EU AML Regulation from 10 July 2027: what payment institutions, EMIs and crypto firms must change

By Harry Khan, Founder · Published 8 November 2026 · Last reviewed 8 November 2026

The short answer

From 10 July 2027, the EU's anti-money laundering rules for firms move from national laws into a single regulation that applies directly in every member state: the AML Regulation (AMLR), Regulation (EU) 2024/1624. Payment institutions, electronic money institutions (EMIs) and crypto-asset service providers (CASPs) are obliged entities under it. A companion directive, the sixth AML Directive, covers supervisors and registers, and a new EU authority, the Anti-Money Laundering Authority (AMLA) in Frankfurt, coordinates supervision and will directly supervise 40 high-risk cross-border institutions from 2028.

For most firms the AMLR does not invent new concepts. It harmonises customer due diligence, beneficial ownership, enhanced due diligence, reliance and internal controls, removing many of the national differences that cross-border firms manage today. But the detail changes, and firms need policies, systems and governance that match the regulation on 10 July 2027.

The EU AML package

The AMLR is a regulation, so it applies without national transposition. Member states can no longer add their own customer due diligence rules on top in most areas, though national supervisors still supervise most firms.

What changes for payment institutions and EMIs

• Customer due diligence. One set of rules on identification, verification, the purpose of the relationship and ongoing monitoring, with technical standards from AMLA on the information to collect.
• Beneficial ownership. A common 25% ownership threshold and more detailed rules on control through other means, with checks against central registers.
• Enhanced due diligence. Harmonised triggers, including for high-risk third countries identified at EU level and for cross-border correspondent relationships.
• Internal controls. A member of the management body responsible for AML compliance, a compliance officer, group-wide policies and a business-wide risk assessment.
• Outsourcing and reliance. Clearer rules on what can be outsourced and when firms can rely on due diligence carried out by others.
• E-money. Revised conditions for simplified treatment of low-value e-money products.

EMIs and payment institutions that passport across the EU will benefit most, because one policy can serve all member states. They also need to remove national variations from their procedures where the regulation now sets the rule.

What changes for crypto-asset service providers

CASPs authorised under MiCA are obliged entities under the AMLR. Specific provisions include due diligence for occasional transactions of EUR 1,000 or more, enhanced measures for cross-border correspondent relationships with other CASPs, a ban on anonymous accounts including anonymous crypto-asset accounts, and risk measures for transfers involving self-hosted wallets. These apply alongside the travel rule under the Transfer of Funds Regulation, which has applied since 30 December 2024.

CASPs should treat the AMLR as part of the same compliance project as MiCA. National supervisors already assess AML controls in MiCA applications, and our page on MiCA CASP authorisation covers that file.

For crypto firms, the practical work is in onboarding thresholds, wallet screening and counterparty due diligence. Occasional transactions that fall below the threshold today in some member states will need full due diligence once they reach EUR 1,000. Transfers to and from self-hosted wallets need risk-based measures, which usually means wallet ownership checks above set values and blockchain analytics on the counterparty address. Relationships with other CASPs, for liquidity, custody or settlement, need correspondent files with senior approval.

Business-wide risk assessment and governance

The AMLR requires each obliged entity to maintain a business-wide risk assessment covering its customers, products, services, transactions, delivery channels and geographies, documented, kept up to date and made available to the supervisor. It must take account of the EU supranational risk assessment, national risk assessments and AMLA guidance. The management body approves internal policies and controls, one of its members is responsible for AML compliance, and a compliance officer carries out day-to-day work with direct access to the management body.

For groups, the parent must put group-wide policies in place and share information within the group for AML purposes. Branches and subsidiaries outside the EU must apply measures at least equivalent to the AMLR where local law allows. A group that today runs separate frameworks in each member state should design one group framework and keep local annexes only where national law still applies.

Customer due diligence in more detail

The AMLR spells out the information to collect for natural persons and legal entities, the timing of verification, the circumstances in which simplified and enhanced measures apply, and the frequency of updates. AMLA's technical standards will add detail on the information required, including for remote onboarding and electronic identification. Firms should review onboarding journeys against the final standards, because changes to data fields and verification methods take time to build and test.

Ongoing monitoring must be proportionate to risk, with customer information updated at set intervals: more frequently for higher-risk customers. Firms that rely on periodic refresh cycles set years ago should recalibrate them to the regulation and record the reasoning.

Beneficial ownership in practice

The AMLR sets a common 25% threshold for ownership and requires firms to identify control exercised through other means, such as voting agreements, rights to appoint directors or family ties. Where ownership runs through several layers, the firm must understand the structure and record how it reached its conclusion. Firms must report discrepancies between what they find and what central beneficial ownership registers show. For payment and e-money firms with many business customers, the change is mainly in the documentation of complex structures and the discrepancy reporting process.

High-risk countries and enhanced due diligence

Under the AMLR, the EU identifies high-risk third countries, taking account of FATF listings, and sets the measures that apply. Some lists trigger full enhanced due diligence; others trigger specific measures only. Firms must apply the EU lists directly rather than national versions. Payment institutions with remittance corridors, and CASPs with customers or counterparties in listed countries, should map their exposure to the EU lists, set the measures for each, and plan for changes after each update. Cross-border correspondent relationships with institutions outside the EU, including between CASPs, require enhanced measures such as senior management approval and an assessment of the respondent's controls.

AMLA direct supervision from 2028

AMLA will directly supervise 40 selected obliged entities. To be eligible, a credit or financial institution, including a CASP, payment institution or EMI, must operate in at least six member states, through establishments or cross-border services, and be among those with the highest money laundering and terrorist financing risk under AMLA's methodology. The first selection runs for six months from 1 July 2027, and direct supervision begins on 1 January 2028. The selection is reviewed every three years.

Large EMIs, payment institutions and CASPs that passport widely are among the types most likely to be considered. A firm that could be selected should expect supervision through a joint team led by AMLA, with higher expectations on governance and data.

How the AMLR fits with PSD3 and MiCA

The AMLR applies from July 2027, around the time EU payment institutions and EMIs start preparing their PSD3 re-authorisation files. The authorisation file under PSD3 includes AML internal controls, so firms can prepare once: build AMLR-compliant controls, then describe them in the PSD3 file. Our PSD3 re-authorisation guide covers that process. For CASPs, the end of MiCA's transitional periods on 1 July 2026 means most are now authorised or in the queue, and AMLR compliance becomes part of ongoing supervision.

A plan to 10 July 2027

AMLA and the European Commission are adopting technical standards and guidelines through 2026 and 2027. Firms should track them and leave room in the plan to absorb late detail.

Start with the gap analysis: it shows how much of the existing framework can be kept and where the real work lies.

Groups with UK and EU entities

The AMLR does not apply in the UK, where the Money Laundering Regulations, amended in 2026, continue to apply. Groups with UK and EU entities will run two frameworks that are close in principle but different in detail: high-risk country lists, thresholds and some due diligence rules differ. A group policy should set common standards and annex the differences for each regime. Our guide to the UK MLR changes of 2026 covers the UK side.

How Buckingham Capital Consulting helps

We run AMLR gap analyses for payment institutions, EMIs and CASPs, rewrite policies and procedures to the regulation, and prepare the AML sections of PSD3 and MiCA files. Our financial crime services cover the program from risk assessment to testing, and our guides to the Lithuania EMI licence and Ireland EMI licence cover the supervisors firms deal with today.

Questions

Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.