The European Union's 2024 anti-money-laundering (AML) package is the most significant overhaul of EU financial-crime rules to date. It replaces a patchwork of national transpositions with a directly applicable single rulebook — the Anti-Money-Laundering Regulation, Regulation (EU) 2024/1624 (AMLR) — supported by a sixth AML Directive, Directive (EU) 2024/1640 (AMLD6), and a new EU-level supervisor, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, Regulation (EU) 2024/1620 (AMLA), based in Frankfurt am Main.

The package was published in the Official Journal on 19 June 2024. The AMLR harmonises the substantive obligations on businesses — customer due diligence, beneficial ownership, reporting and a Union-wide cash limit — so they apply identically across all 27 Member States. AMLD6 covers the institutional architecture (supervisors, Financial Intelligence Units, beneficial-ownership registers) that Member States must put in place. AMLA centralises supervision and standard-setting.

What is the EU AML package and what does each instrument do?

The package has three legal instruments:

  • AMLR — Regulation (EU) 2024/1624 (the "single rulebook"): directly applicable, harmonised rules on customer due diligence (CDD), beneficial ownership, suspicious-transaction reporting and a cash-payment limit. As a regulation, it needs no national transposition and applies identically across the EU.
  • AMLD6 — Directive (EU) 2024/1640: the institutional framework — national supervisors, Financial Intelligence Units (FIUs), beneficial-ownership registers and cross-border cooperation. As a directive, Member States transpose it into national law.
  • AMLA Regulation — Regulation (EU) 2024/1620: establishes the EU's Authority for Anti-Money Laundering and Countering the Financing of Terrorism, headquartered in Frankfurt.

Together they shift the EU from a directive-led model (where rules varied by country) to a regulation-led model with a central supervisor.

Who is an "obliged entity" under the AMLR?

"Obliged entities" are the businesses required to apply AML controls. The AMLR retains the traditional categories — credit and financial institutions, auditors, accountants, tax advisers, notaries and other legal professionals, trust and company service providers, estate agents and dealers in high-value goods — and expands the scope to include:

  • crypto-asset service providers (now fully in scope);
  • crowdfunding service providers and certain crowdfunding intermediaries;
  • traders in high-value goods such as precious metals and stones, and operators dealing in luxury goods;
  • persons in investment-migration (residence/citizenship-by-investment) operations;
  • professional football clubs and football agents (in respect of higher-risk transactions such as transfers, sponsorships and agent fees).

Football clubs and agents benefit from a later application date (see timeline).

What are the customer due diligence (CDD) and enhanced due diligence (EDD) rules?

Obliged entities must identify and verify the identity of their customers and, where relevant, the beneficial owner, and monitor the business relationship on an ongoing basis. The AMLR sets harmonised, risk-based CDD requirements rather than leaving the detail to national law.

  • Standard CDD is triggered when establishing a business relationship, for occasional transactions above set thresholds, on suspicion of money laundering or terrorist financing, or where there are doubts about previously obtained data.
  • Occasional cash transactions of EUR 3,000 or more trigger identification/verification even where no business relationship exists.
  • Enhanced due diligence (EDD) applies to higher-risk situations — for example, cross-border correspondent relationships with third-country institutions, dealings linked to high-risk third countries, and politically exposed persons (PEPs).
  • Simplified due diligence is permitted only in demonstrably lower-risk situations.

The rules are deliberately uniform so that a customer faces the same baseline checks regardless of the Member State.

How do the beneficial-ownership rules work?

A beneficial owner is, in general, a natural person who ultimately owns or controls a legal entity. The AMLR maintains a baseline ownership threshold of 25% or more of shares or voting rights (or ownership interest), alongside control by other means.

Key points:

  • The threshold can be lowered for higher-risk categories of entities: following a risk assessment, the European Commission may set a lower threshold (to a maximum of 15%) for certain sectors particularly exposed to money-laundering or terrorist-financing risk.
  • Obliged entities must take reasonable measures to verify the identity of beneficial owners using reliable, independent sources.
  • AMLD6 governs the central beneficial-ownership registers Member States must maintain, including rules on who may access them (competent authorities, obliged entities, and persons with a legitimate interest).

What is the EUR 10,000 cash payment limit?

The AMLR introduces a Union-wide upper limit of EUR 10,000 on cash payments in the course of a business (trade in goods or services). The limit:

  • applies whether the payment is a single operation or several linked operations;
  • is a maximum — Member States may set lower national limits;
  • does not apply to private, non-professional transactions between individuals.

Separately, obliged entities must apply customer identification for occasional cash transactions of EUR 3,000 or more. The cash limit is a harmonised measure intended to reduce the use of large cash sums to launder funds.

What is AMLA and where is it based?

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) is a new EU body established by Regulation (EU) 2024/1620 and headquartered in Frankfurt am Main, Germany. Its role combines:

  • Direct supervision of a selected group of the highest-risk credit and financial institutions operating across multiple Member States, using joint supervisory teams;
  • Indirect supervision — coordinating, assessing and conducting peer reviews of national supervisors and supervisory colleges;
  • Standard-setting — developing technical standards and guidelines for the single rulebook;
  • FIU support — coordinating and supporting national Financial Intelligence Units.

The AMLA Regulation applies from 1 July 2025, giving the authority a multi-year build-up period before it begins direct supervision (expected from 2028).

When do the new rules apply, and how do they relate to the earlier AMLDs?

Key dates (verify against the latest official sources before relying on them):

  • 9 July 2024 — the AMLR entered into force (published in the Official Journal 19 June 2024).
  • 1 July 2025 — the AMLA Regulation applies; AMLA stands up in Frankfurt.
  • 10 July 2027 — the AMLR applies in general, and the AMLD6 transposition deadline falls (some beneficial-ownership-register provisions had earlier deadlines).
  • 2028 — AMLA's direct supervision of selected entities is expected to begin.
  • 10 July 2029 — AML obligations for professional football clubs and football agents apply (a phased, later start for that sector).

Relationship to prior law: the package largely replaces the earlier directive-based regime built on the 4th and 5th AML Directives (Directive (EU) 2015/849 as amended). Substantive obligations move from national transpositions into the directly applicable AMLR, while AMLD6 modernises and consolidates the institutional/organisational rules.

Frequently asked questions

Is the AMLR directly applicable, or does it need national transposition?

The AMLR (Regulation (EU) 2024/1624) is directly applicable in all 27 Member States and does not require transposition — it applies identically across the EU from 10 July 2027. By contrast, AMLD6 is a directive that Member States must transpose into national law.

When does the AMLR start to apply?

The AMLR generally applies from 10 July 2027. A later date of 10 July 2029 applies to obligations for professional football clubs and football agents. Confirm against EUR-Lex, as dates may be subject to further measures.

What is the EU-wide cash payment limit?

A Union-wide limit of EUR 10,000 on cash payments made in a professional/business context, applying to single or several linked operations. Member States may impose lower limits. Identification is also required for occasional cash transactions of EUR 3,000 or more.

What is the beneficial-ownership threshold?

The baseline is 25% or more of shares, voting rights or ownership interest (or control by other means). For higher-risk categories of entities, the European Commission may set a lower threshold, up to a maximum of 15%.

Who does AMLA supervise, and where is it based?

AMLA is based in Frankfurt am Main. It will directly supervise a selected group of the highest-risk cross-border financial institutions (expected from 2028) and indirectly oversee national supervisors. The AMLA Regulation applies from 1 July 2025.

Does the package replace the old AML Directives?

Largely, yes. It moves substantive obligations from the 4th/5th AML Directive framework (Directive (EU) 2015/849 as amended) into the directly applicable AMLR, while AMLD6 consolidates and strengthens the institutional rules. Businesses should treat the AMLR as the primary source of operational obligations from 10 July 2027.

Official sources