The AMLR applies from 10 July 2027, and Member States must have transposed AMLD6 by the same date. This page sets out what changes for checking a business customer, with every date and every obligation cited to the Official Journal text.
The package is a regulation that binds firms, a directive that binds Member States, and a regulation that creates a new EU authority. All three were adopted on 31 May 2024 and published in the Official Journal on 19 June 2024.
| Act | Form | What it carries |
|---|---|---|
| AMLR | Regulation (EU) 2024/1624, directly applicable | The obligations that bind firms: customer due diligence, beneficial ownership, screening against targeted financial sanctions, reporting suspicions, and record keeping. |
| AMLD6 | Directive (EU) 2024/1640, transposed into national law | What Member States must put in place: beneficial-ownership registers and the rules for access to them, bank account registers, financial intelligence units, and supervision. |
| AMLA Regulation | Regulation (EU) 2024/1620, directly applicable | The Authority for Anti-Money Laundering and Countering the Financing of Terrorism: its seat, its powers, and direct supervision of a selected group of financial-sector firms. |
The change of form is the change that matters. The rules firms follow today come from Directive (EU) 2015/849 as transposed in each Member State, which is 27 national texts with 27 sets of drafting choices. AMLD6 repeals that Directive with effect from 10 July 2027 (Article 77 AMLD6), and the obligations move into the AMLR, which applies in the same words everywhere (Article 90 AMLR). References to the old Directive are read as references to the Regulation and the new Directive, through a correlation table annexed to each (Article 89 AMLR, Article 77 AMLD6).
Nothing in the package removes national law. Member States keep room to identify higher risks and require additional measures, and they notify the Commission and AMLA when they do (Article 34(6) AMLR). A firm that operates in several Member States still has to read each one, but it reads them against one baseline rather than against 27.
Every date below is set in one of the three acts, and the last column names the article that sets it.
| Date | What happens | Basis |
|---|---|---|
| 26 June 2024 | A named list of articles of the AMLA Regulation applies, including the Authority's establishment and its seat. | AMLA Regulation, Art. 108 |
| 1 July 2025 | The AMLA Regulation applies. | AMLA Regulation, Art. 108 |
| 10 July 2025 | Member States must have brought into force the provisions needed to comply with Article 74 of AMLD6. | AMLD6, Art. 78(1) |
| 31 December 2025 | Article 103 of the AMLA Regulation applies. | AMLA Regulation, Art. 108 |
| 10 July 2026 | Member States must have brought into force the provisions needed to comply with Articles 11, 12, 13 and 15 of AMLD6, which are the beneficial-ownership register access rules. | AMLD6, Art. 78(1) |
| 10 July 2026 | AMLA guidelines are due on the risk variables and risk factors firms must take into account, and on ongoing monitoring. | AMLR, Art. 20(3) and Art. 26(5) |
| 10 November 2026 | Registers must verify a legitimate-interest request and answer the applicant within 12 working days, and a grant of access runs for three years. | AMLD6, Art. 13(6) |
| By 1 July 2027 | AMLA commences the first selection of financial-sector entities for direct supervision, and concludes it within six months. Direct supervision begins six months after the list is published. | AMLA Regulation, Art. 13(4) |
| 10 July 2027 | The AMLR applies, and Member States must have transposed AMLD6. | AMLR, Art. 90; AMLD6, Art. 78(1) |
| 10 July 2027 | AMLA guidelines are due on identifying close associates of politically exposed persons and on the asset test for the highest enhanced due diligence tier. | AMLR, Art. 42(2) and Art. 34(5) |
| 10 July 2029 | The AMLR applies to football agents and professional football clubs. Member States must have transposed Article 18 of AMLD6. Existing bearer shares must have been converted, immobilised or deposited. The Commission's assessment of whether a lower ownership threshold should apply to higher-risk categories of company is due. | AMLR, Art. 90, Art. 79(3) and Art. 52(2); AMLD6, Art. 78(1) |
| 10 July 2030 | Bearer shares that were not converted, immobilised or deposited are cancelled. | AMLR, Art. 79(3) |
This is where the package asks for the most new work. The definition moves, the arithmetic is written down, the ownership structure itself becomes part of the record, and consulting the register becomes part of verification rather than an alternative to it.
A beneficial owner is the natural person who ultimately owns or controls a legal entity or a legal arrangement (Article 2(1)(28) AMLR). From 10 July 2027 the test has two limbs, set out in Article 51: a person who has, directly or indirectly, an ownership interest in the entity, and a person who controls it, directly or indirectly, through an ownership interest or via other means. Article 51 says in terms that control via other means is identified independently of and in parallel to an ownership interest, so one company can have beneficial owners on both limbs at once.
An ownership interest means direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest in the company, including rights to a share of profits, other internal resources or the liquidation balance (Article 52(1) AMLR). Indirect ownership is calculated by multiplying the shares or voting rights held by the intermediate entities along each chain and adding the results across the chains, and all shareholdings on every level of ownership are taken into account.
That is a real change of wording, not a restatement. The Directive in force until 10 July 2027 treats a shareholding of 25% plus one share, or an ownership interest of more than 25%, as an indication of direct ownership (Article 3(6)(a)(i) of Directive (EU) 2015/849). The AMLR makes 25% or more a definition. A firm whose rules read “more than 25%” will include holders at exactly 25% once the Regulation applies.
The threshold can also fall. Where Member States identify categories of company exposed to higher risk, the Commission must assess by 10 July 2029 whether those risks matter for the internal market, and may adopt a delegated act setting a lower threshold for them. That lower threshold is capped at 15%, and in any case has to be below 25% (Article 52(2) AMLR).
Control through an ownership interest means direct or indirect ownership of 50% plus one of the shares, voting rights or other ownership interest (Article 53(2)(c) AMLR). Control via other means always includes four things: the majority of the voting rights, the right to appoint or remove a majority of the board or equivalent body, relevant veto or decision rights attached to a share, and decisions on distributing profit or shifting assets (Article 53(3) AMLR).
Beyond that list, control may come from formal or informal agreements with owners or members, provisions in articles of association, partnership or syndication agreements, voting arrangements, relationships between family members, or formal or informal nominee arrangements (Article 53(4) AMLR). Article 54 deals with the awkward case: a multi-layered structure in which ownership interest and control coexist at different layers of the same chain.
Article 62(1) AMLR sets out the beneficial ownership information an entity has to hold and supply. For each beneficial owner that is the names, place and full date of birth, residential address, country of residence, nationalities, identity document number, and any unique personal identification number assigned by the country of residence, together with the nature and extent of the interest held and the date from which it is held.
Then comes the part that is new for most firms. Where the ownership and control structure contains more than one entity or arrangement, the record must include a description of that structure: the names and identification numbers of the entities in it, the relationships between them, and the share of the interest held (Article 62(1), point (d)). The chain stops being working-out and becomes the evidence.
Entities have to obtain this information within 28 calendar days of being created, update it within 28 calendar days of any change, and verify it at least annually (Article 62(2) and Article 63(2) AMLR).
A firm verifies a beneficial owner either by the means used for the customer, or by taking reasonable measures to obtain the information from the customer or other reliable sources, including public registers other than the central registers. The extent is set by the risk, including the risk arising from the ownership structure. Then Article 22(7) adds a third subparagraph: in addition to those means, firms shall verify the information on the beneficial owners by consulting the central registers.
Reading the register is therefore not one option among several from 10 July 2027. It is an additional step on top of whatever else the firm does. There is a related obligation at the start of a relationship with a legal entity: collect valid proof of registration, or a recently issued excerpt of the register confirming that the registration is valid (Article 23(4) AMLR).
Where, after exhausting all possible means, no natural person is identified, or where there is doubt that the persons identified are the beneficial owners, the firm records that no beneficial owner was identified and instead identifies and verifies all the natural persons holding senior managing official positions (Article 22(2) AMLR). It also keeps records of the actions taken and the difficulties met on the way to that conclusion.
If verifying the senior managing officials would tip the customer off that the firm has doubts about the beneficial ownership, the firm abstains from that verification and records the steps it took instead. On the other side of the relationship, the entity itself has to give the register a statement that there is no beneficial owner or that one could not be determined, with a justification, plus the details of its senior managing officials (Article 63(3) and (4) AMLR).
Nominee shareholders and nominee directors must hold accurate information on their nominator and the nominator’s beneficial owners, and disclose it with their nominee status to the entity, which reports it to the central register and to firms performing due diligence (Article 66 AMLR). The information a firm collects about a legal entity customer includes the names of anyone holding shares or a directorship in nominee form, and a reference to that status (Article 22(1)(b)(iv) AMLR).
Where a firm finds a discrepancy between the central register and what it has collected itself, it reports the discrepancy to the register without undue delay and in any case within 14 calendar days of detecting it, with the information indicating the discrepancy and who it considers the beneficial owners, and the nominee shareholders and directors, to be, and why (Article 24(1) AMLR).
There is a narrow derogation. A firm may ask the customer instead of reporting, where the discrepancy is limited to typographical errors, transliteration or minor inaccuracies that do not affect the identification, or where it comes from outdated data and the beneficial owners are known from another reliable source with no grounds for suspicion. Even then, a firm that concludes the register is wrong has to invite the customer to correct it within 14 calendar days, and report the discrepancy if the customer does not. The derogation does not apply in higher-risk cases (Article 24(2) and (3) AMLR).
From 10 July 2027 the measures a firm must apply are a single directly applicable list. The risk-based approach stays, but the duty to be able to demonstrate the choice is written down.
Article 20(1) AMLR requires all of the following:
The firm sets the extent of each measure from an individual analysis of the risk, taking account of its own business-wide risk assessment and the variables and risk factors in Annexes I to III (Article 20(2) AMLR). It must be able to demonstrate to its supervisor at any time that the measures taken were appropriate to the risks identified (Article 20(4) AMLR). Where it cannot complete due diligence at all, it must refrain from the transaction, terminate the relationship, and consider reporting a suspicious transaction (Article 21(1) AMLR).
For a legal entity customer, Article 22(1)(b) AMLR requires the legal form and name, the address of the registered or official office and, if different, the principal place of business, the country of creation, the names of the legal representatives, and where available the registration number, the tax identification number and the Legal Entity Identifier. It also requires the names of anyone holding shares or a directorship in nominee form, with a reference to that status.
Verification happens before the relationship is established or the occasional transaction is carried out (Article 23(1) AMLR), with two narrow derogations: completion during establishment where that is necessary not to interrupt normal business and the risk is low, and account opening with safeguards that prevent transactions until identification and beneficial-ownership identification are complete (Article 23(2) and (3) AMLR).
Where the risk is low, a firm may apply simplified due diligence, and the permitted simplifications are listed rather than left open: verifying identity after the relationship is established and in any case within 60 days, updating customer information less often, collecting less about the purpose of the relationship, and scrutinising transactions less often or less deeply (Article 33(1) AMLR). Simplified measures stop where there is doubt about the information, where the lower-risk factors are gone, or where there is any suspicion of money laundering or of sanctions evasion (Article 33(5) AMLR).
Where the risk is higher, enhanced due diligence applies, both in the cases the Regulation names and in cases the firm identifies itself (Article 34(1) AMLR). The measures may include more information on the customer, the beneficial owners and the source of funds and wealth, senior management approval, enhanced monitoring, and requiring a first payment through an account in the customer’s own name (Article 34(4) AMLR). Any transaction that is complex, unusually large, in an unusual pattern, or without apparent economic or lawful purpose has its origin, destination and purpose examined (Article 34(2) AMLR).
Politically exposed persons attract senior management approval, measures to establish the source of wealth and funds, and enhanced ongoing monitoring (Article 42(1) AMLR). The same measures apply to family members and known close associates (Article 46 AMLR), and they continue for at least 12 months after the person leaves the function, and longer while the risk lasts (Article 45(2) AMLR). Each Member State publishes a list of the functions that qualify in its law, and the Commission publishes a single consolidated list in the Official Journal (Article 43 AMLR).
Ongoing monitoring has a clock on it. Customer documents, data and information have to be kept up to date, and the period between updates may not exceed one year for higher-risk customers and five years for every other customer (Article 26(2) AMLR). A review is also required when the customer’s relevant circumstances change, when the firm has a legal obligation to contact them about beneficial ownership in the year, or when it becomes aware of a relevant fact (Article 26(3) AMLR). Sanctions verification is repeated at a frequency matched to the risk, and credit and financial institutions repeat it on every new designation (Article 26(4) AMLR).
Records of due diligence, of the assessment behind any suspicion, and of transactions are retained for five years from the end of the relationship or the transaction, and personal data is deleted at the end of that period. A competent authority may require a further period, case by case, of no more than five more years (Article 77 AMLR).
AMLD6 rebuilds the registers and replaces public access with two tiers: firms performing due diligence, and persons who can demonstrate a legitimate interest. The structure follows a judgment of the Court of Justice, not a policy preference.
Each Member State keeps a central register of the beneficial owners of the entities created in its territory, holding the beneficial ownership information, any statement that no beneficial owner could be determined, and information on nominee arrangements, in machine-readable form (Article 10(1) AMLD6). The national registers are interconnected through the European Central Platform (Article 10(19) AMLD6), and the information stays available for five years after an entity is dissolved (Article 10(20) AMLD6).
Registers are no longer passive. They have to verify that the information submitted is adequate, accurate and up to date, on submission and regularly afterwards (Article 10(7) AMLD6). They have to check whether a registered beneficial owner is subject to targeted financial sanctions and flag the entity when they are, visibly to everyone with access (Article 10(9) AMLD6). They have to act on a reported discrepancy within 30 working days, and show that a discrepancy was reported until it is resolved (Article 10(10) AMLD6). And they can withhold or suspend a certificate of proof of registration where the information does not hold up (Article 10(13) and (14) AMLD6).
The categories deemed to have a legitimate interest are listed in Article 12(2) AMLD6, and two of them matter to anyone onboarding business customers. Point (c) covers a person likely to enter into a transaction with the entity who wishes to prevent any link between that transaction and money laundering. Point (j) covers providers of anti-money-laundering products, strictly to the extent that the products are supplied only to obliged entities or competent authorities, and where the provider can show the need in the context of a contract with one.
From 10 November 2026 a register has to verify a legitimate-interest request and answer within 12 working days, extendable in the event of a sudden high volume. A grant of access comes as a certificate valid for three years, and later requests from the same person are answered within 7 working days (Article 13(6) AMLD6). Access can be refused only on the grounds listed in Article 13(7), and there has to be a route to challenge a refusal (Article 13(9)).
There is one exception in the other direction. In exceptional circumstances set out in national law, where access would expose a beneficial owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner is a minor or otherwise legally incapable, a Member State exempts all or part of the personal information from access, case by case (Article 15 AMLD6).
On 22 November 2022, in Joined Cases C-37/20 and C-601/20, the Grand Chamber of the Court of Justice held that the provision requiring Member States to make beneficial ownership information accessible in all cases to any member of the general public was invalid, by reference to Articles 7 and 8 of the Charter. Several Member States closed public access to their registers before the new Directive was adopted, which is why national practice already differs and why the access route a firm uses is a fact about each country rather than a single EU answer.
That is the practical reason the three register pages on this site exist: they say what each register publishes, what it restricts, and on what basis Covenance reads it.
AMLA is the new EU authority. Most firms will meet it through its guidelines rather than through supervision, because direct supervision reaches a small, named group.
The Authority for Anti-Money Laundering and Countering the Financing of Terrorism was established by Regulation (EU) 2024/1620, with its seat in Frankfurt am Main (Article 4). The Regulation applies from 1 July 2025, with a named list of articles applying from 26 June 2024 and Article 103 from 31 December 2025 (Article 108). AMLA’s own site describes it as having started operations in 2025 and gives its mandate as directly supervising selected cross-border financial-sector entities that present a high risk, alongside coordinating national supervisors and financial intelligence units.
Direct supervision has a selection mechanism rather than a size test. AMLA periodically assesses credit and financial institutions, and groups of them, that operate in at least six Member States, and classifies their inherent and residual risk profiles as low, medium, substantial or high (Article 12(1) and (3)). Those classified high qualify as selected obliged entities. If more than 40 qualify, AMLA may agree a different number greater than 40, taking account of its own capacity (Article 13(1) and (2)).
The timing is set out in Article 13(4). AMLA commences the first selection process by 1 July 2027 and concludes it within six months. It publishes the list without undue delay, and begins direct supervision of the entities on it six months after publication. The selection then repeats every three years.
For a firm that is not selected, the practical effect of AMLA is its guidelines, and several are already timetabled in the AMLR itself. Guidelines on risk variables and risk factors and on ongoing monitoring are due by 10 July 2026 (Articles 20(3) and 26(5) AMLR). Guidelines on identifying close associates of politically exposed persons, on the risk levels of the different categories, and on the asset test for the highest enhanced due diligence tier are due by 10 July 2027 (Articles 42(2) and 34(5) AMLR). A good deal of the operational detail arrives in those documents rather than in the Regulation.
Nine things in the package change what an onboarding file has to contain or prove. Each one names the article that requires it, so you can check it against your own rules.
Covenance gathers the information and prepares the findings for review. It does not decide: a person records the onboarding decision, and under the default rule a second person approves it.
Every legal statement on this page was read from the text below on 2026-10-25. The three 2024 acts were read from the Official Journal text through the Publications Office of the European Union.