AMLA & AMLR: anticipating European AML compliance by 2027

In brief

The EU 2024 AML Package introduces four instruments: the AMLR (regulation directly applicable from 10 July 2027), the AMLD6 (directive to be transposed), AMLA (European authority based in Frankfurt, operational since 1 July 2025) and the recast TFR on crypto-assets. For Belgian regulated entities, the key deadline is 10 July 2027: all KYC policies, UBO procedures, monitoring and archiving must be aligned with the AMLR, or face sanctions of up to 10 million euros.

Why 2027 will change everything

On 10 July 2024, the European Union published in its *Official Journal* the 2024 AML Package — the most ambitious anti-money laundering reform since the 1st directive in 1991. Four legislative instruments, a tight timetable, and a new logic: harmonise the rules rather than leave them to Member-State interpretation.

The keyword: end of fragmentation. Where the Belgian Act of 18/09/2017 transposed the 5th directive with its own choices (regulated entities, thresholds, sanctions), the new framework imposes a directly applicable regulation. No more 27 different AML regimes — the goal is a common mandatory baseline across the EU.

The pivotal deadline: 10 July 2027. On that date, the AMLR (regulation) and the AMLD6 (transposed directive) become applicable. Every Belgian regulated entity will have to have adapted its policies, procedures, tools and training. Anticipating means gaining two years over competitors that will discover the text at the last minute.

The 2024 AML Package: 4 instruments to know

The package is not only AMLA. It rests on four complementary texts:

The AMLR is the revolution: for the first time, a European regulation imposes AML obligations directly on regulated entities, without going through national law. Belgian notaries, accountants, banks, real-estate agents and domiciliation agents will be subject to a text that applies word for word in Paris, Berlin, Madrid and Brussels.

The AMLD6 complements the AMLR: it addresses matters that are inherently State-level (organisation of supervisors, operation of the CTIF and its counterparts, access to the UBO register, etc.).

The AMLA is the new European authority. The TFR extends traceability obligations (the *Travel Rule*) to all crypto-asset service providers.

AMLA: the new European AML authority

The Anti-Money Laundering Authority (AMLA) is the agency created by Regulation (EU) 2024/1620. Key points:

• Seat: Frankfurt-am-Main (Germany), chosen in February 2024

• Establishment: operational from 1 July 2025

• Target headcount: about 400 staff at full capacity (2027-2028)

• Governance: a chair, an executive board, a general board bringing together national supervisors

AMLA exercises two types of supervision:

Direct supervision (40 high-risk entities)

From 2028, AMLA directly supervises a core of around 40 regulated entities considered high cross-border risk: large European banks, large crypto-asset service providers, some fintechs. The list will be published in mid-2027 on the basis of harmonised criteria (volumes, cross-border exposure, geographic risk).

Indirect supervision (everyone else)

For the tens of thousands of other regulated entities (notaries, accountants, real-estate agents, domiciliation agents, smaller banks), supervision remains national (NBB, FSMA, SPF Economy, ITAA, IPI in Belgium). But AMLA:

• Issues the technical standards national supervisors must apply

• Coordinates cross-border inspections

• Assesses national supervisors and may impose improvement plans

• Can take over in cases of serious supervisory failure

Practical effect: the NBB and FSMA, already strict, will have to step up further on technical standards, sanction scales and inspection frequency. Belgian regulated entities will feel the AMLA effect without being directly supervised by it.

AMLR: substantive rules harmonised EU-wide

The AMLR (Regulation 2024/1624) bundles more than 80 articles covering the whole AML cycle. Key changes versus the Belgian Act of 18 September 2017:

1. Extended scope of regulated entities

The AMLR expands the list of obliged entities. Notable additions:

• All crypto-asset service providers (CASPs) — instead of only crypto/fiat exchange offices

• Crowdfunding platforms

• Luxury-goods dealers (above specified thresholds)

• Professional football agents and top-level football clubs (flagship measure, from 2029 depending on risk)

• Cultural-goods and antiques dealers (above €10,000)

• Non-bank mortgage lenders in some States

Domiciliation agents, fiduciaries and advisors (already covered in Belgium) stay within scope.

2. Single cash-payment cap: €10,000

The AMLR sets a single EU cap of €10,000 for any cash payment linked to a professional activity. States may keep a lower cap (Belgium already has €3,000 for professional transactions, which remains applicable). Above the cap, KYC checks are mandatory.

3. Ultimate beneficial owners (UBOs): clarified threshold

The 25 % threshold is maintained, but the calculation criteria are clarified:

• Direct or indirect ownership

• Control through other means (shareholders' agreement, veto right)

• Designation of default UBO (senior officers) only after exhausting all other avenues, with documented justification

For complex multi-jurisdictional structures, the AMLR imposes a formalised UBO cascade at every level up to the natural person. See our guide beneficial owners and Belgian UBO register.

4. Enhanced due diligence: unified rules for third countries

The AMLR harmonises enhanced due diligence (EDD) measures for:

• High-risk third countries (EU list)

• Politically exposed persons (PEPs)

• Remote relationships without eIDAS substantial-level identification

End of the patchwork between Member States: a single EDD scale applies everywhere.

5. Hidden treasures and residence by investment

The AMLR imposes mandatory enhanced due diligence on citizenship by investment and residence by investment programmes. Several States (Cyprus, Malta, Portugal) are implicitly targeted.

6. Standardised digital identification

The AMLR imposes mutual recognition of eIDAS electronic identification at substantial or high level. In Belgium, this means that eID and itsme® will be recognised EU-wide for KYC, and conversely foreign electronic identifiers of equivalent level.

AMLD6: what remains in Belgian law

The AMLD6 (Directive 2024/1640) remains a directive to be transposed. It covers matters affecting Member-State internal organisation:

• Supervisor powers: harmonisation of administrative sanctions, minimum applicable scale

• FIU cooperation: the Belgian CTIF will have to exchange automatically with its counterparts on listed cases (modernised FIU.net network)

• National BO registers: strengthened interconnection via BORIS (Beneficial Ownership Register Interconnection System)

• Access to bank accounts: centralised register of bank accounts (in Belgium: the Central Contact Point at the NBB, already in place)

• Lifting of professional secrecy: harmonisation of the cases in which supervisors and FIUs can obtain information

• AML whistleblower protection

Belgium has until 10 July 2027 to transpose these provisions into a law that will replace (or complement) the Act of 18/09/2017.

Timeline 2024-2030: dates to memorise

Each date corresponds to an internal workstream for regulated entities — see the roadmap below.

Who is concerned in Belgium?

All current regulated entities under the Act of 18/09/2017 remain covered by the AMLR — and some are added. In practice:

• Banks, life insurers, investment firms, EMIs, PSPs → NBB supervision + AMLA standards

• Crypto-asset service providers → AMLR framework + recast TFR

• Notaries, lawyers, bailiffs, statutory auditors

• Accountants, certified accountants, tax advisors (ITAA)

• Real-estate agents (IPI)

• Domiciliation agents, fiduciaries, trust and company service providers (SPF Economy)

• Dealers in valuable goods (jewellers, gold, art)

• Casinos and gambling operators

• New: crowdfunding, art dealers above €10,000, some precious-metal traders

Note: the vast majority of Belgian regulated entities will not be directly supervised by AMLA — but will be subject to harmonised technical standards through the NBB, FSMA, SPF Economy and ITAA.

Practical roadmap: what to do in 2026, 2027, 2028?

Phase 1 — Awareness and mapping (2026)

• Identify the status: is your entity already regulated, or becoming so under AMLR?

• Map the gaps between your current framework (Act 18/09/2017) and the AMLR

• Train the executive team and the AML officer on key changes

• Update your risk assessment in view of the new thresholds

Phase 2 — Procedure adaptation (2026 mid-2027)

• Revise KYC policies to include the new rules (formalised UBO cascade, harmonised third-country EDD)

• Adapt monitoring processes to AMLA technical requirements

• Set up cross-border eIDAS recognition (eID / itsme® + foreign identifiers of equivalent level)

• Strengthen file documentation (the AMLR requires more written justifications, particularly for the UBO cascade and the default UBO)

• Prepare a digital vault compliant with 10-year retention with timestamping and traceable access

Phase 3 — Final compliance (10 July 2027)

• AMLR deadline: by this date, your policies, procedures, client files and systems must reflect the new regulation

• Run a blank audit three months ahead to identify last gaps

• Train all teams (AMLR requires documented periodic training)

Phase 4 — Continuous adaptation (from 2028)

• AMLA monitoring: follow the technical standards as they are published

• Adapt RegTech tools to new monitoring rules

• Anticipate coordinated cross-border inspections (2028-2030)

• Annual update of risk assessment with AMLA inputs (high-risk countries, typologies)

Sanctions under the new regime

The AMLR tightens administrative sanction scales. In case of serious breach:

• Legal persons: up to €10 million or 10 % of total annual turnover — whichever is higher

• Natural persons: up to €5 million per infringement

• Additional sanctions: ban from practice, withdrawal of authorisation, named publication

National supervisors keep their sanction power but with a harmonised minimum at EU level. See our guide AML non-compliance sanctions for the current regime — which will be strengthened on 10 July 2027.

FAQ: the most-asked questions

What is AMLA?

AMLA (Anti-Money Laundering Authority) is the European AML authority created by Regulation (EU) 2024/1620. Based in Frankfurt, operational since 1 July 2025, its mission is to directly supervise about 40 high-risk cross-border entities and to issue the technical standards that all national supervisors will have to apply from 2027.

What is AMLR?

AMLR (Anti-Money Laundering Regulation, Regulation (EU) 2024/1624) is the European AML regulation that becomes directly applicable in all Member States on 10 July 2027. It harmonises rules for KYC, UBO, due diligence, cash caps and obligations of regulated entities.

When does the AMLR apply?

On 10 July 2027. From that date, every EU regulated entity must apply the regulation, with no national transposition needed.

Will my company be directly supervised by AMLA?

Most likely not. AMLA directly supervises about 40 high cross-border risk entities (large European banks, major CASPs, fintechs). The vast majority of Belgian regulated entities will remain supervised by their usual authorities (NBB, FSMA, SPF Economy, ITAA, IPI), but according to AMLA technical standards.

Will the cash-payment cap change in Belgium?

The AMLR sets an EU cap of €10,000 for professional transactions. Belgium already has a lower cap (€3,000 for professional transactions), which remains applicable. So in practice no change for Belgian traders, but harmonisation for cross-border transactions.

What to do now in 2026?

Three priorities: (1) map the gaps between your current framework (Act 18/09/2017) and the AMLR; (2) raise awareness of the executive team and AML officer on the new concepts (formalised UBO, harmonised EDD, strengthened sanctions); (3) consolidate your RegTech tooling to absorb 2027 changes without an emergency overhaul.

Should I wait for the Belgian transposition?

No. The AMLR is a directly applicable regulation — there is nothing to wait for. The AMLD6 (directive) will be transposed by a Belgian law before 10 July 2027, but only covers supervisor and CTIF powers. The substantive rules reach you directly via the AMLR.

Are Belgian domiciliation centres concerned?

Yes. Domiciliation centres and fiduciaries are already regulated in Belgium under the Act of 18/09/2017, and remain within the AMLR scope. They will have to adapt their enhanced due diligence, UBO cascade and transaction monitoring policies to the new harmonised rules.

What are the differences with the 6th directive (AMLD6)?

AMLD6 (Directive 2024/1640) addresses the internal organisation of States (supervisor powers, FIU cooperation, BO registers) — it must be transposed by a national law. AMLR (Regulation 2024/1624) addresses the substantive rules applicable to regulated entities (KYC, UBO, due diligence) — it applies directly, without transposition. See also our guide 6AMLD.

How Company Belgium prepares the transition

Company Belgium equips Belgian regulated entities to absorb AMLR/AMLD6 without a last-minute technical overhaul:

• Formalised UBO cascade across 3 levels and automatically compared with the Belgian UBO register — already compliant with the future AMLR format

• KYC pre-fill from a BCE/KBO number: denomination, legal form, directors, NACE — the basis of an AMLR-ready client file

• Ongoing monitoring of BCE changes (directors, registered office, accounts, dissolution) — aligned with AMLA technical standards in preparation

• Built-in risk assessment with client/product/geography matrices, updated against EU lists

• eIDAS recognition of Belgian electronic identities (eID, itsme®) and foreign ones of equivalent level

• Encrypted, timestamped digital vault for 10-year retention, exportable during coordinated AMLA inspections

• Full audit trail on every consultation, change or decision — the AMLR requires more documented justifications than the Act of 18/09/2017

The bet is simple: entities consolidating their framework from 2026 will turn 10 July 2027 into a simple parameter switch. Those that wait will pay the cost of an emergency overhaul — and likely the sanctions tied to late compliance.

In summary

• The 2024 AML Package is the most important European anti-money-laundering reform since 1991.

• AMLA = European authority in Frankfurt, operational since 1 July 2025, direct supervision of ~40 entities from 2028.

• AMLR = directly applicable regulation on 10 July 2027 — replaces the substantive rules of the Belgian Act of 18/09/2017.

• AMLD6 = directive to be transposed into Belgian law before 10 July 2027 — organises supervisor powers and FIU cooperation.

• Recast TFR = traceability extended to crypto-assets.

• Sanctions: up to €10M or 10 % of turnover for legal persons, €5M for natural persons.

• The right reflex: map gaps from 2026, consolidate RegTech tooling, train teams, and prepare a smooth transition for 10 July 2027.

AML compliance ceases to be a national matter and becomes a common European baseline. Belgian regulated entities that anticipate will gain a competitive edge over those who discover the AMLR at the last minute — and that is precisely the window Company Belgium helps capture.