ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
AMLR vs AMLD is not a comparison of two competing rulebooks. It is the story of the European Union replacing a Directive that each Member State wrote its own version of with a Regulation that applies identically in all twenty-seven. Understanding what actually changed matters more than the label, because a firm that carries its Directive-era controls forward untouched will be non-compliant in ways that are hard to see from the inside.
Regulation (EU) 2024/1624 applies from 10 July 2027. This is what the AMLR vs AMLD shift means in practice, provision by provision.
The obligations that used to sit in a Directive and be transposed into national law now sit in a Regulation and apply directly. Directive (EU) 2024/1640 still exists and still requires transposition, but it governs the machinery — registers, Financial Intelligence Units, supervision and penalties — rather than what an obliged entity must do.
The practical AMLR vs AMLD difference is that the text binding your firm is now the same text binding a competitor in another Member State, and it is already published. There is no national version to wait for and no local interpretation to rely on.
Under the Directive regime, a firm read its national transposition. National legislators added, subtracted and delayed, so the same obligation looked different in Dublin and Frankfurt, and implementation could reasonably wait for the local text.
A Regulation removes that step. In the AMLR vs AMLD comparison this is the single biggest operational change, and it cuts both ways. Firms lose the extra months that transposition used to buy. They also lose the argument that a national rule permits something the European text does not.
Where a national requirement inherited from the Directive says something different, the question is now whether the Regulation occupies that ground. That is a legal analysis, and it belongs at the front of an implementation plan rather than the end. Our AMLR 2027 timeline sets out where it fits in the sequence.
This is where the AMLR vs AMLD gap surprises people most. Article 11 requires two appointments where most national regimes named one.
A compliance manager must be a member of the management body in its management function, responsible for ensuring compliance with the Regulation, with Regulation (EU) 2023/1113 and with any administrative act issued by a supervisor. That person also carries an express duty to ensure sufficient human and material resources are allocated.
A compliance officer is appointed by the management body, must have sufficiently high hierarchical standing, runs the programme day to day including targeted financial sanctions, is the contact point for competent authorities, and reports suspicions to the Financial Intelligence Unit under Article 69(6).
Notably, the term “money laundering reporting officer” appears nowhere in the Regulation. Firms that have organised around a single MLRO need to work out which of that role’s duties belong to which of the two — a mapping exercise covered in our guide to the AML compliance officer under AMLR.
The structure is familiar and the detail is not. Article 20 lists the measures, Article 33 governs simplified due diligence and Article 34 governs enhanced due diligence. Three changes are worth isolating in an AMLR vs AMLD review.
| Area | Directive-era practice | Under AMLR |
|---|---|---|
| Update intervals | Risk-based, no fixed ceiling in the text | Article 26(2): maximum 1 year for higher-risk customers, 5 years for all others — and the interval must still vary with risk below the ceiling |
| Simplified due diligence | Often read as a reduced document set | Article 33 lists exactly five permitted simplifications, and verification postponed under 33(1)(a) has a hard 60-day limit |
| Sanctions checks | Name screening | Article 20(1)(d) adds a control test and a more-than-50% proprietary-rights test for legal entities, assessed individually or collectively |
| Occasional transactions | Single threshold | EUR 10 000 generally, plus a separate EUR 1 000 trigger for transfers of funds at credit and financial institutions other than crypto-asset service providers |
The aggregation point in the sanctions row is the one automated screening tends to miss. Two designated persons holding thirty per cent each are inside the test; neither is individually. The wider question of when enhanced measures start is covered in CDD vs EDD.
Almost every legacy AML procedure covers how long records are kept. Very few cover destroying them, and that is the sharpest AMLR vs AMLD difference in the record-keeping chapter.
Article 77(3) requires records to be retained for five years and then states plainly that obliged entities “shall delete personal data upon expiry of the five-year period”, without prejudice to other Union or national retention obligations. Deletion is a duty, not an option, and late deletion is a breach in the same way early deletion is.
The clock also has three possible start points: termination of the business relationship, the carrying out of the occasional transaction, or a refusal to enter into one. That third start point creates a five-year retention obligation on a file with no customer record behind it, which is exactly the case most systems cannot produce on demand.
The twenty-five per cent threshold is familiar, and reading it as unchanged is a mistake. The AMLR vs AMLD difference here is that the Regulation specifies the arithmetic and the second test that sits beside it.
Article 52(1) defines an ownership interest as direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest — expressly including rights to a share of profits, other internal resources or the liquidation balance. That last clause reaches instruments carrying economic rights without votes, which a share register alone will not show.
It then prescribes the calculation. Indirect ownership is worked out by multiplying the holdings along each chain and adding together the results from the various chains. A person holding fifteen per cent through one chain and twelve per cent through another holds twenty-seven per cent and is a beneficial owner, though neither chain reaches the threshold alone. The addition step is the one most legacy procedures omit.
Alongside it, Article 53(2)(c) sets a separate control test at fifty per cent plus one of the shares or voting rights, and Article 51 requires control via other means to be identified independently of and in parallel to ownership. That is not a waterfall: finding a shareholder does not end the search. The detail is in our guide to the beneficial owner 25 percent threshold.
Not everything moved, and a gap analysis that treats the whole regime as new wastes effort. The risk-based approach survives. Politically exposed persons still require senior management approval, source of wealth and source of funds, and enhanced ongoing monitoring. The tipping-off prohibition survives in Article 73 in recognisable form. Reliance on third parties survives in Articles 48 and 49, though it is narrower than it looks — it covers only Article 20(1) points (a), (b) and (c).
What has changed around those is the precision. Where the Directive left a matter to national discretion, the Regulation often now states a figure, an interval or a list.
Annex VI of the Regulation is a correlation table mapping Directive (EU) 2015/849 to Directive (EU) 2024/1640 and to the Regulation itself. It is the right starting point for an AMLR vs AMLD gap analysis because it tells you where each old provision went — including the provisions that went nowhere.
One caution when scanning it: the table lists entries headed “Annex I” through “Annex IV” that belong to the repealed Directive, not to the Regulation. The Regulation has six annexes of its own. Reading the correlation table as though it enumerates the Regulation’s annexes is an easy and consequential mistake.
Firms carrying parallel EU obligations will find the same sequencing problem in DORA requirements, and the full Regulation text is on EUR-Lex.
No. In the AMLR vs AMLD package, the Regulation carries the obligations on obliged entities and Directive (EU) 2024/1640 carries the Member State mechanisms. People often use “6AMLD” loosely to mean the whole package, which is why checking which instrument a requirement sits in matters.
Not entirely. Member States retain competence in defined areas — Article 80(2) lets them set cash limits below the Regulation’s EUR 10 000, and pre-existing lower limits continue to apply. The Directive-derived machinery also remains national. What changes is that the core obligations no longer depend on transposition.
More of the structure than the content. The risk-based approach, the policy set and the governance shape are recognisable. The detail — intervals, thresholds, the two named roles, the deletion duty, the beneficial ownership calculation — needs rewriting against the Regulation rather than editing.
With Article 3, to establish which category of obliged entity you are and therefore which date and which obligations apply. Then Annex VI to map existing controls, then the business-wide risk assessment under Article 10, which everything else has to be proportionate to.
An AMLR vs AMLD gap analysis usually produces a longer list than expected, and most of it is documentation. Our EU AMLR Toolkit is 99 editable templates arranged on the Regulation’s own chapter structure, with an article-by-article compliance register that opens with all eighty operative articles already listed, so the gap analysis has somewhere to land.
September 7, 2026
September 7, 2026
September 7, 2026
September 7, 2026
September 7, 2026