EU AML Reform in October 2026: AMLA Standards, Supervision and Compliance

Introduction:

October 2026 brought several important developments in the European Union’s anti-money laundering and counter-terrorist financing (AML/CFT) programme. The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) finalised draft technical standards on customer due diligence, business relationships and linked transactions, group-wide controls, and cooperation between national supervisors. It also consulted on a central supervisory database and published recommendations concerning the review of the Markets in Crypto-Assets Regulation (MiCA).

• These developments do not all have the same legal effect. The EU AML Regulation has been enacted but generally applies from 10 July 2027. AMLA’s final draft standards still require Commission adoption and publication before they become binding. The database and MiCA materials are proposals. This guide explains the October package and the practical steps that obliged entities can take while preserving that distinction.

What changed in October 2026?:

‍On 1 October, AMLA announced final drafts covering four operational areas: customer due diligence (CDD); the distinction between business relationships and occasional or linked transactions; minimum group-wide AML/CFT arrangements, including third-country branches and subsidiaries; and cooperation between home and host supervisors. AMLA submitted the drafts to the European Commission. It proposed that the three private-sector standards apply six months after entry into force, subject to the separate timetable for football-sector obliged entities.

• On 7 October, AMLA opened a consultation on draft technical standards for a central AML/CFT database. The consultation closed on 3 November. The proposed database is designed to support confidential, risk-based information exchange among supervisory authorities; AMLA stated that it would not create direct reporting duties for private companies. On the same date, AMLA identified possible AML/CFT priorities for the Commission’s MiCA review. These are recommendations, not amendments to MiCA.

The legal timetable: enacted rules and draft standards:

‍Regulation (EU) 2024/1624, commonly called the AML Regulation (AMLR), is directly applicable legislation. Most of its provisions apply from 10 July 2027; the specified football clubs and agents are subject to the later date of 10 July 2029. Directive (EU) 2024/1640 requires Member States to implement parts of the framework on the timetable set out in that Directive. Regulation (EU) 2024/1620 establishes AMLA. Regulation (EU) 2023/1113, covering information accompanying transfers of funds and certain crypto-assets, is a related but separate instrument.

• AMLA prepares technical standards under mandates in the legislation, but its final report is not itself a Commission delegated regulation. The Commission may scrutinise or amend the drafts. Accordingly, policies and client communications should describe them as “final AMLA draft standards” until their adoption and publication are confirmed. Maintain a regulatory tracker distinguishing rules already in force, future application dates, draft delegated measures and consultation proposals.

Customer due diligence: proportionate evidence and reliable verification:

‍The CDD draft addresses information to obtain and verify about customers, persons acting for them, beneficial owners and persons on whose behalf activity is conducted. It covers identity attributes, reliable and independent verification sources, electronic identification, remote onboarding and relevant PEP checks. For corporate structures, the practical task is to establish the entity’s existence, authority to act, ownership and control chain, and the identity of the natural persons who ultimately own or control it.

• The draft’s risk-based approach should not be confused with either a blanket reduction or an unlimited document request. In defined low-risk circumstances, simplified measures may permit a reduced set of core identity information. Higher-risk cases may require enhanced verification and closer examination of source of funds or wealth. A firm should record why its chosen measures are proportionate, what evidence supports the decision and what change would prompt reassessment. The final adopted text must be checked before revising procedures.
• Remote onboarding requires more than an uploaded identity document or a vendor’s “compliant” label. Assess the reliability and independence of data sources, document integrity, impersonation controls, audit trails, security, escalation arrangements and the need for manual review. The method should accommodate legitimate cross-border differences in identity documents without treating every source as equally reliable.
• PEP screening is an ongoing risk control, not a one-off onboarding tick-box. A PEP classification triggers specified enhanced measures; it is not evidence of wrongdoing. Firms should evaluate the credibility of source-of-funds and source-of-wealth evidence in context, and keep PEP analysis separate from sanctions screening.

Business relationships and linked transactions:

‍The Article 19(9) draft clarifies when an engagement is a continuing business relationship rather than an occasional transaction, and how transactions may be linked for applying CDD thresholds. The legal concept turns on professional or commercial dealings with repetition or duration; a written contract is not decisive. Ongoing access to services, expected repeat dealings and the nature of the engagement can all matter.

• For professional advisers, the underlying transaction may be more relevant than the adviser’s fee when applying the draft’s criteria. A firm should assess the service performed and the transaction’s value and connection, rather than mechanically relying on invoice value or splitting related payments. The draft does not authorise collecting additional personal data without a legal basis simply to search for possible links.

Group-wide controls and cross-border supervision:

‍The group-wide draft addresses governance, risk assessment, internal controls and secure sharing of relevant information across an obliged entity group. It also addresses branches and subsidiaries in third countries where local law may prevent application of group policies or information exchange. Groups should map which entity contracts with each customer, who makes risk decisions, where records are held and how local restrictions are identified and escalated.

• Where a third-country legal restriction is asserted, document the applicable law, the information affected, legal advice where appropriate, available exceptions and the mitigating measures adopted. A group standard cannot override mandatory local law, data-protection requirements or professional secrecy. A clear allocation of EU accountability is particularly important where several EU entities sit within a group headquartered outside the Union.
• The home-host cooperation draft sets out how national supervisors should exchange information and coordinate cross-border inquiries for groups operating in more than one Member State. This supports more consistent supervision but does not remove national authorities’ role. AMLA’s direct supervision is limited to selected high-risk cross-border financial-sector entities; most obliged entities, including most non-financial professions, will remain under national supervision.

The central database and MiCA review:

‍The proposed central AML/CFT database is intended for supervisory authorities and AMLA, with confidential, need-to-know access. Its purpose is to improve risk-based oversight and make supervisory reporting more predictable. AMLA has said the draft uses information supervisors already hold or will collect and creates no direct reporting obligation for private entities. Firms should not treat the consultation as a new filing requirement.

• AMLA’s MiCA response identifies areas for possible future clarification or amendment, including staking, lending and borrowing, decentralised finance, unauthorised stablecoins, certain asset-referenced token issuers and cross-border supervision. These points may inform future Commission proposals. They do not, by themselves, change the legal obligations of crypto-asset service providers today.

Data protection, professional secrecy and non-EU groups:

‍AML/CFT duties do not displace the GDPR. Personal data must be collected for defined purposes, limited to what is necessary, kept accurate and protected. This is particularly relevant to PEP-related information, family or close-associate data and centralised group systems. Assess each proposed transfer or shared database under the applicable data-protection framework.

• The Court of Justice’s 2022 judgment in the Luxembourg beneficial-ownership register cases concerned unrestricted public access to beneficial-ownership information under the then applicable regime. It did not abolish beneficial-ownership registers or obliged entities’ CDD duties. Legal professional privilege and secrecy require jurisdiction-specific analysis; neither a group policy nor a broad claim of privilege should replace that analysis.
• The EU AMLR does not automatically replace UK AML law. UK rules continue to apply to UK-regulated activities. An EU establishment or other relevant EU nexus may create additional obligations under EU and national law, so international groups should map the legal entity providing the service, its regulator, the location of records and the applicable reporting channels.

A proportionate preparation programme:

‍Obliged entities can begin by mapping which group entities and activities fall within the AML/CFT framework, identifying the responsible national supervisors and recording the relevant commencement dates. Next, compare current CDD, beneficial-ownership, PEP, remote-verification and linked-transaction procedures with AMLA’s final drafts, labelling any proposed changes as provisional until the Commission adopts the texts.

• Groups should document governance, information flows, third-country legal restrictions and escalation routes. Firms should test practical scenarios: remote onboarding of an overseas founder, repeated professional services, linked payments, a PEP beneficial owner and a group information request restricted by local law. Assign an accountable owner to monitor Commission adoption, Official Journal publication and national implementation.

Conclusion:

‍October 2026 advanced the operational design of the EU AML/CFT framework, but it did not make every announced measure immediately binding. The AMLR’s application date, AMLA’s final drafts, the database consultation and MiCA recommendations must be treated as distinct legal categories. Firms that prepare now should focus on evidence, proportionate risk decisions, clear group accountability and a process for updating controls once the final instruments are adopted.

‍

‍Frequently asked questions :-

Are AMLA’s October 2026 standards already binding?

‍No. The private-sector standards and home-host cooperation standards were final drafts submitted to the European Commission. They become binding only through the applicable adoption and publication process.

When does the EU AML Regulation apply?

‍Regulation (EU) 2024/1624 generally applies from 10 July 2027, with a later 10 July 2029 date for the specified football-sector entities.

Do the October standards create immediate CDD obligations?

‍The drafts do not, by their publication alone, create binding new obligations. Existing applicable national and EU requirements remain in force; firms should monitor adoption and commencement.

Will the central AMLA database require companies to file directly?

AMLA stated that the proposed database standards do not create direct reporting duties for private companies. The draft is designed for supervisory information exchange.

Does AMLA supervise every EU obliged entity directly?

No. National authorities continue to supervise most entities. AMLA direct supervision is limited to selected high-risk cross-border financial-sector entities.

Do AMLA’s MiCA recommendations amend the crypto-asset rules?

‍No. They are recommendations for the Commission’s review and are not themselves amendments to MiCA.

What should an international group do now?

‍Map regulated entities and responsibilities, review CDD and information-sharing controls against the drafts, document third-country restrictions, and monitor formal adoption and national guidance.