The EU AML package: AMLR, AMLD6 and AMLA — timeline and impact

By Mitchell Zandwijken · 19 August 2026 · updated 4 September 2026 · EU AML package, AMLR, AMLA

The EU's 2024 AML package is the biggest overhaul of European anti-money laundering rules in decades. It replaces the directive-based system — implemented nationally in laws like the Dutch Wwft — with a single, directly applicable regulation, a new directive and a European supervisor.

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

The three instruments

Instrument	What it covers	Key date
AMLR — Regulation (EU) 2024/1624	Directly applicable obligations for obliged entities: CDD, beneficial ownership, reporting, group policies	Applies from 10 July 2027
AMLD6 — Directive (EU) 2024/1640	Registers, national supervision and FIUs, risk assessments	Transposition largely by 10 July 2027
AMLA Regulation — (EU) 2024/1620	The new EU supervisor AMLA, based in Frankfurt	Operational since 2025; direct supervision from 2028

Key changes

A single rulebook: harmonised CDD, beneficial-ownership and internal-control requirements across the EU, with technical standards and guidance increasingly coming from AMLA.
More prescription: the AMLR is considerably more detailed than most national laws — existing policies and procedures will need recalibration, not just renaming.
A wider scope: crypto-asset service providers under the full regime, traders in luxury goods, and (from 2029) professional football clubs and agents.
An EU-wide cash limit: €10,000 for large cash payments in trade, with member states free to go lower.
AMLA: direct supervision of selected high-risk cross-border institutions from 2028, plus coordination of national supervisors and FIUs.

How to prepare

Run a gap analysis mapping your current framework (e.g. the Wwft) to the AMLR, article by article.
Get UBO and CDD data in order — stricter documentation rules will expose weak files.
Rewrite policies against the Regulation, referencing AMLR articles where possible.
Track AMLA's technical standards and guidance as they are published in the run-up to 2027.
Train your people on new definitions and thresholds — from front line to board.

What stays national

The Regulation sets out what obliged entities must do. The Directive — AMLD6, Directive (EU) 2024/1640 — sets out what member states must put in place, so those parts still arrive through national law. In practice that covers:

Registers: the beneficial ownership register, the trust register and rules on who may access them.
Supervision: which authority supervises which sector, what powers it holds and what penalties it may impose. The Dutch split across DNB, the AFM, the BFT, the deans of the bar and Bureau Toezicht Wwft therefore remains a national choice.
The FIU: the position, powers and cooperation arrangements of FIU-the-Netherlands.
Bank account registers and property data: central registers accessible to supervisors and law enforcement.

For your institution that means the obligations will come from Brussels, but the supervisor you answer to and the reporting channel you use stay Dutch — including the Dutch choice to report unusual rather than suspicious transactions.

AMLA: from establishment to direct supervision

AMLA, the EU's Anti-Money Laundering Authority, was established by Regulation (EU) 2024/1620 and is based in Frankfurt am Main. It is building up in stages, and three of those matter to obliged entities.

Technical standards. AMLA drafts the regulatory technical standards and guidelines that fill in the open norms in the AMLR, including on customer due diligence. These appear in the run-up to July 2027 and often determine your design more concretely than the Regulation's own text.
Selection for direct supervision. AMLA will directly supervise a selected group of the highest-risk cross-border financial institutions. The selection cycle runs in 2027 and direct supervision starts in 2028; candidate institutions are involved in data collection beforehand.
Indirect supervision. Even if you are not selected, something changes: AMLA assesses and steers national supervisors. Expect DNB, the AFM and the BFT to state their expectations more sharply and more uniformly over the coming years.

Four misconceptions we keep meeting

"It applies in 2027, so there is time." The date of application is not the date you may start thinking. Rewriting policy, changing systems and retraining people takes a mid-sized institution twelve to eighteen months. Starting in 2027 means starting late.

"It is a Regulation, so national rules no longer matter." Not so. Supervision, registers and the reporting channel remain national. And until 10 July 2027 the Wwft applies in full, enforcement included.

"We are small, this is really about banks." The expansion of the obliged-entity population lands hardest on smaller firms that fall outside the regime today. For them this is not a tightening but a first encounter with the whole framework.

"Our group operates in several member states, so everything will be identical." Largely, and that is a real gain. But member states retain discretion on some points — a lower cash limit, for instance — and supervision stays nationally organised. Expect harmonised norms, not a harmonised experience.

A realistic quarter-by-quarter plan

Period	What to do
Now to end 2026	Run a gap analysis against the AMLR. Establish which parts of your framework have to change regardless, and which changes can be folded into work you had already planned.
First half 2027	Rewrite policies, procedures and work instructions against the Regulation. Book system changes with your vendors early — they have a queue too. Incorporate AMLA standards as they are published.
Spring 2027	Train. New definitions, thresholds and triggers have to land with the front line and the board before the date of application.
Around 10 July 2027	Transition. Make sure file documentation meets the new requirements from that date, and that legacy files have a clear status.
2028	AMLA direct supervision begins for selected institutions. Expect sharper, more harmonised expectations from national supervisors as well.

The new obliged entities, in detail

The AMLR widens the population of obliged entities considerably. Firms in the categories below should assume they will be in scope and plan accordingly, because for most of them this is not an adjustment to an existing framework but a first build.

New category	What it covers	Practical consequence
Crypto-asset service providers	The full CASP population as defined under MiCAR, beyond the narrower registration regimes some member states used	Full CDD, monitoring and reporting obligations alongside MiCAR licensing
Crowdfunding platforms	Platforms and intermediaries not already covered by the EU crowdfunding regulation	Client due diligence on both sides of the platform
Traders in luxury goods	Precious metals and stones, and high-value goods generally	Due diligence on occasional transactions above the applicable thresholds
Traders in vehicles, vessels and aircraft	Motor vehicles, watercraft and aircraft above value thresholds	A regime most dealerships have never had to operate
Credit intermediaries	Consumer and mortgage credit intermediaries that are not credit institutions	Client due diligence at the point of intermediation
Investment migration operators	Firms arranging residence or citizenship by investment	Enhanced scrutiny given the inherent risk profile
Professional football clubs and agents	Top-tier clubs and agents, with a later application date of 2029	Two extra years, but a demanding regime once it lands

Alongside the wider population, the Regulation introduces a Union-wide ceiling on large cash payments for goods and services of €10,000, replacing the patchwork of national limits. Member states may keep or introduce a lower limit, so a group operating across several countries still cannot apply a single number everywhere. Institutions also face a dedicated enhanced due diligence regime for very wealthy clients, in addition to the existing triggers for politically exposed persons and high-risk third countries — a change that will bite hardest in private banking, wealth management and the trust sector.

Where the Netherlands sits in this

Dutch institutions start from a relatively mature position: the Wwft already implements the fourth and fifth EU directives, the risk-assessment obligation is well established, and supervisors publish detailed expectations. Three points nonetheless deserve attention.

First, the Dutch reporting standard. The AMLR does not change the fact that the Netherlands asks for unusual transactions, and the objective indicators that force a report have no direct equivalent in most other member states. Groups that harmonise their reporting logic across Europe risk harmonising it downwards.

Second, the fragmented supervisory landscape. Five different bodies supervise Wwft compliance in the Netherlands, each with its own emphasis. Harmonisation of the rules does not merge those bodies.

Third, sectors that are new to the regime. Dutch dealers in high-value goods, crowdfunding platforms and parts of the credit intermediation market will need to build a framework from scratch rather than adjust one. For them, 2027 is not a migration but an implementation.

Working out what this means for your institution? Read the Dutch companion piece, Van Wwft naar EU AMLR: wat verandert er in 2027?, which includes an article-by-article mapping from the Wwft to AMLR topics.

FAQ

When does the EU AML Regulation apply?

The AMLR (Regulation (EU) 2024/1624) applies directly in all EU member states from 10 July 2027. A later date (2029) applies to some sectors, such as professional football clubs and agents.

What is AMLA?

AMLA is the EU's new Anti-Money Laundering Authority, based in Frankfurt. It coordinates national supervisors and FIUs, and from 2028 will directly supervise a selection of the highest-risk cross-border financial institutions.