Regulatory update

The EU AML package: preparing for the single rulebook and AMLA

The EU's AML reform moves core obligations into a directly applicable regulation and creates a new supervisory authority, AMLA. Firms that start a gap analysis now can adapt in good time.

30 June 20265 min readJurisdictions: EU

The EU's anti-money laundering package, adopted in 2024, restructures AML regulation across the Union. At its centre is the AML Regulation, which will apply directly in all member states from July 2027, and the Anti-Money Laundering Authority (AMLA), which is being established in Frankfurt.

What changes for obliged entities

Core customer due diligence requirements move into a directly applicable regulation, reducing national divergence.
Crypto-asset service providers are fully within scope as obliged entities across the EU.
Harmonised rules on beneficial ownership, enhanced due diligence and reliance on third parties.
AMLA will directly supervise a limited number of higher-risk cross-border financial institutions, and coordinate national supervisors for the rest.

Gambling and the AML framework

Gambling service providers remain obliged entities, with member states retaining some flexibility over lower-risk gambling services. Operators licensed in several member states should expect greater convergence in supervisory expectations over time.

Preparing now

Firms can begin now with a gap analysis against the Regulation's text, focusing on customer due diligence, beneficial ownership verification, group-wide policies and outsourcing of CDD measures. Detailed technical standards will shape many practical requirements, and the analysis can be refined as they are adopted. ROZSUD carries out these gap analyses and updates AML/CFT policies, procedures and risk assessments accordingly.

This article is general commentary and does not constitute legal advice. Regulatory positions change; please seek advice on your specific circumstances.

Related insights

Practice note28 July 2026

Building a bankable file: how high-risk businesses are assessed by acquirers and banks

For high-risk businesses, the onboarding file is the evidence banks and acquirers rely on. Prepared the way their compliance teams read it, it answers their questions in advance.

6 min read

Practice note21 May 2026

DORA in practice for payment and e-money institutions

The Digital Operational Resilience Act (DORA) has applied since January 2025. For smaller payment and e-money institutions, most of the practical work lies in ICT third-party arrangements.

5 min read

Regulatory update8 September 2026

After the MiCA transition: what crypto-asset service providers should now have in place

With MiCA's transitional periods over, the question for CASPs serving EU clients is whether their operating model matches the services they were authorised to provide.