The EU AML Package and AMLA

The EU AML package and AMLA: the short answer

The EU AML package adopted in 2024 replaces the patchwork of national anti-money laundering rules with a directly applicable single rulebook and creates a new EU Anti-Money Laundering Authority (AMLA) in Frankfurt am Main. The package consists of the AML Regulation (EU) 2024/1624 (AMLR), which applies from 10 July 2027; the Sixth AML Directive (EU) 2024/1640 (AMLD6) on national supervisors, financial intelligence units and beneficial ownership registers, to be transposed mainly by 10 July 2027; the AMLA Regulation (EU) 2024/1620, which has applied since 1 July 2025; and the recast Transfer of Funds Regulation (EU) 2023/1113 covering crypto-asset transfers. From 2028, AMLA will directly supervise selected high-risk credit and financial institutions and groups.

For German obliged entities, from banks and payment institutions to real estate agents, traders in goods, lawyers, notaries and tax advisers, the EU AML package means that much of the Money Laundering Act (Geldwäschegesetz, GwG) will be replaced by EU law. This article explains what changes, who is affected and how to prepare.

The components of the EU AML package

Who is affected

The AMLR applies to the traditional financial sector and a wide range of non-financial businesses: credit institutions, financial institutions, crypto-asset service providers, auditors, accountants and tax advisers, lawyers and notaries when involved in certain transactions, trust and company service providers, estate agents, persons trading in goods above certain cash thresholds, gambling service providers and, from 2029, certain professional football clubs and agents. Investment migration operators and persons trading in high-value goods such as precious metals and luxury vehicles are also covered.

In Germany, the GwG already covers most of these sectors, but its rules will be replaced by the directly applicable AMLR, with national law limited to matters left to Member States, such as supervision, sanctions and certain options. German supervisors, notably BaFin for the financial sector and the federal states' authorities for the non-financial sector, will continue to supervise most obliged entities.

Key changes under the AML Regulation

Cash limit

Under Article 80 of the AMLR, persons trading in goods or providing services may accept or make cash payments only up to EUR 10,000, or the equivalent, whether the payment is made in one operation or several linked operations. Member States may set lower limits. Germany has so far had no general cash payment limit, so the EU AML package introduces one for the first time.

Beneficial ownership

The AMLR harmonises the identification of beneficial owners. Ownership of 25 per cent or more of the shares, voting rights or other ownership interest in a corporate entity generally establishes beneficial ownership, assessed together with control through other means. Rules for trusts, foundations and similar arrangements are specified in more detail, and obliged entities must report discrepancies with the central registers.

Customer due diligence

Customer due diligence requirements, simplified and enhanced due diligence, rules on politically exposed persons and third-country high-risk jurisdictions are set out in detail in the Regulation and supplemented by AMLA's regulatory technical standards and guidelines. Obliged entities will need to update policies, risk assessments, onboarding processes and monitoring systems to meet the harmonised standards.

Group-wide policies

Parent undertakings must ensure group-wide policies and procedures, including information sharing within the group, and branches and subsidiaries in third countries must apply measures consistent with the Regulation where local law permits.

AMLA: the new EU authority in Frankfurt

The AMLA Regulation establishes the Authority for Anti-Money Laundering and Countering the Financing of Terrorism with its seat in Frankfurt am Main. AMLA's tasks include direct supervision of selected obliged entities, indirect supervision and coordination of national supervisors in the financial sector, support and coordination of supervisors in the non-financial sector and of FIUs, and the development of regulatory and implementing technical standards and guidelines.

Credit and financial institutions and groups whose residual risk profile is classified as high, based on criteria and a methodology set by AMLA, and which operate in a minimum number of Member States, qualify as selected obliged entities. According to the Regulation, direct supervision of selected obliged entities should commence in 2028. For these entities, AMLA will be the supervisor with powers to request information, conduct investigations and impose administrative sanctions, working with joint supervisory teams including national supervisors.

Crypto-assets and the travel rule

Crypto-asset service providers are fully integrated into the EU AML package. They are obliged entities under the AMLR, and the recast Transfer of Funds Regulation (EU) 2023/1113 requires them to collect and transmit information on the originator and beneficiary of crypto-asset transfers, in the same way as banks for wire transfers. Transfers involving self-hosted wallets are subject to specific verification requirements. In Germany, crypto-asset service providers also need authorisation under the Markets in Crypto-Assets Regulation, supervised by BaFin, and AML compliance is a central part of the authorisation and ongoing supervision.

Reporting suspicious transactions

The obligation to report suspicious transactions to the Financial Intelligence Unit remains at the heart of the regime. The AMLR sets harmonised rules on when and how obliged entities must report, on refraining from carrying out suspicious transactions and on the prohibition of tipping off. In Germany, the FIU is part of the Central Customs Authority. AMLD6 strengthens FIUs' powers to suspend transactions and to cooperate across borders, and AMLA will coordinate joint analyses by FIUs. Obliged entities should expect more consistent feedback and possibly more information requests from FIUs as a result.

AMLD6 and national structures

AMLD6 requires Member States to ensure adequately resourced supervisors and FIUs, to maintain central registers of beneficial ownership with improved access rules following the Court of Justice's 2022 judgment on public access, and to establish single access points to real estate information and interconnected bank account registers. Germany's Transparency Register (Transparenzregister) and the account information system will need to be adapted. Member States must transpose most provisions by 10 July 2027, with some deadlines in 2025, 2026 and 2029.

Governance and responsibilities

The AMLR requires obliged entities to appoint a member of the management body responsible for compliance with AML rules and a compliance officer with sufficient seniority, resources and access to information. In groups, the parent must appoint a group compliance function. These requirements formalise expectations that German supervisors already apply under the GwG, where the money laundering officer and the responsible board member play similar roles. Boards should ensure that reporting lines, resources and documentation of decisions meet the new standard, because supervisors will hold individual managers accountable for systemic failures.

Outsourcing of AML tasks to service providers remains possible within limits. The obliged entity stays fully responsible, and certain decisions, such as approving the risk assessment or deciding to file suspicious transaction reports, cannot be outsourced. Contracts with service providers should therefore be reviewed against the AMLR before 2027.

Implications for non-financial businesses

The EU AML package is not only a banking topic. Real estate agents, traders in goods, art dealers, auditors and tax advisers, as well as lawyers and notaries in transactional work, must apply the AMLR's customer due diligence rules. Many smaller obliged entities in Germany have struggled with GwG compliance, and supervisory authorities of the federal states have increased inspections in recent years. The harmonised rules and AMLA's guidance for non-financial supervisors are intended to raise standards across the Union. Businesses in these sectors should review whether their current processes, often based on simple checklists, will meet the more detailed EU requirements.

Sanctions and enforcement

AMLD6 requires Member States to provide for administrative sanctions and measures for breaches of the AMLR, including significant maximum pecuniary sanctions for serious, repeated or systematic breaches, which for credit and financial institutions can be linked to turnover. AMLA can impose sanctions on selected obliged entities. German law will need to align the fine provisions currently contained in the GwG with these requirements. In addition, criminal liability for money laundering under § 261 of the Criminal Code remains a separate risk for individuals and, through §§ 30 and 130 OWiG, for companies.

Preparing for 2027

1. Map current GwG processes against AMLR requirements and identify gaps.
2. Update the business-wide risk assessment and customer risk scoring methodologies.
3. Review onboarding, beneficial ownership verification and ongoing monitoring.
4. Implement the cash limit in sales processes and point-of-sale systems where relevant.
5. Assess group-wide policies and information sharing, including third-country branches.
6. Monitor AMLA's technical standards and guidelines and BaFin's implementation guidance.
7. Train staff on the new terminology and requirements.

Illustration: a hypothetical German car dealer group regularly accepts large cash payments from private customers. Under the GwG, it already has due diligence obligations for cash transactions above certain thresholds. From 10 July 2027, the AMLR's EUR 10,000 cash limit prohibits accepting cash payments above that amount altogether. The group updates its sales policies, trains staff, adapts its accounting systems to block cash payments above the limit and informs customers in advance.

Financial institutions that may become selected obliged entities should also prepare for the cultural shift of direct EU supervision: more standardised data requests, joint supervisory teams with members from several Member States and a supervisory approach that compares institutions across the Union. Documentation in English and consistent group-wide data will become increasingly important.

How TRW & Co helps with the EU AML package

We advise banks, payment and crypto-asset service providers, fund managers and non-financial obliged entities on the EU AML package. We conduct gap analyses between the GwG and the AMLR, update risk assessments, policies and onboarding processes, advise on beneficial ownership and transparency register questions and represent clients before BaFin and other supervisors. We also prepare institutions for possible direct supervision by AMLA. Our work connects with our financial regulation and compliance practices. See also AML duties of obliged entities under the GwG and the transparency register. To prepare for 2027, contact us.