Publication 19.10.2026

AML/CFT: the new European framework for regulated financial entities and the creation of AMLA

In this article, Daniel ARROCHE, Partner at d&a partners, presents the new European anti-money laundering and counter-terrorist financing framework: the entities in scope, supervision, the main changes to obligations and the timeline.

Are you an obliged entity looking to prepare the adaptation of your AML/CFT framework to the new European rules? The law firm d&a partners can assist you.

Key takeaways

The new framework covers all professionals subject to AML/CFT rules, not only crypto players. Banks, payment and electronic money institutions, investment firms, asset management companies, life insurers, crypto-asset service providers and certain non-financial professions will be governed by a single European regulation.

As from July 10, 2027, the AML/CFT obligations of obliged entities will be set out in a directly applicable European regulation. It will replace most of the rules of the French Monetary and Financial Code and will be supplemented by harmonized technical standards.

The new European authority, AMLA, will directly supervise only a limited number of financial players. From 2028, around 40 credit or financial institutions operating in at least six Member States. Other entities will remain supervised by national authorities.

The new obligations do not apply before July 10, 2027. Only the rules on information accompanying transfers of funds and crypto-assets already apply.

Applicable framework

The European anti-money laundering and counter-terrorist financing (“AML/CFT“) package, published on June 19, 2024, comprises three texts, in addition to a regulation that already applies:

Text	Purpose	Application
Regulation (EU) 2024/1624 (“AMLR”)	Obligations of obliged entities: internal organization, customer due diligence, beneficial ownership, suspicious transaction reporting, record-keeping.	July 10, 2027 (Art. 90)
Directive (EU) 2024/1640 (“AMLD6”)	Organization and powers of national supervisors, financial intelligence units, beneficial ownership registers, sanctions.	Transposition for the most part “by 10 July 2027” (Art. 78)^[1]
Regulation (EU) 2024/1620 (“AMLAR”)	Establishment of the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (“AMLA“).	Direct supervision from 2028, limited to around 40 credit or financial institutions operating in at least six Member States (section 2)
Regulation (EU) 2023/1113 (“TFR”)	Information accompanying transfers of funds and crypto-assets (“travel rule”).	Already applicable since December 30, 2024

1. Entities in scope

The AMLR applies to all obliged entities, whether or not they operate in the crypto sector. The list is set out in Article 3, supplemented for the financial sector by the definition of financial institution (Art. 2(1)(6) AMLR):

Category	Entities covered	Details
Credit institutions	Banks, including branches of third-country institutions located in the Union.	Art. 3(1); branches: Art. 2(1)(5)
Financial institutions	Payment and electronic money institutions, currency exchange offices, investment firms, UCITS and AIFs and their managers, life insurance undertakings and intermediaries, lenders, central securities depositories, crypto-asset service providers (“CASPs“).	Art. 2(1)(6). Not covered: account information services^[2]; advice on crypto-assets, which is excluded from the definition of crypto-asset services.^[3]
Crowdfunding	Crowdfunding service providers and intermediaries.	Art. 3(3)(h)
Accounting and legal professions	Auditors, external accountants, tax advisors; notaries and lawyers when they take part in certain transactions (real estate, sale of businesses, management of client funds or crypto-assets, company formation); trust or company service providers, i.e., professionals who form companies, provide a registered office or business address, or act on behalf of third parties as directors, shareholders or trustees.	Art. 3(3)(a) to (c)
Other professions	Real estate agents (including rentals of EUR 10,000 or more per month), traders in precious metals and high-value goods, traders in cultural goods and intermediaries in that trade, including art galleries and auction houses, for transactions of at least EUR 10,000, gambling services, credit intermediaries, football clubs and agents.	Art. 3(3)(d) to (o)

Note: certain entities currently subject to AML/CFT rules under French law are not listed as such at European level, for example financial investment advisors (conseillers en investissements financiers). Whether they remain in scope will depend on the choice of the French legislator, which may extend all or part of the AMLR to other sectors under a notification procedure with the European Commission (Art. 3 AMLD6). This point has not been settled to date.

Measures and entities concerned

Measure	Entities concerned
General rules: internal organization, risk assessment, due diligence, beneficial ownership, suspicious transaction reporting	All obliged entities
EUR 10,000 cap on cash payments for goods or services (Art. 80)	Any person selling goods or providing services
Travel rule (TFR)	Payment service providers and CASPs
Cross-border correspondent relationships (Art. 36)	Credit institutions and financial institutions
Crypto-asset specific rules (Art. 37, 40 and 79)	CASPs
Eligibility for direct supervision by AMLA	Credit institutions and financial institutions, including CASPs, operating in at least six Member States

2. Supervision

General rule: national supervision. For the vast majority of entities, supervision remains at national level: in France, by the ACPR or the AMF depending on the entity’s status, or by the competent authority or professional body for non-financial professions. AMLA harmonizes these supervisors’ methods and assesses their quality.
Exception: direct supervision by AMLA of the largest financial players. Eligible entities are credit and financial institutions operating “in at least six Member States, including the home Member State” (Art. 12(1) AMLAR). AMLA will select up to 40 of them, based on their risk level, for direct supervision from 2028; the selection takes place in the second half of 2027 and will be renewed every three years (AMLA, Explainer, January 2026).

Note: activity carried out under the freedom to provide services may count toward the six-Member State threshold. For activity carried out under the freedom to provide services, the draft technical standards treat a Member State as relevant where more than 20,000 customers reside there, or where annual transactions exceed EUR 50 million. This draft has not yet been adopted.

3. Main changes to obligations

Topic	Change	Source
Governance	Appointment of a member of the management body responsible for AML/CFT compliance and of a compliance officer appointed by management; at least annual reporting. The two roles may be combined where size and risk justify it.	Art. 11 AMLR
Risk assessment	Assessment that is “documented, kept up-to-date and regularly reviewed“, approved by management, including the risk of evasion of targeted financial sanctions; prior assessment of any new product, service or channel.	Art. 10 AMLR
Customer due diligence	Information to be collected harmonized at European level, for simplified, standard and enhanced due diligence; common rules for occasional and linked transactions.	Art. 19 to 28 AMLR (Chapter III, Section 1); draft technical standards (Sept. 30, 2026)
Remote onboarding	Identity verification through an identity document or through electronic identification means compliant with the eIDAS Regulation and qualified trust services.	Art. 22(6) AMLR
Updating customer files	At least every year for high-risk customers, every five years for others, and upon any relevant event.	Art. 26 AMLR
Beneficial ownership	Threshold of at least 25% maintained; detailed rules for ownership chains and control (Art. 51 to 55); reporting of discrepancies to the register (Art. 24).	Art. 24 and 51 to 55 AMLR
Outsourcing	Permitted, with the entity remaining fully liable; certain tasks cannot be entrusted to a third party.	Art. 18 AMLR

Additional rules for CASPs

Occasional transactions: full due diligence from EUR 1,000; below that amount, at least identification and verification of the customer (Art. 19(3) AMLR).
Self-hosted addresses: assessment and mitigation of the risks of transfers “directed to or originating from a self-hosted address” (Art. 40 AMLR).
Anonymity: prohibition of anonymous accounts, including accounts allowing anonymization including through anonymity-enhancing coins (Art. 79 AMLR).
Correspondent relationships: enhanced measures for relationships with third-country CASPs (Art. 37 AMLR).

The implementing texts are not yet final. The technical standards on due diligence have been submitted to the European Commission, which may amend them; other AMLA guidelines are still under consultation (AMLA, regulatory instruments). Procedures adopted before their adoption may need to be revised.

4. Timeline

Until July 10, 2027, the current rules of the French Monetary and Financial Code continue to apply (Art. 90 AMLR).
From that date, obliged entities must have an AMLR-compliant framework in place, adopted by their management and operationally implemented.
The travel rule has already applied to payment service providers and CASPs since December 30, 2024.

As an indication, an upgrade is generally organized in the following stages:

Period	Preparation steps
End of 2026	Gap analysis between the existing framework and the AMLR.
Q1 2027	Drafting of new procedures; adaptation of customer due diligence, screening and transaction monitoring tools.
Q2 2027	Integration of the adopted technical standards; staff training; appointments under Article 11.
Before July 10, 2027	Adoption by the management body and operational implementation.
After July 10, 2027	Updating of existing customer files within the time limits set by Article 26.

Note: for credit or financial institutions operating in six or more Member States, the data used to select the entities to be supervised by AMLA will be collected as early as the first quarter of 2027.

In summary

The new framework covers all professionals subject to AML/CFT rules, with CASPs also subject to specific rules.

It applies from July 10, 2027, the date by which obliged entities must have a compliant framework in place.

Disclaimer

This note is a general information note prepared by d&a partners. It does not constitute legal advice, does not take into account the particular situation of any reader and may not serve as the basis for any decision without an individual analysis, which may be the subject of a separate engagement. It outlines Regulations (EU) 2024/1624 and 2024/1620 and Directive (EU) 2024/1640, solely in light of European Union law and French law, to the exclusion of any other law. It does not address the sector-specific regimes applicable to the entities mentioned, nor tax matters. It is prepared as of October 19, 2026, while several implementing texts and the French transposition measures have not yet been adopted. Its content is subject to change and d&a partners is under no obligation to update it. No one may rely on it against d&a partners. It may not be reproduced or disclosed to third parties without the prior written consent of d&a partners.

^[1] In France, the bill on various provisions adapting French law to European Union law authorizes the Government to transpose AMLD6 by ordinance. It is under review as of the date of this note.

^[2] Art. 2(1)(6)(a) AMLR, which covers the activities listed in Annex I to Directive 2013/36/EU “with the exception of the activities referred to in point 8 of Annex I to Directive (EU) 2015/2366“, i.e., account information services.

^[3] The definition of crypto-asset services used in the AMLR excludes the provision of advice on crypto-assets referred to in Art. 3(1)(16)(h) of Regulation (EU) 2023/1114 (MiCA). A CASP that provides other crypto-asset services remains subject to the rules in respect of those services.