On this page · 12 sections
- What applies on 10 July 2027, and what comes before and after
- AMLA's standards: what is final, what is pending
- KYC and customer due diligence: what to rebuild
- Beneficial ownership: the 25% test across every layer
- Ongoing monitoring and transaction monitoring
- Record-keeping: five years, unredacted, then delete
- What changes for crypto-asset service providers
- Group-wide controls for fintech groups
- Indian vendors and engineering teams serving EU firms
- Implementation plan: November 2026 to July 2027
- How eCorpIT can help
- References
Summary. Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (AMLR), applies from 10 July 2027, 245 days after 7 November 2026; football clubs and agents follow on 10 July 2029. One directly applicable rulebook replaces national variations. Customer due diligence (CDD) applies to occasional transactions of €10,000 or more, to transfers of funds of €1,000 or more at credit and financial institutions, and at €1,000 for crypto-asset service providers (CASPs), which must still identify and verify customers below that. A beneficial owner holds 25% or more, with indirect stakes multiplied along each chain and a separate control test across layers. Records are kept unredacted for 5 years, then deleted. On 1 October 2026 the EU anti-money laundering authority (AMLA) sent the Commission final drafts of its CDD, business-relationship and group-wide standards, proposed to apply six months after entry into force. Its monitoring guidelines and suspicious-transaction report format were pending on 7 November 2026. Verdict: start data-model and retention work now.
About this article. For compliance, product and engineering leads at EU payment, e-money and crypto firms, banks and their technology vendors. On 7 November 2026 we checked every date, threshold and article against the English Official Journal text of Regulation (EU) 2024/1624 of 19 June 2024 (no English corrigendum or amendment found), read via the EU Publications Office, and against AMLA's final reports, factsheets, consultations and tracker. This is not legal advice: AMLA's drafts can change, so confirm obligations with counsel and your supervisor. Researched with AI assistance and reviewed by our editorial team.
What applies on 10 July 2027, and what comes before and after
Today, AML rules reach fintechs through national laws transposing Directive (EU) 2015/849; from 10 July 2027 the core obligations apply directly. The package also includes the Sixth Anti-Money Laundering Directive (EU) 2024/1640 (AMLD6), covering supervisors, financial intelligence units (FIUs) and registers, and Regulation (EU) 2024/1620 (AMLAR), which created the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA).
| Date | Milestone | Basis |
|---|---|---|
| 19 June 2024 | AMLR, AMLAR and AMLD6 published; AMLA established on 26 June | AMLA |
| 10 July 2026 | Deadline for AMLA's draft CDD, business-relationship, group-wide and STR format standards and monitoring guidelines | AMLR Articles 16, 17, 19, 26, 28, 69 |
| 1 October 2026 | AMLA submits three final draft RTS to the Commission | AMLA |
| By 1 July 2027 | AMLA starts selecting entities for direct supervision, finishing within six months | AMLAR Article 13 |
| 10 July 2027 | AMLR applies; guidelines on suspicious-activity indicators, outsourcing and self-hosted addresses due | AMLR Articles 18, 40, 69, 90 |
| During 2028 | AMLA starts direct supervision of 40 entities | AMLA |
| 10 July 2029 | AMLR applies to football clubs and agents; Commission deadline to assess lower ownership thresholds | AMLR Articles 52, 90 |
AMLA's standards: what is final, what is pending
AMLA's regulatory technical standards (RTS), implementing technical standards (ITS) and guidelines fill in the AMLR's data points, formats and supervisory expectations. AMLA's tracker, last updated 7 October 2026, its consultation pages and its 18 December 2025 announcement give this status on 7 November 2026.
| Instrument | Basis | Status on 7 November 2026 | What it shapes |
|---|---|---|---|
| RTS on customer due diligence | AMLR 28(1) | Final draft sent to the Commission | KYC data model, eID, screening |
| RTS on business relationships and linked transactions | AMLR 19(9) | Final draft sent to the Commission | Threshold and linking logic |
| RTS on group-wide requirements | AMLR 16(4), 17(3) | Final draft sent to the Commission | Group data sharing |
| ITS on reporting suspicions and transaction records | AMLR 69(3) | Consultation closed 20 September 2026 | STR export, FIU packages |
| Guidelines on ongoing monitoring | AMLR 26(5) | Consultation closed 3 September 2026 | Monitoring rules, refresh cycles |
| Guidelines on business-wide risk assessment | AMLR 10(4) | Consultation closed 15 July 2026 | Risk-assessment method |
| RTS on selecting entities for direct supervision | AMLAR 12(7) | Final report, December 2025 | Whether AMLA supervises you |
| RTS on a central AML/CFT database | AMLAR 11(6) | Hearing consultation closed 3 November 2026 | Supervisory data flows |
Two consequences follow. First, the October RTS bind only once adopted: the Commission has three months to decide, the Parliament and Council then have three months, extendable by three, to object, and the RTS would apply six months after entry into force. The AMLR will most likely apply first, so build to the drafts now. Second, European Banking Authority guidelines, including those on ML/TF risk factors, remote onboarding and the Travel Rule, apply until AMLA's replacements take effect.
KYC and customer due diligence: what to rebuild
When CDD is triggered
Article 19 sets the triggers. Most fintechs already apply CDD to every account, so the change sits in occasional, linked and crypto transactions.
| Trigger | Threshold | Who |
|---|---|---|
| Establishing a business relationship | Any amount | All obliged entities |
| Occasional transaction, single or linked | €10,000 or more | All obliged entities |
| Occasional transfer of funds | €1,000 or more | Credit and financial institutions, except CASPs |
| Occasional crypto-asset transaction | €1,000 or more for full CDD; identify and verify below that | CASPs |
| Occasional cash transaction | €3,000 or more: at least identify and verify | All, unless a national cash limit of €3,000 or less applies |
| Suspicion of money laundering or terrorist financing | Any amount, regardless of exemption | All obliged entities |
| Doubts about identification data or who you are dealing with | Any amount | All obliged entities |
AMLA's final draft RTS under Article 19(9) adds no lower thresholds. It does set tests for currency exchange offices, money remitters and CASPs that exchange crypto-assets or transfer them for clients: three or more transactions in the last 12 months point to a business relationship, and a one-month window applies when checking whether occasional transactions are linked.
For payment initiation services, the customer is the merchant. Supervisors may exempt e-money from parts of CDD only if the instrument is not reloadable, holds no more than €150, is used only with the issuer or its network, is not linked to a payment account, cannot be exchanged for cash or crypto-assets, and is monitored. Payment and e-money institutions should treat these rules, plus the €1,000 transfer threshold, as their main CDD changes.
What data to collect and verify
AMLA's final draft CDD RTS and its factsheet show how much the data model changes.
- Names. All given names and surnames as they appear on the identity document, passport or electronic identification (eID) means.
- Place of birth. Recorded as the document or eID shows it, which may be a country, state, city, town or village. Documents differ, so do not force a country-plus-city pair.
- Address. Country (name or ISO 3166 code) and city, municipality, town or village, with postal code, state, street, building and apartment number where they exist.
- Nationality. Reasonable measures to establish whether a person holds more than one; record all declared and verify at least one.
- Verification. Every Article 22(1) data point is verified. In low-risk situations natural persons need only names, date and place of birth, and nationality, with no address.
- Remote onboarding. Where a customer cannot reasonably show a document in person and has no eID, alternative verification is allowed with the Article 7 safeguards, such as confirming the presenter is the document holder and keeping time-stamped copies. Annex I lists the attributes eID means must supply.
- Screening. Sanctions and politically exposed person (PEP) screening may be automated, manual or both. Screen names in the original alphabet or Latin transliteration, plus aliases and wallet addresses where available, at onboarding, when sanctions lists change and when customer data changes.
For engineers this means schema changes: a place-of-birth field that takes what the document shows, structured addresses, multi-valued nationality, provenance for each verified attribute and a low-risk flag. Check KYC vendor contracts against Annex I, including European Digital Identity Wallet support, covered in our EUDI Wallet acceptance guide for banks.
Existing customers
The draft RTS bring existing customers into line on a risk-sensitive basis within one year for higher-risk customers and five years for others, counted from the RTS's entry into force. Size that remediation programme now by counting records that lack a place of birth as shown on the document, a structured address or a second-nationality check.
Beneficial ownership: the 25% test across every layer
Article 52 defines an ownership interest as direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest, including rights to profits or liquidation balance. Indirect ownership multiplies holdings along each chain and adds the chains, counting every level, unless Article 54 applies. Article 54 covers chains where ownership and control sit on different layers: whoever controls a company, for example through 50% plus one of its shares, is a beneficial owner where that company holds a direct ownership interest in the customer. Control by other means, such as veto rights or board appointments, is assessed in parallel under Articles 51 and 53.
By 10 July 2029 the Commission must assess lower thresholds for higher-risk categories that Member States identify, at most 15% unless a higher figure below 25% is more proportionate. In low-risk cases the central register may identify the beneficial owner, but register data alone does not verify it. You must consult the register in every case and report discrepancies within 14 calendar days under Article 24.
Worked example: calculating indirect ownership
Person A owns 60% of HoldCo 1, which owns 50% of Customer Co. A also owns 10% of HoldCo 2, which owns 40% of Customer Co. Person B owns the other 40% of HoldCo 1.
| Person | Chain | Calculation | Result |
|---|---|---|---|
| A | Via HoldCo 1 | 60% × 50% | 30% |
| A | Via HoldCo 2 | 10% × 40% | 4% |
| A | Total | 30% + 4% | 34%: beneficial owner |
| B | Via HoldCo 1 | 40% × 50% | 20%: below 25% |
B qualifies only through control by other means, or if a delegated act set a 15% threshold for Customer Co's category. Now let HoldCo 1 own 30% of Customer Co. A's multiplied interest falls to 60% × 30% = 18%, plus 4%, which is 22%. A is still a beneficial owner under Article 54, because A controls HoldCo 1 and HoldCo 1 holds a direct stake of at least 25%. A system that only multiplies would miss A, so store the full ownership and control graph and recompute when holdings, control rights or thresholds change.
Ongoing monitoring and transaction monitoring
Article 26 requires ongoing monitoring so that transactions stay consistent with what you know about the customer and unusual ones get a fuller assessment. Three details change system design:
- Cross-product and group view. CDD must cover every product in a relationship, and the customer's relationships with other group entities must be taken into account.
- Refresh deadlines. Customer information is updated at least yearly for higher-risk customers and every 5 years for others, and whenever circumstances change. AMLA's draft guidelines, consulted on until 3 September 2026, cover these refresh cycles and the monitoring framework.
- Sanctions re-checks. Verify sanctions exposure regularly; credit and financial institutions must also do so upon any new designation. The Instant Payments Regulation already requires providers of instant euro transfers to screen users at least daily and immediately after new or amended sanctions, as covered in our piece on the 9 April 2027 SEPA Instant deadline.
Article 69 requires reports to the FIU, regardless of amount, when you know, suspect or have reasonable grounds to suspect criminal proceeds or terrorist financing, including attempted transactions and cases where CDD could not be completed. FIU requests are answered within 5 working days, which an FIU can cut to under 24 hours in urgent cases. AMLA's ITS will fix report and transaction-record formats; the draft sets templates by type of entity for firms that automate reporting instead of using the FIU's portal. Guidelines on suspicious-activity indicators are due by 10 July 2027.
What to build: an event pipeline joining transactions across products and group entities, documented scoring thresholds, case management that records every assessment whether or not it becomes a report, an STR export ready for AMLA's format, and fast FIU response packs.
Article 75 allows information-sharing partnerships, subject to notifying supervisors, a data protection impact assessment and human oversight of shared AI output. AMLA and the European Data Protection Board hold a technology-provider roundtable on 30 November 2026 for joint guidelines expected to go to consultation in the first half of 2027.
Record-keeping: five years, unredacted, then delete
Article 77 lists what you keep: CDD documents and information, including eID data; the record of every suspicion assessment and its result, whether or not you filed a report; court-admissible transaction records; and records from information-sharing partnerships. Records must not be redacted, and references may replace copies only if the information is immediately available and unalterable. When the 5 years below run out, personal data must be deleted, unless other law requires longer retention. A competent authority can require up to 5 more years case by case, and a transitional rule covers proceedings pending on 10 July 2027.
| Record type | Clock starts | Default retention | Engineering requirement |
|---|---|---|---|
| CDD documents and eID data | End of relationship or occasional transaction | 5 years, then delete | Per-record clock, deletion job, legal hold |
| Suspicion assessments and STR copies | End of relationship or occasional transaction | 5 years | Immutable case history, including no-report decisions |
| Transaction records | End of relationship or occasional transaction | 5 years | Court-admissible storage, fast retrieval |
| Refused onboarding | Date of refusal | 5 years | Keep evidence of refusals |
| Authority-ordered extension | Set by the authority | Up to 5 more years | Hold flags that override deletion |
The refusal clock is easy to miss: many onboarding systems purge rejected applicants, whose records you must keep.
What changes for crypto-asset service providers
CASPs face the lowest thresholds and the most specific product rules.
- €1,000 CDD threshold for occasional transactions, single or linked, with identification and verification below it.
- No anonymity. Article 79 bars credit institutions, financial institutions and CASPs from keeping accounts that anonymise the holder or obscure transactions, expressly including through anonymity-enhancing coins. Existing anonymous accounts need CDD before any use.
- Self-hosted addresses. Article 40 requires CASPs to assess and mitigate the risk of transfers to and from self-hosted addresses, for example by identifying the counterparty. AMLA guidelines on this, and on correspondent relationships with non-EU crypto firms under Article 37, are due by 10 July 2027.
- Wallet addresses in screening. The draft CDD RTS lists wallet addresses among the data to screen where available.
The system changes: one-month linked-transaction detection, address screening, a decision on any anonymity-enhancing coins you list, and self-hosted address checks in the withdrawal flow. The EBA's Travel Rule guidelines stay in force until AMLA replaces them.
Group-wide controls for fintech groups
AMLA's group-wide RTS sets minimum governance, risk management, internal controls and secure information sharing. Its factsheet says arrangements without common ownership, management or compliance control, such as a shared technical platform, generally fall outside it.
Indian vendors and engineering teams serving EU firms
The AMLR binds EU obliged entities, not their suppliers, but Article 18 lets them outsource AML tasks only after notifying the supervisor, treats the provider as part of the obliged entity, and leaves the obliged entity fully liable. Some tasks cannot be outsourced: deciding a customer's risk profile, deciding whether to onboard, reporting suspicions to the FIU (except to a group entity in the same Member State) and approving detection criteria. Providers in EU-listed high-risk third countries can take outsourced tasks only within the same group, under further conditions.
Indian RegTech, KYC and engineering vendors should expect EU clients to demand Annex I eID attributes, structured data, retention clocks, evidence logs and audit access. Personal data moving from the EU to India needs a GDPR transfer tool such as standard contractual clauses, and processing of Indian users' data falls under India's own rules, covered in our DPDP Rules compliance checklist.
Implementation plan: November 2026 to July 2027
- November 2026. Map Articles 18 to 26, 52 to 54, 69 and 77 to system owners.
- December 2026. Gap-assess the KYC data model against the draft CDD RTS and count records needing remediation.
- January 2027. Rebuild beneficial ownership as an ownership-and-control graph with 14-day discrepancy reporting.
- February 2027. Make sanctions screening event-driven, adding wallet addresses where relevant.
- March 2027. Add per-record retention clocks, including refusals, with legal holds and immutable storage.
- April 2027. Rework monitoring for group-wide data and one-month linking windows; test a 5-working-day FIU response pack.
- May 2027. Test STR exports against AMLA's ITS if final, and update outsourcing contracts and notifications.
- June 2027. Run an end-to-end dry run and freeze changes before 10 July 2027.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our data and analytics practice builds AML data foundations for EU fintechs and CASPs, from KYC data models and ownership graphs to retention clocks and monitoring pipelines, alongside your MLRO and counsel. Talk to us at /contact-us/.
Last updated: 7 November 2026.
