A regulation, not a directive: the end of national transpositions
On 10 July 2027, Regulation (EU) 2024/1624, known as the AMLR, becomes directly applicable in the 27 Member States. It is the centrepiece of the EU anti-money laundering package adopted in June 2024, alongside the sixth directive (AMLD6, which organises national supervision and registers) and the regulation creating AMLA, the new European authority based in Frankfurt.
The difference from the five previous directives comes down to one word: harmonisation. A directive left each State to transpose it, with the familiar gaps between Luxembourg, Germany and France on thresholds, PEP definitions or review frequency. A regulation applies as it stands, without transposition, with a single text and regulatory technical standards (RTS) drafted by AMLA. For a financial intermediary active in several countries, it is the end of 27 variants of the same KYC file.
AMLA took over the EBA's AML mandate on 1 January 2026. On 1 October 2026 it published its final reports on the most structuring RTS (due diligence, thresholds, group requirements, third countries). In 2027 it will select around forty groups presenting the highest risk, active in at least six Member States, for direct supervision from 2028. The other obliged entities remain under their national authorities, but with the same reference text.
Why Swiss banks are affected without being obliged entities
Switzerland is neither in the EU nor in the EEA. A Swiss bank, an independent asset manager or a trustee based in Geneva or Zurich is therefore not an obliged entity within the meaning of the AMLR. The applicable law remains the Swiss AMLA, the FINMA AMLO and the CDB 20. But the AMLR reaches the Swiss financial centre through four channels, three of which are binding.
Subsidiaries and branches in the EU and the EEA. A Luxembourg, German or Liechtenstein entity of a Swiss group is a fully fledged obliged entity from 10 July 2027. It will have to apply the new thresholds, the new definitions and the new review calendar, with its own AML officers subject to fit and proper requirements, a framework for managing conflicts of interest and adapted systems.
Group-wide policies (articles 16 and 17). This is the most structuring channel and the least visible. A group whose parent company is in the EU must extend its AML policies, procedures and controls to all its branches and subsidiaries, including in third countries. It must carry out a group-wide risk assessment and organise the sharing of information on customers, beneficial owners, transactions and suspicions between entities. A Swiss bank owned by a French, German or Luxembourg group will therefore receive European standards through its parent. On 1 October 2026 AMLA finalised the RTS setting the minimum group requirements and the measures to take when the law of a third country prevents the application of the AMLR.
Counterparties and correspondents. European correspondent banks, custodians, life insurers and intermediaries will apply the AMLR to their relationships with Swiss institutions. They will ask for beneficial owner files, source of funds evidence and screening attestations that match their framework, not the Swiss one. The cross-border file will have to satisfy both regimes.
Regulatory arbitrage. Deloitte points to an indirect risk: clients could seek to exploit the gaps between the Swiss and the European regimes. A financial centre that appeared less demanding on beneficial owner identification or PEP monitoring would attract a flow that nobody wants.
The case of Liechtenstein
Liechtenstein is not in the EU but in the EEA. The AMLR will be incorporated there by decision of the EEA Joint Committee and will replace the Due Diligence Act (SPG). The consultation report on the new Liechtenstein law was adopted on 3 March 2026, and the chosen timetable aligns application with 10 July 2027, whether or not the formal EEA decision has been taken by then. Banks and fiduciaries in Vaduz, many of which are owned by Swiss groups or share a client base with Switzerland, are therefore on the same timetable as Luxembourg.
What changes in every file
The AMLR does not so much increase the number of clients as the number of persons to identify per file, the frequency of reviews and the scope of screening. Four changes concentrate most of the workload.
Beneficial owners: 25% included, chain calculation, control through other means (art. 51 to 53)
The threshold moves from "more than 25%" to "25% or more" of the shares, voting rights or other ownership interests, held directly or indirectly. The calculation becomes multiplicative along each chain of ownership, then additive across chains: a person who holds 60% of a holding company that holds 40% of the company (24%) and 10% directly totals 34% and becomes a beneficial owner. Control through other means is defined broadly: a majority of votes, the power to appoint or remove a majority of the board, veto rights, rights over distributions, nominee or informal arrangements. Senior managing officials are retained only as a last resort, and do not dispense with the search.
The Commission must assess by 10 July 2029 whether a lower threshold, of at most 15%, is appropriate for categories of higher-risk entities (art. 52(2)).
PEPs: broader definition, longer measures (art. 42 to 45)
Heads of regional and local authorities with 50,000 inhabitants or more enter the definition. Each Member State publishes a national list of qualifying functions. Enhanced measures apply for at least 12 months after the end of the mandate. Senior management approval, verification of the source of wealth and of funds, and enhanced monitoring are mandatory. By 10 July 2027 AMLA will publish guidelines on family members and close associates and on PEP risk categories.
Sanctions screening built into due diligence (art. 20)
For the first time, the European AML framework explicitly addresses targeted financial sanctions. Checking that the customer and its beneficial owners are not subject to sanctions becomes a component of CDD, at onboarding and on an ongoing basis, no longer a parallel process run by another team.
Periodic reviews: 1 year for high risk, 5 years for the rest (art. 26(2))
Files must be updated at least every year for high-risk customers and at least every five years for the others, with an ad hoc update at every significant change. For institutions that worked by trigger event, the stock of existing clients becomes a recurring flow of re-KYC. The requirements apply to new relationships from July 2027 and to existing relationships progressively.
The specific regime for high-net-worth clients (art. 34(5))
This is the article that most directly concerns wealth management. Where a high-risk relationship involves a client whose total wealth reaches EUR 50 million, excluding the main residence, and of which at least EUR 5 million is handled within personalised services (wealth management, private banking, advisory), the obliged entity must apply additional measures: specific procedures for this client base, additional information on the source of funds and wealth, and conflict of interest controls between the client and the staff in charge of the relationship.
By 10 July 2027 AMLA will publish the methodology for valuing wealth. For a Swiss private bank whose Luxembourg subsidiary or German correspondent applies this article, the practical consequence is simple: the source of wealth file of a UHNW client will have to be documented to a level the Swiss framework does not formally require today, and be producible in the format the European entity expects.
Thresholds, prohibitions and new obliged entities
Trigger thresholds are harmonised and, for the most part, lowered. The newly obliged sectors widen the circle of entities that will have to perform KYC, and therefore of counterparties that will ask for it.
| Measure | AMLR rule | Article |
|---|---|---|
| Occasional transactions | CDD from EUR 10,000 (previously EUR 15,000) | 19 |
| Transfers of funds | CDD from EUR 1,000 for credit and financial institutions | 19 |
| Cash | Identification from EUR 3,000; cash payments capped at EUR 10,000 per transaction or linked transactions (Member States may set less) | 19(4), 80 |
| Anonymous accounts | Prohibition of anonymous accounts, passbooks and safe-deposit boxes and of any anonymising instrument | 79 |
| High-risk third countries | Mandatory enhanced due diligence according to the EU list, based on the FATF and extended by delegated acts | 29 to 31 |
| Record keeping | 5 years after the end of the relationship, extendable by 5 years | 77 |
Entering the scope of obliged entities: crypto-asset service providers (CASPs within the meaning of MiCA), crowdfunding platforms, dealers in high-value goods (jewellery and watches above EUR 10,000, vehicles above EUR 250,000), and from 10 July 2029 professional football clubs and agents. For a bank, each of these new obliged entities is also a counterparty or a client that will now have to evidence its own due diligence.