The EU AML Package: The Countdown to 10 July 2027

On 17 September 2026 the Czech Financial Analytical Office (Finanční analytický úřad, or FAÚ) opened a guidance series for the firms it supervises, titled the AML package step by step. Its first instalment is narrow and practical: which legal texts will govern anti-money-laundering and counter-terrorist-financing work from 10 July 2027. That date is the pivot for the whole EU AML package.

From 10 July 2027, AMLR will directly apply many substantive AML/CFT obligations that are currently implemented through national law under Directive (EU) 2015/849, while national law remains necessary for AMLD6 mechanisms and other domestic provisions. The new EU supervisor, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), has run from Frankfurt since 1 July 2025 and is already gathering the data it needs to pick the cross-border firms it will supervise directly. National authorities are moving too: the FAÚ has opened its AML-package guidance series, while the CSSF has issued supervisory communications on AMLA’s direct-supervision work. In Luxembourg, the national FIU is the Cellule de renseignement financier (CRF), not the CSSF.

The EU AML/CFT framework comprises four legal acts: Regulation (EU) 2024/1624 (AMLR), Directive (EU) 2024/1640 (AMLD6), Regulation (EU) 2024/1620 establishing AMLA, and Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (TFR). They have different legal effects and application dates, so 10 July 2027 is the AMLR/AMLD6 pivot rather than the start date of the entire package.

Related reading: AMLR: what changes for Luxembourg firms

Four instruments, one 2027 pivot

The EU AML/CFT framework is built from four legal acts. The three 2024 acts, Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620, are dated 31 May 2024 and were published in the Official Journal on 19 June 2024. Regulation (EU) 2023/1113, the recast Transfer of Funds Regulation, was published on 9 June 2023 and applies from 30 December 2024.

Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation, is the single rulebook. It is directly applicable, which means the same text applies in every Member State without national transposition. It carries the substantive obligations that touch a reporting officer daily: customer due diligence, beneficial ownership, record-keeping, the cash-payment limit and the duty to report suspicion.

Directive (EU) 2024/1640, the sixth Anti-Money Laundering Directive (AMLD6), works the other way. It tells Member States what to build: beneficial ownership registers, centralised bank-account registers, empowered financial intelligence units and national supervisors. Member States must write those mechanisms into national law.

Regulation (EU) 2024/1620 establishes AMLA itself. It sets the authority’s powers, its governance and the process by which it will supervise the highest-risk firms directly and coordinate FIUs across the Union.

The distinction matters operationally. Because the Regulation is directly applicable, some teams expect their national AML statute to disappear on 10 July 2027. It will stay. The Czech Republic is drafting a domestic implementing act, which the FAÚ refers to in its first article, and Luxembourg will amend its own AML law. Obliged entities will read the Regulation and a slimmer national statute side by side.

The dates that bind a project plan

Deadline pressure is the reason this topic sits prominent in 2026 compliance planning. Several implementation dates already lie in the past. The package was adopted on 31 May 2024 and published in the Official Journal on 19 June 2024. AMLA became operational in Frankfurt on 1 July 2025, and at the start of 2026 it absorbed the anti-money-laundering mandate that had sat with the European Banking Authority. Member States were also required to guarantee access to beneficial ownership information from 10 July 2025, with further development of the interconnected beneficial ownership registers required from 10 July 2026.

Several implementation and review dates remain open beyond 2027, including dates in 2028, 2029, 2030 and later. The central pivot is 10 July 2027, when the Regulation becomes directly applicable and AMLD6’s general transposition deadline falls. AMLA’s current timeline places the selection procedure in July to December 2027 and the start of direct supervision in 2028. Regulation (EU) 2024/1620 provides that direct supervision starts six months after publication of the selected-entity list. A further phase arrives on 10 July 2029, when Article 18 of AMLD6 must be transposed for the real-estate single access point and AMLR begins to apply to football agents and to professional football clubs in respect of the transactions listed in Article 3(3)(o), subject to the Member State exemptions for certain professional football clubs permitted by Article 5.

What the AML Regulation makes directly applicable

The Regulation is where the day-to-day reporting obligations converge into one text. Four changes will show up quickly in systems and procedures.

First, scope changes. Crypto-asset service providers performing one or more crypto-asset services within the AML/CFT definition are already covered by the current EU AML/CFT framework following Regulation (EU) 2023/1113’s amendment of Directive (EU) 2015/849; AMLR brings that defined category into the directly applicable rulebook from 10 July 2027. In both the current Directive and AMLR, providing advice on crypto-assets is excluded from the relevant definition of crypto-asset services. Persons trading regularly or principally in the high-value goods covered by Article 3 are also obliged entities under AMLR. Football agents, and professional football clubs only in respect of the transactions listed in Article 3(3)(o), are brought into AMLR scope from 10 July 2029. Article 5 nevertheless permits Member States, on the basis of proven low risk, to exempt in full or in part top-division clubs with total annual turnover below EUR 5 million in each of the previous two calendar years and clubs participating in lower divisions.

Second, Article 80 limits cash payments made or accepted by persons trading in goods or providing services to EUR 10,000 or the equivalent, including linked operations. Lower national limits may apply. The Article 80 ceiling does not apply to non-professional payments between natural persons or to payments or deposits made at the premises of credit institutions, electronic-money issuers and payment service providers; payments or deposits in that second category above the Article 80(1) limit of EUR 10,000 or the equivalent in national or foreign currency must instead be reported to the FIU within the FIU’s deadlines.

Third, customer due diligence is harmonised. The triggers, the standard measures, the enhanced-diligence cases and the simplified cases are written once, for the whole Union, rather than left to twenty-seven national interpretations.

Fourth, the duty to report to the FIU is set out in the Regulation itself, the clearest signal that the reporting trigger is meant to be identical wherever a group operates.

The phrase directly applicable does the heavy lifting here, and it is easy to overstate. It removes national transposition of these substantive rules. The national implementing statute survives, continuing to carry registers, FIU procedures and penalties. Reading the Regulation as a complete national code is the first mapping error to avoid.

Beneficial ownership moves to one definition

Beneficial ownership is the area that national divergence has most directly shaped, and it is the area the package changes hardest.

The Regulation fixes a single EU definition of the beneficial owner. An ownership interest is set at 25% or more of shares, voting rights or other ownership interest, including rights to a share of profits (Chapter IV, Article 52). That replaces the patchwork of national thresholds and definitions built up under the older directives. The Regulation also lets the Commission set lower thresholds for higher-risk sectors through later delegated acts, so the 25% figure is a baseline for most entities rather than a permanent universal number.

AMLD6 carries the register side. Access to beneficial ownership information had to be in place from 10 July 2025, the further development of the interconnected registers from 10 July 2026, and a single access point for real-estate information from 10 July 2029.

The common error here is assuming existing beneficial-ownership logic ports across untouched. It rarely does. Layered ownership chains, nominee arrangements and control through other means must be tested under Articles 51 to 57. The 25% threshold is the ownership-interest test; control via other means must be assessed independently and in parallel. Senior managing-official details are used only where, after all possible identification means have been exhausted, no beneficial owner can be identified or there is substantial and justified uncertainty about the persons identified. For reporting teams, the practical task is to re-derive beneficial owners against the AMLR methodology and update existing national beneficial-ownership register processes where AMLD6 implementation changes the applicable information, verification or submission requirements.

Suspicious transaction reporting under the new rulebook

For an AML reporting function, the centre of gravity is the duty to report suspicion, and the package writes it into the Regulation. Article 69 requires an obliged entity to transmit a report to the financial intelligence unit promptly when it knows, suspects or has reasonable grounds to suspect that funds or an activity are linked to criminal activity or to terrorist financing.

A firm files on suspicion, without waiting for confirmation or proof. Article 21(1) provides that where an obliged entity cannot comply with the customer due diligence measures in Article 20(1), it must refrain from carrying out a transaction or establishing a business relationship, terminate an existing business relationship, and consider reporting a suspicious transaction to the FIU under Article 69, subject to the specific exceptions and alternatives in Article 21. Termination does not replace an Article 69 report where the Article 69 reporting trigger is met.

What stays the same is the destination. Reports go to the national FIU through the national channel. In Luxembourg that means the goAML platform operated by the Cellule de Renseignement Financier; in the Czech Republic it means the FAÚ’s own reporting route. AMLA supports and coordinates FIUs and provides methods, coordination, tools and operational support for joint analyses, but ordinary Article 69 reports are submitted to the relevant national FIU, not to AMLA.

Practitioners can see how that national channel works today in the goAML reporting workflow used by Luxembourg’s FIU. That shape, one harmonised trigger and many national inboxes, is what reporting teams should design their systems around.

AMLA, and the firms it will supervise directly

AMLA is the structural change the package is named for. It has been operational in Frankfurt since 1 July 2025, and it took over the anti-money-laundering mandate previously held by the European Banking Authority at the start of 2026. Its work runs on two pillars: consistent AML/CFT supervision across the Union, and support and coordination for the Member States’ FIUs.

Supervision of the financial sector splits in two. AMLA will directly supervise selected entities. Non-selected entities remain under direct supervision by their national financial supervisors, while AMLA exercises the Regulation’s indirect-supervision powers in relation to the supervision of those non-selected entities. Direct supervision begins in 2028 over up to 40 selected financial institutions or groups that meet the applicable cross-border and risk criteria for the first selection cycle. For the first selection cycle, the periodic assessment covers credit institutions, financial institutions and relevant groups operating in at least six Member States, including the home Member State. Entities whose residual risk profile is classified as high may qualify for selection. AMLA must start the first selection process by 1 July 2027 and conclude it within six months; direct supervision begins six months after the selected-entity list is published. Each directly supervised firm is assigned a joint supervisory team that includes its national supervisors.

The selection work starts well before the go-live. AMLA published the documents for identifying entities eligible for direct supervision on 12 May 2026 and ran a webinar on 10 June 2026 to walk firms through them. National supervisors relayed the message: the CSSF told relevant Luxembourg entities to review the documents and prepare for the data collection now. Eligibility is determined by the cross-border-activity and residual-risk criteria under Articles 12 and 13 of Regulation (EU) 2024/1620, with the first selection cycle subject to the transitional selection rule in Article 106(2). Firms can see what the exercise asks for in AMLA’s risk-assessment data collection for direct supervision and in the emerging home-host model for cross-border AML teams.

A common misconception is worth correcting head-on: firms outside the up-to-40 sometimes read the direct-supervision headline as if the package passes them by. Every obliged entity in AMLR scope is bound by the single rulebook, whoever supervises it. Non-selected financial entities remain directly supervised by their national financial supervisors, while AMLA exercises indirect-supervision powers under Section 4 of Regulation (EU) 2024/1620.

AMLD6 and the parts that stay national

AMLD6 is the quieter half of the package, and it is where national variation survives. The directive assigns to Member States the machinery around the Regulation: the beneficial ownership registers, the centralised automated mechanisms for bank and payment account information, the powers and independence of FIUs, and the powers of national supervisors.

The general transposition deadline is 10 July 2027, the same day the Regulation applies. Some provisions run on a different clock, as described above: beneficial ownership access from 10 July 2025, register development from 10 July 2026, and the real-estate single access point from 10 July 2029.

Because a directive is transposed rather than directly applied, differences between Member States will persist inside the harmonised frame. How a register handles legitimate-interest access, how an FIU takes delivery of reports, and what penalties attach to a failure are all shaped by national law. A group running one AML Regulation across several countries will still meet several national implementing regimes underneath it. That is the trap in reading the package as full harmonisation: the rulebook is single while the underlying mechanisms stay national.

Bank account registers, FIU access and the data teams already hold

Two mechanisms in AMLD6 change what supervisors and FIUs can see, and both carry a reporting dimension that firms tend to underestimate. The directive requires Member States to run centralised automated mechanisms, such as bank account registers, that let FIUs and competent authorities identify the holders of bank and payment accounts quickly, and it pushes national registers toward interconnection at EU level. It also requires each Member State to maintain an operationally independent FIU with direct access to financial, administrative and law-enforcement information.

AMLD6 broadens and interconnects the account information available to FIUs, AMLA and supervisory authorities under the applicable access rules. Firms should therefore treat consistency across data submitted through AML/CFT reporting and register channels as a control objective; the Directive itself does not quantify the scale of obliged entities’ template changes.

Sequencing the EU AML package for reporting and compliance teams

A change this wide rewards an ordered plan over a scramble in 2027. Five workstreams cover most of it.

Start with a gap analysis: put your current national customer due diligence and beneficial ownership policies next to the Regulation and mark where the harmonised text is stricter or simply different. Then remediate beneficial ownership data against Articles 51 to 57: apply the 25% ownership-interest test and assess control via other means independently and in parallel, then update national-register processes as Member States implement AMLD6. Third, align the suspicious-reporting process to the Article 69 wording and confirm the national FIU channel you file through. Fourth, test your cross-border footprint against the direct-supervision criteria, confirm whether your group was captured in the 2026 provisional-eligibility exercise, and monitor AMLA’s announcements on the schedule for the next eligibility collection. Fifth, track the draft Level 2 technical standards AMLA is developing for Commission adoption and the Level 3 guidelines AMLA issues, because the new framework leaves detail for those instruments to fill.

The FAÚ’s step-by-step series and the CSSF’s communiqués are useful precisely because they show national supervisors sequencing the same work. For a reporting officer, the first concrete task is deciding, against the AMLA identification documents already published, whether your group sits in the selection pool, a determination that comes well before the 2027 go-live.

Frequently Asked Questions

Does the AML Regulation replace our national AML law entirely on 10 July 2027?

No. The Regulation is directly applicable and carries the substantive obligations, but Member States keep a national implementing statute for beneficial ownership registers, FIU procedures, supervisory powers and penalties. Obliged entities apply the Regulation and the national law together.

If our firm is not one of the up-to-40 directly supervised entities, does the package still apply to us?

Yes. The single rulebook binds every obliged entity regardless of who supervises it. Non-selected financial entities remain under direct supervision by their national financial supervisors, while AMLA exercises indirect-supervision powers under Regulation (EU) 2024/1620; AMLR still applies to them according to its scope.

Do we send suspicious transaction reports to AMLA?

Reports go to the national financial intelligence unit through the national channel, such as goAML in Luxembourg or the FAÚ’s route in the Czech Republic. AMLA coordinates and supports FIUs and supports joint analyses under Regulation (EU) 2024/1620 and AMLD6, but Article 69 suspicious-transaction reports are submitted to the relevant national FIU, not to AMLA.

What happened to the AML guidelines the European Banking Authority used to issue?

The EBA’s anti-money-laundering mandate passed to AMLA at the start of 2026. AMLA now develops draft Level 2 regulatory and implementing technical standards for submission to the Commission and issues Level 3 guidelines under the new framework. Guidance issued under the earlier framework generally remains relevant until AMLA replaces or updates it.

How is the EUR 10,000 cash limit applied?

Article 80 sets a EUR 10,000 ceiling for cash payments made or accepted by persons trading in goods or providing services, including linked operations, while allowing lower national limits. It expressly excludes non-professional payments between natural persons and payments or deposits made at the premises of credit institutions, electronic-money issuers and payment service providers; payments or deposits in that second category above the Article 80(1) limit of EUR 10,000 or the equivalent in national or foreign currency must be reported to the FIU within the FIU’s deadlines.

Are crypto-asset service providers fully in scope now?

Crypto-asset service providers performing one or more crypto-asset services within the AML/CFT definition are already covered by the current EU AML/CFT framework following Regulation (EU) 2023/1113’s amendment of Directive (EU) 2015/849. AMLR’s directly applicable customer due diligence, record-keeping and reporting duties apply to that defined category from 10 July 2027; providing advice on crypto-assets is excluded from the relevant definition of crypto-asset services.

When will AMLA actually start supervising a selected firm?

Selection runs through 2027, and direct supervision begins in 2028. AMLA published the 2026 eligibility reporting package in May 2026, and that 2026 reporting package is now closed. AMLA has not yet published the final schedule for the next data collection and provisional list.

Related Articles

• CSSF AML/CFT Data Collection 2026: how Luxembourg’s supervisor runs its annual AML/CFT data collection from obliged entities.
• EuReCA Reporting and AMLA Joint Controllership: how material AML/CFT weaknesses are reported into the EU central database.
• Luxembourg AML Law and CRF Fraud Signalements: the national reporting duties that sit under the EU framework.
• AMLA Central Contact Point Survey for PSPs and EMIs: how AMLA is scoping central contact points for payment and e-money firms.
• EU Sanctions Package and Russia Screening: the screening obligations that run alongside AML controls.

Key Takeaways

• The EU AML/CFT framework rests on four instruments with different legal effects and dates: Regulation (EU) 2024/1624 applies from 10 July 2027; Directive (EU) 2024/1640 has a general transposition deadline of 10 July 2027; Regulation (EU) 2024/1620 established AMLA, whose powers and responsibilities launched on 1 July 2025; and Regulation (EU) 2023/1113 on transfers of funds and certain crypto-assets applies from 30 December 2024.
• Article 80 sets a EUR 10,000 Union ceiling for cash payments by persons trading in goods or providing services, while permitting lower national ceilings to continue or be adopted. The ceiling does not apply to the specific categories excluded by Article 80(4), including payments or deposits made at the premises of credit institutions, electronic-money issuers and payment service providers.
• AMLA assigns a joint supervisory team to each of the up to 40 directly supervised firms, with national supervisors participating in that team rather than stepping back from the firm.
• AMLA has taken over the EBA’s AML/CFT mandate and now develops draft Level 2 regulatory and implementing technical standards for submission to the Commission and issues Level 3 guidelines that fill in detail left open by the new framework. Tracking that pipeline is part of the preparation workstream for 2027.
• AMLD6 expands access to beneficial-ownership and account information and requires the centralised automated mechanisms for bank, payment, securities and crypto-asset account information to be interconnected through BARIS by 10 July 2029. Article 16 gives FIUs immediate and unfiltered access to the national mechanisms, gives AMLA that access for joint analyses, and provides timely access for supervisory authorities.
• AMLR applies from 10 July 2027 to crypto-asset service providers performing one or more crypto-asset services within the Article 2(8)-(9) definition and to persons trading regularly or principally in the high-value goods covered by Article 3; the corresponding defined CASP category is already covered by the current EU AML/CFT framework through Regulation (EU) 2023/1113’s amendment of Directive (EU) 2015/849. Providing advice on crypto-assets is excluded from the relevant definition of crypto-asset services. Football agents, and professional football clubs in respect only of the transactions listed in Article 3(3)(o), are brought into AMLR scope from 10 July 2029, subject to the Member State exemptions for certain professional football clubs permitted by Article 5.
• The staggered AMLD6 schedule means register obligations are already running: beneficial-ownership access had to be in place from 10 July 2025, further register development from 10 July 2026, and a single access point for real-estate information from 10 July 2029. The 2027 transposition deadline is not the start of all register work.

What 10 July 2027 requires from compliance teams

Compliance teams should anchor their programme to three certainties. 10 July 2027 is the hard date when the Regulation applies and AMLD6 must be transposed, yet a national implementing statute continues to govern registers, FIU procedures and penalties alongside the directly applicable text. Beneficial ownership moves to harmonised EU rules under which the 25% threshold applies to the ownership-interest test while control via other means must be assessed independently and in parallel. Firms therefore need to re-derive beneficial owners against the full Articles 51 to 57 methodology and update national-register processes where AMLD6 implementation changes them. Suspicious transaction reports under Article 69 still go to the national FIU, such as goAML in Luxembourg or the FAÚ’s channel in the Czech Republic, and not to AMLA.

AMLA will select up to 40 financial institutions or groups for direct supervision in the first selection round in 2027, with direct supervision beginning in 2028. AMLA published the 2026 eligibility reporting package in May 2026. The 2026 eligibility reporting package is now closed. AMLA has not yet published the final schedule for the next data collection and provisional list. On scope, AMLR will apply from 10 July 2027 to crypto-asset service providers performing one or more crypto-asset services within the Article 2(8)-(9) definition and to the high-value-goods traders covered by Article 3; the corresponding defined CASP category is already covered by the current EU AML/CFT framework through Regulation (EU) 2023/1113’s amendment of Directive (EU) 2015/849. Providing advice on crypto-assets is excluded from the relevant definition of crypto-asset services. Football agents, and professional football clubs only for the transactions listed in Article 3(3)(o), follow under AMLR from 10 July 2029, subject to the Member State exemptions for certain professional football clubs permitted by Article 5. A group of any size that has not yet mapped the Regulation against its current procedures is behind the curve.

Sources and References

• Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation) – EUR-Lex
• Directive (EU) 2024/1640 (AMLD6) – EUR-Lex
• Regulation (EU) 2024/1620 establishing AMLA – EUR-Lex
• Regulation (EU) 2023/1113 (Transfer of Funds Regulation) – EUR-Lex
• European Commission: Anti-money laundering and countering the financing of terrorism at EU level
• Finanční analytický úřad (FAÚ): AML balíček krok za krokem (17 September 2026)
• FAÚ: Prameny práva v oblasti AML/CFT od 10. 7. 2027 (PDF)
• CSSF: Update on identification of obliged entities eligible for AMLA direct supervision (June 2026)
• AMLA: next step toward the 2027 selection of entities for direct supervision

Putting 10 July 2027 on the project plan

The Level 1 framework is settled, but Level 2 and Level 3 implementation work is still developing. What is also open is each firm’s readiness. The AML Regulation applies and AMLD6 reaches its general transposition deadline on 10 July 2027, while AMLA’s first selection process starts by 1 July 2027 and must conclude within six months. The 2026 provisional-eligibility collection is closed; AMLA has not yet published the schedule for the next data collection. Map your obliged-entity status against AMLR, remediate the beneficial-ownership and reporting workstreams, and confirm your group’s eligibility status with the relevant national financial supervisor.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.