EU AML Regulation (AMLR) 2027: what changes for KYB at banks and PSPs

On 10 July 2027 the EU Anti-Money Laundering Regulation, the AMLR, starts to apply. For every bank and PSP that onboards business clients, it changes the basis of KYB: the rules no longer come from a national law that transposes a directive, but from a regulation that applies as written in every Member State.

Below, the changes in the order a compliance team meets them: who sets the rules, what due diligence covers at onboarding, how often files must be updated, and what has to be kept. It is the overview for our deeper guides on ultimate beneficial owners under the AMLR and on sanctions and PEP screening under the AMLR.

Status: November 2026. Based on the AMLR and AMLA's drafts published by 30 September 2026. No legal advice, see the note at the end.

From 10 July 2027, the AMLR applies directly in every EU member state, without national transposition

Regulation (EU) 2024/1624 is directly applicable in all Member States from 10 July 2027. For football agents and professional football clubs, it applies from 10 July 2029.

AMLA itself explains why the EU chose a regulation instead of another directive. In the final report on AMLA's draft standards on customer due diligence, submitted to the European Commission in September 2026, AMLA writes that national discretion under the old framework created legal uncertainty and extra cost for obliged entities operating across borders. The AMLR replaces that with due diligence rules that are the same across the Union and across sectors.

For institutions this cuts both ways. A group that onboards clients in several countries can build one process. But national habits that passed an audit in the past are no longer the benchmark.

AMLA drafts the technical standards behind the AMLR and proposes how breaches would be classified

The AMLR sets the obligations. AMLA, the EU Anti-Money Laundering Authority, drafts the regulatory technical standards that say how to meet them. AMLA's draft standards on customer due diligence now go to the European Commission for adoption and publication in the Official Journal. Once adopted, they enter into force on the twentieth day after publication and apply six months after that.

AMLA also proposes how heavily a breach should weigh. Under its draft standards on pecuniary sanctions under the AML directive, supervisors would sort AML/CFT breaches into four categories of increasing severity. A breach would fall into the most severe category where there is a structural failure of a firm's AML/CFT systems, controls or policies, or a material failure to put adequate ones in place.

AMLA's draft standards for selecting institutions for direct supervision show which data it would ask for. For screening, AMLA would collect the maximum number of hours between the publication of targeted financial sanctions and their implementation in an institution's screening tools, and it would record which AML/CFT tasks, such as customer due diligence, sanctions screening and PEP detection, are outsourced to service providers.

Customer due diligence under the AMLR covers identity, beneficial owners, sanctions and PEP status at onboarding

Article 20(1) AMLR lists the customer due diligence measures. For KYB, these are the ones that shape onboarding:

• identifying the beneficial owners, verifying their identity and understanding the ownership and control structure
• verifying whether the customer or its beneficial owners are subject to targeted financial sanctions and, for a legal entity, whether sanctioned persons control it or hold more than 50% of its proprietary rights or a majority interest, individually or collectively
• determining whether the customer, its beneficial owner and, where relevant, the person on whose behalf a transaction is carried out is a politically exposed person, a family member or a person known to be a close associate

For a legal entity, Article 22(1) requires, among other data, the legal form and name, the address of the registered office, the names of the legal representatives and, where available, the registration number, tax identification number and Legal Entity Identifier, plus any nominee shareholders or directors. For a natural person, it requires among other data all names and surnames, the place and full date of birth, nationalities and the usual place of residence. To verify the identity of a legal entity, AMLA's draft standards point to the documents set out in the AMLR and to extracts from public registers that can be used for legal purposes, whether the customer provides them or the institution retrieves them directly.

Beneficial owners and screening carry most of the new work. Both have their own guide, on ultimate beneficial owners and on sanctions and PEP screening under the AMLR.

Re-KYC under the AMLR: customer files must be updated at least every 5 years, and every year for higher-risk customers

Onboarding is only the start. Article 26(2) AMLR caps the period between updates of customer information at 1 year for higher-risk customers under enhanced due diligence and 5 years for all others. In its consultation paper on draft guidelines on ongoing monitoring, AMLA reads these as maximum periods: firms should set more frequent updates based on each customer's risk profile. A review done earlier than scheduled can reset the timeline for the next update.

The existing book is covered too. Under AMLA's draft standards, existing business relationships are brought in line within the 1-year and 5-year periods of Article 26(2) AMLR, counted from the standards' entry into force. AMLA did not accept requests to extend them.

Reviews are not only scheduled. The consultation paper names events that may trigger a review: changes in legal form, ownership structure, directors, authorised signatories or representatives, and new adverse media or a new PEP status. To detect them, firms may use company registries and public databases that show changes in ownership or status. For low-risk customers with no new activity, AMLA's draft guidelines allow lighter periodic reviews, for example by checking business registries, running PEP and adverse media screening and checking internally whether the relationship has changed. These are draft guidelines from a consultation that ran from 3 June to 3 September 2026.

Due diligence records must stay complete and unredacted for 5 years after a client relationship ends

Article 77 AMLR requires institutions to keep copies of the documents and information obtained in customer due diligence, unredacted, for 5 years from the end of the business relationship, the occasional transaction or the refusal to enter into one.

That is a long time for a file to stay explainable. In its draft methodology for selecting institutions for direct supervision, AMLA would score institutions on data such as how many legal-entity customers have beneficial owners that were not identified or not verified, how many customers were due an update of their customer information in the last calendar year, and how many customers had their information reviewed and updated in that year.

OTTO Payments went from 16 audit findings to 0 after its internal audit reviewed the new KYB setup on Sinpex. For what this means for personal accountability, read Personal liability under AMLR 2027.

Banks and PSPs need a clear order of work before 10 July 2027

With the AMLR applying from 10 July 2027, the order of the work matters. One compliance lead put it this way to us: postponing new checks until the deadline only moves the work, and switching everything on at once in July 2027 creates a peak.

In the consultation on AMLA's draft standards, firms also said they expect the recurring cost of the new due diligence rules to come mainly from maintaining and re-verifying expanded customer datasets, additional screening and alert handling, external verification and data services, and continuous training.

A practical sequence until 10 July 2027:

• map the current KYB process against the customer due diligence measures in Article 20 AMLR
• close the data gaps, such as nationalities and the identification data for beneficial owners
• set the beneficial ownership calculation for layered structures and document it per file
• define which parties in a structure are screened, and what triggers a review
• keep due diligence documents and information traceable and unredacted for 5 years after the relationship ends

FAQ: the EU AML Regulation (AMLR)

When does the AMLR apply?

The AMLR applies directly in all Member States from 10 July 2027. For football agents and professional football clubs, it applies from 10 July 2029.

What is the difference between the AMLR and AMLA?

The AMLR is the regulation that sets the obligations. AMLA is the EU authority that drafts the technical standards on how to meet them, including a proposal for how breaches would be classified.

What does customer due diligence include under the AMLR?

Among other measures: identifying the customer, identifying the beneficial owners and verifying their identity, checking for targeted financial sanctions, determining PEP status, and keeping customer information up to date.

Does the AMLR apply to existing customers?

Yes. Under AMLA's draft standards, existing business relationships are brought in line within the 1-year and 5-year periods of Article 26(2) AMLR, counted from the standards' entry into force.

How long must KYC and KYB records be kept?

For 5 years from the end of the business relationship, unredacted.

Sources: Regulation (EU) 2024/1624 (AMLR) · AMLA, final report on the draft standards on customer due diligence · AMLA, consultation paper on ongoing monitoring guidelines · AMLA, final report on draft standards on pecuniary sanctions · AMLA, final report on draft standards for selecting institutions for direct supervision

This article is for general information only and does not constitute legal advice. It reflects the AMLR, the related EU implementing acts and the published AMLA drafts as of November 2026. Some technical standards are still drafts and may change before they are adopted. Whether and how the rules apply depends on your institution's business model, risk profile and national supervisory practice. Please verify the information independently and seek legal advice for your specific situation. Status: November 2026.