EU AMLR Readiness Checklist: What to Do Before 10 July 2027 (With AMLA's Standards Tracked)

The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 (the AMLR), applies from 10 July 2027 under its Article 90, and on that day one directly applicable rulebook replaces the national laws that transposed the Fourth AML Directive. On 1 October 2026 the EU's Anti-Money Laundering Authority (AMLA) published final draft standards on customer due diligence (including electronic identification, non-face-to-face verification and PEP screening), on business relationships and linked transactions, and on group-wide controls, and submitted them to the European Commission. AMLA proposes that they apply six months after their entry into force. On 2 October it invited industry representatives to sectoral roundtables on simplified due diligence, which will feed draft guidelines.

Below: what changes against your national rules, a tracker of AMLA's mandates as of 5 October 2026, a checklist of 14 workstreams with the AMLR article, owner, evidence and the AMLA instrument each waits on, a 90-day plan, a one-page board update, and notes for groups with a non-EU parent and for five sectors. Article numbers are AMLR unless stated.

Eight dates set the AMLR timeline, and AMLA's standards may trail the law

The AMLR was published in the Official Journal on 19 June 2024 with two companions: the AMLA Regulation, Regulation (EU) 2024/1620, which created the authority, and the sixth AML Directive (AMLD6), Directive (EU) 2024/1640, which member states transpose. EUR-Lex records corrigenda to some language versions of the AMLR but no amendments, so the text you build against is the 2024 text.

The gap sits between the second and sixth rows. The AMLR gave AMLA until 10 July 2026 to submit the three standards, and each final draft says it applies six months after its entry into force (CDD final report, draft Article 29). The Commission has three months from receipt to decide whether to adopt a draft regulatory technical standard (AMLA Regulation Article 49(1)), and the European Parliament and Council then have three months to object, extendable by three more (Article 51(1)). On those default periods the standards would apply around the end of 2027, after the AMLR itself; faster adoption or an early non-objection would pull that forward. Plan for a window in which the AMLR's CDD articles bind you while the detailed standards are settled in substance but not yet in force. Build to the final drafts, which AMLA's own factsheets say the Commission may still amend.

Eleven things change on 10 July 2027 compared with your national rules

National AML laws differ, so the comparison is against the directive they transpose, Directive (EU) 2015/849 (AMLD4).

Member states keep some room, such as lower cash limits (Art. 80(2)), extra enhanced due diligence (Art. 34(6)) and their own lists of prominent public functions (Art. 43(1)), and Article 8(3) and (4) decide which state's rules each establishment follows. Enforcement sits in AMLD6: Article 55(3) requires maximum fines for credit and financial institutions that are legal persons of at least EUR 10 million or 10% of total annual turnover, whichever is higher, measured on the ultimate parent's consolidated accounts where those are required.

AMLA has finalized three standards for firms and is still drafting most of the rest

AMLA took over the EBA's AML/CFT mandates on 1 January 2026, and the EBA's existing AML guidelines stay in force until AMLA replaces them (AMLA, 19 January 2026; AMLA Regulation Art. 54(5)). AMLA's own tracker, last updated 30 September 2026, lists none of its standards as adopted by the Commission. The table covers each mandate that changes a firm's build.

AMLA's work programme, published in February 2026, planned the final BWRA, monitoring, risk-factor and reporting-format texts for the fourth quarter of 2026; the risk-factor guidelines have already missed their planned consultation quarter.

A tracker like this goes stale fast: four of its rows changed on 1 and 2 October 2026. RegWatch, my company, monitors the regulators and sources you choose on the schedule you set, so AMLA's pages, the Official Journal and your national supervisors can sit on one watchlist, with each finding scored against your company profile and the source clause cited.

The readiness checklist covers 14 workstreams, each with an owner and evidence

Copy the rows into your tracker, or use the free workbook that comes with this post, and add a status and a last-reviewed date to each. As in our obligations register template, the unit is a row you can assign and evidence. Owners are roles; put a named person against each.

Governance and risk assessment

Customer due diligence

Groups, third parties, reporting and records

Three rows need more than a table cell.

Customer file remediation (row 4). Article 26(2) caps the interval between customer information updates at one year for higher-risk customers and five years for the rest. Draft Article 28 of the CDD standard applies those windows to existing relationships from the standard's entry into force, and AMLA refused requests to extend them (final report, feedback section). The higher-risk window will probably close during the AMLR's first year, so count that population now. The final draft's low-risk data set (names, date and place of birth, nationality, no address) shows which fields you may not need to chase.

Monitoring effectiveness (row 8). AMLA's consultation draft on ongoing monitoring says vendor default settings should not be used without a documented assessment (paragraph 50), automated closure of alerts needs human oversight through sampling (paragraphs 78 and 79), and effectiveness should not be judged solely by alert or reporting volumes (paragraph 84). The evidence that answers those points is the trail from alert to case to report, with the reasons for each closure.

Training (row 13). Article 12 asks for training "appropriate to their functions or activities and to the risks", "duly documented". The evidence that meets it is a curriculum mapped by role to the BWRA's top risks, with assessment results recorded by role.

AMLA's selection for direct supervision runs on data as of 31 December 2026

The AMLA Regulation assesses credit and financial institutions, and groups of them, that operate in at least six member states including their home state, through establishments or the freedom to provide services (Article 12(1)). Under the final draft standard on Article 12(7), freedom-to-provide-services activity counts in a member state where more than 20,000 of the firm's customers reside there at 31 December, or where those customers' incoming and outgoing transactions exceed EUR 50 million in the year, with activity through agents and distributors and across group entities added together (AMLA interpretative note). Each risk profile is classified low, medium, substantial or high, at group level for groups (Article 12(3)), and a high residual risk qualifies (Article 13(1)). AMLA says it will select up to 40 entities in 2027 for direct supervision starting in 2028.

The process has run all year. Sampled entities were asked to send data for a testing exercise by 22 April 2026. National supervisors collected eligibility data as of 31 December 2025 and were due to pass it to AMLA by 15 August 2026, with a provisional list of eligible entities expected by the end of September 2026. Under the final draft implementing standard on cooperation (Article 5), supervisors then collect eligibility information and data points as of 31 December 2026 from provisionally eligible entities, finish by 31 March 2027 and pass them to AMLA by 31 May 2027. The EBA published a public working draft of the data model for the 2027 eligibility collection in August 2026.

If you might be eligible, three things matter before January. Count member states the way AMLA will. Give the data set an owner outside the compliance team's spreadsheets, because the same data points feed the business-wide risk assessment: AMLA's draft BWRA guidelines tell firms to refer to the supervisory data points when assessing inherent risk. And rehearse the extract, since the reference date is 31 December and national collections close three months later.

Groups with a non-EU parent must name an EU parent undertaking

Where a group's head office is outside the EU and at least two of its subsidiaries are obliged entities in the EU, one EU undertaking must carry the parent role: an obliged entity, not a subsidiary of another EU obliged entity, with sufficient prominence in and understanding of the group, and the responsibility for group-wide requirements (Article 2(1)(42)(b)). The final draft group-wide standard sets the tests. Prominence comes first from holding-company status, cross-border establishments, customer numbers and transaction volumes, then turnover, balance sheet and staff (draft Article 10). Understanding comes from deciding strategy, important transactions, internal controls or material outsourcing for most EU entities, then from compliance staff numbers (draft Article 11). The chosen entity notifies its supervisor and the other EU entities within 28 calendar days of the situation arising, or on the standard's date of application for groups already in it, and the supervisor approves within 60 calendar days (draft Article 13).

An illustrative case, with a fictional group: a Canada-headquartered payments group holds an e-money institution in the Netherlands and a payment institution in Portugal through separate Canadian holding companies. Neither is the other's parent, so one must be identified. If the Dutch entity serves most EU customers, runs the shared transaction monitoring for both and employs most of the EU compliance staff, it is the likelier choice under draft Articles 10 and 11.

Three further points for these groups. Group-wide requirements cover the EU entities; Article 16(1) extends them to third-country branches and subsidiaries only for groups headed in the EU. For AMLA's eligibility data, "head office outside the EU" means the ultimate parent, and an EU holding company that becomes an obliged entity only on 10 July 2027 must still be identified, with a subsidiary reporting for the group (AMLA FAQ). And information flowing upward needs a legal view: Article 73(3) allows suspicion-related disclosures between obliged entities in the same group and to their third-country branches and subsidiaries that follow group-wide policies, and it does not name a parent outside the EU.

Sector rules change the checklist for payments, crypto, insurance, banking and car finance

Each of these sectors has AMLR articles that a generic checklist misses.

Payments and e-money

Account information service providers fall outside the AMLR's definition of financial institution (Article 2(1)(6)(a) excludes point 8 of Annex I to PSD2), and payment initiation providers treat the merchant as their customer (Article 19(6)(d)). Other payment and e-money firms apply CDD to occasional transfers of funds of EUR 1,000 or more (Article 19(2)). Issuers of virtual IBANs must identify their users, and the institution servicing the underlying account must be able to obtain that identity within 5 working days (Article 22(3)). Activity through agents or distributors in other member states generally follows the host state's rules (Article 8(5)), and host states may require a central contact point (AMLD6 Article 41(1)). For remitters, the draft linked-transactions standard sets a one-month linking window and treats three or more transactions in 12 months as a sign of a business relationship (draft Articles 2(4) and 3(2)). See also our payments and fintech page.

Crypto-asset service providers

Crypto-asset service providers are financial institutions for every crypto-asset service except advice (Article 2(1), points (6)(i) and (8)). They apply CDD to occasional transactions from EUR 1,000 and at least identify and verify the customer below that (Article 19(3)). Transfers with self-hosted addresses need a risk assessment and mitigating measures (Article 40), relationships with non-EU counterparts need enhanced checks including whether the respondent is licensed or registered (Article 37), and accounts that allow anonymization, including through anonymity-enhancing coins, are prohibited (Article 79(1)). An entity on ESMA's MiCA Article 110 list of non-compliant entities counts as a shell institution (Article 2(1)(23)(b)). AMLA's advisory note on the end of MiCA's transitional period asks CASPs taking on customers from exiting providers to assess them individually and scale their monitoring. The MiCA side is in our MiCA compliance checklist.

Life insurers

Life and investment-related insurers, insurance holding companies and most life insurance intermediaries are financial institutions (Article 2(1)(6)(b) and (c)). Beneficiaries are recorded by name, or by enough information about a class to identify them at payout, and verified at payout (Article 47). PEP status of beneficiaries is determined no later than payout or assignment, and for higher risks senior management is informed before payout (Article 44). Where CDD cannot be completed, the insurer may refrain from transactions, including payouts, instead of terminating (Article 21(1)).

Banks

Banks run enhanced checks on third-country correspondent relationships (Article 36), must act on any AMLA recommendation about a specific third-country respondent (Article 38) and may not deal with shell institutions (Article 39). Personalized services handling EUR 5 million or more for a higher-risk customer with total assets of at least EUR 50 million trigger extra measures (Article 34(5)), and sanctions screening must run on every new designation (Article 26(4)).

Automotive finance and dealers

A car maker's finance arm that lends or leases without a banking license is still a financial institution: lending and financial leasing are points 2 and 3 of Annex I to the CRD, which Article 2(1)(6)(a) brings in, and Article 2(1)(6)(g) names consumer and mortgage creditors. AMLA's selection methodology has a separate category for credit providers other than credit institutions (AMLA Regulation Article 12(4)(d)), and its April 2026 template correction added credit providers to the entity types. Credit and financial institutions providing services for the purchase of motor vehicles of EUR 250,000 or more for non-commercial purposes must report those transactions to the FIU (Article 74(2)) and collect information on intended use (Article 25). Dealers that trade such vehicles as a regular or principal activity become obliged entities (Article 3(3)(f) and Annex IV), report those sales (Article 74(1)(a)) and treat their supplier as a customer for CDD (Article 19(6)(a)), so a manufacturer's sales company should expect CDD questions from its own dealers. Annex IV says "exceeding EUR 250 000" while Article 74 says "at least", so set the reporting trigger at EUR 250,000 inclusive. See also our financial services page.

The next 90 days run from gap analysis to a board decision before January

The board needs one page: status, decisions, dependencies and dates

The one page I would send has eight lines:

1. Headline: overall RAG status and the date the AMLR applies, 10 July 2027.
2. Workstreams: the 14 rows with RAG status, owner and next milestone.
3. Decisions needed now: the compliance manager appointment (Article 11(1)), remediation funding, outsourcing changes, and for groups the EU parent undertaking.
4. External dependencies: AMLA instruments still pending, with AMLA's own planned dates.
5. AMLA selection: eligibility status, and the 31 March 2027 data deadline if it applies.
6. Top three risks: for example the CDD data model, vendor contracts and staffing, each with its mitigation.
7. Evidence readiness: what an examiner could sample today, row by row.
8. Next update: the date, and what will have changed by then.

Keep the plan current by treating every AMLA publication as a change event

The checklist is accurate on 5 October 2026 and will drift. Still to come before or around July 2027: final guidelines on the business-wide risk assessment and ongoing monitoring, the final reporting format, guidelines on risk factors, the simplified due diligence guidelines, nine more guideline mandates, the Commission's adoption of the three standards and their publication in the Official Journal, Commission delegated acts identifying high-risk third countries under Article 29, 27 national laws transposing AMLD6, and whatever guidance your national supervisors add.

Handle each as a change: log it, run a short impact assessment, update the affected checklist rows and date them. Our regulatory change impact assessment template fits each AMLA instrument, the horizon scanning template holds the ones still in consultation, and the obligations register takes the rows once they apply. A regulatory change management policy sets who signs off, and how compliance teams track regulatory changes covers the feed. Outsourced KYC and screening vendors belong in your third-party risk process as well as in row 10.

This is the loop RegWatch, my company, is built for. A watchlist covers the regulators and sources you choose (AMLA, the EBA, the Official Journal, your national supervisors and FIUs, and any other jurisdiction that publishes its rules online), and monitoring runs on the schedule you set. Triage scores each finding against your company profile and writes why it matters with the source clause cited, and an accepted alert converts to an obligation with an owner, a deadline and evidence. Lifecycle stages from Consultation to Adopted and In force keep the tracker's status column current, the tamper-evident, append-only audit log records who decided what and when, and board-ready reports feed the one-page update above. If you want to see it on your own regulators, book a demo and we will run the session on the AMLA and national sources you name. More of this regime lives in the financial services hub.

---

This article is general information, not legal advice.