The EU's single AML rulebook from 10 July 2027, and the deadlines before it

One rulebook for twenty-seven states

The EU's AML package replaces the directive-based model, under which every member state wrote its own version of the rules, with a directly applicable regulation. Published in the Official Journal in June 2024, Regulation (EU) 2024/1624 (AMLR), the single rulebook, applies from 10 July 2027, with the football sector following from 10 July 2029. Directive (EU) 2024/1640 (AMLD6) governs supervision, FIUs and the national machinery, with a general transposition deadline of 10 July 2027 and staged deadlines on either side of it under Article 78: the Article 74 amendments to the current Directive by 10 July 2025, the rules on access to beneficial-ownership registers (Articles 11 to 13 and 15) by 10 July 2026, and the Article 18 single access point to real-estate information by 10 July 2029; the register framework itself and the substantive ownership standard follow with the rulebook in 2027.

And Regulation (EU) 2024/1620 establishes AMLA, the new EU authority, which has been operational since mid-2025 and assumes direct supervision in 2028 of a first cohort of around 40 credit and financial institutions and groups: those operating in at least six member states whose residual risk AMLA classifies as high, selected in a process that starts by 1 July 2027, with supervision beginning six months after the list is published (Article 13 of Regulation (EU) 2024/1620); AMLA's own planning aims at readiness for the first supervisory cycle by mid-2028. Until the rulebook applies, the operative law remains Directive (EU) 2015/849 as amended, so firms are managing a staged handover.

What changes

Three shifts matter more than the rest. First, harmonisation by regulation: because the AMLR is a regulation, the familiar strategy of arbitraging softer national implementations largely ends; customer due diligence, beneficial-ownership standards and internal-control requirements will read the same in every member state, as will the new EU-wide limit of EUR 10,000 on cash payments for goods or services in a business context, linked payments aggregated and private payments between individuals excluded, which member states may undercut but not exceed; group policies built around one national law will need rewriting.

Second, a wider net of obliged entities: the rulebook consolidates and extends the scope of who must run AML programmes, including crypto-asset service providers, whose position we cover separately in our update on CASPs and the travel rule.

Third, a new supervisor with an EU-wide view: AMLA will issue the guidelines that give the rulebook its operational meaning, including guidelines on money-laundering risks, trends and methods involving geographical areas outside the Union and on how institutions establish whether a customer crosses the rulebook's high-net-worth marker. That marker is cumulative and conditional: under Article 34(5) of the AMLR, credit institutions, financial institutions and trust or company service providers must apply specific additional enhanced measures where a business relationship already identified as higher-risk involves the handling of assets of at least EUR 5 million through personalised services for a customer holding total assets of at least EUR 50 million, in financial, investable or real-estate assets or a combination of them, excluding the customer's private residence.

Three further rulebook points belong in the gap analysis now. Beneficial ownership under Article 51 runs on two independent limbs, ownership interest and control via other means, with the ownership limb set at 25 per cent or more of shares, voting rights or other ownership interest (Article 52(1)) and an enabling power for the Commission, after an assessment due by 10 July 2029, to set a lower threshold by delegated act for categories of corporate entity that Member States have identified as higher-risk; that lower threshold is capped at 15 per cent, so it may be set lower still, unless the Commission concludes on risk grounds that a higher figure below 25 per cent is more proportionate (Article 52(2)). Until such an act applies, 25 per cent governs. Outsourcing of AML tasks is permitted under Article 18, but the supervisor must be notified before the provider starts, and the provider is treated as part of the obliged entity. Internal procedures and controls must be approved at least at the level of the compliance manager, and AMLA's guidelines on proportionate internal policies were due by 10 July 2026.

AMLA's Single Programming Document 2026–2028 and its explainer schedule twenty-four of its forty mandates for delivery during 2026, the rest to follow; the individual statutory deadlines should be checked against the relevant provisions. The supervisory centre of gravity moves in stages, and the firms selected for direct AMLA supervision from 2028 will experience that shift first.

The road to July 2027

The work between now and mid-2027 falls into five workstreams. Run a gap analysis of current policies against the AMLR text itself, flagging every place where the group standard currently leans on a national option that will disappear. Remediate beneficial-ownership data now, because the register-access rules were due in national law in July 2026, obliged entities are to have timely register access when they take due diligence, and the AMLR ownership standard that applies from July 2027 will be tested against the same register data.

Redesign group policy architecture for a regulation-first world: one standard, national annexes only where the AMLR itself leaves an option (exemptions, lower cash limits) or AMLD6 leaves room in the national machinery. Track the AMLA guideline pipeline, because the technical standards and guidelines arriving through 2026 and 2027 will settle the questions the level-one text leaves open, and consultation windows are where industry input still counts. And document the transition itself: supervisors will ask how you reached compliance by 10 July 2027, and the record of the transition is part of the answer.

What this means for you

• Budget for 2026, and rebuild group policies top-down. Firms that start the gap analysis after the AMLA guidelines land will be starting late, and a regulation-first architecture now saves a second rewrite later.
• Use the register-access step. The July 2026 access rules precede the rulebook by a year; the ownership standard that will touch every corporate customer file applies from July 2027, and the data work for it cannot start then.
• Non-EU groups: check your perimeter. EU subsidiaries and branches bring the rulebook into the group, and AMLA's geographic-risk guidelines will shape how EU entities view their non-EU affiliates.

Isak Legal advises banks, fintechs, crypto businesses and corporate groups on EU AML readiness, group policy design and the interaction of the EU, Swiss and UK regimes. See our Sanctions and AML and Financial Regulation pages, or get in touch.

This client update is provided for general information only, reflects the position as at 27 September 2026 and does not constitute legal advice or create a lawyer-client relationship. Implementation dates and technical standards should be verified against the current texts at the official sources linked above. For advice on a specific matter, please contact us.