AMLR and AMLA: what compliance teams face from 2027

Short answer: The EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) applies directly in all Member States from 10 July 2027; for professional football clubs and football agents it applies from 10 July 2029 (Article 90 AMLR). With the AMLR in 2027, the same rules apply across the EU, for example on customer due diligence, beneficial owners from 25 % and a cash payment limit of EUR 10,000. The new EU authority AMLA in Frankfurt will directly supervise up to 40 financial institutions or groups active in at least six Member States from 2028.

This article is for heads of compliance, money laundering reporting officers (MLROs) and general counsel in Germany, and for Swiss institutions with entities in the EU. It sets out the deadlines of the EU AML package, the main new obligations, the impact on KYC portfolios and what a gap analysis with a capacity plan looks like.

The EU AML package at a glance

The EU AML package consists of three legal acts that take effect in stages until 2029. The AMLR is a regulation and applies without transposition; the AMLD6 is a directive and must be transposed into national law; the AMLA Regulation creates the new supervisory authority.

• AMLR – Regulation (EU) 2024/1624: a single rulebook for obliged entities covering, among other things, internal controls, customer due diligence, beneficial ownership, record keeping and cash payments.
• AMLD6 – Directive (EU) 2024/1640: covers registers, financial intelligence units (FIUs) and national supervision. It must generally be transposed by 10 July 2027.
• AMLA Regulation – Regulation (EU) 2024/1620: establishes the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, based in Frankfurt am Main.

All deadlines, including Swiss and German dates, are collected in the regulatory calendar for legal and compliance.

Key changes for obliged entities

The AMLR moves many detailed rules out of national law into a directly applicable EU regulation. For existing programmes this means that definitions, thresholds and deadlines need to be mapped again against the text of the regulation. The following points affect most obliged entities.

Scope of obliged entities

Article 3 AMLR covers credit and financial institutions and, among others, tax advisers, notaries and lawyers for certain transactions, estate agents, crowdfunding service providers, investment migration advisers, traders in high-value goods, non-financial mixed holding companies and, from 2029, football agents and professional football clubs.

Compliance functions and the management body

• A member of the management body is appointed as compliance manager. This person ensures that policies, procedures and controls match the risk exposure and that sufficient staff and resources are available (Article 11(1) AMLR).
• The AML/CFT compliance officer is appointed by the management body, must hold a sufficiently senior position and reports suspicious transactions to the FIU. Removal requires prior information of the management body, and the supervisor must be notified (Article 11(2) AMLR).
• The business-wide risk assessment expressly covers, in addition to money laundering and terrorist financing, the risk of non-implementation and evasion of targeted financial sanctions (Articles 9 and 10 AMLR).

Customer due diligence and beneficial ownership

• Due diligence applies to every business relationship and to occasional transactions of EUR 10,000 or more; for transfers of funds by credit and financial institutions and for crypto-asset service providers the threshold is EUR 1,000 (Article 19 AMLR).
• A beneficial owner is anyone holding directly or indirectly 25 % or more of the shares or voting rights; control via other means must be assessed in parallel (Articles 51 and 52 AMLR).
• Customer information must be updated at least once a year for higher-risk customers and at least every five years for all other customers (Article 26(2) AMLR).

Record keeping and cash payments

• Records must be kept for five years after the end of the business relationship or the occasional transaction; personal data must then generally be deleted (Article 77(3) AMLR).
• Persons trading in goods or providing services may accept or make cash payments only up to EUR 10,000; Member States may set lower limits (Article 80 AMLR).

AMLA: direct supervision from 2028

From 2028 AMLA will directly supervise up to 40 financial institutions or groups that are active in at least six Member States. Selection takes place between July and December 2027, and the result will be communicated by the end of 2027. AMLA published the selection methodology in December 2025 (AMLA explainer on direct supervision).

For all other obliged entities national supervision remains the main channel. In Germany, according to media reports from October 2026, a central coordination unit for AML supervision is to be set up at BaFin in Bonn and the FIU is to receive more powers; the Federal Ministry of Finance published the ministry draft of the implementing act on 28 October 2026. Groups that may be selected for direct supervision should be able to show in 2027 that their risk assessment, controls and data quality hold up across the group.

Impact on KYC portfolios

The largest operational impact of the AMLR is on the existing customer base: fixed maximum update intervals, the 25 % threshold and the parallel control test will trigger review waves. Institutions that currently use longer intervals or capture control only through shareholdings will need to update files.

Example (assumption): estimating review volume

A bank has 20,000 customers, 2,000 of them higher risk. The higher-risk customers need an annual update; the remaining 18,000 are spread over a five-year cycle, which means around 3,600 updates a year. At an average of 1.5 hours per file this adds up to around 8,400 working hours a year. With 1,600 productive hours per full-time employee, that is just over five FTE for periodic reviews alone, before event-driven reviews and rework.

Estimates like this show whether the business line can absorb the portfolio or whether a remediation taskforce is needed. How volume, team size and process fit together is covered in planning KYC remediation with interim specialists. A practical example is the KYC taskforce with eight compliance officers that was completed in a financial institution in ten months in 2025.

Swiss institutions with an EU footprint

The AMLR does not apply directly to Swiss institutions; the Swiss Anti-Money Laundering Act (Geldwäschereigesetz, GwG) remains the relevant law. Entities of a Swiss group that are established in the EU and qualify as obliged entities there must, however, comply with the AMLR from 10 July 2027. This also applies to branches: a branch of a credit institution located in the EU counts as a credit institution under the AMLR regardless of where its head office is (Art. 2(1)(5)(b) AMLR).

• Group-wide requirements: where a group has its head office outside the Union and at least two subsidiaries in the EU that are obliged entities, one of these EU entities takes on the role of parent undertaking for the group-wide policies, procedures and controls (Art. 2(1)(42)(b) and Art. 16 AMLR). The criteria for identifying it are set out in regulatory technical standards under Art. 16(4) AMLR; AMLA submitted the final draft to the European Commission on 1 October 2026, and adoption and publication in the Official Journal are pending (as at 31 October 2026).
• Beneficial owners: The Swiss Transparency Act also uses a threshold of 25 % of capital or votes, or control by other means (Article 4 TJPG). The Swiss transparency register has been operating since 1 October 2026; see Swiss AML revision and the new transparency register.
• Updates: In Switzerland, financial intermediaries have reviewed customer records periodically and on a risk basis since 2023 (Article 7(1bis) Swiss GwG). The AMLR instead sets fixed maximum intervals of one and five years. Groups with common processes should either adopt the stricter cycle deliberately or manage the two regimes separately.
• Data model: Different terms (beneficial owner in the EU, controlling person or beneficial owner in Switzerland) and thresholds belong in one shared data model so that group reporting stays comparable.

Gap analysis and capacity plan

An AMLR gap analysis compares the existing programme article by article with the regulation and turns gaps into work packages with effort and owners. If system changes are needed, the time until July 2027 is short.

1. Confirm scope: Which entities are obliged entities under Article 3 AMLR, and which may be selected for AMLA supervision in 2027?
2. Map the requirements: compare AMLR articles with existing policies, procedures and controls.
3. Assess gaps: prioritise by risk, effort and dependency on IT changes.
4. Adjust governance: appoint the compliance manager in the management body and document the compliance officer role and reporting lines.
5. Plan the KYC portfolio: estimate volume by risk class and interval, and decide on a taskforce or additional capacity in the business line.
6. Update policies and training: move procedures, templates and training to the new definitions.
7. Keep evidence: document decisions, test results and remaining gaps for internal audit and the supervisor.

Typical roles are an AML project lead, lawyers for requirement mapping, compliance officers for policies and controls, and KYC analysts for the portfolio. Alpinum Solutions provides such specialists and managers through staff leasing and freelancing, part-time or full-time, as individuals or as teams; the institution directs the work. Whether an interim professional can formally take on the MLRO function depends on the regulatory requirements; in Germany, outsourcing must be notified to BaFin at least two weeks in advance. More in interim MLRO or AML project team.

Limits and risks

• The AMLR will be supplemented by AMLA technical standards and guidelines. Some thresholds, for example for occasional transactions in higher-risk sectors, may be set lower (Article 19 AMLR).
• The German implementing act exists only as a draft bill. Responsibilities and penalty rules may still change.
• Responsibility for the AML programme stays with the management body. Interim professionals contribute, but they do not decide in place of senior management.
• Alpinum is not a law firm and does not provide legal advice. Institutions clarify questions of interpretation with their legal department or external advisers.

Frequently asked questions about the AMLR and AMLA

Does the AMLR replace the German Money Laundering Act?

Partly. The AMLR applies directly from 10 July 2027 and therefore overrides many obligations currently in the German Money Laundering Act (GwG). On 28 October 2026, the Federal Ministry of Finance published a ministry draft of an Act implementing the Sixth EU Anti-Money Laundering Directive and strengthening money laundering prevention. According to media reports, the new act is to replace the 2017 GwG on that date, implement the EU package one to one and regulate supervision and the FIU. Cabinet approval was still pending as at 31 October 2026.

Which institutions will AMLA supervise directly?

From 2028 AMLA will directly supervise up to 40 financial institutions or groups that operate in at least six Member States. Selection runs from July to December 2027 based on the methodology published in December 2025. All other institutions remain primarily under national supervision, which in Germany means BaFin.

Does the AMLR apply to Swiss banks?

Not directly, because Switzerland is not an EU member and applies its own Anti-Money Laundering Act. Entities of Swiss groups that are established in the EU and qualify as obliged entities there are affected, however. From 10 July 2027 they must meet the AMLR requirements, such as the fixed update intervals for customer information.

How often must customer information be updated under the AMLR?

The interval depends on risk but must not exceed set maximums: one year for higher-risk customers and five years for all other customers (Article 26(2) AMLR). In addition, information must be reviewed whenever relevant circumstances of a customer change.

What does the EUR 10,000 cash limit mean?

Persons trading in goods or providing services may accept or make cash payments only up to EUR 10,000, even if the amount is split into several linked operations (Article 80 AMLR). Member States may set lower limits. Payments between private individuals not acting in a professional capacity are exempt.

Next step

If you want to run an AMLR gap analysis or clear a KYC review backlog with additional specialists, talk to us about scope and profiles. Selected profiles are usually available within 48 hours; the start date is agreed jointly by the company and Alpinum.

• AML, KYC and financial crime compliance: remediation and taskforces
• KYC remediation planning: staffing, team and process
• Interim MLRO or AML project team
• Discuss your requirements

Last updated: 31 October 2026.