Achieving AMLR Compliance

The European Anti-Money Laundering Regulation (EU-AMLR) harmonizes anti-money laundering rules across the EU for the first time and will apply directly to all obligated entities, such as those in the financial sector, starting July 10, 2027.

Definition of EU-AMLR

The EU-AMLR, formally known as Regulation (EU) 2024/1624, is the central regulation of the new EU anti-money laundering package, which aims to harmonize rules for combating money laundering and terrorist financing across the European Union, thereby enhancing the resilience of the European economic and financial system.

Core Principles of the EU AMLR Package

The AMLR establishes a uniform “Single Rulebook” for combating money laundering and terrorist financing, which includes a harmonized risk-based approach (RBA) with EU-wide risk factor lists and mandatory risk assessments. In general, the aim is to:

• establish uniform EU rules,
• introduce enhanced due diligence obligations,
• meet additional data requirements in Know-Your-Customer processes,
• expand EU-wide, lead supervision by the Anti-Money Laundering Authority (AMLA).

Obligations for Companies

Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) must be conducted in accordance with uniform guidelines upon the entry into force of the EU-AMLR, and obligated entities must adhere to shorter update deadlines; for high-risk customers, this means, for example, that annual reviews must be conducted.

In addition, the EU-AMLR harmonizes and expands sanctions screening and PEP definitions; for example, heads of local authorities must now also be recorded as “politically exposed persons” (PEP). Group-wide risk assessments and internal controls are also mandatory as of July 10, 2027, supplemented by stricter reporting obligations to transparency registers.

The obligations under Know-Your-Business (KYB) procedures have also been clarified by the EU-AMLR; beneficial ownership is consequently regulated uniformly at a 25% threshold, including complex calculation logic for multi-tier structures.

Entities Subject to the EU-AMLR

In addition to those already subject to the requirements, such as entities in the financial sector, the EU-AMLR expands the scope to include holding companies and financial holding companies, FinTechs, crypto-asset service providers (CASPs), crowdfunding platforms, and professional soccer clubs (for which, however, a transition period applies until 2029).

Why Obligated Entities Must Act Now: Roadmap and Timeline

The AMLR, which will apply EU-wide starting July 10, 2027, requires obligated entities to systematically align their risk analyses, governance, Know-Your-Customer/CDD processes, IT/data management, and reporting with the new, harmonized regulatory framework.

Key Dates for the EU-AMLR

• July 9, 2024
• The EU-AMLR package was published in the Official Journal of the EU, and the EU-AMLR thereby enters into force.
• July 1, 2025
• The EU-wide AMLA begins operations.
• July 10, 2025–2026
• Implementation of individual AMLD6 obligations (including those related to beneficial ownership rules and transparency registers).​
• February 10, 2026
• Updated, consolidated guidelines on the Money Laundering Act (GwG) apply, and the GwG Reporting Regulation (GwG-MeldV) becomes relevant.
• July 10, 2027
• The EU AMLR applies generally and directly; AMLD6 must be fully implemented; AMLD4 is repealed.
• By July 10, 2029
• Full implementation of certain sector- and registry-related obligations (e.g., real estate registries, some sector-specific AMLR rules).

Identification Processes as a Core Component of the EU-AMLR

Identification processes form the core of Customer Due Diligence (CDD) in the EU-AMLR and encompass the identification and verification of customers and Ultimate Beneficial Owners (UBOs) using standardized data sets and risk-based methods. They are specified in Regulatory Technical Standards (RTS), with a focus on digital procedures certified under eIDAS 2.0.

CDD Requirements Under Art. 20 of the EU-AMLR

The EU-AMLR prioritizes automated, digital identification solutions certified under eIDAS 2.0.

• Identification of Customers (Individuals)
  Name, address, date and place of birth, nationalities, ID document number, tax ID (if available).
• Identification of businesses
  Verification of the ownership structure, including UBOs, recording of the business purpose and the nature of the transaction. In case of uncertainty, all individuals at the senior management level must be identified. For these individuals as well as the UBOs, the same data sets as for private individuals must be collected and managed.

Verification Methods According to Art. 22 EU-AMLR

The EU-wide interoperable EUDI Wallet, available in Germany starting in early 2027, is to be prioritized as an eIDAS 2.0-compliant identification method and must be accepted by all obligated parties as of January 1, 2028, in accordance with the Implementing Act.

Fallback solutions remain permissible provided they are certified under eIDAS 2.0. Since acceptance of eID solutions (on which the EUDI Wallet is based) is currently rather low among the general public, obligated companies are well advised to maintain their existing and well-established identification procedures in a manner that is also EU-AMLR-compliant.

Video identification procedures such as VideoID from WebID, for example, are TÜV-certified and compliant with eIDAS 2.0. Agents who have undergone comprehensive and ongoing training guide customers through the identification process via a live HD video call, which is supplemented by AI-based document authenticity verification and a blacklist check, thereby meeting the highest security standards. VideoID is part of the WebID Identity Hub, which enables obligated entities to perfectly orchestrate their ID ecosystem – and also comply with future EU AMLR requirements.