The European Union has been steadily tightening its anti-money laundering (AML) laws. The Sixth Anti-Money Laundering Directive (6AMLD) is already in force, and an ambitious new EU AML Regulation has been adopted and will apply from July 2027. Together, these measures bring significant changes for businesses across all sectors. Below, we break down the key points and practical implications of 6AMLD and the new AML Regulation for companies operating in the EU.
Understanding 6AMLD: A New Level of Enforcement and Liability
6AMLD was introduced to strengthen and harmonize AML rules across EU member states. It had to be transposed into national laws by December 2020, with firms expected to comply by June 2021. Unlike prior directives, 6AMLD focuses heavily on closing legal loopholes and ensuring criminals (and complicit businesses) face tougher consequences. The main changes under 6AMLD include:
- Cross-Border Crime Prosecution: 6AMLD makes it easier to prosecute money laundering that spans multiple countries. It compels EU states to cooperate more effectively and allows offenses committed in different jurisdictions to be prosecuted in a single member state. Importantly, for certain serious crimes (e.g. terrorism, trafficking, organized crime), EU countries must treat them as money-laundering predicate offenses even if the conduct isn’t illegal where it occurred. This elimination of the “dual criminality” loophole means money launderers can no longer hide behind differences in national laws.
- Unified Predicate Offenses: The directive defines a single harmonized list of 22 predicate offenses (underlying crimes) that constitute money laundering across all EU states. New categories like environmental crime, cybercrime, and insider trading have been added to reflect modern criminal risks. Businesses must ensure their compliance programs can detect transactions linked to any of these predicate offenses, as the risk landscape has broadened.
- Corporate Criminal Liability: One of the most impactful changes is that legal persons (companies and partnerships) can now be held criminally liable for money laundering. If a company fails to prevent a “directing mind” (e.g. an executive or person of authority) from engaging in money laundering, the company itself can be prosecuted. Business leaders and those in positions of control may be personally accountable for lapses in supervision or controls that enable laundering. Essentially, the burden of proof is now on the company to show it took sufficient steps to prevent money laundering within the organization. This shift greatly raises the stakes for management to maintain effective AML controls.
- Tougher Penalties: 6AMLD mandates harsher punishments for money laundering offenses. EU Member States must impose a minimum four-year prison term for individuals convicted of money laundering (up from the previous one-year minimum). Companies convicted of involvement can face steep fines and even sanctions like temporary bans on business, exclusion from public funding, or permanent shutdowns of business operations. These tougher penalties aim to ensure AML violations are met with “effective, proportionate and dissuasive” sanctions across the EU.
- Criminalizing Aiding and Abetting: The directive broadens the scope of AML offenses to include aiding, abetting, inciting, and attempting to commit money laundering. So-called “enablers” – anyone who helps or tries to help launder money – can now be prosecuted as criminals, even if they didn’t personally benefit financially. For businesses, this means employees, partners, or contractors who facilitate money laundering (even indirectly) expose themselves and the company to liability. Firms must be vigilant that they are not unwittingly assisting clients or associates in illicit schemes.
Practical compliance impact of 6AMLD: With 6AMLD in force, businesses have had to tighten their AML compliance programs significantly. The extension of criminal liability to companies and managers has made it imperative to identify and fix any compliance gaps quickly. Companies should update their AML/CFT policies, procedures, and training to cover the expanded list of predicate crimes and the new offense of aiding and abetting. Internal controls and oversight mechanisms (e.g. internal audits, managerial sign-offs) need strengthening to meet the higher bar of accountability. In many cases, firms are upgrading their monitoring systems and deploying specialist RegTech solutions to better detect suspicious activity. (For example, using advanced compliance software like AML Track can help companies continuously monitor transactions and beneficial owners, ensuring no red flags are missed.) Overall, 6AMLD’s message is clear: AML compliance is no longer just a legal formality, but a core corporate responsibility. Business leaders must foster a culture of compliance, as regulators now have more power to punish organizations and individuals for AML failings.
The New EU AML Regulation: One Rulebook for All Members
While 6AMLD is the last of the EU’s AML directives, it has already been complemented by a far-reaching EU AML Regulation adopted in 2024. In 2024, the EU adopted an AML reform package, including a new regulation that will apply from July 2027. Unlike a directive, an EU regulation is directly applicable in all member states without the need for national legislation, creating a single harmonized rulebook for AML. This regulation (officially Regulation (EU) 2024/1624), adopted in 2024 and applying from July 2027, will replace the existing 4th and 5th AML Directives and any national variations.
What does the new AML Regulation introduce? In essence, it elevates and unifies AML requirements across Europe, closing gaps and ensuring consistency. Key changes that businesses should prepare for include:
- Stricter Customer Due Diligence (CDD): Firms will face enhanced due diligence obligations under the AML Regulation. Companies must more precisely identify and continuously monitor the beneficial owners of their customers and business partners. This means keeping up-to-date information on who ultimately owns or controls client companies, and tracking any changes. In addition, suspicious activity reporting will be under tighter timelines – regulators are imposing a deadline of five working days for obliged entities to respond to Financial Intelligence Unit (FIU) information requests. In practice, businesses need to speed up internal investigations and reporting of suspicious transactions. Even cryptocurrency transactions face greater scrutiny: the regulation explicitly extends enhanced due diligence requirements to crypto-asset service providers, meaning crypto exchanges and similar platforms must follow the same rigorous CDD and monitoring standards as banks.
- Caps on Cash Transactions: Large cash transactions will be curtailed across the EU to reduce money laundering via cash. The regulation sets an EU-wide upper limit of €10,000 for cash payments in business transactions. Any payment above €10k in cash will be illegal, and member states can opt to enforce even lower national limits. Furthermore, for any cash transaction of €3,000 or more, businesses will be required to verify the customer’s identity and record the details. These measures mean that sectors dealing in high-value goods (e.g. luxury car dealers, jewelers, art sellers) will need to implement strict controls on accepting cash. Companies should update their payment policies and train staff to enforce the new cash caps, where applicable, to ensure all large payments are traceable through banks or other regulated channels.
- Expanded Scope of Regulated Entities: The new rules bring more businesses under AML obligations. The AML Regulation broadens the definition of “obliged entities” (those legally required to implement AML controls) to include sectors and activities that were previously outside the AML net. Notably, crypto-asset service providers, crowdfunding platforms, real estate and art intermediaries, professional football clubs and agents, and high-value goods dealers (e.g. trade in precious metals or gemstones) are explicitly added to the AML regime. Even some professions like lawyers and accountants were already covered under prior directives; now the net is cast wider to capture emerging risk areas. While there is room for exemptions for very low-risk scenarios, generally more businesses than ever before must establish AML programs. If your company operates in one of these newly included industries, you will need to set up internal procedures for customer due diligence, record-keeping, and suspicious activity reporting, if you haven’t already. Even businesses that remain outside the formal list should be aware that large, unusual transactions could still trigger scrutiny under general criminal laws.
- Harmonized Beneficial Ownership Rules: The new framework standardizes how companies must identify and report beneficial owners (the persons who ultimately own or control an entity). Across the EU, a beneficial owner will be uniformly defined as anyone owning 25% or more of a company’s shares or voting rights, or otherwise exercising control. Previously, some countries had slightly different thresholds (e.g. “more than 25%”); the new 25% rule is clear-cut and consistent. In high-risk sectors, the European Commission can even lower the threshold to 15%, forcing identification of any owners above that lower limit. For businesses, this means compliance teams must be diligent in collecting ownership information down to these thresholds for all clients and perhaps re-papering some existing client files to meet the new criteria. Moreover, authorities are going to actively verify beneficial ownership data: under the parallel 6th AML Directive in the package, national authorities must continuously check the accuracy of information in beneficial ownership registers and interlink these registers across Europe. A centralized European access point will allow regulators to quickly retrieve ownership info across borders. The practical upshot is that it will be much harder for true owners to hide behind complex corporate structures – and companies must ensure that the ownership information they report to regulators is correct and kept up to date.
- New EU AML Authority (AMLA): A major institutional change is the creation of a European Anti-Money Laundering Authority (AMLA) based in Frankfurt. From 2025, AMLA will start building its capacity, and by 2026-2027 it will be fully operational. This agency will have direct supervisory powers over certain high-risk, cross-border financial institutions (up to 40 of the largest banks and fintechs in the EU) and will coordinate supervision for the broader financial and non-financial sectors. For most businesses, AMLA’s impact will be indirect but significant: it will set unified regulatory standards (by issuing guidelines, technical standards, etc.) and ensure national regulators enforce the rules consistently. If a national supervisor is too lax, AMLA can step in. The presence of a central authority means that large multinational firms might be overseen at the European level, and even smaller companies will feel the effects of more consistent, rigorous supervision standards across the board. In short, the era of “light-touch” AML oversight in any EU country is coming to an end, leveling the playing field for compliance. International businesses should welcome the consistency – but also be prepared for closer scrutiny.
Practical Implications and Next Steps for Businesses
A Uniform EU Compliance Framework
The new AML Regulation will create a more uniform compliance environment across all member states. For businesses operating in multiple EU countries, this is a positive change – it will simplify compliance by aligning requirements and removing the need to navigate differing national laws. Companies can develop one robust AML program and apply it EU-wide, with confidence that it meets the standard everywhere. Consistency in rules (e.g. the same due diligence standards and cash limits) should enable more efficient group-wide policies and training. As the DLA Piper legal team notes, “more uniform national laws will allow for aligned processes across the EU,” benefiting internationally active companies.
Greater Responsibility and Liability
On the flip side, the unified regime comes with heightened accountability. Under 6AMLD and the new regulation, regulators have more tools to enforce compliance and less tolerance for failures. Senior management and boards must treat AML as a strategic priority, since they can be held personally liable for serious compliance lapses. Businesses should establish clear lines of responsibility for AML internally – for example, appointing qualified compliance officers, providing regular reports to the board, and fostering a culture where compliance concerns are raised and addressed. The era of “check-the-box” compliance is over; regulators will expect to see that firms proactively prevent money laundering, not just react after the fact.
Upgraded Procedures and Training
Practically, companies should review and update their AML procedures now, rather than waiting for 2027. Both 6AMLD and the AML Regulation emphasize areas that may require new internal measures. For instance, procedures for verifying beneficial owners need enhancement to meet the continuous monitoring requirement. Employee training programs should be refreshed to cover the expanded list of predicate offenses (like environmental or cybercrime-related red flags) and the new offense of aiding and abetting, so staff know how to spot and report all forms of suspicious activity. Where cash is accepted, policies must be revised to enforce the new €10k limit and ID requirements. If your business falls into a newly obliged category (e.g. a crypto service or a luxury goods trader), you may need to build an AML program from scratch – this includes drafting a risk assessment, client due diligence procedures, record-keeping systems, and reporting protocols to your national FIU.
Leverage Technology for Compliance
Given the broadened scope of what needs to be monitored (more transactions, more data on ownership, shorter reporting deadlines), manual compliance processes may no longer suffice. Regulatory experts are encouraging firms to upgrade their monitoring systems and consider specialist RegTech tools to handle the increased workload. Automation and data analytics can help flag suspicious transactions across multiple predicate crime categories or detect anomalies in customer behavior more effectively than traditional methods. For example, solutions like AML Track (a dedicated AML compliance platform) can assist businesses in conducting ongoing customer due diligence, screening for risk indicators, and generating required reports efficiently. By investing in technology, companies can not only ensure they meet the new requirements but also reduce the burden on their compliance teams.
Stay Ahead of Enforcement
It’s worth noting that regulators are not waiting until 2027 to act. The clear direction of EU law is already toward stricter AML enforcement, and national authorities are likely to intensify supervision in the interim. In fact, the EU’s AML package explicitly signals that there will be “stricter control of existing AML obligations… even before the AML Regulation fully applies,” and urges obliged entities to use the lead time to strengthen their processes. Businesses should heed this warning by conducting thorough internal audits of their AML controls now. Remediate any weaknesses – whether it’s outdated customer verification practices, backlogs in reviewing alerts, or insufficient training – as soon as possible. Regulators will view early compliance upgrades as a good-faith effort, whereas waiting until deadlines approach could invite scrutiny or penalties.
A New Era of Accountability for EU Businesses
In summary, the 6AMLD and the new EU AML Regulation together herald a new era of anti-money laundering compliance in Europe. The practical impact on businesses will be substantial: companies face a broader scope of regulated activities, more stringent due diligence duties, and direct liability for missteps. Yet, these changes also bring benefits in the form of clearer rules and a level playing field across the single market. Businesses that proactively adapt – by reinforcing their compliance frameworks, training their people, and employing smart technological solutions – will not only reduce their risk of penalties but also help foster a safer and more transparent financial environment. The ultimate goal of these reforms is to protect honest enterprises and the economy at large from the harms of money laundering. For business leaders, that means compliance is not just a legal checkbox, but a vital component of corporate integrity and sustainability. Embracing these AML changes today will prepare your organization for the more unified, accountable, and resilient marketplace of tomorrow.
AML Track: Supporting Businesses in the New Compliance Era
Adapting to 6AMLD and the new EU AML Regulation may seem overwhelming, but technology can ease the burden. AML Track is an advanced compliance platform designed to help companies meet these heightened requirements. It automates customer due diligence, monitors transactions in real time, screens clients against sanctions lists, and generates audit-ready reports. By centralizing AML processes, AML Track not only reduces the risk of human error but also ensures organizations stay aligned with evolving EU standards. For businesses navigating stricter obligations and liability, AML Track offers a reliable way to strengthen defenses and maintain regulatory confidence.
How does 6AMLD differ from the previous AML directives?
6AMLD significantly raised the stakes compared to earlier directives by introducing corporate criminal liability, expanding the list of predicate offenses, and harmonizing definitions across the EU. Unlike earlier rules that left more discretion to member states, 6AMLD closed loopholes such as “dual criminality” and required harsher sanctions. This means that both individuals and companies can face tougher penalties, and compliance must be more proactive and comprehensive.
What impact will the EU AML Regulation have compared to directives?
Directives require transposition into national law, which often leads to variations in implementation. The new AML Regulation, however, is directly applicable in all member states, creating a uniform set of rules across the EU. For businesses, this removes the complexity of adapting compliance programs to different national frameworks. Instead, one harmonized system will apply, which simplifies some aspects but also eliminates flexibility and excuses for non-compliance.
Why is beneficial ownership such a focus in the new rules?
Beneficial ownership transparency is at the heart of the EU’s fight against money laundering because criminals often hide behind complex corporate structures. The AML Regulation enforces a consistent definition of beneficial owners and requires companies to identify, monitor, and update this information continuously. This not only prevents abuse of shell companies but also increases pressure on businesses to maintain accurate, up-to-date records, which regulators can now easily cross-check through linked registers.
How will AMLA change the enforcement landscape in Europe?
The creation of the European Anti-Money Laundering Authority (AMLA) marks a turning point in supervision. AMLA will directly oversee the riskiest cross-border financial institutions and set harmonized standards for all obliged entities. While most companies will still report to their national supervisors, AMLA ensures consistency and can intervene if national regulators are too lenient. This means enforcement will be stricter, more uniform, and more predictable across the EU, raising the overall bar for compliance.
What should businesses do now to prepare for the new AML Regulation?
Companies should not wait until 2027 to start adjusting. Instead, they should review their AML policies, strengthen customer due diligence procedures, and ensure their systems can handle tighter reporting deadlines. Training staff to recognize the expanded range of predicate offenses and implementing technology-driven monitoring tools are also crucial steps. By acting early, businesses reduce the risk of penalties, build trust with regulators, and position themselves as leaders in compliance rather than followers scrambling to catch up.
