.png)
On 1 October 2026, the EU's Anti-Money Laundering Authority (AMLA) published three final draft regulatory technical standards (RTS) on business relationships and linked transactions, customer due diligence (CDD) and group-wide requirements. These are three of the 17 instruments AMLA currently lists, and provide some of the detail on what AMLR will require when its main obligations apply from 10 July 2027.
Many of the financial crime leaders we speak to understand the general principles behind the new regulations, but are not clear about what they mean operationally. This is complicated by the fact that the requirements are not all final, as the RTS still need to be adopted by the European Commission, and several AMLA guidelines due under AMLR have not yet been issued.
Nonetheless, given the timelines, firms have to act before everything is settled. Firms need to translate requirements into changes to policies, processes, systems and controls across their entities and jurisdictions, and keep those arrangements aligned as the framework develops.
This makes a structured approach to regulatory change management essential. The 17 instruments are at different stages, with some finalised and others consulted on but not yet finalised. AMLA also says its list is not exhaustive. Some are aimed at supervisors and financial intelligence units rather than firms, but they will still impact how firms are supervised.
AMLR is a textbook regulatory change exercise, albeit a significant one. It will inevitably test whether firms’ existing processes can handle the volume and speed of change that modern regulation brings.
A brief summary of the new framework
The EU's AML package has three main parts: a rulebook for firms, a directive for national authorities, and a new EU supervisor:
- AMLR - Regulation (EU) 2024/1624 is the directly applicable rulebook for obliged entities. It has been in force since July 2024, and its main obligations apply from 10 July 2027.
- AMLD6 - Directive (EU) 2024/1640 covers national supervision, financial intelligence units and beneficial ownership registers. It must be transposed into national law, generally by 10 July 2027.
- AMLA - established under Regulation (EU) 2024/1620, AMLA is the new EU authority that drafts technical standards and guidelines and oversees national supervisors. In its first selection, it will directly supervise up to 40 high-risk credit and financial institutions or groups operating in at least six member states, a number that can rise in later selections. Selection starts by 1 July 2027, and direct supervision begins in 2028.
Firms will of course be adapting controls they already have. EBA AML/CFT guidelines remain in force until AMLA replaces them, and the draft CDD standards build on earlier EBA work. Most firms will continue to be supervised by their national authority.
Three key challenges for implementing AMLR
Implementing AMLR involves three key challenges:
1. Legal interpretation: deciding what risk-based requirements mean in practice. Some provisions are prescriptive, such as the CDD identification data points. Many others, such as "reasonable measures" to verify beneficial owners, leave firms to judge what is sufficient, and AMLA has no supervisory track record yet to show where it draws the line.
2. Operational implementation: finding where existing arrangements are insufficient. Each requirement has to be built into onboarding, KYC systems, screening and group policies, and this is often where gaps appear. For example, a KYC system may have no field for the required data, or one entity in the group may still follow an older procedure.
3. Ongoing change: keeping interpretations and controls current. The RTS may change before adoption. AMLA has consulted on guidelines on ongoing monitoring and business-wide risk assessment but not finalised them, and guidelines on risk factors and internal policies, procedures and controls are still to come.
Some national differences will remain. Most firms will still be supervised by their national authority, under national law that transposes AMLD6. National experience therefore remains valuable, but existing interpretations need to be tested against the new EU rules rather than assumed to carry over.
These challenges are greater for groups operating across several member states. Procedures built under different national rules have to be brought into one group-wide framework, which EU-headquartered groups must also apply to their branches and subsidiaries outside the EU.
What the three new draft standards change
The final draft RTS are not yet legally binding. Once adopted by the Commission and published in the Official Journal, they are proposed to apply six months after entering into force. They are the instruments most directly relevant to firms' customer-facing controls so far, but they cover only part of what firms will need to implement.
Business relationships and linked transactions
This standard sets criteria for deciding when an engagement is a business relationship, which triggers CDD and ongoing monitoring, and when separate transactions are linked.
- Thresholds unchanged - AMLR's general EUR 10,000 threshold for occasional transactions remains, with lower thresholds for some activities such as transfers of funds and gambling. AMLA chose not to add more.
- Sector criteria - money remitters, bureaux de change and certain crypto-asset service providers must consider three or more transactions in 12 months as a sign of repetition, and one month as the period for assessing linked transactions.
- Not automatic tests - AMLA is explicit that the criteria are neither exhaustive nor determinative.
Customer due diligence
This standard specifies what identification data firms must collect and how they can verify it.
- Identification data - set data points for individuals and legal entities, with a reduced set for low-risk situations.
- Verification - alternative methods where customers cannot use identity documents in person or electronic identification. The central beneficial ownership register is not sufficient on its own.
- Screening - sanctions screening and identification of PEPs, their family members and close associates.
- Existing customers - for business relationships existing when the standard enters into force, customer information must be brought into line on a risk-sensitive basis within one year for higher-risk customers and five years for others. Updates triggered by a change in circumstances, and CDD where there is suspicion, still apply.
Group-wide requirements
This standard sets minimum requirements for group-wide AML/CFT frameworks.
- Scope - governance, risk assessment, policies and information sharing, extending to some networks and partnerships with common ownership, management or compliance control.
- Third countries - where local law prevents a branch or subsidiary from complying, the group must notify its supervisor and apply additional measures. Supervisors may ultimately require it to close operations in that country.
Managing AMLR as regulatory change: six steps
The six steps below take each requirement from the regulatory text through to the policies, systems and controls that implement it.
1. Track developments and their legal status. Keep a register of every instrument and its status: applicable (AMLR from 10 July 2027), final draft (the RTS), in consultation or not started, plus AMLD6 transposition in each relevant member state. Status determines whether to implement, prepare or monitor. AMLA’s list of regulatory instruments is a useful starting point, but it does not cover Commission adoption, national transposition or which instruments apply to which entities.
2. Extract and structure specific obligations. Break each instrument into discrete, testable obligations, such as "capture every name shown on the identity document" rather than "perform CDD", each with a source reference, legal status and owner. Our workshop with the ICA shows how to turn regulatory text into an obligations register using widely available AI tools.
3. Map obligations to policies, processes, systems and controls, then test the control. Link each obligation to the specific policy section, procedure step, system field and control that implement it, and confirm those links with the people who own them. Any obligation that cannot be mapped is a gap. The firm must then test that each control works, for example that the onboarding system actually captures every required data point, and keep evidence that it does.
4. Document interpretations and decisions. For each obligation requiring judgement, record how the firm interprets it, why, which sources it relied on, and who approved it and when. For example, a firm should record what it treats as “reasonable measures” to verify a beneficial owner, and which sources beyond the central register it uses. This lets the firm explain its decisions to a supervisor.
5. Prioritise remediation. Rank gaps by compliance risk, implementation complexity, timing and regulatory certainty. A KYC data model change may need to start first because system changes take longer, while a larger policy rewrite can wait for final guidelines. Assign owners and deadlines, and keep evidence of remediation.
6. Reassess as requirements develop. When the RTS are adopted, guidelines issued or supervisory findings published, identify the obligations, interpretations and controls affected and update them, with version control showing what the firm relied on at each point and why it changed.
The worked example below applies these steps to one requirement in the draft CDD standards.
These are the areas where AMLR is most likely to require changes to firms’ systems, data or group arrangements:
Beyond July 2027
The rules will continue to evolve after AMLR applies from 10 July 2027. Further technical standards and AMLA guidance will follow, while the start of direct supervision in 2028 will give firms a clearer picture of how the new framework is being applied in practice.
Firms will therefore need to keep their policies and controls traceable to the requirements behind them. For any requirement, a firm should be able to show its source and status, how it was interpreted, which control implements it, who owns it and what has changed. Across several entities and jurisdictions, this is hard to sustain in spreadsheets and email.
Technology can help with much of this work. AI tools can monitor regulatory developments, extract obligations and flag which policies and controls may need updating, while keeping a record of the sources and decisions behind each change. They do not decide how ambiguous provisions should be read, but they make those decisions visible and easier to revisit.
A practical test for firms preparing for July 2027 would be to take one obligation from the draft CDD standards and trace it through their own policies, systems and controls. If that proves difficult for one obligation, it will be much harder across all 17 instruments and those still to come.
Zango is the AI compliance layer for financial institutions. If you’re preparing for AMLR, speak to our team about how we help firms track regulatory change, extract obligations and keep them mapped to policies, systems and controls.
Read our draft white paper on Regulatory Change Management with AI Agents to learn more about our approach.
.png)
