Countdown to the AML Regulation

The EU Anti-Money Laundering Authority (AMLA) has published the final drafts of its first standards on the AML Regulation. These standards govern customer due diligence, transaction identification and group obligations – and also apply to estate agents, dealers in high-value goods, tax advisers and law firms.

Key Takeaways:

1. On 30 September 2026, the European Anti-Money Laundering Authority (AMLA) published the final drafts of its first three Regulatory Technical Standards (RTS) on the EU Anti-Money Laundering Regulation (AML Regulation) and submitted them to the Commission.
2. The standards set out in detail the customer due diligence obligations, the distinction between business relationships, occasional and linked transactions, and group-wide obligations, including additional measures for entities in third countries.
3. The AMLA is not introducing any additional, lower thresholds – the amounts specified in the AML Regulation remain in place.
4. The AML Regulation will apply directly from 10 July 2027. It does not provide for an industrial holding company exemption as set out in Section 1(24), second sentence, of the Money Laundering Act (GwG): if the group’s parent company has even one subsidiary subject to the obligations, it itself becomes subject to those obligations and must comply with the group-wide requirements.

What are the AMLA standards relating to the AML Regulation?

Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation, AML Regulation) will harmonise anti-money laundering legislation across the EU from 10 July 2027 within a directly applicable regulatory framework; European requirements will thus replace large parts of the German Money Laundering Act. The AML Regulation authorises the adoption of numerous regulatory technical standards, which are drafted by the new Anti-Money Laundering Authority (AMLA), based in Frankfurt am Main, and adopted by the Commission as delegated regulations. These standards set out in detail how the obligations under the AML Regulation are to be fulfilled – uniformly for the financial sector and for all other obliged entities.

What has the AMLA presented?

On 30 September 2026, the AMLA published its final reports on the first three standards, which are addressed directly to obliged entities, and submitted the drafts to the European Commission. This was preceded by public consultations in spring 2026, which yielded several hundred responses from the financial and non-financial sectors. Specifically, these concern:

• the standard under Article 28(1) of the AML Regulation on customer due diligence obligations,
• the standard under Article 19(9) of the AML Regulation on the distinction between business relationships, occasional transactions and linked transactions, as well as on the issue of lower thresholds; and
• the standard under Article 16(4) and Article 17(3) of the AML Regulation on group-wide minimum requirements and additional measures for entities in third countries.

The standards will only become binding once the Commission has adopted them as a delegated regulation and they have been published in the Official Journal of the EU. The Commission has three months to decide on their adoption (Article 49 of the AMLA Regulation); thereafter, the European Parliament and the Council may raise objections within three months, extendable by a further three months (Article 51 of the AMLA Regulation). According to the drafts, the standards are to apply six months after their entry into force. Experience shows that fundamental changes to the content are rare at this stage of the procedure – the drafts therefore already serve as the authoritative basis for planning, alongside the AML Regulation itself.

Customer due diligence: What will apply in detail in future

The most comprehensive standard sets out what information obliged entities must collect and how they must verify it. The AMLA explicitly adopts a horizontal approach in this regard: the same rules apply to credit institutions as well as to dealers in high-value goods, estate agents and tax advisers.

Identification and verification

For natural persons, all first and last names, place and date of birth, all nationalities and the full residential address must be recorded; obliged entities must take appropriate measures to clarify whether a person holds multiple nationalities. For legal entities, the legal form, name, any alternative trading name, the registered office address and any registration or tax numbers must be recorded in particular.

• Verification is carried out using identity documents bearing a photograph, signature and security features, or via electronic means of identification or qualified trust services in accordance with the eIDAS Regulation with a ‘substantial’ or ‘high’ assurance level – including during face-to-face interactions.
• Other remote identification solutions remain permissible provided they meet minimum requirements for authenticity and identity verification, integrity and confidentiality; their use must be justified and documented.
• Sources of information must be reliable and independent; decisive factors include, amongst others, their official status, up-to-date nature and resistance to forgery.

Purpose of the business relationship, PEP and sanctions checks

Obligated entities must obtain information, commensurate with the risk, on the economic background of the business relationship, the expected transaction volume, and the origin and use of the funds. In doing so, they should draw on information already available to them or to other obliged entities within the same group. Detailed provisions also cover checks for politically exposed persons (PEPs) and screening against lists of targeted financial sanctions – in each case when establishing the business relationship, on an ad hoc basis and at risk-based intervals, whether carried out automatically, manually or using a combination of both methods.

Simplified and enhanced due diligence obligations

In cases of low risk, for example, the requirement to collect the address of natural persons may be waived, and beneficial owners may be identified using registers and reliable public sources. The AMLA has expressly rejected further relaxations, as these would effectively have created exceptions to the AML Regulation. In high-risk cases, the standard requires additional information on the customer and beneficial owners, on the origin of funds and assets and – in the case of complex structures – on their economic or legal basis.

Existing customers

The standard does not require a one-off conversion of the entire customer base as of a specific date. Data relating to existing business relationships must be adapted to the new requirements on a risk-based basis within the update deadlines set out in Article 26(2) of the AML Regulation. These deadlines are determined by the level of risk and must not exceed one year for high-risk customers or five years for all other customers under any circumstances.

Distinguishing between transactions: business relationship or occasional transaction?

Whether a business relationship or an occasional transaction exists determines whether, and to what extent, due diligence obligations are triggered. The standard set out in Article 19(9) of the AML Regulation establishes uniform criteria for this across the EU for the first time:

• For all obliged entities, the decisive factor is whether the customer is granted ongoing access to services relevant under money laundering legislation; according to the final version, a purely technical registration is not sufficient.
• Obligated entities outside the financial sector – such as estate agents, notaries, solicitors or tax advisers – must also assess whether a service requires several actions over a significant period of time, whether services are provided repeatedly at intervals, or whether various services are provided.
• In the case of currency exchange bureaux, money transfer service providers and crypto-asset service providers, three or more transactions within twelve months constitute a business relationship.

Linked transactions must be identified by means of an overall assessment. Indicators include, amongst other things, identical principals or recipients, persons acting in concert, the same technical infrastructure (such as an IP address or device), the same purchase transaction, and a close temporal connection, which is assessed according to the business model and size of the obliged entity. No single criterion is decisive on its own, and obliged entities need only evaluate information already available to them.

It is worth noting what the standard does not include: the AMLA sees no sufficient grounds for additional, lower thresholds. The amounts set out in the AML Regulation itself remain in force.

Group obligations: What parent companies must ensure

The third standard is aimed at groups to which obliged entities belong. The parent company must introduce group-wide, uniform strategies, procedures and controls, which must be approved by its management body. The obligations of the individual group companies remain unaffected by this.

Minimum requirements

• documented governance with clear responsibilities and a compliance officer with sufficient decision-making powers at group level,
• a group-wide risk analysis that reflects the group’s complexity and risk profile and takes particular account of entities in third countries and outsourced activities,
• intra-group exchange of information in accordance with the ‘need-to-know’ principle via secure channels and in compliance with data protection law – an annex to the standard specifies which information is to be shared – and
• a regular, documented exchange between the compliance function, the management body, business units and the audit function.

Networks and other structures

The standard also covers networks, partnerships and franchise systems with shared ownership, management or compliance control – arrangements that are particularly common amongst auditors, tax advisers, solicitors and estate agents. The standard specifies who is at the head of such a structure and, under certain conditions, permits joint minimum systems for structures without a designated head.

Entities in third countries

If the law of a third country does not permit the implementation of the group-wide requirements, the parent undertaking must inform the supervisory authority without delay, and at the latest within 28 calendar days, and take additional measures. The range of measures extends from restricting the product range, through enhanced monitoring and management approval for high-risk relationships, to the termination of business relationships and – as a last resort – the closure or disposal of the entity.

Abolition of the industrial holding company privilege: when the group’s top management itself becomes a obliged entity

For many corporate groups, one change is likely to have a more significant impact than the detailed rules of the new standards: the AML Regulation does not recognise an industrial holding privilege. Group parent companies, which were previously exempt from money laundering legislation, may themselves become obliged entities from 10 July 2027 – and will then, as parent companies, be subject to the group-wide requirements.

Previous legal situation under the Anti-Money Laundering Act (GwG)

Financial undertakings within the meaning of Section 1(24) of the GwG are obliged entities (Section 2(1)(6) of the GwG). These include undertakings whose main activity consists of acquiring, holding or disposing of shareholdings. Under the previous reference to the German Banking Act (KWG), case law had also classified pure holding companies as financial undertakings and rejected a restrictive interpretation. The legislature responded with the 2020 amendment to the GwG: Since then, Section 1(24), second sentence, of the GwG has excluded holding companies that hold only shareholdings in undertakings outside the credit institution, financial institution and insurance sectors and do not engage in any business activities beyond the management of those shareholdings. According to the explanatory memorandum to the Act, shareholdings in the financial sector of minor significance – typically up to 5 per cent – are not detrimental. Since the group’s top management is not an obligated party under these provisions, such groups also lack an obligated parent company to which the group-wide obligations under Section 9 of the Money Laundering Act (GwG) apply.

What changes with the AML Regulation

The AML Regulation defines the scope of obliged entities independently and, in the case of holding companies, bases this not on their own activities but on their position within the group and on the activities of their subsidiaries. According to Recital 10, holding companies that carry out mixed activities and have at least one subsidiary that is an obliged entity are themselves to be included as obliged entities. This is implemented through two definitions:

• Mixed financial holding company (Article 2(1)(10) of the AML Regulation): an undertaking which is neither a financial holding company nor a mixed financial holding company, nor a subsidiary of another undertaking, and whose subsidiaries include at least one credit institution or financial institution. It is itself regarded as a financial institution (Article 2(1)(6)(a) of the AML Regulation) and is therefore an obliged entity.
• Non-financial mixed holding company (Article 2(1)(13) of the AML Regulation): a company whose subsidiaries include at least one obliged entity as defined in Article 3(3) of the AML Regulation. It is listed as a new category of obliged entity in Article 3(3)(m) of the AML Regulation.

If the group’s parent company holds both financial or credit institutions and other obliged entities, it is to be classified as a financial mixed holding company. Only the top-tier company is covered in each case, not an intermediate holding company which is itself a subsidiary. The AML Regulation does not provide for an exemption modelled on Section 1(24), second sentence, of the Money Laundering Act (GwG) or a de minimis threshold for shareholdings; the national exemption will therefore no longer apply in this respect from 10 July 2027.

Who may be affected

According to the wording, a single obliged subsidiary is sufficient. Whether a subsidiary is an obliged entity is determined by the list set out in the AML Regulation, and no longer by the GwG. The broad definition of ‘goods trader’ under the GwG no longer applies; only dealers in precious metals and gemstones, as well as traders and stockists of high-value goods, are now covered. Typical triggers in industrial and commercial groups are:

• leasing, factoring and sales finance companies,
• and, according to the wording, also traders and manufacturers who themselves grant consumers payment by instalments or deferred payment: they are lenders within the meaning of consumer credit law and are therefore financial institutions (Article 2(1)(6)(g) of the AML-VO); legal literature calls for a restrictive interpretation in this regard,
• credit and insurance intermediaries, insofar as they are financial institutions or obliged entities under the AML Regulation,
• companies operating as estate agents,
• companies that regularly sell vehicles or other high-value goods exceeding the value thresholds set out in the AML Regulation (more on this shortly), and
• tax consultancy firms belonging to the group.

What are ‘high-value goods’?

High-value goods are defined in Article 2(1)(54) in conjunction with Annex IV of the AML Regulation as:

• jewellery, gold and silver articles worth more than 10,000 euros,
• watches worth more than 10,000 euros,
• motor vehicles costing more than 250,000 euros, and
• aircraft and watercraft, each with a price exceeding 7.5 million euros.

This list is exhaustive. Obliged entities are those whose regular or main occupation consists of trading in such goods (Article 3(3)(f) of the AML Regulation). A secondary activity is sufficient if it is carried out on a regular basis. Unlike the previous exemption for goods traders under the Anti-Money Laundering Act (GwG), the provision is not linked to cash payments – these are replaced by the general cash threshold of 10,000 euros (Article 80 of the AML Regulation). Those covered by the regulation are subject to the full range of obligations, including due diligence requirements, reporting of suspicious transactions and the appointment of an anti-money laundering officer. The value threshold applies to the individual item. Consequently, this may cover not only dealers in luxury vehicles, but also companies that regularly sell coaches, heavy goods vehicles, special-purpose vehicles or high-value motorhomes with an individual price exceeding 250,000 euros. The AML Regulation does not expressly stipulate whether manufacturers who distribute their own vehicles are also covered, and legal literature has not yet addressed this question in depth. An argument in favour of this is that the regulator justifies the inclusion on the basis of the high value and transportability of the vehicles (Recital 20) – risks that are no less significant in the case of direct sales by the manufacturer – and that German law has, to date, also treated the sale of goods manufactured in-house as trade in goods. It also remains unclear whether, in the case of companies with a mixed product range, the obligations are limited to the goods listed in the catalogue. Furthermore, if vehicles in this price category are sold for non-commercial purposes – such as motorhomes to private customers – every such transaction must be reported to the Central Office for Financial Transaction Investigations (Article 74 of the AML Regulation).

For industrial groups whose companies have, as goods traders without cash transactions, enjoyed a largely privileged status to date, this has two consequences: the selling company itself becomes a obliged entity, and the group’s senior management is also brought within the scope of the obligations via the non-financial mixed holding company. It remains to be seen whether Germany will subject further goods traders to these obligations beyond the scope of the AML Regulation, a possibility provided for in Article 3 of the 6th Anti-Money Laundering Directive.

Consequences for group management

If the holding company becomes an obliged entity, it is at the same time a parent undertaking within the meaning of the AML Regulation, provided that at least one subsidiary is an obliged entity (Article 2(1)(42) of the AML Regulation). The traditional customer due diligence obligations are likely to be of little practical significance in the case of a pure investment holding company, given its lack of its own customer relationships. Of particular importance are the group-wide obligations under Article 16 of the AML Regulation and the new standard set out in the AMLA:

• a group-wide risk assessment based on the risk analyses of the obliged group entities,
• group-wide strategies, procedures and controls to be implemented by the obligated group entities,
• compliance functions at group level, comprising a compliance manager and, where justified, an anti-money laundering officer (Article 16(2) of the AML Regulation), and
• an internal group-wide exchange of information, in which non-obligated group companies may also participate.

Added to this is a group-wide impact: group entities subject to the obligation must, as part of their ongoing monitoring, take into account information regarding the same customer’s business relationships with other group entities – including those which are not themselves subject to the obligation (Article 26(1), third subparagraph, of the AML Regulation). This requires interconnected data flows and a sound data protection basis, as data protection law does not recognise a ‘group privilege’.

Unresolved issues

• ‘Mixed activities’: Recital 10 refers to holding companies that carry out mixed activities; the definitions, however, do not require the company to engage in its own business activities. It is therefore a matter of debate whether holding companies engaged purely in asset management are covered. The majority of views expressed in the literature to date do not see the recitals as providing a basis for any restriction, as they are not legally binding.
• Groups with marginal financial activities: The definition of a mixed financial holding company does not include a requirement for a principal activity of its own. Even mixed groups whose financial activities are closely linked to supply or trading operations may therefore be covered.
• Exemption under Article 6 of the AML Regulation: Member States may, under strict conditions, exempt entities that carry out financial activities only occasionally or to a very limited extent. However, the provision relates to the undertaking that carries out the financial activity itself; it remains to be seen whether it applies to a holding company that is only indirectly affected and whether Germany will make use of this option.
• Implementation in Germany: It remains to be seen how the German legislature will align money laundering legislation with the AML Regulation and which authority will supervise the new entities subject to the ‘ ’ obligation. The current standards under the AMLA do not clarify the scope of the holding company categories.

What groups should do now

• systematically review the shareholding structure to determine whether subsidiaries are credit or financial institutions or obliged entities under Article 3(3) of the AML Regulation,
• document the classification of the group’s top management and, where appropriate, examine options for structuring the group under company law,
• Establish group compliance, group-wide risk assessment and information exchange – including a data protection policy – in good time before 10 July 2027; and
• monitor the German implementing legislation, any application of Article 6 of the AML Regulation and guidance from the supervisory authority.

What does this mean for businesses outside the financial sector?

For dealers in high-value goods, estate agents, tax advisers, as well as solicitors and notaries – the latter in relation to the specified transactions listed in Article 3(3)(b) of the AML Regulation, such as the purchase and sale of property or business premises, or the formation and management of companies – the standards will apply directly upon their adoption. As EU law, they take precedence over the previous national guidelines on interpretation and application issued by supervisory authorities and professional bodies; these will need to be revised and may in future only be used as a supplementary reference, insofar as they are compatible with the European requirements. In addition, there is the group level: industrial and commercial groups must assess whether their group management will itself be a ‘person subject to the obligations’ in future (see above). Specifically, the following is recommended:

• Risk analysis: Comparing the existing risk analysis with the criteria set out in the standards and developing or revising a group-wide risk analysis.
• KYC processes: Gap analysis of identification, verification and screening processes, including data fields in IT and onboarding systems; assessment of whether the remote identification procedures used meet the requirements.
• Transaction definition: Defining when mandates, orders or client relationships are to be treated as business relationships, and establishing rules for identifying linked transactions.
• Group policies: Review of group policies, internal information exchange and data protection framework, as well as an inventory of entities in third countries.
• Existing customers: Planning a risk-based update of customer data.

Outlook

The Commission must now decide within three months whether to adopt the drafts. This leaves little time before the AML Regulation comes into force on 10 July 2027, particularly as further standards and guidelines on the AML Regulation are still pending and the AMLA has announced additional clarifications for the non-financial sector. BaFin is making the new supervisory regime under the AMLA the focus of its symposium on money laundering prevention on 10 December 2026. Companies should use the remaining months to align their compliance organisation with the new regime.