The EU AML rulebook applies from July 2027 and AMLA supervision follows. How obliged entities can prepare CDD, beneficial-ownership and governance controls now.
From a directive patchwork to a single rulebook
For decades, EU anti-money-laundering obligations reached obliged entities through directives. Each member state transposed the text into national law, and each transposition added its own choices: different customer due diligence triggers, different beneficial-ownership practices, different record-keeping habits. Groups operating across the Union learned to maintain several variants of the same control. Regulation (EU) 2024/1640 — the AML Regulation, or single rulebook — changes the legal form. Because it is a regulation, it applies directly in every member state from 10 July 2027, without national transposition. Alongside it, Directive (EU) 2024/1654 (the sixth AML Directive) still requires transposition by 2027 for the matters that remain national.
What “directly applicable” removes
Direct applicability removes transposition drift. The same CDD triggers, the same approach to identifying beneficial owners, and the same record expectations will apply in every member state on the same date. Group policies no longer need dozens of national variants of one control; they need one policy mapped to the regulation, with local add-ons only where national law genuinely differs.
What stays national
Not everything moves into the rulebook. The sixth AML Directive covers matters such as national supervisory organization, Financial Intelligence Unit cooperation, and criminal-law provisions, and member states must transpose it by 2027. Teams should not assume one legal text now covers everything: the operating model must track the regulation for core obligations and national law for what remains transposed.
Customer due diligence and beneficial ownership converge
The single rulebook harmonizes when and how obliged entities identify customers and their beneficial owners, what evidence supports the conclusion, and how long records are kept. It also harmonizes the content of national beneficial-ownership registers and the rules on access to them, so internal files and register data will be easier to compare — and discrepancies easier to spot. The familiar ownership-threshold approach is retained: a shareholding of 25 per cent plus one share remains an indication of ownership, with control assessed through other means where that threshold does not settle the question. The regulation also introduces a Union-wide limit of EUR 10,000 for large cash payments, relevant wherever a business model still touches physical cash.
- Map every CDD trigger in current procedures — onboarding, occasional transactions, doubts about previously collected data, suspicion of money laundering — against the harmonized triggers in the regulation, and note where national practice was stricter or looser.
- Reconcile beneficial-ownership records with register data now: once register content and access rules are harmonized, inconsistencies between internal files and official registers will surface faster.
- Standardize identification evidence across the group so the same document set supports the same conclusion in every member state where the entity operates.
- Document reliance and outsourcing arrangements precisely, because harmonized obligations make it clearer where responsibility sits when a third party performs part of customer due diligence.
- Assess whether the Union-wide cash-payment limit affects any product, branch, or client segment, and update acceptance policies accordingly.
AMLA changes what supervision feels like
Regulation (EU) 2024/1620 establishes the new Anti-Money Laundering Authority, seated in Frankfurt. AMLA’s most visible power is direct supervision: from 2028 it will supervise a first cohort of around 40 selected obliged entities — groups with significant cross-border activity in higher-risk categories, chosen jointly with national supervisors. For everyone else, AMLA coordinates national authorities, develops draft technical standards, and works to make supervision converge. Even a group that is never selected will feel the change, because national supervisors will increasingly apply the same playbook AMLA writes.
Who could be selected
Selection looks at cross-border footprint and inherent risk. A group present in several member states in a higher-risk category should treat selection as a realistic scenario, not a remote one: identify which legal entities would fall inside the supervised perimeter, who would act as the supervisory contact, and whether group reporting lines could support a European supervisor’s calendar.
What direct supervision changes day to day
Direct supervision means a European authority reading the same CDD files, beneficial-ownership analyses, and governance minutes that national supervisors once read — and comparing them across borders. Evidence quality becomes the defense: files that show who identified the customer, on what sources, with which conclusion, and what follow-up was triggered will travel well; files reconstructed from inboxes will not.
A 2026-2027 preparation sequence
The window between publication and application is the remediation window. As of mid-2026, obliged entities still have time to work through a deliberate sequence rather than a reactive scramble. A practical order of operations looks like this.
- Gap assessment
- Data remediation
- Governance reset
- Screening and travel-rule alignment
- Dry run
Sanctions screening and the travel rule sit beside the rulebook, not inside it
The single rulebook does not absorb the Union’s restrictive-measures obligations, and it does not replace the recast transfer-of-funds framework — Regulation (EU) 2023/1113 — which requires payer and payee information to travel with transfers of funds and crypto-assets. These are parallel obligations that share one customer. A sanctions hit, an incomplete transfer data set, and a CDD conclusion all describe the same relationship, and under harmonized supervision they will increasingly be read together. The operational goal is one file: identity established under the AMLR, screening outcome recorded under sanctions rules, and transfer data complete under the travel rule, all visible in a single audit trail.
One file, three obligations
When a reviewer can move from the CDD conclusion to the screening disposition to the transfer data without leaving the case record, each obligation reinforces the others. When the three live in disconnected tools, the gaps between them become the finding.