What's done, what's due: The AML Countdown

On 10 July 2027 – one year from now – the Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 (AMLR) and the Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 (AMLAR) will become directly applicable across all EU Member States, and the Sixth Anti-Money Laundering Directive¹ (AMLD6) must be transposed into national law².

Here is an overview of the steps that regulators and stakeholders have already completed, what still lies ahead and what is currently being discussed in the run-up to the new regulatory framework:

1. RTS and Guidelines: Is there enough time to prepare?

Obliged entities are currently preparing for the upcoming changes in the AML regime. They invest significant time and effort into conducting gap analyses, aligning internal processes and establishing new policies to be ready by the time the new AML package becomes applicable.

The timeline for implementation has been tight from the outset, and the time pressure is now even stronger in light of pending Regulatory Technical Standards (RTS) and Guidelines on various key aspects. Obliged entities are forced to begin adapting their complex processes even though final guidance from the Anti Money Laundering Authority (AMLA) and the European Commission is not yet in place.

Under the AMLR, AMLA was supposed to issue the first draft Guidelines and submit various draft RTS to the Commission for adoption by 10 July 2026. Therefore, some RTS that require thorough preparation from obliged entities were published for consultation early in the process. These included, for example, RTS on Customer Due Diligence³ and RTS on the assessment of the inherent and residual risk profiles of obliged entities⁴ (see our previous blog post). AMLA later reopened the consultation on RTS on Customer Due Diligence⁵ and on RTS on pecuniary sanctions, administrative measures and periodic penalty payments⁶ to collect additional feedback from the non-financial sector (see our previous blog post).

AMLA has supplemented some consultations by holding public hearings, for example, on the draft RTS on criteria for business relationships, occasional transactions and linked transactions and lower thresholds⁷, as well as on the draft Guidelines on business-wide risk assessment⁸ and on ongoing monitoring of a business relationship.⁹

Although AMLA has been especially busy in the last few months, the authority has not met all its own deadlines. For some of the draft RTS and Guidelines, AMLA already extended the deadline for feedback to the consultation drafts beyond the 10 July 2026.¹⁰ With AMLA setting its own deadlines, obliged entities will have even less time to implement the relevant changes before 10 July 2027.

The table below provides an overview of the Guidelines and RTS that, under the AMLR and AMLD, were due to be issued by AMLA or submitted to the European Commission by 10 July 2026 (status as of 14 July 2026).

2. What’s currently in focus: Group-wide requirements 

One of the currently widely discussed topics are the draft RTS regarding group-wide requirements.¹² Many global groups face challenges in identifying the entity that will serve as the (intermediate) parent undertaking within the EU¹³ – the focal point for group-wide AML/CFT governance, information-sharing and supervisory notifications.

Under the AMLR, the parent undertaking must be an obliged entity with sufficient prominence within the group and have sufficient understanding of the operations of the group. The draft RTS set out the criteria for identifying the relevant parent undertaking. However, in practice, institutions face several challenges when applying these criteria. For example, where sufficient prominence is to be determined by the average amount of incoming and outgoing transactions¹⁴, institutions must determine what constitutes a ‘transaction’ for this purpose; i.e. how intra-group transfers or complex settlement processes during securities trading should be accounted for.

And even once the (intermediate) parent undertaking is assigned, the key question that remains for most non-EU groups, is how to enforce such measures. In many instances, the (intermediate) parent undertaking does not have control over all EU entities and, thus, cannot effectively implement and enforce a new AML/CFT framework.

3. Who's on AMLA’s radar for direct supervision?

AMLA will select up to 40 eligible financial institutions and groups operating in the EU to fall under its direct supervision starting from 2028.¹⁵ As the first selection round is scheduled for 2027, AMLA has already initiated a provisional eligibility assessment, which primarily involves collecting data from potentially eligible obliged entities.¹⁶

Potentially eligible obliged entities have received questionnaires from their National Competent Authorities (NCAs) designed to collect the necessary data for the assessment of eligibility for direct supervision.¹⁷ All entities that receive these requests are asked to complete the questionnaire, even if they believe they do not meet the eligibility criteria.¹⁸

AMLA has published a full set of materials to help obliged entities fill out the questionnaires correctly, including an Interpretative Note, webinar recordings, webinar materials and pre-filled templates.¹⁹ Separately, AMLA will put in place arrangements for the handover of supervisory information and documentation from NCAs in accordance with all applicable data protection requirements.²⁰ The data will be transferred to AMLA by 15 August 2026.²¹

Based on the data collected, AMLA will identify the provisionally eligible obliged entities by end-September 2026.²²  In the first quarter of 2027, AMLA will commence the next data collection process for eligibility confirmation and for the risk assessment. In summer 2027, AMLA is expected to begin conducting its ML/TF risk assessment to derive the list of selected obliged entities (SOEs).²³ According to the current timeline, AMLA is expected to commence direct supervision of SOEs by July 2028.²⁴

Outlook

There is no indication that the deadline for the new AML requirements to come into force on 10 July 2027 will be extended. Institutions thus need to strike a balance between moving forward with the implementation and, at the same time, adapting to the continuously evolving guidance from AMLA.

1. Directive (EU) 2024/1640 of the European Parliament and of the Council of 31 May 2024.

2. Please note that some exceptions apply according to Article 78 of AMLD6, accordingly, Article 74 shall be transposed by 10 July 2025, Articles 11, 12, 13, 15 shall be transposed by 10 July 2026 and Article 18 shall be transposed by 10 July 2029. 

3. EBA Response to the European Commission’s Call for Advice on six AMLA mandates, Draft RTS under Article 28(1) of Regulation (EU) 2024/1624. 

4. Draft RTS on the assessment of the inherent and residual risk profile of obliged entities under Article 40(2) of Directive (EU) 2024/1640.

5. Consultation Paper – Draft RTS under Article 28(1) of Regulation (EU) 2024/1624.   

6. Consultation Paper – Draft RTS on pecuniary sanctions, administrative measures and periodic penalty payments under Article 53(10) of Directive (EU) 2024/1640.

7. Public Hearing on the draft RTS on criteria for identifying business relationships, occasional and linked transactions and lower thresholds held on 24 March 2026. 

8. Public Hearing on draft Guidelines on business-wide risk assessment held on 29 May 2026.

9. Public Hearing on draft Guidelines on ongoing monitoring of business relationships held on 2 July 2026.

10. For example: Consultation Paper – Draft RTS specifying the relevance and selection criteria when determining whether a report submitted pursuant to Article 69(1), first subparagraph, point (a), of Regulation (EU) 2024/1624 concerns another Member State under Article 31(3) of Directive (EU) 2024/1640. The feedback is requested by 6 October 2026. Please also see, Consultation Paper – Draft Guidelines on ongoing monitoring of a business relationship under Article 26(5) of Regulation (EU) 2024/1624. The feedback is requested by 3 September 2026. 

11. The final report and the consultation on these Draft RTS covered credit institutions and financial institutions. On 13 July 2026, a further consultation on Draft RTS pursuant to Article 40(2) AMLD was opened, specifically addressing the non-financial sector.

12. Consultation Paper – Draft RTS on group-wide requirements under Article 16(4) of Regulation (EU) 2024/1624 and on additional measures on branches and subsidiaries in third countries under Article 17(3) Regulation (EU) 2024/1624.

13. According to Article 2(1) number (42)(b) AMLR, where at least two EU obliged entities belong to the same group but are not subsidiaries of an EU obliged entity, one of them must be designated as the “parent undertaking” within the Union.

14. Draft RTS on group-wide requirements (see footnote 11), Article 17(1)(b)(ii).

15. AMLA, Explainer: Towards AMLA’s direct supervision. 

16. Potentially eligible entities comprise credit institutions and financial institutions, where they operate, whether through establishments or under the freedom to provide services, in at least six Member States, including the home Member State, Article 12(1) AMLAR.

17. Interpretative Note on the identification of provisionally eligible obliged entities pursuant to the draft ITS under Article 15(3) AMLAR, p. 2; AMLA Webinar, Identification of Obliged Entities Eligible for Direct Supervision (AMLA Webinar Materials), p. 14. 

18. Interpretative Note on the identification of provisionally eligible obliged entities pursuant to the draft ITS under Article 15(3) AMLAR, p. 5; AMLA Webinar Materials, p. 18.

19. AMLA launches data collection exercise to test risk assessment models. 

20. AMLA, Single Programming Document 2026-2028, p. 19.

21. AMLA takes next step towards 2027 selection of entities for direct supervision. 

22. Ibid. 

23. AMLA Webinar Materials, p.10.

24. AMLA Webinar Materials, p.12.