The EU’s single AML rulebook arrives in July 2027. Here is what changes when you onboard.

For most of the last decade, an e-money institution in Malta, Lithuania or Ireland applied its own country’s version of the EU anti-money laundering directives. That is why two providers could ask you for quite different things. That changes on 10 July 2027, when the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624, usually called the AMLR) applies directly in every member state.

The rules apply to your provider, not to you. But you feel them, because your provider can only open and keep your account if your file meets them. This includes UK businesses with an EU account or IBAN.

What is actually changing

• One rulebook instead of 27. Customer due diligence moves from national laws into a single regulation, with detailed standards written by the new EU Anti-Money Laundering Authority (AMLA) in Frankfurt.
• The detail is nearly settled. On 1 October 2026 AMLA published its final draft standards on customer due diligence and sent them to the European Commission. Once adopted, they are due to apply six months after entering into force.
• A European supervisor. AMLA starts selecting the firms it will supervise directly by 1 July 2027, with direct supervision due to begin in 2028. The first group of around 40 is expected to include high-risk payment and e-money firms operating in at least six member states.
• Higher stakes for providers. Maximum fines for financial institutions rise to at least €10 million or 10% of annual turnover. Expect providers to be less flexible, not more.

What your provider is likely to ask you for

Based on the regulation and AMLA’s final draft standards, these are the changes most clients will notice.

• A fuller identity record. For individuals: all names, place and date of birth, nationality, usual address and, where available, a tax identification number, verified rather than just collected. Lower-risk relationships can use a shorter set.
• Beneficial owners at exactly 25%. The threshold becomes 25% or more, so a shareholder holding exactly a quarter now counts. Anyone who controls the business by other means still needs to be identified.
• Digital identity first. The draft standards favour electronic identification at eIDAS “substantial” or “high” assurance. Remote document-and-selfie checks become a narrower exception that providers must justify to their supervisor.
• Screening that does not stop. Sanctions and politically exposed person checks cover you and your beneficial owners at onboarding, whenever sanctions lists change and whenever your details change.
• No automatic shortcuts. Simplified due diligence is no longer available by sector or product. It depends on the provider’s assessment of your business in particular.

Periodic reviews get a deadline

Article 26 of the AMLR sets maximum intervals for refreshing customer information: one year for higher-risk customers and five years for everyone else. Many existing client files were built under lighter national rules. Expect remediation requests through 2027 and 2028, often with a deadline and the threat of restrictions if you miss it. A slow reply to a review is one of the most common reasons an account gets restricted or closed.

Who should pay attention

• Higher-risk sectors, including gaming, crypto, adult, marketplaces paying out to third parties and cross-border payment businesses. Enhanced due diligence will be applied more consistently, and providers will want evidence rather than explanations.
• Businesses with complex ownership, such as trusts, holding companies, nominee arrangements or investors sitting around 25%.
• UK and non-EU companies with EU accounts. You are outside the EU, but your provider is not.
• Crypto businesses, because crypto-asset service providers are now obliged entities in their own right under the same rulebook.

How to get ahead of it

1. Refresh your onboarding pack now. Current registry extract, an ownership chart down to every individual at 25% or more, ID and proof of address for directors and owners, and tax numbers. Our KYB pack guide lists what providers expect.
2. Get your owners a digital ID route. If your directors and beneficial owners can verify through an eIDAS-recognised electronic ID, onboarding and reviews move faster.
3. Write down your source of funds. For higher-risk businesses, a clear one-page account of where the money comes from saves weeks of back and forth.
4. Name an owner for provider requests. Give one person responsibility for replying to compliance questions within a few working days.
5. Ask your provider directly. “How will your onboarding change for the AMLR, and when will you ask existing customers to update?” A provider with a clear answer is ready. One without an answer is worth watching.

If you are choosing a provider now

Onboarding to a provider that is still working to its old national rules can mean doing it twice: once now, and again when it remediates its book in 2027. Ask how far through its AMLR programme it is before you sign. If you are not sure which providers are ready, that is exactly what a good introduction should tell you.

This article is general information, reviewed in October 2026. The AMLA standards referred to are final drafts awaiting adoption by the European Commission and may change before they apply. It is not legal advice.

← All articles