Homechevron_rightStandardschevron_rightEU AMLA & AML Package

ActiveInternational Standardupdate Standard Updated: June 2024fact_check Fact checked: Jun 28, 2026

EU AMLA & AML Package

AML Authority and AMLR/AMLD6 — Regulations (EU) 2024/1620, 2024/1624 and Directive (EU) 2024/1640

apartmentPublishing Organization:European Anti-Money Laundering Authority (AMLA)

European Union European Economic Area Finance & Banking Services Technology Retail

Standard Introduction

EU AMLA & AML Package is an active standard published by European Anti-Money Laundering Authority (AMLA). It is commonly used across Finance & Banking, Services, Technology, Retail and applies in European Union, European Economic Area.

Use this page to review the official documentation, current status, and the certification or assessment bodies most commonly associated with EU AMLA & AML Package.

Implementation Roadmap

Phase 1schedule Duration: 3-6 weeks

Define EU anti-money laundering and counter-terrorist financing governance scope

Identify the products, services, systems, entities, jurisdictions, teams, vendors, and stakeholders covered by EU AMLA & AML Package. Confirm owners, boundaries, applicable obligations, documentation, and evidence expectations for obliged-entity scope, customer due diligence, beneficial ownership, risk assessment, policies, controls, group-wide programs, suspicious transaction reporting, recordkeeping, sanctions interface, governance, and AMLA/national supervision.

Phase 2schedule Duration: 4-10 weeks

Assess obligations and gaps

Compare current practices with the expected EU anti-money laundering and counter-terrorist financing governance approach. Review enterprise risk assessment, customer risk scoring, CDD and EDD, beneficial ownership verification, transaction monitoring, STR escalation, sanctions screening, record retention, group controls, training, independent testing, and supervisory reporting, then prioritize gaps by legal exposure, safety or rights impact, customer commitments, operational dependency, reporting deadlines, and audit readiness.

Phase 3schedule Duration: 8-24 weeks

Implement controls and evidence

Deploy required procedures, technical controls, review gates, training, supplier workflows, reporting paths, and operational records. Maintain risk assessments, policies, CDD files, beneficial ownership records, screening logs, transaction alerts, STR decisions, training records, audit reports, governance minutes, regulator communications, and remediation plans as traceable evidence.

Phase 4schedule Duration: Ongoing

Review, report, and improve

Run management reviews, internal checks, independent assessments where applicable, corrective actions, and change reviews. Refresh the program when products, vendors, laws, incidents, reporting cycles, or stakeholder expectations change.

Compliance Checklist

0 / 12

Frequently Asked Questions

Who needs EU AMLA & AML Package?

expand_more

EU AMLA & AML Package is most relevant to EU obliged entities, financial institutions, crypto-asset service providers, professional service firms, supervisors, and groups preparing for AMLR, AMLD6, and AMLA supervision. The exact scope depends on products, services, jurisdictions, reporting duties, customer commitments, and the organization's role in the relevant ecosystem.

Is EU AMLA & AML Package certifiable?

expand_more

The EU AML package is a legal supervisory regime, not a certification. Firms must align with directly applicable AMLR obligations, AMLD6 national implementation, and AMLA supervisory expectations.

What should implementation focus on first?

expand_more

Start by defining scope, obligations, accountable owners, and the evidence expected by regulators, customers, auditors, or governance bodies. Then perform a gap assessment against current controls and prioritize remediation by risk and deadline.

What evidence is useful for EU AMLA & AML Package?

expand_more

Useful evidence includes risk assessments, policies, CDD files, beneficial ownership records, screening logs, transaction alerts, STR decisions, training records, audit reports, governance minutes, regulator communications, and remediation plans. Evidence should be version-controlled, attributable to owners, linked to obligations and controls, and retained for the required review or audit period.

How often should the program be reviewed?

expand_more

Review it at planned intervals and whenever laws, products, vendors, incidents, reporting cycles, customer commitments, or assurance expectations change. Higher-risk obligations should have more frequent monitoring and management reporting.