We explore the EU’s new AML package of rules and consider how it will affect the future of compliance in Europe.

Ever since the first directive to combat money laundering and the financing of terrorism was issued in 1991, the European Union has continued to improve and harmonize the legislative arsenal of its member states.

In the space of 30 years, six dedicated Anti-Money Laundering Directives (AMLD) have been issued. The first was mainly aimed at combating drug-related offences and introduced the first KYC provisions. The 4th and 5th Directives (AMLD4 & AMLD5) brought in increased transparency obligations, including access to beneficial ownership registers and strengthening controls on virtual currency transactions. With each new iteration, the scope of protection has expanded significantly and now covers many areas, ranging from art dealing to cryptocurrency trading.

A major development to AML controls came in May 2024 with the release of the AML package, a set of legislative proposals aimed at strengthening the EU’s AML/CFT rules. The AML package aims to close regulatory gaps, strengthen cooperation between member states and ensure uniform application of the rules across the EU.

The AML package is well on its way to become a comprehensive model for the banking industry. It offers uniformity and efficient applications of AML requirements, and the combined rule sets cover top-level economic decision making all the way to daily life for individuals. However, the legislation and regulations are often tinged with a somewhat negative reputation as their final form can stifle innovation, rather than protecting the people they claim to serve.

Analysts and pundits commend the EU for its outreach to seek input and collaboration for new legislation, but final forms of initiatives rarely resemble the spirit in which they began. This is exemplified in the Draghi Report of September 2024 that discusses European competitiveness.

As the AML package is being finalized, there is still the opportunity for strong private sector collaboration. If done right, this brings Europe close to ‘digital first’ solutions that are standardized, scalable and competitive on a global scale.
Rayissa Armata, Director of Global Regulatory and Government Affairs at IDnow.

“This would better ensure a more level playing field for both traditional services alongside rapidly growing industries such as crypto, blockchain, and digital identity verification processes based on more secure frameworks. If such points are harmonized and implemented properly, Europe has a strong chance to be a leader in the next phase of development in the digital economy,” adds Rayissa.

Here, we explore some of the new rules and consider the effect it may have on AMLD6 and the future of compliance in Europe.

5 new changes to AML rules and regulations in 2024.

A new European Anti-Money Laundering Authority (AMLA) has been established and will be operational in Frankfurt from 2025. With a staff of 400, it will centralize anti-money laundering efforts, coordinate national authorities and conduct cross-border investigations.

A directive which will further tighten criminal provisions and procedures that need to be adopted by member states to improve the AML/CFT regime.

A regulation that will introduce harmonised rules that will be directly applicable as a regulation to combat money laundering and terrorist financing across all EU member states.

Crypto-asset service providers will now be required to collect and store information on the source and beneficiary of the funds for each transaction. This rule, known as the “travel rule”, already exists in traditional finance and requires that information on the source of the asset and its beneficiary travels with the transaction and is stored on both sides of the transfer. CASPs will be obliged to provide this information to competent authorities if an investigation is conducted into money laundering and terrorist financing. This means that businesses operating in these spaces must adopt harmonized verification standards, aligning with those used by traditional financial institutions.

A directive on Access to Centralized Bank Account Registers: This directive makes information from centralized bank registers available to member states. This contains data relating to the identity and location of bank account holders – through a single access point.

Regulations, directives and AMLD6 changes.

It’s important to note that there is an Anti-Money Laundering Regulation (AMLR) and Anti-Money Laundering Directives.

AMLR focuses more on regulatory and supervisory mechanisms, while directives, such as AMLD6 enhances the criminal law framework for tackling money laundering. Together, these laws are designed to increase financial transparency, make it harder to use the financial system for illicit purposes, and ensure that there is greater accountability for both individuals and legal entities involved in money laundering.

The AMLR provides a uniform set of standards directly applicable across the EU, ensuring consistency in financial and compliance procedures. AMLD6, however, allows member states some flexibility in how they apply criminal sanctions and enforcement measures, provided they align with the directive’s goals. Together, AMLR and AMLD6 form a cohesive framework within the AML Package.

AMLD6, which came into force in December 2020, has introduced several new legal provisions and expanded the list of criminal offences related to money laundering. Faced with the diversification of money laundering schemes, it now includes offences that go beyond simple financial crime. There are now 22 additional offences, including environmental crimes, tax crimes and cybercrime.

AMLD6 also encourages member states to prosecute “facilitators” who help to carry out illegal activities. How member states should prosecute is also being revised and AMLD6 seeks to improve the deterrent effect of existing legislation by imposing tougher penalties. EU member states are now required to impose prison sentences of at least four years for serious money laundering offences, with heavier penalties for repeat offenders. Significant financial penalties are also issued (up to €5 million for individuals), to deprive the culprits of any profit derived from illicit activities.

Another major development is the expansion of who should be held responsible for money laundering. From now on, legal entities could be liable for money laundering offences committed by their employees. Companies may also be subject to severe penalties, which could result in the company’s closure. Executives may also be held liable for money laundering offences committed within their organization as part of the EU’s plan to adopt “effective, proportionate and dissuasive criminal sanctions“.

Recognizing the transnational challenges posed by organized crime and money laundering, AMLD6 promotes a rapid and effective exchange of information on suspicious transactions and ongoing investigations, as well as enhanced legal assistance in the collection of evidence and freezing of assets. It also promotes cooperation with specialized European agencies, such as Europol and Eurojust to facilitate the coordination of cross-border investigations.

Finally, the legislation contains enhanced due diligence provisions for wealthy individuals with assets of more than €50 million, excluding their main residence, as well as an EU-wide limit of €10,000 for cash payments.

The future of AML compliance.

The implementation of AMLD6 has significant implications for businesses and financial institutions. Companies will now be required to protect themselves against compliance risks and adopt appropriate control mechanisms and systems, conduct regular audits, and raise awareness among their employees. This includes investing in advanced transaction monitoring and analysis technologies to proactively detect suspicious financial activity. These actions are necessary to protect the integrity of the company, avoid severe penalties, and maintain stakeholder trust.

In addition, many industries that were not previously required to comply with certain AML regulations will now need to be more transparent with their transactions. For example, from 2029, top-tier professional football clubs involved in large-scale financial transactions, whether with sponsors, advertisers or in the context of player transfers, will have to comply with certain KYC rules. Like the financial sector, football clubs will have to verify the identity of their customers, monitor transactions and report any suspicious transactions to the FIUs.

As money laundering and terrorist financing is a global problem, measures adopted at EU level must be coordinated with international measures otherwise they will have a very limited effect. The European Union must therefore continue to consider the recommendations of the Financial Action Task Force (FATF) and other international bodies active in AML/CFT.

The new package of AML rules has now been entered into the EU’s Official Journal, which means that companies will have up to two years to implement some measures and three years for others.