The EU’s single anti-money laundering rulebook applies from 10 July 2027, and the new authority finalised its first customer due diligence standards in October. For most fintechs, the hard part is data, not the headline rules.

For years, EU anti-money laundering rules came as directives. Each member state wrote its own version, so a fintech serving ten countries met ten slightly different rulebooks. That ends next summer. The EU AMLR applies directly across the bloc from 10 July 2027, with one set of rules for every obliged firm.

What the EU AMLR is

The Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, is part of a wider package agreed in 2024. A new directive, AMLD6, covers national supervisors, financial intelligence units and registers. A third law created the Anti-Money Laundering Authority, or AMLA, in Frankfurt.

AMLA has been operational since July 2025 under its chair, Bruna Szego, formerly of the Bank of Italy. It had 157 staff in July and aims for 432 by the end of 2027. “My overall message to you is that we are on track,” Szego told MEPs in a July hearing.

The October standards

The clearest signal came on 1 October 2026. AMLA finalised three draft technical standards and sent them to the European Commission. They cover customer due diligence, the line between business relationships and occasional or linked transactions, and group-wide controls.

The due diligence standard is the part of the EU AMLR package fintechs will feel most. It sets what information to collect and verify, when simplified checks are allowed, and how remote onboarding and electronic identity work. It also covers screening for politically exposed persons. However, the standards are not yet law. They take effect six months after the Commission adopts them and they appear in the Official Journal.

What changes for fintechs

Several EU AMLR rules change daily work. First, the beneficial ownership test becomes “25% or more” rather than “more than 25%”. As a result, an owner with exactly 25% now counts. Second, the threshold for checks on occasional transactions falls to €10,000, and to €1,000 for occasional crypto transfers.

Third, customer files must be refreshed at least every year for higher-risk customers and every five years for others. Sanctions screening also becomes an explicit part of due diligence. In addition, all crypto-asset service providers become obliged entities, and anonymous accounts are banned.

Outsourcing has new limits too. Firms cannot hand off six core tasks, including the business-wide risk assessment, the onboarding decision and approval of detection rules. Meanwhile, maximum fines for financial firms rise to at least €10 million or 10% of annual turnover. For more on how ownership checks are changing elsewhere, see our roundup on beneficial ownership rules.

The 15% myth

One claim needs correcting. Under the EU AMLR, the beneficial ownership threshold has not dropped to 15%. The Commission may set a lower threshold, capped at 15%, for specific higher-risk categories. However, that requires a future delegated act, after an assessment due by July 2029. Today, nothing sits at 15%.

A second claim is also common. The EU-wide €10,000 cash limit covers payments for goods and services. It does not stop customers depositing cash at a bank, payment institution or e-money firm.

Who AMLA will supervise directly

Most fintechs will not meet AMLA directly. From 1 January 2028, it will supervise just 40 groups or firms. To qualify, a financial firm must operate in at least six member states and score high on risk. AMLA will run a formal selection from July to December 2027 and review the list every three years.

Everyone else stays with their national supervisor. Still, the EU AMLR and AMLA standards bind those supervisors too, so the rules will apply in the same way. Szego has said AMLA will deploy around 200 people on the 40 firms, ACAMS reported, working in joint teams with national authorities.

The UK is moving the other way

The UK is not bound by the EU AMLR. Instead, it amended its own Money Laundering Regulations, with most changes in force from 30 June 2026. The UK narrowed mandatory enhanced checks for high-risk countries to the FATF’s “call to action” list. It also converted euro thresholds into sterling.

The result is two diverging rulebooks. UK groups with an EU subsidiary, or firms serving EU customers from an EU entity, must meet both. That matters for firms such as Flowdesk, which took an EU payment licence to hold and move stablecoins.

Where the real work sits

For most fintechs, the hardest part of the EU AMLR is data. Existing customer files need the new due diligence fields. Ownership chains need recalculating at 25% or more. Firms also need to show that checks change when a customer’s risk changes, rather than staying fixed after onboarding.

AMLA itself has flagged weak customer checks as the main problem at EU banks. Therefore, a sensible order of work is clear. First, map current files against the draft standards. Next, plan a refresh for higher-risk customers before July 2027. Then review outsourcing contracts against the six tasks that must stay in-house.

What to watch next

Several dates will shape EU AMLR readiness over the coming year. The Commission must adopt the October standards, which then apply six months later. AMLA is also consulting on guidelines for simplified due diligence, which matter for low-risk e-money and payment products. Further technical standards are expected through 2027.

Then comes 10 July 2027, when the EU AMLR applies and the old directive is repealed. AMLA’s selection of the 40 directly supervised firms follows later that year. Above all, firms that start data remediation now will find the deadline far easier than those waiting for the final text.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.