Europe’s anti-money laundering framework is moving toward greater consistency, and financial institutions are getting a clearer picture of what that will mean in practice.
On October 1, 2026, the European Union’s Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) announced the completion of three draft Regulatory Technical Standards (RTS) covering customer due diligence (CDD), business relationships and linked transactions, and group-wide compliance arrangements.
The announcement represents another important step toward implementing the EU’s harmonized anti-money laundering and counter-terrorist financing (AML/CFT) framework.
While the standards are still subject to European Commission review and adoption, they provide valuable insight into how compliance expectations are developing across the EU.
For financial institutions, the implications extend beyond updating policies. The standards raise practical questions about how customer risk is identified, how screening decisions are supported, and how compliance controls operate across different businesses and jurisdictions.
What has AMLA finalized?
The three draft standards address distinct but closely connected areas of financial crime compliance.
1. Customer due diligence: Establishing consistent, risk-based expectations
The first standard, developed under Article 28(1) of the EU Anti-Money Laundering Regulation (AMLR), further defines the information institutions must collect and verify when conducting customer due diligence.
It addresses several important elements of the CDD process, including:
- Customer identification and verification requirements
- Identification and verification of beneficial owners
- Simplified due diligence measures for lower-risk situations
- Electronic identification and alternative verification methods
- Screening for targeted financial sanctions and politically exposed persons (PEPs), including relevant family members and close associates
One important aspect is the emphasis on proportionality.
AMLA’s approach recognizes that customer due diligence should reflect the level of risk presented. For example, the draft standards provide for reduced identification requirements in certain lower-risk circumstances while maintaining the need for reliable verification.
The standards also clarify expectations surrounding sanctions and PEP screening. Depending on the circumstances, institutions may use automated solutions, manual checks, or a combination of both. Relevant aliases, trade names, and digital wallet addresses must also be considered for targeted financial sanctions screening where applicable and available.
What this means for compliance teams
The challenge is not simply collecting more information. It is ensuring that the information collected is appropriate, reliable, and useful for understanding customer risk.
Institutions should consider whether their existing processes can distinguish meaningful risk indicators from irrelevant matches, identify relationships between customers and beneficial owners, and support consistent decisions.
A PEP match, for example, does not automatically indicate wrongdoing. Effective due diligence requires sufficient context to understand the nature of the relationship, assess the associated risks, and determine an appropriate response.
These distinctions become increasingly important when institutions are managing large customer populations, complex ownership structures, and multiple jurisdictions.
2. Business relationships and linked transactions: Understanding risk beyond individual activity
The second standard, developed under Article 19(9) of the AMLR, establishes criteria for distinguishing between business relationships, occasional transactions, and linked transactions.
This distinction matters because it determines when particular CDD obligations apply.
A business relationship generally involves an expectation of repetition or duration and carries ongoing monitoring obligations. An occasional transaction may be subject to different requirements depending on its value, nature, and associated risk factors.
The draft standard also provides criteria for identifying transactions that should be considered together rather than independently.
For example, multiple transactions sharing similar origins, destinations, purposes, or other relevant characteristics may qualify as linked transactions. This can apply even when transactions involve multiple customers acting together.
What this means for compliance teams
Financial crime risk does not always emerge through a single transaction.
Activity that appears ordinary when examined individually may warrant further attention when viewed alongside related transactions, customer behavior, or broader relationships.
Consider a series of payments that individually fall below an applicable due diligence threshold. If those transactions are linked, their combined value may trigger obligations that would not apply to each transaction in isolation.
The regulatory implications are clear: Institutions need reliable processes for understanding the relationships between transactions and applying the correct CDD requirements.
This raises an important operational question: Are compliance controls evaluating transactions only as individual events, or can they also recognize when seemingly separate activities are connected?
The answer may depend on how customer information, transaction data, and monitoring workflows interact.
3. Group-wide compliance: Creating consistency across jurisdictions
The third standard, developed under Articles 16(4) and 17(3) of the AMLR, focuses on minimum requirements for group-wide AML/CFT arrangements.
For multinational institutions, one of the challenges of financial crime compliance is maintaining consistent oversight across subsidiaries, branches, and jurisdictions with different operational and legal environments.
The draft standard further defines expectations for:
- Group-wide governance and accountability
- Money laundering and terrorist financing risk assessments
- Consistent policies, procedures, and internal controls
- Secure sharing of relevant customer and risk information
- Oversight of compliance deficiencies and remediation
It also addresses circumstances where third-country laws restrict an institution’s ability to implement group-wide requirements or share information.
Importantly, information sharing must remain consistent with applicable data protection requirements and appropriate access controls.
What this means for compliance teams
A financial institution’s understanding of risk may be incomplete when relevant information remains isolated across business units or jurisdictions.
A customer relationship considered low risk by one entity may warrant additional scrutiny when information held elsewhere in the group reveals other exposures or connections.
Greater consistency does not necessarily mean every institution or subsidiary must operate an identical compliance process. Controls must remain proportionate to the organization’s structure and risk profile.
However, institutions should be able to demonstrate how relevant information is shared, how risks are assessed, and how compliance decisions are governed across the organization.
For multinational financial institutions, this makes data accessibility, governance, and coordination especially important.
A common theme: Consistency without abandoning a risk-based approach
Although the three standards address different requirements, they share an important objective: making AML/CFT obligations clearer and more consistently applied across the European Union.
That consistency must coexist with proportionality.
The standards do not suggest that every customer, transaction, or business relationship should receive identical scrutiny. Instead, they reinforce the importance of applying controls based on the risks involved, supported by appropriate information and documented processes.
For compliance leaders, this creates an opportunity to evaluate whether existing operating models can deliver both consistency and flexibility.
Three considerations stand out.
Data quality matters as much as data availability. Screening and due diligence processes depend on accurate identification information, reliable sources, and sufficient context to distinguish relevant risk from background noise.
Monitoring must account for changing circumstances. Customer relationships, transaction patterns, ownership structures, and risk exposures can change over time. Processes need to support the ongoing assessment of risk where required, rather than relying exclusively on information collected at onboarding.
Decision-making must remain explainable. Whether a decision is supported by technology or conducted manually, institutions need appropriate records explaining what information was considered, how risk was assessed, and why an action was taken.
Together, these capabilities can support more consistent compliance outcomes without introducing unnecessary friction into every customer interaction.
What should financial institutions do next?
The standards have been submitted to the European Commission and are not yet definitive.
The underlying AML Regulation is scheduled to apply from July 10, 2027, for most obliged entities, with a later application date for certain professional football clubs and agents. AMLA has indicated that the three technical standards are proposed to apply six months after their entry into force, following adoption and publication in the Official Journal of the European Union.
Institutions should monitor the adoption process and confirm the final requirements and applicable dates before implementing changes.
In the meantime, the draft standards provide a useful framework for reviewing existing compliance practices.
Rather than treating the announcement as an immediate mandate to overhaul existing systems, compliance leaders can begin with several questions:
- Customer due diligence: Are identification, verification, and screening practices consistent with the risk-based requirements outlined in the draft standards?
- Transaction relationships: Can existing controls identify potentially linked transactions and account for their combined value when determining CDD obligations?
- Group-wide visibility: Can relevant customer and risk information be shared securely across the appropriate entities and jurisdictions?
- Governance: Are screening outcomes, risk assessments, and compliance decisions documented sufficiently to support internal oversight and regulatory review?
These questions can help identify areas where existing procedures are effective and where additional attention may be warranted.
Looking ahead: A more connected approach to financial crime compliance
AMLA’s latest announcement is part of a broader effort to strengthen the consistency and effectiveness of financial crime prevention across Europe.
For institutions operating across multiple markets, regulatory harmonization has the potential to reduce ambiguity while creating clearer expectations for how compliance programs should function.
The transition will require more than regulatory interpretation. Institutions will need to consider how their data, technology, governance, and operational workflows support those expectations in practice.
The opportunity is to build compliance processes that are not only aligned with evolving requirements but also better equipped to identify meaningful risks, adapt to changing circumstances, and support informed decisions.
As Europe’s AML framework continues to take shape, the ability to connect information, understand risk in context, and demonstrate consistent decision-making will remain central to effective financial crime compliance.
