AMLA's new AML/CFT framework: the operational impacts

As part of the ongoing harmonization of anti-money laundering and countering the financing of terrorism (AML/CFT) rules across the European Union, AMLA published three draft regulatory technical standards (RTS) on 1 October 2026 for review by the European Commission. They cover customer due diligence measures, business relationships and linked transactions, and group-wide requirements.

In most cases, the European Commission makes only marginal changes to RTS before adopting them as delegated regulations. The provisions in the current drafts are therefore unlikely to change significantly in their final version.

When do the new AML/CFT rules apply, and to whom?

These RTS are intended to specify the provisions of Regulation (EU) 2024/1624, known as the AML Regulation (AMLR).

Their application date is not yet known, except for certain specific provisions requiring more substantial changes to AML/CFT frameworks, which will apply from 10 July 2029. The AMLR itself applies from 10 July 2027. Taken together, the AMLR and all its RTS carry the same regulatory force and will apply to all obliged entities.

The scope of the AMLR, and therefore of the RTS, is broader than under the current rules. It covers crowdfunding service providers, investment migration operators, football agents and professional football clubs (these last two categories have an application date of 10 July 2029), in addition to financial sector entities and certain non-financial entities (lawyers, notaries, real estate agents, etc.).

Who will supervise your entity: AMLA or your national supervisor?

Supervision of obliged entities will remain largely with the national supervisors designated by each Member State, such as the ACPR (Autorité de contrôle prudentiel et de résolution) and the AMF (Autorité des marchés financiers) in France.

AMLA, for its part, will directly supervise 40 financial entities: groups operating in at least six Member States (whether under the freedom to provide services or the freedom of establishment) with more than 20,000 resident customers or €50 million in transactions in a given Member State, and with a high net risk profile. These criteria come from Article 1 of the draft RTS on the risk assessment for selecting entities for direct supervision, under Article 12(7) of Regulation (EU) 2024/1620.

AMLA will select these 40 entities by 31 December 2027, with direct supervision taking effect from July 2028. The list will then be updated every three years.

How will supervisors rate your ML/TF risk?

The upcoming framework also brings a major change to the way national supervisors assess the money laundering and terrorist financing (ML/TF) risk of financial obliged entities.

The dedicated draft RTS sets out a single risk assessment methodology, to remove the divergences that currently exist between Member States. The methodology itself is conventional: national supervisors will calculate inherent risk, then net or residual risk by taking into account the risk mitigation framework the obliged entity has put in place, to arrive at a final rating.

It is also highly granular. The risk factors to be considered are numerous and tailored to each segment of the financial sector (payments, lending, crypto-assets, private banking, investment services, etc.).

National supervisors will therefore have to adapt for the 2028 assessment cycle and absorb a considerable operational workload to implement the new method, even though the inherent risk calculation is automated. The net risk calculation will require manual analysis, since it depends on the risk mitigation framework (controls, procedures, etc.) of each financial obliged entity.

The draft RTS sets out a mandatory list of elements to be considered in the net risk calculation:

• governance;

• the internal control framework and outsourcing;

• ML/TF risk classification;

• the AML/CFT framework;

• the asset-freezing framework;

• the group-wide framework.

To keep the assessment accurate and true to reality, national supervisors will have to update this rating once a year, except for certain small entities assessed as low risk, whose rating will be updated every three years.

What changes for cross-border activity under the freedom to provide services?

The changes to cooperation between supervisors, and to the allocation of their powers, are particularly noteworthy.

Today. Under EU law, the supervisor of the home Member State is responsible for the entities it has authorized, including when they provide services in other Member States under the freedom to provide services. The supervisor of the host Member State is responsible for entities operating on its territory under the freedom of establishment (branches, agents of payment service providers, e-money distributors).

Going forward. The new AML Directive (Directive (EU) 2024/1640) and the AMLR introduce a different allocation of AML/CFT supervisory powers. Where a financial institution provides services under the freedom to provide services through agents or distributors, and that local presence is identified and relatively structured (in other words, where there is an infrastructure within the meaning of Article 38 of Directive (EU) 2024/1640), the host supervisor will have to ensure effective oversight.

The host supervisor may therefore ask a payment institution (PI), an electronic money institution (EMI) or a crypto-asset service provider (CASP) operating under the freedom to provide services to explain:

• its operating model, country by country;

• its distribution chains;

• its control framework.

Although such situations should in principle be rare, this change strengthens host supervisors, which is far better suited to operational reality: the services are, after all, provided to customers resident in the host Member State.

Which customer due diligence measures change?

On customer due diligence, the new framework brings significant changes, on top of largely harmonizing due diligence measures across the EU. In practice, obliged entities will need to bring their AML/CFT frameworks into line on the following points.

Customer identification and verification

The identification and verification data to be collected are now set out precisely, which is not currently the case: all names shown on the identity document, all known nationalities (at least one of which must be verified), and an address including country and city.

For remote onboarding, obliged entities will use a qualified or substantial-level electronic identification service, or a trust service within the meaning of the eIDAS Regulation (Regulation (EU) No 910/2014). By way of exception, obliged entities will have to justify any alternative remote identification method, subject to the conditions set out in the RTS on customer due diligence.

Virtual IBANs. Another major step forward for AML/CFT: credit and financial institutions holding an account to which payments are redirected through a virtual IBAN issued by another financial institution will have to identify the natural or legal person using that virtual IBAN, and obtain the virtual IBAN from the institution that issued it.

Beneficial owners

Identifying beneficial owners becomes more demanding, and the information to be collected is now specified. The complexity of ownership structures is assessed through indicators (layers, trusts, high-risk jurisdictions, nominees).

Consulting the beneficial ownership register remains insufficient, unless the obliged entity can demonstrate that the risk is low.

Simplified and enhanced due diligence

Simplified and enhanced due diligence measures are now precisely listed, which is not currently the case.

For low-risk situations, obliged entities will have to apply a minimum set of measures: intended use of the product or service, estimated value of transactions, and the customer's activity.

Enhanced due diligence measures are also listed, while leaving obliged entities free to select the most appropriate ones. In addition, the rationale for each level of due diligence must be demonstrated.

Sanctions and PEP screening

The scope of screening against asset-freezing lists is extended. It will now cover:

• persons controlling the corporate customer;

• the customer's representative, where circumvention of an asset-freezing measure is suspected;

• crypto-asset wallet addresses.

Screening frequency must be evidenced through timestamps, recording what triggered each screening (audit trail). The scope of politically exposed person (PEP) screening (customers, beneficial owners, transaction beneficiaries) remains unchanged.

Occasional customer or business relationship

The line between an occasional customer and a business relationship is clarified. The dedicated RTS sets out several criteria for identifying a business relationship:

• the duration of the relationship, where multiple interactions over a sufficiently long period must be considered, and repetition (services provided at different times, or different services provided);

• three transactions within 12 months for currency exchange, money remittance, crypto-asset exchange services (against funds or other crypto-assets) and crypto-asset transfers.

Obliged entities will also have to detect linked transactions (a single beneficiary of several transactions, the same device or IP address, a common intermediary or invoice).

This clarification, which the market will welcome, will nonetheless require substantial changes to obliged entities' AML/CFT frameworks (tools, procedures, staff training, etc.).

Existing customer portfolio

Existing customers are also covered by these requirements. Files for business relationships established before the CDD RTS enters into force will have to be brought into line using a risk-based approach.

The deadlines are set out in Article 26 of the AMLR: one year for high-risk customers, five years for all others. For the largest portfolios, this remediation work needs to be planned now.

Which AML/CFT procedures need rewriting?

The scale of the work depends on each entity's starting point: its status, its distribution model, its onboarding channels and how formalized its current procedures are.

For an institution already supervised by the ACPR or the AMF, the work is less about new obligations than about formalizing choices: which measure, triggered by which event, decided by whom, and on what grounds. The table below summarizes the workstreams by procedure. The sections that follow focus on the areas where the gap with current practice is likely to be widest.

Remote onboarding: classify each journey

For fully digital players, remote onboarding is the most visible workstream. The RTS reserves alternative methods for specific cases, and each use will have to be justified.

Entities that currently rely on a remote identity verification provider, or on the combinations of measures permitted by the French Monetary and Financial Code, have every interest in checking now which category each onboarding journey falls into. A journey classified as an alternative method will need to be justified on a case-by-case basis.

Two indicators are worth tracking from 2027: the share of customers routed to an alternative method, and the reasons for doing so. The European Digital Identity Wallet, expected in Member States from late 2026, may also reshape these journeys.

Due diligence levels: link each measure to a risk

Where enhanced due diligence takes the form of a list of measures applied wholesale to every high-risk customer, the procedure will need to change. A customer who is high risk because of their geography does not call for the same measures as one who is high risk because of their activity or volumes.

A matrix mapping each risk factor to the relevant measures helps justify choices consistently from one analyst to the next. The rationale must be recorded in the file. The RTS also allows entities to take into account information already held by the entity or its group, which avoids asking customers again for documents already collected.

For simplified due diligence, the minimum baseline can be inferred from the product taken out. A well-designed onboarding form is often enough to cover it.

Asset-freeze screening: build in the triggers

Extending the scope of asset-freeze screening first changes the data fed into the screening tool: persons controlling the corporate customer, representatives, and wallet addresses for CASPs.

The main operational challenge lies in the triggers. A change of name, nationality, residence or beneficial owner must trigger a new screening. The procedure must therefore link customer data updates to the screening tool, which often requires a technical integration between the two.

The RTS accepts automated, manual or hybrid screening, provided it is effective and proportionate. Entities should document this effectiveness: matching thresholds used, periodic sample testing, alert handling times.

Linked transactions: start from existing data

For currency exchange, money remittance and crypto-asset services, the three-transactions-in-12-months criterion means monitoring customers who are currently treated as occasional.

The RTS makes clear that there is no need to collect new data solely to detect linked transactions. The first step is therefore to use the data already available: device identifier, IP address, beneficiary, invoice reference.

The procedure must also specify who decides on requalification and what happens next: collecting the full set of due diligence information and documents, then moving to ongoing monitoring of the business relationship.

Remediating the existing portfolio: segment before reaching out

The one-year deadline for high-risk customers runs from the entry into force of the RTS, which leaves little room to maneuver for large portfolios.

An effective approach is to segment the portfolio by risk level, then combine two levers: targeted update campaigns for high-risk customers, and event-driven reviews (change of circumstances, unusual transaction) for the rest of the portfolio. The procedure should also set out how to handle customers who do not respond to update requests.

Internal control: cover outsourced tasks

The supervisor's net risk rating will take into account, among other things, internal control and outsourcing. Obliged entities that outsource part of their reviews to external providers will have to demonstrate how they control those decisions: sampling, error rates, corrective actions.

How will AMLA calculate sanctions?

The new framework also harmonizes sanctions. Today, the same breach can lead to different outcomes depending on the Member State.

Each breach will now be classified into one of four severity categories, based on common criteria such as duration, repetition, impact or systematic nature. A category 3 or 4 breach will have to result in a pecuniary sanction.

For the entities it supervises directly, AMLA will also apply coefficients to the base amount of the sanction:

• a breach revealing systemic weaknesses in procedures or internal control multiplies this amount by 2.2;

• failure to take corrective action after the finding, by 1.7;

• voluntary measures to prevent recurrence bring it down to 0.6 times;

• prompt and complete reporting to the authority, to 0.4 times.

As the ACPR puts it: "the final amount will depend as much on conduct after the inspection as on the breach itself."

What does the ACPR check during an on-site inspection?

An obliged entity's conduct will have to be demonstrated through the quality of the data it provides. For an on-site inspection, the ACPR's General Inspectorate usually sends a data request several weeks before the mission (see the ACPR-AMF Fintech Forum 2026 AML/CFT workshop presentation).

It then checks the completeness and quality of the data provided, which are supposed to be those the entity uses for its own AML/CFT framework. These data are cross-checked against public reference datasets, then analyzed with the ACPR's tools, which rely on network analysis and natural language processing.

A decision taken without a reliable audit trail leaves a file the entity can no longer explain.

How do you make sure procedures are actually applied?

In most obliged entities, AML/CFT procedures are described across several documents, and their execution is spread across several tools: KYC/KYB solution, screening tool, transaction monitoring tool, internal backoffice, spreadsheets. This gap makes it harder to reconstruct a file at the time of an inspection.

Bringing procedures closer to compliant, day-to-day execution makes it possible to retrieve, for each file, the rule applied, who made the decision, whether an operator, an external provider or an AI agent, and the four-eyes validation where required.

As the RTS evolve after adoption, compliance teams will also need to be able to update their rules quickly, while keeping a history of versions and of the decisions taken under each one.

What are the four steps to 10 July 2027?

We recommend building compliance in four stages:

• By end-2026: compare each AML/CFT procedure against the three draft RTS, starting with remote onboarding and screening.

• Q1 2027: identify the high-risk customers to be remediated within a year of the CDD RTS entering into force.

• Q2 2027: roll out the revised procedures with traceability for every decision, then test a data extraction as if the ACPR's General Inspectorate had requested it.

• July 2027: check that the risk classification reflects the AMLR requirements ahead of the 2028 cycle, the first to be rated under the common methodology.

Just over nine months separate the transmission of the RTS from the application of the AMLR. Entities that enter 2028 with traceable decisions will have nothing to reconstruct when they face their first inspection under the new methodology.

FAQ

When does the AMLR apply?

The AMLR applies from 10 July 2027. The application date of the three RTS is not yet known, except for certain specific provisions, which will apply from 10 July 2029.

How long do you have to update existing customer files?

One year for high-risk customers and five years for all others, under Article 26 of the AMLR.

When does an occasional customer become a business relationship?

The RTS looks at the duration and repetition of the relationship. For currency exchange, money remittance, crypto-asset exchange services and crypto-asset transfers, three transactions within 12 months is one of the criteria for identifying a business relationship.

Co-written by Lyncas and Forest. Sources: AMLA press release of 1 October 2026 and draft RTS under Articles 28(1), 19(9), 16(4) and 17(3) of Regulation (EU) 2024/1624; ACPR-AMF Fintech Forum AML/CFT workshop presentation, 2 October 2026.