Europe’s New AML Rulebook: What Every Organisation Needs to Know

by Clive Bourke
November 5, 2026

Europe is replacing 27 divergent national AML frameworks with a single directly applicable regulation from July 2027, extending obligations to crypto providers, gambling operators, football clubs, and professional services firms that have never built compliance programs before. Only one-third of EU organisations believe they will be ready by the deadline, making data quality and consistent identity verification the most urgent operational gaps to close.

Europe is moving to a single anti-money laundering (AML) rulebook. For decades, each Member State has had a higher degree of discretion in terms of how they applied and regulated EU AML requirements. Organisations operating across borders have had to manage a slightly different version of the rules in every market they serve, with different expectations, different interpretations, and different supervisors.

The new Anti-Money Laundering Regulation (AMLR) changes that. From 10 July 2027, one EU regulation will replace this patchwork of national rules. According to the official EU summary of the legislation, the regulation “harmonises anti-money laundering rules for the first time throughout the EU.”

Some of the details are still being finalised, but the direction is already clear. More organisations will fall within scope, customer checks will become more consistent, and a new EU authority will oversee how the rules are applied. Organisations will face closer scrutiny and higher expectations for how they verify and monitor their customers.

This guide acts as an introduction: what the AMLR is, who it applies to, what it requires, and how organisations can start preparing now.

What Is the AMLR?

The AMLR, formally Regulation (EU) 2024/1624, sits at the centre of a wider package of EU reforms designed to stop criminals using the financial system to launder money or fund terrorism.

The most important thing to understand is the difference between a directive and a regulation. A directive sets goals that each Member State then writes into its own national law. That flexibility is how Europe ended up with 27 versions of what was meant to be a single set of rules. A regulation works differently. It applies directly, and in the same way, in every Member State, with no national rewriting required.

In practice, this means an organisation operating in France, Germany, and Ireland should face the same core requirements in all three. For businesses that have spent years reconciling different national approaches, that is a significant change.

Who Does It Apply To?

The AMLR applies to “obliged entities”, meaning the organisations legally required to carry out anti-money laundering checks on their customers.

Banks and other financial institutions have always been at the centre of this group. The new rules extend the list further, reflecting the EU’s view that money laundering risks now reach well beyond traditional banking.

Obliged entities include:

Banks and financial institutions
Crypto-asset service providers
Accountants, auditors, and tax advisers
Lawyers and notaries handling financial or property transactions
Traders in high-value goods
Gambling providers—particularly casinos and online betting or gaming platforms
Professional football clubs and agents

Many of the newly covered organisations are building AML processes for the first time, often without the compliance teams and infrastructure that banks have developed over decades. Most will need practical guidance quickly.

The rules also reach beyond the EU’s borders in one important respect. A parent company must make sure all its branches and subsidiaries comply, including those located outside the EU, even where local requirements are lower. Some low-risk activities may qualify for exemptions at national level, but most organisations on the list should assume the rules apply to them in full.

What Organisations Must Do

The AMLR sets out a common set of duties for every obliged entity. At its simplest, the regulation asks organisations to understand their risks, know their customers, and act when something looks wrong.

The core duties are to:

Assess and document money laundering risks
Appoint a compliance manager
Verify every customer’s identity
Identify who really owns or controls business customers
Monitor customer relationships over time
Report suspicious activity

Together, these duties turn AML from a set of one-off checks into an ongoing responsibility.

The compliance manager role deserves attention. The regulation requires a named individual to oversee compliance and make sure employees understand their obligations. Accountability also stays with the organisation when it hands tasks to a third party. Outsourcing a check does not outsource the responsibility for it.

When the customer is a company rather than an individual, organisations must look past the company name to the people behind it. These people are known as beneficial owners. Under the AMLR, a beneficial owner is anyone who holds 25% or more of a company’s shares or voting rights, or who controls the company by other means. If three people each own a third of a business, all three must be identified. A person who controls a company through an agreement or other arrangement must also be identified, even if they hold few or no shares.

These checks are known as customer due diligence (CDD). They are required:

When a new customer relationship begins
For one-off transactions of €10,000 or more
Whenever money laundering or terrorist financing is suspected

Due diligence does not end once a customer is on board. Organisations must continue to monitor relationships and keep customer information current. If they cannot complete the required checks, they must decline the customer or end the relationship, and report any suspicions to their national financial intelligence unit (FIU).

Who Enforces It?

The reforms create a new EU body: the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), based in Frankfurt.

AMLA’s role is to bring consistency to how the rules are applied across Europe. It develops common standards, supports cooperation between national supervisors, and will directly supervise a small number of high-risk financial institutions that operate across borders.

For most organisations, day-to-day supervision will stay with their national regulator. That does not make AMLA a distant concern. Its standards and methods will shape what national regulators expect, so organisations that never deal with AMLA directly will still feel its influence.

For businesses used to differing national interpretations, this should bring greater clarity. It should also make gaps easier to spot, since supervisors across Europe will be working from the same rulebook.

Why Data Matters

Understanding the rules is one thing. Following them depends on something more practical: reliable customer information.

As LSEG Risk Intelligence puts it: “What makes implementation so demanding? In short, data.”

Organisations need customer and ownership information that is accurate, complete, and kept up to date. They also need to show where that information came from, when it was checked, and how it informed a decision. That is harder than it sounds. Customer information often sits across multiple systems, ownership records arrive in different formats, and local teams may follow different processes. Each of these makes it harder to apply one standard across an entire group.

PwC’s 2026 EMEA AML Survey is indication of how much work remains. Only about one-third of EU respondents believe they will be ready to comply by 10 July 2027.

The gap between understanding the rules and being ready to follow them is where most organisations sit today. Closing it starts with an honest look at the data.

Preparing for 10 July 2027

The technical standards may still be taking shape, but the core requirements are settled. As FinTech Global observed, “Waiting for every technical standard is not an option.”

Five practical steps can help organisations get started:

Confirm whether the organisation is in scope
Compare current processes against the new requirements
Review the quality of existing customer records
Check that verification tools work consistently across every market
Assign clear ownership for the programme

Existing customers deserve particular attention. The new rules do not apply only to people who sign up after July 2027. Many organisations will need to check existing records against the new standards and refresh information where it falls short, a task that grows with the size of the customer base.

How Daon Helps

The AMLR marks a shift from fragmented national practice to one European standard. Daon helps organisations meet that standard through Identity Continuity, verifying a customer’s identity to a high standard at onboarding and maintaining that assurance throughout the relationship. The result is one coordinated view of customer identity for compliance teams, instead of a patchwork of tools across markets.

With TrustX, Daon’s low-code orchestration platform, organisations can:

Verify customers and documents consistently across every market
Bring identity verification, document checks, and risk decisions into one workflow
Re-verify existing customers without starting from scratch
Keep clear records of when and how each check was completed
Adjust processes as technical standards are finalised

Organisations that start now can build compliance in gradually, test their processes, and fix gaps while there is still time.

Connect with a Daon solutions expert