sharing: Privacy-preserving technologies such as federated learning and secure multi-party computation enable institutions to share typology intelligence without exposing customer data, improving collective detection capabilities.
Practical Steps for Compliance Leaders
The path forward for AML compliance is clear: invest in technology, empower your compliance teams, and embed a culture of vigilance throughout your organization. Start by conducting a gap analysis against current regulatory requirements in every jurisdiction where you operate. Prioritize remediation based on enforcement risk and regulatory examination schedules. Evaluate your technology stack; legacy systems that rely solely on rules-based monitoring are no longer sufficient. Engage your board and senior management with regular AML risk reporting that explains open issues, reviewer decisions, and overdue remediation. Strong AML programs help institutions onboard customers faster, maintain better correspondent banking relationships, and avoid the reputational and financial consequences of enforcement actions.