EU AMLR 2027 Compliance Guide: CDD, Beneficial Ownership, Monitoring and AML Controls
Publish Date
30 Sep 2026
Reading Time
17 minutes
Category
Legal Guides
Jurisdiction
EU
What changes on 10 July 2027?
The AMLR was adopted in 2024 as part of a wider EU AML/CFT package that also includes the new AMLA Regulation, the Sixth Anti-Money Laundering Directive and the revised Transfer of Funds Regulation.
The central policy objective is greater consistency.
Under the previous structure, EU AML requirements were implemented principally through national legislation transposing directives. That created meaningful differences in interpretation and implementation between jurisdictions.
The AMLR moves many obligations directly into EU law.
The Regulation is already in force but applies later
The AMLR entered into force in 2024 but Article 90 provides that it will apply from 10 July 2027.
The later 10 July 2029 date applies only to the newly covered categories of professional football agents and specified professional football-club transactions.
For Legasset’s core financial, crypto and gambling clients, 10 July 2027 is the operative compliance date.
Which businesses are in scope?
The AMLR applies to a wide population of obliged entities.
At the financial-sector level, this includes credit institutions and financial institutions. The wider EU framework identifies categories including payment institutions, electronic money institutions and crypto-asset service providers. The AMLR also covers designated non-financial businesses and professions, including gambling service providers, trust and company service providers, legal and accounting professionals in specified circumstances, crowdfunding businesses and certain high-value sectors.
For Legasset, four groups deserve particular attention.
| Sector | AMLR relevance |
|---|---|
| CASPs / crypto businesses | Expressly within the financial-sector AML framework, with crypto-specific CDD and wallet rules |
| Payment institutions / EMIs | Subject to the harmonised financial-sector AML/CFT framework and transaction-monitoring obligations |
| Fintech businesses | Scope depends on regulated activity; many fintechs fall within financial institution categories or support obliged entities |
| iGaming businesses | Gambling service providers are obliged entities, with a dedicated EUR 2,000 CDD trigger |
Existing AML programmes should be remapped, not simply renamed
A business that is already AML-regulated will not be starting from zero.
Many familiar concepts remain:
- risk-based compliance;
- customer and beneficial-owner identification;
- enhanced due diligence;
- PEP controls;
- ongoing monitoring;
- suspicious transaction reporting;
- recordkeeping;
- staff training; and
- governance.
What changes is the degree of harmonisation and detail.
The AMLR brings many of these requirements together into a directly applicable rulebook, while AMLA is developing technical standards and Guidelines to make implementation more consistent across sectors.
The correct implementation exercise should therefore compare the existing control environment against the new AMLR article by article, rather than assuming that current national-law compliance will automatically satisfy the 2027 framework.
Business-wide risk assessment becomes the foundation
Article 10 requires obliged entities to identify and assess the money-laundering and terrorist-financing risks to which they are exposed.
Importantly, the assessment also has to address the risks of non-implementation and evasion of targeted financial sanctions.
The analysis must consider factors including the business model, customers, products, services, transactions, delivery channels and geographic exposure. New products, technologies, customer segments and geographic markets must be assessed before launch.
This makes the business-wide risk assessment, or BWRA, more than an annual compliance document.
The BWRA should drive the control environment
A credible BWRA should explain why the firm’s controls look the way they do.
For example:
A CASP with high exposure to self-hosted wallets should show how that risk changes wallet screening and enhanced due diligence.
A payment institution serving higher-risk cross-border merchants should show how geographic and customer-risk factors affect transaction monitoring.
An online casino should show how deposit methods, player geography, rapid movement of funds and linked betting transactions influence risk treatment.
AMLA has already consulted on draft Guidelines under Article 10. Those draft Guidelines are intended to establish minimum expectations while preserving proportionality based on the entity’s business model, size and complexity. As of 26 September 2026, that consultation is closed and the final instrument is still being developed.
Governance becomes more explicit
The AMLR creates a clearer division between board-level responsibility and day-to-day compliance.
An obliged entity must appoint a member of the management body responsible for AML/CFT compliance — the compliance manager — and must also have a sufficiently senior compliance officer responsible for day-to-day AML/CFT policies, controls and contact with competent authorities.
The compliance officer is also responsible for suspicious transaction reporting to the FIU. The two roles can be combined where the nature, size and risk of the business justify it.
This should be reflected in the governance chart
Businesses should document:
who owns AML/CFT at board level;
who operates the control framework;
who approves policies;
who decides customer-risk classifications;
who receives escalation;
who files suspicious transaction reports;
and how the compliance function can escalate directly to management.
The AMLR also requires adequate resources, including staff and technology, proportionate to the size and risk of the business.
A compliance function that exists only on paper is unlikely to satisfy that standard.
Policies and procedures must cover the full AML lifecycle
Article 9 requires written internal policies, procedures and controls.
These cover the business-wide risk assessment, risk-management framework, CDD, PEP identification, suspicious reporting, outsourcing, record retention, remediation, recruitment integrity and staff training.
The policies must remain current and weaknesses must be addressed.
For implementation projects, we recommend avoiding a single oversized AML manual.
It is usually more effective to map the framework across operational documents such as:
CDD procedure;
customer-risk methodology;
transaction-monitoring procedure;
PEP and sanctions procedure;
STR escalation procedure;
outsourcing policy;
group-wide AML framework;
record-retention policy;
and training programme.
The policy suite should then map clearly back to the AMLR.
Customer due diligence triggers become more harmonised
Article 19 establishes a common structure for when CDD is required.
The general rule requires CDD when establishing a business relationship and for an occasional transaction of at least EUR 10,000, subject to sector-specific rules and any lower thresholds adopted under the Regulation.
There are important sector differences.
| Activity | Core AMLR threshold |
|---|---|
| General occasional transaction | EUR 10,000 |
| Certain transfers of funds by financial institutions other than CASPs | EUR 1,000 |
| CASP occasional transaction | EUR 1,000 |
| CASP occasional crypto transaction below EUR 1,000 | At least customer identification and verification measures apply |
| Gambling: collection of winnings, wagering of stake, or both | EUR 2,000 |
| Occasional cash transaction requiring at least identification/verification | EUR 3,000 |
Linked transactions matter
Threshold controls cannot be designed only around individual payments.
AMLA’s draft technical standards on business relationships and linked transactions expressly address the risk that customers split activity into several smaller transactions to avoid CDD triggers.
Interestingly, AMLA stated during the 2026 consultation that it had not at that stage exercised its power to introduce additional lower occasional-transaction thresholds. The technical standard is still being finalised.
Businesses should therefore build aggregation logic into transaction monitoring now rather than relying solely on individual transaction values.
What CDD actually requires
Standard CDD under Article 20 includes four core elements:
identifying and verifying the customer;
identifying the beneficial owner and taking reasonable steps to verify that identity;
understanding the purpose and intended nature of the relationship or occasional transaction; and
checking relevant targeted financial sanctions exposure.
The customer profile should not be treated as static.
Information obtained during onboarding becomes the baseline against which later activity is monitored.
AMLA is still finalising the detailed CDD standard
AMLA consulted in February 2026 on draft Regulatory Technical Standards under Article 28.
Those standards are intended to specify in greater detail what information and documentation obliged entities should collect and how identity should be verified.
The consultation closed on 8 May 2026, and as of the current freshness check AMLA still lists the instrument within its regulatory work programme rather than as a fully completed final standard.
This creates an important implementation principle:
build systems around the Level 1 AMLR requirements now, but preserve flexibility for the final technical standards.
Beneficial ownership is not only a 25% calculation
The AMLR harmonises beneficial ownership around both ownership and control.
For corporate entities, ownership of 25% or more of shares, voting rights or another ownership interest is generally relevant to beneficial ownership.
However, control through other means must also be assessed independently.
This is important for complex groups.
A customer cannot be treated as having no beneficial owner merely because no individual exceeds 25% directly.
The analysis may need to consider:
- indirect holdings;
- voting arrangements;
- control over shareholders;
- rights over profits or internal resources;
- management influence; and
- control through other mechanisms.
For higher-risk categories of entities, EU law also provides a mechanism for lower ownership thresholds to be introduced in the future.
UBO methodology should be standardised across jurisdictions
Cross-border fintech and crypto groups often maintain different UBO rules in different onboarding teams because national requirements historically diverged.
The AMLR creates an opportunity to standardise the core methodology.
Firms should review whether their KYC systems can calculate indirect ownership through multiple layers and distinguish ownership from control.
Ongoing monitoring becomes more structured
CDD does not end when the account is opened.
Article 26 requires ongoing monitoring of the business relationship and requires customer information to remain current.
The maximum interval between scheduled customer-information updates is risk-based but cannot exceed:
1 year for higher-risk customers;
5 years for other customers.
These are maximum intervals, not guaranteed review periods.
A material event should trigger an earlier review.
Event-driven KYC remains essential
Examples can include:
a change in ownership;
a new director;
new geographic activity;
a material increase in transaction volume;
adverse information;
a PEP status change;
new wallet behaviour;
or a significant change in the product used.
AMLA’s 2026 draft ongoing-monitoring Guidelines focus on two areas: keeping customer information current and transaction/activity monitoring.
The consultation closed on 3 September 2026, and final Guidelines are still pending.
Businesses implementing KYC refresh tooling should therefore build around the statutory 1-year / 5-year ceilings while allowing configuration once the final AMLA guidance is available.
Transaction monitoring must test activity against customer risk
Ongoing monitoring requires more than screening transactions against fixed rules.
The firm must understand whether transactions and activity are consistent with its knowledge of the customer, business, risk profile and, where appropriate, source of funds.
AMLA’s draft monitoring framework is intended to apply across financial and non-financial sectors and to harmonise core principles rather than impose identical alert logic on every industry.
For Legasset sectors, the indicators differ significantly.
Payments and EMIs
Relevant monitoring may include unusual merchant activity, rapid movement of funds, geographic mismatches, transaction splitting, mule indicators and abnormal payment flows.
CASPs
Monitoring can require integration of customer behaviour with blockchain analytics, Travel Rule information, wallet exposure and self-hosted-address risk.
iGaming
Monitoring may need to detect rapid deposit and withdrawal patterns, minimal gameplay, third-party funding, linked accounts, structuring around CDD triggers and unusual movement between payment methods.
The compliance framework should therefore explain why monitoring scenarios correspond to the BWRA.
Enhanced due diligence remains risk-based
Where a higher ML/TF risk is identified, enhanced due diligence applies.
Measures can include obtaining additional information on the customer or beneficial owner, understanding source of funds and source of wealth, obtaining senior-management approval and applying more intensive monitoring.
Higher-risk treatment should be justified by the risk profile rather than used mechanically.
That is especially important for PEPs.
PEPs require specific measures
For politically exposed persons, the AMLR requires:
senior-management approval for entering into or continuing the relationship;
adequate measures to establish source of wealth and source of funds; and
enhanced ongoing monitoring.
PEP status should not itself be treated as evidence of criminal activity.
The Regulation expressly frames PEP requirements as preventive.
That distinction should be reflected in customer-risk policies to avoid crude automatic de-risking.
CASPs face a particularly detailed AMLR transition
Crypto businesses are among the sectors most directly affected by the new rulebook.
CASPs are already subject to MiCA authorisation requirements and the EU crypto Travel Rule.
From July 2027, the AMLR adds a more harmonised private-sector AML framework on top of that regulatory infrastructure.
The EUR 1,000 threshold is crypto-specific
For an occasional crypto transaction of EUR 1,000 or more, full CDD applies.
Below EUR 1,000, CASPs must still perform at least specified customer identification and verification measures.
That makes crypto materially different from the general EUR 10,000 occasional-transaction rule.
Self-hosted wallets need dedicated controls
The current Transfer of Funds Regulation already creates specific requirements where crypto transfers involve self-hosted addresses.
The AMLR then adds a risk-based framework requiring CASPs to assess ML/TF risks associated with transfers to and from self-hosted addresses and apply appropriate mitigation.
AMLA is also mandated to provide further guidance on those measures.
CASPs should therefore treat wallet-risk controls, Travel Rule compliance and AMLR implementation as one integrated project.
Payment institutions and EMIs should test the customer definition carefully
The AMLR includes activity-specific rules for parts of the payments sector.
For example, in relation to payment initiation services, the Regulation specifies that the merchant is treated as the customer for purposes of the relevant CDD chapter.
Payment groups should therefore map customer relationships by service.
The party treated commercially as the user of a platform is not always necessarily the only relevant AML customer.
This becomes particularly important in marketplace, merchant-acquiring, payment-initiation and embedded-finance models.
Gambling businesses face a EUR 2,000 threshold
Providers of gambling services must apply CDD when the collection of winnings, wagering of a stake, or both reaches EUR 2,000, whether through one transaction or linked transactions.
The Regulation also expects gambling providers to be able to attribute transactions to a customer so they can determine when the threshold has been reached.
This can require transaction attribution even before full identity verification.
For online casinos and sportsbooks, that means the platform architecture must support aggregation.
Gambling exemptions remain limited and risk-based
Member States can exempt certain gambling services where proven low risk exists.
However, the AMLR specifically restricts the use of those exemptions for higher-risk gambling categories, including casinos, with detailed conditions for other forms of gambling.
Operators should therefore avoid assuming that a national exemption under the old framework automatically continues unchanged after July 2027.
Suspicious reporting becomes more harmonised
Article 69 requires obliged entities to report to the relevant FIU where they know, suspect or have reasonable grounds to suspect that funds or activities are connected with criminal activity or terrorist financing.
The obligation applies regardless of the amount involved.
The firm also needs an internal escalation process that allows potentially suspicious activity to reach the compliance function quickly enough for an effective decision.
The reporting format itself is being harmonised
AMLA launched a 2026 consultation on common templates for suspicious reporting and provision of transaction records.
The aim is to reduce the current differences in reporting formats between Member States.
The consultation is closed, but the final implementing standard is not yet complete.
Cross-border groups should therefore avoid investing heavily in country-specific automation that cannot be reconfigured.
Tipping-off controls remain critical
The AMLR prohibits obliged entities and relevant personnel from informing the customer or third parties that suspicious activity is being assessed or that information has been or will be reported to an FIU.
That restriction needs to be incorporated into:
customer-support procedures;
account restriction processes;
investigation notes;
legal escalation;
and communications during account termination.
Poorly drafted customer messages can create a tipping-off problem even where the STR process itself is technically correct.
Outsourcing does not transfer AML responsibility
The AMLR permits outsourcing of some tasks but keeps responsibility with the obliged entity.
It also identifies functions that cannot simply be outsourced.
These include core decisions such as approval of the BWRA and AML policies, assigning the customer risk profile, deciding whether to enter a business relationship, and suspicious reporting outside limited intra-group circumstances.
This is highly relevant to fintech and iGaming businesses relying heavily on KYC vendors.
A provider can support identification, screening or monitoring.
The regulated firm remains responsible for the compliance outcome.
Group-wide AML frameworks need to be rebuilt around the new standard
Groups must establish group-wide AML/CFT policies and information-sharing arrangements.
The framework is intended to allow relevant information about customers, beneficial owners, relationships and suspicions to move within the group where required for AML/CFT risk management, subject to confidentiality and data-protection safeguards.
Where branches or subsidiaries operate in third countries with weaker rules, the EU parent must seek equivalent compliance.
If local law prevents that, additional measures and supervisor notification are required.
AMLA consulted in 2026 on detailed RTS for group-wide controls and third-country restrictions. That consultation is closed and final standards remain in development.
For international groups, this is one of the areas most likely to require legal-entity mapping.
Record retention remains five years
The AMLR requires relevant CDD documents, transaction records, suspicious-activity assessments and related evidence to be retained.
The baseline retention period is five years from termination of the business relationship or completion of the occasional transaction.
The system used to retain records should support prompt regulatory retrieval and preserve integrity.
For crypto and payments businesses, this should also be coordinated with transaction-system and wallet data retention rather than handled only through the KYC platform.
AML decisions using AI still require human control
The AMLR expressly anticipates automated processes and AI-assisted decision making.
Where automated systems influence decisions such as whether to enter or maintain a relationship or adjust CDD measures, the Regulation requires meaningful human intervention, together with safeguards around the use of the data and the ability of the customer to obtain an explanation in relevant cases.
This will become increasingly relevant as firms automate:
customer risk scoring;
adverse-media analysis;
transaction-monitoring alerts;
fraud/AML convergence;
and wallet-risk assessment.
AI can support AML compliance.
It should not become an undocumented black box making final regulatory decisions.
The EU introduces a EUR 10,000 cash-payment ceiling
From the AMLR application date, persons trading in goods or providing services generally may not make or accept cash payments above EUR 10,000, including linked operations.
Member States can maintain or introduce lower national limits.
The rule is more relevant to cash-intensive sectors than to most digital fintech businesses, but it can affect physical casinos, certain high-value services and mixed business models.
A business operating across the EU should therefore check both the EU ceiling and any lower Member State limit.
AMLR does not eliminate Member State differences completely
Direct applicability is one of the biggest changes, but firms should not assume every national difference disappears.
Member States still play important roles in areas including:
supervision;
FIU procedures;
national risk assessments;
certain gambling exemptions;
lower cash limits;
and implementation of options left to national law.
A cross-border compliance programme should therefore have two layers:
EU baseline and Member State overlay.
That is especially important for businesses passporting or operating establishments in several Member States.
What is already fixed and what is still being finalised?
This distinction should guide implementation spending.
| Area | Status as of 26 September 2026 |
|---|---|
| AMLR Level 1 Regulation | Final; applies from 10 July 2027 for most obliged entities |
| EUR 10,000 / EUR 1,000 / EUR 2,000 CDD thresholds | Fixed in AMLR, subject to permitted lower thresholds and specific rules |
| Beneficial ownership baseline | Fixed in AMLR |
| 1-year / 5-year customer refresh ceilings | Fixed in AMLR |
| Business-wide risk assessment Guidelines | Consultation closed; final AMLA instrument pending |
| CDD RTS | Consultation closed; finalisation pending |
| Linked transaction / business relationship RTS | Consultation closed |
| Ongoing monitoring Guidelines | Consultation closed on 3 September 2026 |
| Group-wide RTS | Consultation closed |
| Suspicious reporting format ITS | Consultation closed; common reporting format still being finalised |
AMLR implementation timeline
| Date | Development |
|---|---|
| 19 June 2024 | AMLR published in the Official Journal |
| 30 December 2024 | Revised crypto Travel Rule framework became applicable |
| 2026 | AMLA develops and consults on major Level 2 and Level 3 instruments |
| 26 September 2026 | Multiple key AMLR consultations are closed, with final standards still in development |
| 10 July 2027 | AMLR applies to most obliged entities |
| 2027 | AMLA begins selection of entities for direct supervision |
| 2028 | AMLA direct supervision of selected high-risk cross-border financial institutions begins |
A practical AMLR implementation plan
We recommend structuring the project around ten workstreams:
- Scope mapping — identify which group entities and activities are obliged entities under the AMLR.
- Regulatory gap analysis — map existing national-law controls against AMLR requirements.
- BWRA rebuild — integrate AML/TF and targeted-financial-sanctions risk into one documented methodology.
- CDD redesign — update thresholds, linked-transaction rules, UBO methodology and customer information requirements.
- Customer refresh logic — configure risk-based 1-year and 5-year maximum review periods plus event-driven triggers.
- Monitoring recalibration — align transaction and activity monitoring with the new BWRA and customer-risk framework.
- Governance update — document compliance manager, compliance officer, escalation, audit and board responsibilities.
- Outsourcing and vendor review — identify which AML tasks are delegated and which decisions must remain with the obliged entity.
- Group framework — update cross-border information sharing, third-country subsidiary controls and group policies.
- Technology and reporting readiness — prepare KYC, monitoring, FIU reporting and record systems for final AMLA standards.
The priority should be those changes that require development, procurement or contract renegotiation.
Policy wording can usually be finalised later.
Technology architecture often cannot.
What CASPs should prioritise before July 2027
Crypto businesses should focus on the areas where AMLR interacts directly with MiCA and the Transfer of Funds Regulation.
In practice, this means testing:
the EUR 1,000 occasional transaction rule;
controls below EUR 1,000;
Travel Rule information;
self-hosted-wallet assessment;
blockchain analytics governance;
transaction-monitoring integration;
cross-border crypto relationships;
and customer/beneficial-owner data quality.
For MiCA-authorised firms, the mistake would be to treat AMLR as a separate second project.
The controls should be integrated into the same governance architecture.
What payment and EMI firms should prioritise
Payment businesses should review customer definitions, merchant onboarding, agent/distributor governance, transaction monitoring, cross-border group controls and virtual-account structures.
The AMLR also expressly requires ongoing AML training for employees and, where relevant, agents and distributors.
For embedded-finance businesses, particular care should be taken over which entity is the obliged entity and which party owns the customer relationship for AML purposes.
What iGaming businesses should prioritise
Online casinos and sportsbooks should focus early on transaction aggregation and customer attribution.
The EUR 2,000 gambling trigger cannot be implemented reliably if the platform cannot identify linked wagers, deposits and withdrawals associated with the same customer.
The AML programme should also align player-risk scoring with:
payment behaviour;
jurisdiction;
source of funds;
ownership of payment methods;
wallet activity where crypto is accepted;
and gambling behaviour that may indicate movement of funds rather than genuine play.
For multi-jurisdictional groups, national gambling regulation and AMLR requirements should be mapped together rather than operated in separate compliance silos.
AMLR 2027 Compliance Questions
When does the EU AML Regulation apply?
Regulation (EU) 2024/1624 applies from 10 July 2027 for most obliged entities.
The later 10 July 2029 date relates to specified football-sector obliged entities rather than the financial, crypto and gambling sectors covered in this guide.
Is AMLR a directive that Member States need to transpose?
No.
AMLR is a Regulation and is directly applicable in EU Member States.
National law remains relevant where the Regulation leaves Member State options or where supervision and enforcement operate through national structures.
Are crypto-asset service providers covered?
Yes.
CASPs are expressly incorporated into the EU financial-sector AML framework. They also remain subject to MiCA and the crypto Transfer of Funds Regulation.
What is the AMLR CDD threshold for crypto transactions?
For an occasional crypto transaction, a CASP must perform CDD at EUR 1,000 or more.
For occasional transactions below EUR 1,000, specified identification and verification measures still apply.
What is the CDD threshold for gambling?
Gambling service providers must apply CDD when collection of winnings, wagering of a stake, or both reaches EUR 2,000, including linked transactions.
What is the general occasional-transaction threshold?
The general AMLR threshold is EUR 10,000, subject to sector-specific requirements and any lower thresholds adopted under the applicable legal framework.
How often must KYC information be refreshed?
The maximum interval is one year for higher-risk customers and five years for other customers.
Material events can require earlier review.
What is the new beneficial ownership threshold?
The AMLR generally uses 25% or more ownership for corporate entities, while also requiring firms to identify control through other means.
The test should therefore not be reduced to ownership percentage alone.
Does the AMLR require a compliance officer?
Yes.
The framework distinguishes between a management-body member responsible for compliance oversight and a sufficiently senior compliance officer responsible for day-to-day AML/CFT controls.
Those functions may be combined where the nature and size of the business justify it.
Can KYC and AML monitoring be outsourced?
Certain functions can be supported by external providers, but the obliged entity remains responsible.
The AMLR also prevents outsourcing of specified core decisions such as customer-risk classification, approval of the BWRA and certain suspicious-reporting functions.
How long must AML records be retained?
The baseline AMLR retention period is five years after the business relationship ends or the occasional transaction is completed.
Are AMLA’s detailed technical rules final?
Not all of them.
As of 26 September 2026, important AMLA instruments on CDD, ongoing monitoring, business-wide risk assessment, group-wide controls and suspicious-reporting formats remain in the finalisation process following consultations.
Should firms wait for final AMLA standards before starting implementation?
No.
The core obligations and July 2027 application date are already fixed in the AMLR.
Businesses should implement the Level 1 framework now and leave configurable elements for the final technical standards.
EU AMLR 2027: Official Regulatory and AMLA Implementation Materials
The official AMLR text establishes the directly applicable EU requirements for obliged entities, including customer due diligence, beneficial ownership, monitoring, internal controls, suspicious reporting, record retention and the 10 July 2027 application date.
II. European Commission — EU Anti-Money Laundering and Counter-Terrorist Financing Framework
The Commission’s overview brings together the AMLR, AMLA Regulation, AML Directive and other components of the new EU AML/CFT legislative package.
III. AMLA — Regulatory Instruments and AML Single Rulebook Development
AMLA’s central regulatory tracker provides the current status of technical standards and Guidelines covering customer due diligence, business-wide risk assessments, ongoing monitoring, group-wide controls and suspicious reporting.
IV. AMLA — Draft Regulatory Technical Standards on Customer Due Diligence
The CDD consultation explains AMLA’s work to harmonise the customer information, documentation and verification standards used by financial and non-financial obliged entities under the AMLR.
V. AMLA — Draft Guidelines on Business-Wide Risk Assessment
The Guidelines set out the proposed minimum framework for assessing AML/CFT risks arising from business models, customers, products, services, transactions, channels and geographic exposure.
VI. AMLA — Draft Guidelines on Ongoing Monitoring of Business Relationships
The consultation addresses customer-information refresh processes and transaction and activity monitoring under Article 26 AMLR.
VII. AMLA — Draft RTS on Group-Wide AML/CFT Requirements
These draft standards address group-wide AML/CFT frameworks, cross-border information sharing and additional measures where third-country laws prevent application of equivalent EU controls.
VIII. AMLA — Draft Common Format for Reporting Suspicious Activity
The draft implementing standards seek to harmonise suspicious-reporting data and transaction-record formats across EU Financial Intelligence Units and obliged entities.
