AMLA & AMLR: Your Guide to the EU's New AML Framework

By July 2027, the EU anti-money laundering framework will change in a way that goes beyond a routine legislative update. The newest AML package from the EU introduces three interconnected instruments:

1. The AMLR (the Regulation), which sits at the centre;

2. AMLA (the Authority), which gives it supervisory force; and

3. The Sixth Anti-Money Laundering Directive (AMLD6), which handles the elements requiring national transposition.

Together, from 2027, they will reshape how firms and National Authorities manage AML/CFT obligations across the European Union.

For cross-border firms with an EU footprint, the practical question is: do you understand how this new landscape affects your business, where the likely pressure points are, and what your plan is between now and July 2027? If the answer is no, that isn't a problem to solve by waiting for more legal clarity – it's a signal that ownership and oversight of the issue need to be established now.

The consistency challenge

For firms operating across several EU jurisdictions, dealing with the internal differences that have built up over time may prove more challenging, politically and operationally, than absorbing the new requirements themselves. Many firms still operate AML frameworks that function quite differently from one jurisdiction to another, shaped by years of responding to local supervisory expectations.

As the European framework becomes more harmonised, the pressure moves in the opposite direction: towards reducing those internal differences. Which local variations still serve a real purpose? Which can be removed? Which exist mainly because they were built around a particular supervisory relationship? Those discussions are often difficult because they cut across local ownership, second-line judgement and operational practicality.

Consistency is the outcome AMLA is seeking. The question is whether it will prove achievable in practice for the many firms that will remain under the direct supervision of their home regulator, rather than being part of the roughly 40 directly supervised by AMLA itself.

Harmonisation is not the same as simplification

It would be a mistake to assume a single rulebook automatically makes compliance simpler. Technical standards exist to remove ambiguity, but ambiguity is also where firms exercise judgement within a risk-based approach. If early standards are detailed and prescriptive, firms used to more principles-based supervisory styles – including many UK-authorised firms with EU operations – may experience a tightening of expectations rather than a relaxation.

It is also worth noting how AMLA itself is likely to shape these standards. AMLA is building quickly and recruiting heavily and is anticipated to be fully operational by 2028. However, there is a finite pool of deep AML regulatory expertise in Europe, and much of it will come from existing national authorities. Early standards may therefore reflect established EU supervisory approaches in tone and structure, which is worth bearing in mind when reading draft RTS and ITS as they emerge.

The opportunity to consolidate

Even with the caveat that harmonisation is not the same as simplification, there is a meaningful internal opportunity for cross-border groups, but one which requires careful consideration and strategic planning. A single rulebook provides the mandate many groups have lacked to consolidate fragmented AML operating models. Firms that use this moment to streamline their operating model, rationalise policies and align control standards across their EU footprint will come out of the transition with a more defensible, more efficient framework. Those that treat it purely as a compliance exercise risk embedding the same inconsistencies under a new label.

AMLA matters even outside direct supervision

If your firm is likely to fall within AMLA's directly supervised population – broadly, those operating across six or more EU Member States with 20,000 or more customers – this should already be on your agenda, and you should be mobilising now rather than waiting for full clarity.

If you are likely to sit outside that group, a proportionate approach still makes sense. All firms in relevant EU Member States will need to produce data for AMLA’s risk-based supervisory approach. Any changes needed to find and report that data sit with the firm, regardless of size.