Need further assistance? Visit Support Centre
The EU Anti-Money Laundering Regulation (AMLR) replaces 27 sets of national rules with a single rulebook from 10 July 2027. Alongside it, the new Anti-Money Laundering Authority (AMLA) will begin directly supervising up to 40 high-risk financial institutions in 2028.
For banks, that means harmonized customer due diligence (CDD), stricter beneficial ownership rules and higher expectations for data quality and audit trails. Firms that start now will face far less disruption when the new rules apply.
Last updated October 2026.
We brought together BNP Paribas, EY and KYC Consulting to discuss what AMLR means for customer due diligence, supervision and cross-border compliance. Each panelist shared what a realistic path to readiness looks like from their vantage point.
Speakers
Key takeaways
Recorded: September 2026
To help compliance and operations leaders cut through the detail, we have brought together the essential facts on AMLR and AMLA in one summary. It covers timelines, scope, beneficial ownership changes and what direct supervision means for banks.
What AMLA does, how direct and indirect supervision will work, and what compliance teams should expect as the authority builds its powers.
This infographic maps the pressure points in today's KYC workflows, the specific obligations AMLA introduces, and how Encompass turns regulatory complexity into a repeatable, auditable process at scale.
Document-heavy onboarding slows teams down and introduces compliance risk. eIDAS 2.0 and EC Public Automation create an opportunity to move to verified digital data instead.
AMLR raises the bar for existing client files through harmonized CDD standards and stricter beneficial ownership rules. EC Review is built to remediate legacy KYC at scale, so banks can bring their whole back book in line before the rules apply.
AMLR’s CDD requirements depend on structured, verifiable data from company registries and beneficial ownership sources. EC Public Automation retrieves that data automatically and records the source of every data point, giving supervisors the audit trail they expect.
AMLR is the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624. It creates a single, directly applicable rulebook for anti-money laundering and counter-terrorist financing across all 27 member states from 10 July 2027. It replaces national rules with harmonized requirements for customer due diligence, beneficial ownership and record keeping.
AMLR applies from 10 July 2027. AMLA will select up to 40 high-risk financial institutions for direct supervision during 2027, and direct supervision begins in 2028. Some rules for certain non-financial sectors apply later, from 2029.
AMLR is the law: the single EU rulebook that banks and other obliged entities must follow. AMLA, the Anti-Money Laundering Authority, is the EU body that enforces it. AMLA sets technical standards, coordinates national supervisors and directly supervises a small number of high-risk institutions.
From 2028, AMLA will directly supervise up to 40 credit and financial institutions assessed as high risk and operating across several EU member states. All other firms remain supervised by national authorities, which will themselves apply AMLA’s standards and methodology.
AMLR sets the beneficial ownership threshold at ownership or control of 25% or more, applied consistently across the EU. Banks must also identify individuals who exercise control through other means, and the European Commission can set lower thresholds for higher-risk sectors. This places more weight on accurate, up-to-date ownership data.
Banks should start with a gap analysis of current KYC policies against AMLR and AMLA’s draft technical standards. Next, assess existing client files against the new beneficial ownership and CDD rules, then improve data quality and audit trails. Automating data collection from authoritative sources makes remediation faster and easier to evidence.
AMLR applies to firms established in the EU, including EU branches and subsidiaries of non-EU banking groups. EU-headquartered groups must also apply group-wide AML policies to operations outside the EU. Non-EU banks with no EU presence are not directly in scope but will feel its effects through correspondent banking relationships.