Anti-Money Laundering Regulation (AMLR)

What changes, and what does not

The AMLR is maximum-harmonising. National discretion disappears across the obliged-entity perimeter, customer due diligence, beneficial ownership, simplified and enhanced due diligence, internal policies, group-wide requirements, record-keeping, training and the reporting duty.

The consequence most compliance officers have not yet priced in: from 10 July 2027, national supervisory guidance can no longer add to or subtract from the AMLR. DNB's Q&As and Good Practices and the AFM's Leidraad can restate the rules. They cannot supplement them. The binding interpretive layer becomes AMLA's technical standards and guidelines.

What does not change is as important. The 25% beneficial ownership threshold survives. Five-year record retention survives. Supervision stays national for all but a few dozen groups. The Sanctiewet track is untouched by the package entirely.

Reading the obliged-entity list correctly

Free zones are in, but not as "free-zone operators". The claim circulates in that loose form and it is wrong. Article 3(3)(j) reaches persons storing, trading or acting as intermediaries in the trade of cultural goods and high-value goods when carried out within free zones and customs warehouses, and only above €10,000. Operating a free zone is not itself the trigger.

Crypto-asset service providers are financial institutions. Not a separate category. Article 2(1), point (6)(i) lists "a crypto-asset service provider" within the definition of financial institution, which Article 3(2) then makes an obliged entity. That matters because the financial-institution obligations attach in full, including the Article 19(3) €1,000 occasional-transaction threshold below.

The football exemption is real and generous. Article 5 lets Member States exempt, in full or in part, professional football clubs in the highest national division with total annual turnover below €5 million in each of the previous two calendar years, and clubs in any lower division, on proven low risk.

High-value goods thresholds worth calendaring: motor vehicles at €250,000, and boats and aircraft at €7.5 million.

Customer due diligence

The triggers, and the two thresholds almost nobody quotes

Article 19(1) requires customer due diligence when establishing a business relationship; on an occasional transaction of at least €10,000, single or through linked transactions; when participating in the creation of a legal entity, the setting up of a legal arrangement, or, for auditors, tax advisers, notaries, lawyers and trust or company service providers, the transfer of ownership of a legal entity, irrespective of value; on suspicion, "regardless of any derogation, exemption or threshold"; on doubts about previously obtained identification data; and on doubts about whether the person you are dealing with is the customer.

Then two much lower thresholds that the €10,000 headline hides:

• Article 19(2): €1,000. Credit institutions and financial institutions, with the exception of crypto-asset service providers, must apply customer due diligence on an occasional transaction that constitutes a transfer of funds under the Transfer of Funds Regulation, at €1,000 or more, single or linked.
• Article 19(3)(a): €1,000 for crypto-asset service providers, on any occasional transaction, single or linked.

The high-net-worth rule, in full

Article 34(5) is narrower and more precise than the version usually quoted. All of the following must be true before it bites:

1. the business relationship is already identified as higher risk;
2. it involves the handling of assets worth at least €5,000,000 through personalised services; and
3. the customer holds total assets of at least €50,000,000, in financial, investable or real estate assets or any combination, excluding that customer's private residence.

Where all three hold, credit institutions, financial institutions and trust or company service providers must apply three further measures on top of the ordinary enhanced due diligence: specific procedures to mitigate the risks of personalised services and products, additional information on the customer's source of funds, and measures preventing and managing conflicts of interest between the customer and the senior management or compliance staff handling them.

Note what is not in the test. There is no per-transaction trigger: the €5 million limb is about assets handled through personalised services, not a single transaction. And AMLA must issue guidelines by 10 July 2027 on how to establish whether a customer meets the €50 million test and how to value it, which means the population cannot be finally sized until those land.

A live drafting decision. AMLA holds a power under Article 19(9) to set additional lower thresholds for occasional transactions. In its consultation it stated plainly: "At this stage, AMLA has chosen not to exercise this option."

Beneficial ownership

Article 51 sets two routes in. A beneficial owner is a natural person who has, directly or indirectly, an ownership interest in the corporate entity, or who controls it, directly or indirectly, through ownership interest or via other means.

Read the closing sentence of Article 51 carefully, because it settles a question practitioners argue about: "Control via other means … shall be identified independently of and in parallel to the existence of an ownership interest or control through ownership interest." Control by other means is not a fallback for when the percentage test fails. It runs in parallel, and both must be assessed.

The 25% test, and how chains are actually calculated

Article 52(1) defines an ownership interest as direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest, expressly including rights to a share of profits, other internal resources, or the liquidation balance.

The calculation method is in the text, and it is the answer to the most common structuring question: indirect ownership is calculated by multiplying the shares, voting rights or other ownership interests held by the intermediate entities in the chain, and adding together the results from those various chains, unless Article 54 applies. For the purpose of assessing whether an ownership interest exists, all shareholdings at every level of ownership are taken into account.

Article 54 handles the case the multiplication rule cannot: where a corporate entity is owned through a multi-layered structure and ownership interest and control coexist at different layers of the same chain, the beneficial owners are both the persons controlling the entities that hold a direct ownership interest, and the persons holding the ownership interest, individually or cumulatively.

And note Article 53(2)(c): control through ownership interest is a different and much higher test: 50% plus one of the shares, voting rights or other ownership interest.

Separately, Member States must notify the Commission of beneficial-ownership entity types by 10 October 2027.

The €10,000 cash limit

Article 80(1): persons trading in goods or providing services may accept or make a cash payment only up to €10,000, or the equivalent in national or foreign currency, "whether the transaction is carried out in a single operation or in several operations which appear to be linked."

It binds the trader and the service provider, not the consumer. Linked operations aggregate. And it covers services, which the current Dutch rule does not.

Two different routes for a lower national limit, and the Netherlands is on the harder one

This is the provision an earlier version of this page could not read, and it turns out to be the most consequential detail on the page.

• Article 80(2): a Member State may adopt a lower limit, but only following consultation of the European Central Bank under Article 2(1) of Council Decision 98/415/EC, and must notify the Commission within 3 months of the measure being introduced nationally.
• Article 80(3): where limits already exist at national level below €10,000, "they shall continue to apply". Member States had to notify those to the Commission by 10 October 2024.

The current Dutch rule, and its planned extension

The Dutch government's stated plan is to keep €3,000 and extend it to services from mid-2027, which the Rijksoverheid confirms. The extension is clearly necessary: Article 80(1) covers services and Article 1f does not. What we cannot find is the ECB consultation the extension will also need.

For reference, the current Dutch rule reads: "Het is verboden voor instellingen als bedoeld in artikel 1a, vierde lid, onderdelen i, k en n, in of vanuit Nederland betaling van goederen in contanten voor een bedrag van € 3.000 of meer, of de tegenwaarde daarvan in buitenlandse munteenheid, te verrichten of te accepteren, ongeacht of de transactie plaatsvindt in een handeling of door middel van meer handelingen waartussen een verband lijkt te bestaan." (Artikel 1f Wwft)

Goods only. Addressed to dealers in goods, art dealers and pawnshops. Already aggregating apparently linked transactions.

What the cash limit does not catch

Article 80(4) carves out two cases: payments between natural persons not acting in a professional capacity, and payments or deposits made at the premises of credit institutions, electronic money issuers and payment service providers. But read the sting in the second: such payments or deposits above the limit must be reported to the FIU within the deadlines the FIU imposes. The carve-out moves the obligation; it does not remove it.

Article 80(5) and (6) require Member States to take measures including penalties against professionals suspected of breaching the limit, calculated to be proportionate to the seriousness of the infringement and to discourage repetition. Article 80(7) allows temporary suspension of the limit where, by force majeure, non-cash means of payment become unavailable nationally, with the Commission able to order the suspension lifted if it considers it unjustified.

Anonymous accounts, anonymity-enhancing coins and bearer shares

Article 79(1) prohibits credit institutions, financial institutions and crypto-asset service providers from keeping anonymous bank and payment accounts, anonymous passbooks, anonymous safe-deposit boxes or anonymous crypto-asset accounts, and then goes wider than the list, catching "any account otherwise allowing for the anonymisation of the customer account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins."

So the anonymity-enhancing coin prohibition is real and express. An earlier version of this page removed it as unverified; that was too cautious.

Existing anonymous accounts, passbooks and safe-deposit boxes are not simply closed: their owners and beneficiaries must be subjected to customer due diligence before the account is used in any way.

Article 79(2) separately bars credit and financial institutions acting as card acquirers from accepting payments made with anonymous prepaid cards issued in third countries, unless a Commission technical standard permits it on proven low risk.

Article 79(3): bearer shares. Companies are prohibited from issuing bearer shares, and must convert existing ones into registered shares, immobilise them, or deposit them with a financial institution by 10 July 2029. Companies with securities listed on a regulated market, or whose shares are issued as intermediated securities, are outside this. Where shares are not converted, immobilised or deposited by that date, all voting rights and rights to distribution attached to them are automatically suspended until they are. And shares still not dealt with by 10 July 2030 shall be cancelled, reducing share capital by the corresponding amount. Bearer share warrants are permitted only in intermediated form.

Both 2029 and 2030 dates were removed from an earlier version of this page as unsourced. They are in the text, and they are a two-stage mechanism (suspension first, cancellation second), not a single deadline.

The rules that decide implementation have not been written

This is the most useful thing on this page, and the least reported.

The AMLR delegates its operational detail to AMLA. Two standards decide what customer due diligence actually looks like in 2027:

• the RTS on customer due diligence under Article 28(1) AMLR: standard, simplified and enhanced measures, risk factors for e-money exemptions, reliable sources for identity verification, and the attributes of electronic identification means;
• the RTS on criteria for identifying business relationships, occasional and linked transactions and lower thresholds under Article 19(9) AMLR.

Both opened for consultation on 9 February 2026 and closed on 8 May 2026. As at AMLA's last update on 21 July 2026, neither has a published final report, and neither has been adopted by the Commission.

AMLA has published no delivery plan or deadline schedule for its remaining standards, and its regulatory instruments page states it is "not exhaustive". Four further consultations run into September and October 2026.

Finalised so far, with final reports published: the standards on supervisory cooperation, on pecuniary sanctions and administrative measures, on FIU reporting to the EPPO, on FIU-to-FIU exchanges, and the two risk-profile standards of 16 December 2025. Nothing under the AMLR itself has yet been adopted by the Commission.

High-risk third countries

26 jurisdictions, as at the Commission's last update on 9 January 2026: Afghanistan, Algeria, Angola, Bolivia, British Virgin Islands, Cameroon, Côte d'Ivoire, DPRK, Democratic Republic of the Congo, Haiti, Iran, Kenya, Laos, Lebanon, Monaco, Myanmar, Namibia, Nepal, Russian Federation, South Sudan, Syria, Trinidad and Tobago, Vanuatu, Venezuela, Vietnam, Yemen.

Two delegated regulations of 9 January 2026 did the work, both amending Delegated Regulation (EU) 2016/1675, which remains the operative instrument until the AMLR applies:

• Delegated Regulation (EU) 2026/46 added Russia, and did so by creating an entirely new Annex category: "High-risk third countries which are not identified as being subject to calls for action or increased monitoring by the FATF, but whose membership in that international standard-setter is suspended." Russia is the only entry.
• Delegated Regulation (EU) 2026/83 added Bolivia and the British Virgin Islands, and removed Burkina Faso, Mali, Mozambique, Nigeria, South Africa and Tanzania.

The Dutch implementation

The Wwft is replaced in full by the Implementatiewet ter voorkoming van witwassen en terrorismefinanciering (Iwt), which transposes AMLD6. The AMLR applies directly alongside it.

The Iwt has not reached parliament. Its internet consultation ran in 2025, with third-party advices dated 4 September 2025 from the Openbaar Ministerie and 29 September 2025 from the Adviescollege toetsing regeldruk, which concluded that the implementation is "niet lastenluw" (not light-touch), against the government's own stated policy of adding no national obligations on top of the EU package. We found no Kamerstukken dossier for the Iwt as at 17 August 2026, and no Raad van State advice on it. Neither is proof it does not exist; the authoritative status tracker was not reachable.

The Netherlands is already behind on an earlier tranche. AMLD6 has four staged deadlines: 10 July 2025, 2026, 2027 and 2029. The Eerste Kamer's own EU dossier reports, as at 8 May 2026, that the 2025 tranche was implemented late, the 2026 tranche is not on schedule, the 2027 tranche is on schedule and the 2029 tranche is not on schedule. Which provisions sit in which tranche we could not confirm.

The clearest visible symptom is the UBO register. The decree extending access to persons with a legitimate interest went to Parliament on 2 April 2026. On 15 July 2026 the Raad van State advised, in W06.26.00149/III, not to adopt it unless amended, on two grounds: it fails to implement access for other persons able to demonstrate a legitimate interest, which the Directive requires be assessed case by case; and the Dutch duty to notify the UBO that their data has been accessed conflicts with the Directive's requirement that access occur without warning the entity. It was not in force as at 17 August 2026.