What Is the AMLR? The EU Anti-Money Laundering Regulation Explained

The AMLR is the biggest change to European anti-money-laundering rules in a decade. For the first time, the core obligations that banks, insurers, crypto firms and many other businesses have to meet will be written into a single EU regulation that applies the same way in every member state, rather than into 27 different national laws. That regulation applies from 10 July 2027, and the work to be ready for it is already underway across the EU.

This guide explains what the AMLR is, how it fits into the wider EU AML Package alongside AMLD6 and the new authority AMLA, what it changes compared with the old regime, who has to comply, and the practical steps obliged entities are taking now. It is the starting point for our more detailed guides on AMLR for life insurers and the AMLR compliance checklist.

What Is the AMLR?

The AMLR, or Anti-Money Laundering Regulation, is Regulation (EU) 2024/1624, adopted on 31 May 2024 and published in the Official Journal in June 2024. It is the substantive heart of the EU's new AML framework: a directly applicable set of rules covering customer due diligence, beneficial ownership, reporting of suspicious activity and limits on cash, binding on obliged entities across the EU.

The word that matters most is regulation. Until now, EU anti-money-laundering rules came mainly through directives, most recently the Fourth and Fifth Anti-Money Laundering Directives, which each member state had to transpose into its own national law.

That left meaningful differences from one country to the next, for example in how long records had to be kept. A regulation is different: it applies directly and uniformly in all 27 member states without national transposition. This is why the AMLR is often called the EU's single AML rulebook, and why it is described as maximum harmonisation.

A firm operating in Germany, France and Spain will, for the first time, face one common set of core obligations rather than three. For background on the underlying crime the rules target, see our explainer on money laundering.

The EU AML Package: AMLR, AMLD6 and AMLA

The AMLR does not stand alone. It is one part of the 2024 EU AML Package, a set of linked instruments adopted together. Understanding the package matters because the four parts are easy to confuse, and they do different jobs. The AMLR says what you must do, AMLD6 covers the parts left to national law, AMLA is the new supervisor, and technical standards fill in the detail.

A fifth piece is worth noting for completeness: the recast Transfer of Funds Regulation (EU) 2023/1113, which extends the so-called travel rule to crypto-asset transfers and aligns with MiCA.

Together these instruments replace the patchwork that grew up under the earlier directives. If you want the broader context of how rules like this are implemented through technology, our overview of RegTech is a useful companion.

Key Dates: The AMLR Timeline

The AMLR entered into force on 9 July 2024, but entry into force is not the same as application. The date that matters for compliance teams is 10 July 2027, when the regulation starts to apply and obliged entities must meet its requirements in full. A handful of provisions sit on different dates, shown below.

The AMLR timeline, from entry into force to AMLA direct supervision and the phased 2029 dates.

The headline dates in plain terms:

• 9 July 2024: AMLR enters into force (the 20th day after publication).

• 10 July 2026: deadline for AMLA to issue its first technical standards and guidelines, including on customer due diligence information and ongoing monitoring.

• Second half of 2027: AMLA runs its first selection of the firms it will supervise directly.

• 10 July 2027: the AMLR applies; the AMLD6 transposition deadline falls; the old 2015 directive is repealed.

• 1 January 2028: AMLA begins direct supervision of the first cohort of around 40 high-risk cross-border entities.

• 10 July 2029: football clubs and agents come into scope, and the Commission reviews whether to lower the 25% beneficial-ownership threshold.

What Changes Under the AMLR?

For firms that already run a mature AML programme, the AMLR is less a revolution in principle than a tightening and a levelling. The biggest shifts are these:

• One rulebook, no national variation. Core obligations are identical EU-wide. Group-wide policies no longer have to bend to local quirks, but neither can a firm rely on a lighter national regime.

• Lower thresholds and wider nets. The occasional-transaction due-diligence trigger drops from EUR 15,000 to EUR 10,000, and a new EU-wide cash limit of EUR 10,000 applies to traders in goods and services.

• More obliged entities. Crypto-asset service providers, high-value-goods traders, investment-migration operators and, from 2029, professional football are brought in.

• A tougher, expanded PEP regime, now reaching regional and local officials and treating siblings as family members for the most senior functions.

• An EU supervisor with teeth. AMLA can directly supervise and sanction the highest-risk firms, not just coordinate national regulators.

Who Must Comply? Obliged Entities Under the AMLR

The AMLR applies to obliged entities, the businesses required to run AML controls. Article 3 lists them, and the list is wider than under the old regime. The table groups the main categories and flags what is new or newly explicit:

What the AMLR Requires

The obligations themselves will be familiar to anyone who has run an AML programme, but the AMLR writes them into directly binding law and tightens the detail. The core duties are customer due diligence, enhanced due diligence for higher risk, beneficial-ownership transparency, ongoing monitoring, record-keeping, and reporting suspicions to the Financial Intelligence Unit. It also bans anonymous accounts and relationships with shell banks.

Customer due diligence thresholds at a glance

Due diligence is triggered at different values depending on the activity. Because these thresholds are scattered through the regulation, here they are in one place:

In practice, meeting these duties at onboarding means verifying who the customer is, confirming beneficial owners, screening against sanctions and politically-exposed-person lists, and rating the customer's risk. Our guide to customer risk assessment covers the rating step in detail, and enhanced due diligence applies wherever risk is higher, such as for PEPs or high-risk third countries.

Beneficial Ownership: The 25% Rule

Identifying the real people behind a customer is central to the AMLR. A beneficial owner is, as a baseline, any individual who holds 25% or more of a company's shares, voting rights or other ownership interest, directly or indirectly, or who otherwise exercises control. Indirect holdings are calculated by multiplying the stakes down each ownership chain and adding the results across chains, so ownership split cleverly across layers still counts.

Two points are new. The threshold can be lowered centrally rather than country by country: after a review due by 10 July 2029, the Commission may cut it for higher-risk categories, down to a floor of 15%. And beneficial-ownership registers, governed under AMLD6, must be consulted by obliged entities rather than taken on trust.

For how firms misuse corporate layers to hide ownership, see our explainer on shell companies, and for the mechanics of identifying owners, our guide to the ultimate beneficial owner (UBO).

AMLA: The EU's New AML Supervisor

The Anti-Money Laundering Authority, AMLA, is the institutional centrepiece of the package. Based in Frankfurt and established in 2024, it introduces a two-tier model of supervision.

From 1 January 2028, AMLA will directly supervise a small cohort of the highest-risk entities, expected to be around 40 groups active in at least six member states, selected on their risk profile and reviewed periodically. Every other obliged entity remains under its national supervisor, with AMLA coordinating and setting common standards.

Beyond direct supervision, AMLA drafts the technical standards that put detail on the AMLR, supports and coordinates national Financial Intelligence Units, and is building a single EU-wide format for suspicious-transaction reporting. For most firms the practical effect is indirect but real: the standards AMLA writes, and the consistency it enforces, set the bar that national supervisors will hold everyone to.

How to Prepare for the AMLR

Although 10 July 2027 can feel distant, the firms that will cope best are treating the intervening period as a programme rather than a last-minute project. A practical path looks like this:

1. Run a gap analysis. Map your current controls against the AMLR and identify where national shortcuts no longer hold.

2. Fix governance. Confirm a compliance manager at management level and a compliance officer, with the business-wide risk assessment approved by the management body.

3. Refresh policies and the risk assessment. Rewrite AML policies, controls and procedures to the single rulebook, and update your business-wide risk assessment.

4. Strengthen onboarding and due diligence. Align identity verification, beneficial-ownership checks, sanctions and PEP screening, and customer risk rating to the new thresholds.

5. Make monitoring ongoing. Move from periodic reviews toward continuous monitoring so records stay current and event-driven reviews are triggered automatically.

6. Evidence everything. Keep an audit-ready record of decisions, because the AMLR expects you to demonstrate that your measures are appropriate, not just assert it.

7. Review outsourcing and train staff. Check that outsourced functions meet the new rules (the customer risk decision stays in-house) and train teams on the changes.

How Qoobiss Helps

Much of what the AMLR demands lands at the identity and monitoring layer, which is where Qoobiss works. We help obliged entities turn the requirements above into connected, audit-ready workflows:

• Onboarding and verification. Origin builds no-code onboarding flows with built-in KYC and AML checks, while Ontrace handles remote document and biometric verification with liveness detection, supporting the identity standards the AMLR expects.

• Screening and due diligence. Omnicheck runs sanctions, PEP and adverse-media screening and helps evidence the beneficial-ownership and risk-rating steps.

• Ongoing monitoring and reporting. Qoobiss supports continuous transaction monitoring and fraud prevention so that reviews are event-driven and records stay current, with an audit trail behind each decision.

For sector-specific detail, our companion guide on AMLR for life insurers works through how these duties apply across a long policy lifecycle, and the AMLR compliance checklist turns the preparation steps into a working list.

Prepare for the AMLR with Qoobiss

The AMLR rewards firms that start early and treat identity, screening and monitoring as one connected system rather than separate checks. Qoobiss helps obliged entities verify customers, screen them, and keep that assurance current, with the audit trail the regulation expects. See how Qoobiss supports AML compliance and onboarding, or get in touch to talk through your AMLR readiness.

AMLR - FQAs