AMLR 2027 Readiness Checklist: Closing the Gap Before the EU Single Rulebook Applies

Why a regulation, not a directive, changes your timeline¶

The EU AML package replaces a regime that has been built on directives — most recently the Fourth and Fifth Money Laundering Directives — with a hybrid: a directly-applicable Regulation (the AMLR) for the substantive rules every obliged entity must follow, plus a directive (AMLD6, Directive (EU) 2024/1640) for the institutional and supervisory plumbing that Member States transpose into national law.

The distinction matters for your planning. A directive gives Member States latitude in how they implement, which historically produced the fragmentation the single rulebook is meant to end — different ownership thresholds, different cash limits, different EDD expectations from one jurisdiction to the next. A regulation removes that latitude: the AMLR text is the rule, the same in Dublin, Frankfurt, and Milan, from the day it applies. There is no national implementing act to wait for and no margin of appreciation to lean on.

Practically, that means your gap analysis is against the regulation text itself, not against an as-yet-unwritten national statute. The text is published and stable. What is still in motion are the technical standards AMLA is drafting underneath it — but the obligations they refine are already on the page. You can start today.

AMLA's role: the supervisor and the standard-setter you are gap-assessing toward¶

The Anti-Money Laundering Authority (AMLA), established by Regulation (EU) 2024/1620, began operations on 1 July 2025 in Frankfurt. It does two things that shape your readiness work.

First, it is a direct supervisor. After a selection process expected in 2027, AMLA will take on direct supervision of a first wave of the highest-risk cross-border financial entities — a group the legislation frames in the order of roughly forty firms in that first cohort — from 2028. Even if your institution is not in that first wave, AMLA sets the supervisory tone and coordinates the national supervisors who examine everyone else. The bar it sets in 2028 is the bar your national regulator inherits.

Second, and more immediately useful, AMLA is the standard-setter. It develops draft regulatory technical standards (RTS) and implementing technical standards (ITS) that fill in the operational detail of the AMLR — for example, the specifics of customer-due-diligence information and the risk factors that drive enhanced due diligence. A critical nuance for your gap analysis: these draft standards are binding only once the European Commission formally adopts them. Until then they are draft, and AMLA's guidelines operate on a comply-or-explain basis. Track them, model against them, but anchor your hard requirements to the regulation text and treat the standards as the detail layer that will tighten — not loosen — what the articles already demand.

The obligation areas to gap-assess first¶

A full AMLR readiness programme touches dozens of articles. But a small number of obligation areas carry most of the gap risk because they change the data, triggers, or documents you operate on — not just the wording of a policy. These are the ones to assess in your Q2/Q3 2026 window, before remediation timelines compress against the 10 July 2027 date.

The table below is the spine of this checklist. For each obligation area it states what changes under the AMLR and the readiness action to run now. Use it to scope your gap analysis; the sections that follow expand the highest-stakes rows. You can run a structured version of this assessment with our AMLR 2027 readiness gap tool.

Beneficial ownership: re-baseline your UBO data against the 25% threshold¶

The single rulebook's harmonised beneficial-ownership rules are, for many firms, the largest hidden data-quality gap. The AMLR fixes a 25%-or-more ownership-or-voting-rights threshold for identifying the beneficial owners of corporate entities, applied uniformly — replacing the situation where the same threshold was read and applied differently across Member States, and where some firms layered their own conservative cuts on top.

The readiness problem is not the rule; it is your back book. If you onboarded customers under a divergent national interpretation, or your records resolve ownership to an intermediate holding company rather than a natural person, those records may not survive an AMLR-grade review. Multi-layered ownership chains and nominee arrangements are exactly where the regulation tightens, and exactly where legacy data is thinnest.

Run the re-baseline now, while you have runway. Pull your UBO population, re-test it against the 25% threshold, and triage into three buckets: records that already resolve cleanly to a natural person at or above 25%; records that need refresh or re-verification; and structures you cannot currently resolve at all. The third bucket is your real 2027 risk, and it takes the longest to clear because it depends on the customer responding. Starting that outreach in 2026 is the difference between a managed remediation and a 2027 onboarding-and-review backlog.

EDD triggers and the Article 10 risk assessment: the documents an examiner will open first¶

Enhanced due diligence. The AMLR specifies the situations that require EDD — relationships and transactions involving high-risk third countries, complex or unusually large transactions, and certain correspondent relationships, among others — as directly-applicable rules, with AMLA technical standards refining the underlying risk-factor list. Your gap analysis here is a two-way map: trigger logic you currently run that the AMLR does not require (candidates to retire), and AMLR-required triggers your rules do not yet fire on (gaps to close). Do this per customer segment, because the impact concentrates in correspondent banking, high-value private clients, and cross-border flows.

The Article 10 business-wide risk assessment. Article 10 of the AMLR requires obliged entities to identify and assess the money-laundering and terrorist-financing risks they are exposed to at the level of the business as a whole, to document that assessment, keep it current, and make it available to supervisors. For firms that have treated the enterprise-wide risk assessment as a periodic paper exercise, this is a step-change in expectation: it becomes a living, evidenced artefact that an AMLA-tier examiner will open first to understand whether your controls actually match your risk.

Gap-assess your most recent enterprise-wide assessment against Article 10's dimensions now: does it cover your products, customers, geographies, and delivery channels; is the methodology defensible; is the refresh cadence real; and can you evidence that its conclusions actually drove control decisions? You can structure that against the new requirements with our AML enterprise-wide risk assessment tool. Closing these gaps in 2026 is cheap; closing them under examination in 2027 is not.

The EUR 10,000 cash limit and the AMLA standards layer¶

The cash limit. Article 80 of the AMLR introduces a Union-wide EUR 10,000 limit on large cash payments in the course of a business activity. Member States retain the ability to set lower national limits, but not higher ones, so the practical design requirement is a control that defaults to EUR 10,000 and can be parameterised down per jurisdiction. If any part of your business accepts or facilitates large cash payments, inventory those flows now and build the control and reporting path against the limit, with the per-Member-State lower-limit dimension designed in from the start rather than retrofitted.

The standards layer. Much of the operational specificity of the AMLR — the exact CDD data fields, the detailed EDD risk factors, reporting formats — lands through AMLA's regulatory and implementing technical standards. The discipline for your programme is to separate the stable layer (the regulation articles, which you can build against today) from the tightening layer (the AMLA standards, which become binding only on Commission adoption). Assign an owner to track AMLA consultations and adopted standards, model your design against the drafts so you are not surprised, but commit hard engineering only as standards are adopted. That sequencing avoids the most expensive failure mode in regulatory readiness: building twice.

The AI hook: AMLR sets the controls, your AML agents have to enforce them¶

AMLR is an anti-money-laundering regulation. It says nothing about AI, and you should not let an AI-governance conversation distract from the CDD, UBO, EDD, and cash-limit gap work above — that work stands on its own. But the two intersect at one precise point: if you are deploying AML agents — to triage transaction-monitoring alerts, adjudicate sanctions and PEP hits, untangle beneficial ownership, or draft suspicious-activity narratives — then those agents are the things that will enforce the AMLR controls at machine speed.

That raises a governance question the AMLR readiness work surfaces but does not answer: when an agent auto-closes an alert, clears a hit, or concludes a UBO determination, can you reconstruct exactly what it did and why, to an examiner's standard? Article 69 of the AMLR already presumes that level of reconstructability — it requires obliged entities to answer a financial intelligence unit's request within five working days, compressible to under 24 hours in urgent cases. A five-working-day clock is a test of whether your agents' decisions were captured at the moment they happened, not reconstructed afterward.

This is where KLA's thesis — govern by execution, not paperwork — meets your AMLR programme. The control and the evidence have to sit inside the agent's execution path. In practice that means policy-as-code gates that decide what an agent may do autonomously versus what requires a named human (Policy Builder, with decisions of allow, warn, require approval, or block); a maker-checker approval step for consequential actions like filing a SAR or clearing a high-confidence sanctions hit (Decision Desk); and a sealed, tamper-evident lineage record of every decision, autonomous or human-approved (Evidence Room). We map this end to end for financial-crime workflows in the companion AML Agent Control & Evidence Map. The AMLR tells you which controls must exist; governing your agents by execution is how you make sure they actually run — and that you can prove it.

Run your gap analysis now: the Q2/Q3 2026 window¶

The reason to start in mid-2026 rather than mid-2027 is not box-ticking; it is remediation lead time. The two heaviest readiness items — re-baselining UBO data and rewriting the Article 10 risk assessment — both depend on inputs you do not fully control. UBO re-verification depends on customers responding to outreach. A defensible enterprise-wide risk assessment depends on pulling data from across products and geographies and getting sign-off. Both take quarters, not weeks, and both compress badly against a hard date.

Sequence your readiness work so the long-lead items start first: scope the gap analysis across the six obligation areas, then immediately kick off the UBO re-baseline outreach and the Article 10 rewrite while the faster items (CDD data model, cash-limit controls, EDD trigger remap) run in parallel. Reserve the back half of the window for the AMLA standards layer as drafts firm up.

You can run a structured version of this assessment — obligation area by obligation area, with the readiness actions from the table above — using our AMLR 2027 readiness gap tool. It is the fastest way to turn this checklist into a scoped, owned remediation plan while the window is still open.