Regulatory
The EU AML package: what actually lands on operations teams
Most coverage of the EU AML package is written for people who need to know that it exists. This is written for the people who will have to run under it — the ones who will be rewriting procedures, re-papering customer files and explaining to a supervisor why a control works the way it does.
Two dates matter. The Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027. The new Anti-Money Laundering Authority begins directly supervising selected firms from 1 January 2028. Almost everything below hangs off those two.
The structural change is the instrument, not the content
The single most consequential fact about the AMLR is grammatical: it is a regulation, not a directive. It applies directly, with no national transposition step. The same text binds a bank in Dublin and a payments firm in Tallinn.
For a compliance function that operates in more than one member state, this is the headline. The familiar exercise of maintaining a matrix of local variations — where the Dutch rule differs slightly from the Irish one because each national legislator made its own choices at transposition — narrows sharply for anything the Regulation covers. Group policy stops being a lowest-common-denominator negotiation and starts being a single standard with a small number of documented local overlays.
That is genuinely good news operationally. It is also a substantial one-off project, because most group policies were built assuming divergence and will need unpicking.
Beneficial ownership: a small edit with a long tail
The ownership threshold stays at 25%, but the formulation is tightened to 25% or more. On paper this is a rounding correction. In a customer file it is not.
Any structure that was assessed under a "more than 25%" reading and sits at exactly 25% — a clean four-way split between partners, a joint venture held 25/25/50 — now captures a beneficial owner it previously did not. Four-way and two-plus-two ownership splits are not exotic; they are how a great many small companies are actually held.
The operational question is not whether you agree with the change. It is whether your customer data lets you find the affected population at all. If ownership percentages live in a free-text field or a scanned PDF rather than a queryable one, you cannot run the query that tells you which files need revisiting. Several firms will discover this in 2027 with no time to fix it.
Regulatory change lands on the data model before it lands on the policy. If you cannot query it, you cannot remediate it.
The cash limit is a product and onboarding question
The AMLR sets a Union-wide limit of EUR 10,000 on cash payments, for a single transaction or several that appear linked. Member states may impose lower limits, and existing lower national ceilings continue to apply — Belgium's EUR 3,000 being the example usually cited.
The compliance-team instinct is to treat this as a monitoring rule. It is more useful to treat it as a product constraint. "Several operations which appear to be linked" is the operative phrase, and it is a detection problem: linkage across time, across counterparties, and across channels. A rule that fires on a single EUR 10,000 cash deposit is trivial. A control that recognises five EUR 2,400 deposits over nine days as one payment is the actual requirement, and it needs a linkage definition someone has written down and signed off.
AMLA: direct supervision is narrow, indirect influence is not
AMLA, seated in Frankfurt and established by Regulation (EU) 2024/1620, will directly supervise a small population — up to 40 credit and financial institutions assessed as highest-risk and operating across at least six member states. The selection process starts by 1 July 2027 and concludes within six months, with supervision beginning 1 January 2028.
Two readings of that number are both wrong. The first is "forty firms, so this is somebody else's problem." The second is "AMLA will be everywhere."
What actually happens is convergence. AMLA sets the technical standards, the methodology and the supervisory expectations that national supervisors then apply. The forty are where the standard is demonstrated; everyone else meets it through their own regulator, on a slightly longer delay. If you want to know what your national supervisor will be asking for in 2029, read what AMLA publishes in 2027.
The practical implication for a mid-sized firm is that the useful thing to track is not the selection list. It is the technical standards.
What I would actually do between now and mid-2027
Ranked by how painful they are to start late:
- Audit the beneficial ownership data model first. Not the policy — the fields. Can you produce, today, a list of every customer with an owner at exactly 25%? If the answer involves opening documents, that is the project.
- Write down your linkage definition for cash. What window, what identifiers, what counts as "appear to be linked". Someone will ask, and "the system does it" is not an answer.
- Map group policy against the Regulation, clause by clause. The output you want is a short list of places where you are stricter than the Regulation and can justify it, and a shorter list where you are not and cannot.
- Assign someone to read AMLA's technical standards as they land. Not to summarise them for a committee — to translate each one into a specific control or document you either have or do not.
- Leave the remediation runway. Re-papering a customer population is measured in quarters. Any control change that implies re-collecting information from customers needs to start roughly a year before it must be finished.
The part that is genuinely uncertain
Supervisory expectation is set by practice, not text, and there is no practice yet. Nobody can tell you today how AMLA will interpret proportionality, how hard the first examinations will be, or where the line will sit between a documented judgement and an unsupported one. Anyone selling you certainty on those points is selling you something.
What you can control is whether your reasoning is written down. Every framework I have seen survive an examination had the same property: the decisions were defensible not because they were right in hindsight, but because the basis for them was recorded at the time by someone with the authority to make them.
That is the whole preparation strategy, really. The rules will land where they land. Write down why you did what you did.