The new EU AML package and the implications for obliged entities

The fight against money laundering is of central importance for financial stability in Europe. The previous system – consisting of national regulations – made effective prevention and cooperation within the European Union (EU) more difficult. A new legislative package (“EU AML package”) was therefore adopted at EU level. The new EU AML package expands the group of obliged entities. It also extends the require­ments for due diligence obligations, particularly with regard to the identification of customers and beneficial owners. With the AMLA, there will also be a central EU supervisory authority in future. The measures are intended to harmonize the fight against money laundering and terrorist financing in the EU, but pose various new challenges for obliged entities. ​

“AML” stands for “Anti Money Laundering” and describes the (legal) regulations and practices that are intended to prevent illegally generated money from being “laundered” and thus smuggled into the legal economic cycle. 

To strengthen the control and harmonization of measures to prevent and combat money laundering and terrorist financing in the EU, the European Parliament has adopted a new EU legislative package (EU AML package), which entails fundamental legal and regulatory changes. The package was published in the Official Journal of the EU on June 19, 2024. 

The changes compared to the previous money laundering regulations are particularly interesting for those obligated parties that are already obligated under the Money Laundering Act (GwG), as many of the existing and established processes in these companies must be revised and adapted. 

The EU AML package comprises four central sets of regulations. 

​AMLD 6 aims to create a uniform regulatory and organizational framework for the EU and the individual member states in order to protect the internal market from the misuse of the financial system for money laundering and terrorist financing. To this end, the directive sets out requirements for national and suprana­tional risk assessments and prescribes the establishment of national central registers for recording beneficial ownership and access authorizations to these. In addition, there are to be central registers for banking and real estate information, among other things. The directive also aims to improve cooperation between FIUs and supervisory authorities, extend their powers and harmonize the sanctioning of obliged entities. 

AMLD 6 came into force on July 9, 2024 and most of the regulations must be transposed into national law by the member states by July 10, 2027.  

The central element of the AMLA-R is the creation of a new European supervisory authority, the Anti-Money Laundering Authority (AMLA) based in Frankfurt. In future, this authority will play a central role in coordinating the member states and ensuring that anti-money laundering is enforced uniformly across the EU. The AMLA is expected to be fully operational from January 2028 and will directly supervise certain high-risk financial institutions.  

The AMLA will also develop regulatory technical standards (RTS) and implementing standards (ITS) for obliged entities, national supervisory authorities and Financial Intelligence Units (FIUs), with the help of which the application of EU-wide anti-money laundering and counter-terrorist financing regulations as well as supervisory and FIU-related (reporting) procedures are to be harmonized. 

The AMLA-R came into force on June 26, 2024 and has taken direct effect in all EU member states. It will apply from July 1, 2025. 

​Regulation (EU) 2023/1113 is also part of the EU AML legislative package, but was published in the Official Journal of the EU in June 2023. This legal act entered into force on June 30, 2023 and sets out requirements to ensure the traceability of money and crypto transfers. The regulation will be applied from December 30, 2024. 

The AMLR supplements AMLD 6, specifies certain requirements and provides practical and operationally implementable regulations for obliged entities. The regulations relate primarily to risk assessment, the implementation of due diligence obligations (in particular the identification of customers and beneficial owners) and the reporting of suspicious transactions, particularly in the case of high-risk customers.  

This regulation will have direct effect in the member states from July 10, 2027 and largely replaces the existing national money laundering laws. 

​

​Since the AMLR is directly applicable to obliged entities in the Member States, it is advisable to take a closer look at the specific changes and in particular the due diligence obligations.  

The AMLR expands the group of obliged entities. This includes players in the crypto services sector and traders in high-value goods, including traders in precious metals, precious stones and other high-value goods such as luxury cars. Professional football clubs and soccer agents are also included in the group of obliged entities. However, the national authorities of the member states can exclude certain players from the list of obliged entities if the risk of money laundering is low. 

The AMLR expands the scope of customer data to be collected as part of the identification process: If the customers are natural persons, all nationalities, any refugee status or statelessness and – if available – national identification and tax identification numbers must be recorded in addition to the mandatory informa­tion already existing under the Anti-Money Laundering Act (AMLA). In the case of legal entities, the country of incorporation and, if available, a tax identification number and legal entity identifier must now also be recorded. In addition, the names of the nominal shareholders and nominal directors and their status as such must be recorded. 

 

According to the new AMLR, customer data updates must be carried out after a maximum of 5 years (annually for high-risk customers). However, an exception is possible: if simplified due diligence obligations are applied, the interval between updates may be longer than five years under certain circumstances. 

In addition, the definition of politically exposed persons was extended to include regional/local politicians from constituencies with at least 50,000 inhabitants. 

The sanctions check becomes part of the general due diligence obligation. Obligated parties must now check whether customers or beneficial owners are on sanctions lists or are controlled by persons subject to sanctions. 

As part of the AML law package, the terminology “beneficial owner” will be used in future instead of the previous term “beneficial owner”.  In addition, the threshold for determining beneficial ownership will be reached from a shareholding of 25%. Previously, the threshold in Germany was greater than 25%. For high-risk industries, there is also the possibility that the threshold will be reduced to a shareholding of 15%. 

To identify the beneficial owner, the place and date of birth, address, all nationalities and the number of an ID document and, if available, a unique personal identification number must now also be collected, irrespective of the risk classification. 

​

If beneficial owners cannot be identified, all members of the management level must be identified (“fictitious” beneficial owners).  

Obligated parties must continue to report all suspicious transactions to the Financial Intelligence Unit (FIU), regardless of their amount. What is new, however, is that the AMLR now provides for a clear deadline of five working days for the FIU to respond to an inquiry. In addition, the EU AML package introduces threshold-based reporting obligations for trade in certain high-value goods. The following thresholds apply to transactions in the following high-value goods: motor vehicles from EUR 250,000, watercraft and aircraft from EUR 7,500,000. In addition, several partial payments that together amount to EUR 10,000 or more are now also subject to reporting under the AMLR.  

In addition, an EU-wide limit of EUR 10,000 will be introduced for cash payments in order to improve traceability and combat financial crime. However, member states have the option of setting a lower limit. 

​The new legal requirements demand that obligated parties implement a comprehensive range of suitable measures. These include significant adjustments to internal processes, the revision of compliance measures and risk analyses as well as clear documentation. 

It is advisable for obligated parties to deal with the changes and provisions of the EU AML package now so that they can define suitable risk mitigation measures at an early stage and integrate them into their internal systems and processes in order to actively reduce the risk of regulatory sanctions and reputational damage. ​