AMLA’s single rulebook splits EU AML from the US and UK

The European Union is replacing 27 national anti-money-laundering regimes with one: from July 10, 2027, the Anti-Money Laundering Regulation (AMLR) applies directly across the bloc, and the Frankfurt-based Anti-Money Laundering Authority (AMLA) — operational since July 1, 2025 — will from 2028 directly supervise selected banks, crypto firms and payment providers. The model diverges sharply from the enforcement-led United States approach and the risk-based United Kingdom regime.

The European Union has built its first central anti-money-laundering supervisor and a single, directly applicable rulebook to sit above it. The Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies from July 10, 2027, while the AMLA Regulation (Regulation (EU) 2024/1620) entered into force on June 26, 2024 and applies from July 1, 2025. For brokers, exchanges and crypto-asset service providers (CASPs), 2026 is the build year: AMLA is drafting the technical standards now, and a provisional list of entities eligible for direct supervision is due by end-September 2026. This analysis walks the rulebook, compares four jurisdictions, sets out the enforcement backdrop, and details what compliance teams must do before the 2027 cliff.

Key Facts:

• The AMLR (Regulation (EU) 2024/1624) applies directly across all member states from July 10, 2027 — EUR-Lex
• AMLA (Regulation (EU) 2024/1620) entered into force June 26, 2024 and has been operational in Frankfurt since July 1, 2025 — EUR-Lex
• AMLA will directly supervise about 40 selected obliged entities from 2028; the provisional eligibility list is due by end-September 2026 — AMLA
• The AMLR caps cash payments for goods and services at €10,000 EU-wide; member states may set lower limits
• CASPs must apply customer due diligence (CDD) on occasional transactions from €1,000 — a far lower threshold than for other financial institutions
• The sixth AML Directive (Directive (EU) 2024/1640) sets a 25%-or-more beneficial-ownership threshold and must be transposed by July 10, 2027
• Enforcement benchmark: TD Bank paid roughly $3.09 billion in October 2024 in the largest US Bank Secrecy Act case — US Department of Justice

Methodology and sources

This analysis draws on primary EU legislation — the AMLR (Regulation (EU) 2024/1624), the AMLA Regulation (Regulation (EU) 2024/1620) and the sixth AML Directive (Directive (EU) 2024/1640) — together with AMLA’s own published timeline and Chair statements, the US Bank Secrecy Act framework, the UK Money Laundering Regulations 2017, and Singapore’s Payment Services Act 2019. The jurisdictional scope is the EU, the US, the UK and Singapore. The time window is the package as adopted in 2024 through AMLA’s 2026 rule-drafting phase. The principal caveat: AMLA’s secondary legislation — regulatory and implementing technical standards — is still being written during 2026, so specific obligations will tighten before the 2027 application date.

Related:EU’s PFOF ban hits its June 30 cliff as the US keeps it legal

What the rule actually says

The EU AML package has three moving parts that compliance teams must not conflate. The AMLR is the substantive single rulebook — directly applicable, no national transposition — covering customer due diligence, beneficial ownership, the €10,000 cash cap and crypto obligations. The AMLA Regulation creates the supervisor and its powers. The sixth AML Directive (AMLD6) governs national supervisors, financial intelligence units and the beneficial-ownership register architecture, and must be transposed into national law by July 10, 2027. Crucially, because the core obligations now sit in a regulation rather than a directive, member states lose most of their discretion to “gold-plate” or dilute the rules.

The AMLR’s single rulebook is the substantive core of the EU reform. It is a directly applicable regulation that, from July 10, 2027, replaces the patchwork of national rules derived from earlier directives with one uniform text covering customer due diligence, beneficial-ownership identification at a 25% threshold, enhanced due diligence for high-risk relationships, and a €10,000 ceiling on cash payments for goods and services. For crypto-asset service providers, the regulation is stricter than for most financial institutions: CDD applies to occasional transactions from €1,000, and CASPs are explicitly named obliged entities. The aim, in AMLA’s framing, is to remove the cross-border gaps that let illicit flows migrate to the most lenient member state. Firms operating in several EU states will, for the first time, face one rulebook rather than 27 interpretations.

Sources: EUR-Lex (Regulation (EU) 2024/1624 and 2024/1620); US Department of Justice; UK legislation (SI 2017/692); Monetary Authority of Singapore. Last updated: June 20, 2026.

How four jurisdictions diverge

The four regimes share the Financial Action Task Force (FATF) standards as a floor but differ on architecture. The EU is centralising: one rulebook, one supervisor, harmonised penalties up to the higher of €10 million or 10% of turnover. The US keeps a fragmented federal-state structure with no single AML supervisor, relying instead on the threat of very large settlements — the enforcement-led model. The UK retains the Money Laundering Regulations 2017 and risk-based FCA supervision, with a separate registration gateway for cryptoasset firms. Singapore licenses digital-payment-token providers under the Payment Services Act and supervises them through MAS notices. The practical consequence is regulatory-arbitrage risk: a CASP shut out of one regime can passport or relocate to another, which is precisely the migration the EU’s single rulebook is designed to stop within its borders. The cross-border gap that AMLA cannot close is the one between the blocs — the same fault line visible in our coverage of the FATF Travel Rule sunrise gap and the US, EU and UK split on sanctioning crypto code.

“One of the objectives of AMLA is to reduce this fragmentation and ensure that rules, practices, and working methods become more uniform.”

— Bruna Szego, Chair, Anti-Money Laundering Authority (AMLA / Il Sole 24 Ore)

Enforcement context: why the US benchmark matters

The EU’s supervisory model is, in part, a reaction to the limits of enforcement-after-the-fact. The reference point is TD Bank, which in October 2024 pleaded guilty to Bank Secrecy Act and money-laundering conspiracy violations and agreed to pay roughly $3.09 billion across the Department of Justice, the Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency and the Federal Reserve — the largest BSA penalty on record and the first time a major US bank pleaded guilty to such a conspiracy. The Financial Crimes Enforcement Network component alone was about $1.3 billion. In crypto, the benchmark is Binance’s $4.3 billion settlement with US authorities in November 2023.

These cases frame the EU’s bet. Vast retrospective fines punish failure but arrive years after the laundering; AMLA’s design — direct, ongoing supervision of the highest-risk cross-border entities from 2028 — is meant to catch weak controls before they metastasise into a multi-billion case. The counter-argument is that a single supervisor for only about 40 entities, layered over national supervisors for everyone else, risks creating a two-tier system in which mid-sized firms fall through the cracks. Whether AMLA’s selection model — informed by a data-collection exercise running through 2026 — captures the right entities is the open question on which the whole reform turns.

What this means for brokers, exchanges and compliance teams

For FX and contract-for-difference brokers, the immediate work is mapping the AMLR against existing national rules and closing the gaps before July 10, 2027 — particularly enhanced due diligence, beneficial-ownership verification at the 25% threshold, and group-wide policies that must now be uniform across EU subsidiaries. For exchanges and CASPs, the €1,000 occasional-transaction CDD trigger and the explicit inclusion as obliged entities mean onboarding and transaction-monitoring systems calibrated to MiCA must also satisfy the AMLR; the two regimes intersect, as we examined in our analysis of the EU reopening its crypto rulebook. Fund managers and custodians should expect harmonised expectations on source-of-funds documentation. Legal and compliance teams need three deliverables in 2026: a gap analysis against the AMLR text, an assessment of whether the firm could fall within AMLA’s direct-supervision population, and engagement with the technical standards still being drafted. The operational-resilience overlap with the Digital Operational Resilience Act is real — see our piece on how DORA’s cloud oversight splits the EU, UK and US — because AMLA will expect supervised entities to evidence both financial-crime and operational controls.

“Again, a bunch of big crypto accounts are claiming upcoming AML rules will ban self-custody or anonymous crypto & Bitcoin transactions in the EU. That’s wrong.”

— Patrick Hansen, Head of EU Strategy and Policy, Circle (The Block)

What’s next — the forward view

The decisive 2026 milestones are AMLA’s drafting of regulatory and implementing technical standards and the end-September 2026 provisional list of entities eligible for direct supervision, informed by a data-collection exercise gathering risk metrics from national supervisors. The selection of roughly 40 entities follows in 2027, with direct supervision beginning in 2028. In parallel, member states must transpose AMLD6 by July 10, 2027, and the European Commission and AMLA must finalise the secondary legislation that completes the single rulebook. Contested points remain: the precise reach of the €10,000 cash cap where member states impose lower limits, the calibration of the CASP rules against MiCA, and the perennial debate — pushed back by industry voices — over whether the rules touch self-hosted wallets. For firms outside the EU, the live question is equivalence: whether US, UK and Singaporean frameworks will be treated as broadly aligned, which bears directly on the regulatory-arbitrage dynamics that also shape the global stablecoin issuer split.

TL;DR

The EU is centralising anti-money-laundering supervision. The AMLR (Regulation (EU) 2024/1624) applies directly from July 10, 2027, and the Frankfurt-based AMLA — live since July 1, 2025 — will directly supervise about 40 selected obliged entities, including crypto firms, from 2028. The single rulebook brings a €10,000 cash cap and a €1,000 CDD trigger for CASPs. The model diverges from the enforcement-led US approach, whose benchmark is TD Bank’s roughly $3.09 billion October 2024 penalty. For brokers and CASPs, 2026 is the gap-analysis year before the 2027 cliff.

FAQ

When does the EU AMLR take effect?

The Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies directly across all member states from July 10, 2027. The AMLA Regulation that creates the supervisor entered into force on June 26, 2024 and applies from July 1, 2025.

What is AMLA and where is it based?

AMLA is the EU’s first central anti-money-laundering supervisor, based in Frankfurt am Main and operational since July 1, 2025. It will directly supervise about 40 selected high-risk obliged entities from 2028, while coordinating national supervisors and financial intelligence units.

Does the AMLR cover crypto firms?

Yes. Crypto-asset service providers are named obliged entities and face stricter thresholds than most financial institutions, with customer due diligence triggered on occasional transactions from €1,000. The rules apply to CASPs such as exchanges and custodial wallet providers, not to individuals using self-custody.

How does the EU approach differ from the US and UK?

The EU is centralising with one rulebook and one supervisor. The US relies on the Bank Secrecy Act and enforcement-led settlements with no single AML supervisor, while the UK keeps risk-based FCA supervision under the Money Laundering Regulations 2017. The architectures, not the FATF baseline, are what diverge.

What is the €10,000 cash limit?

The AMLR caps cash payments for goods and services at €10,000 across the EU, though member states may impose lower national limits. It is one of the single rulebook’s most visible consumer-facing measures and applies from the 2027 application date.

What should compliance teams do in 2026?

Run a gap analysis against the AMLR text, assess whether the firm could fall within AMLA’s direct-supervision population, and track the technical standards AMLA is drafting this year. Group-wide policies across EU subsidiaries should be aligned ahead of the July 10, 2027 application date.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.