AMLR 2027: The Complete Timeline to 10 July 2027

AMLR applies from 10 July 2027, and that date is not a filing deadline. It is the day from which every obliged entity in the European Union must already be operating a compliant anti-money-laundering programme. Regulation (EU) 2024/1624 was adopted on 31 May 2024 and published in the Official Journal on 19 June 2024, which means the runway has been visible for three years and is now shorter than most implementation plans assume.

This is an AMLR timeline, not a summary. It sets out which dates bind whom, what the Authority for Anti-Money Laundering and Countering the Financing of Terrorism does in the meantime, and what has to be finished before the application date rather than on it.

What this guide covers

• What AMLR is, and why a Regulation changes the timing
• The AMLR application dates in full
• Who the 2029 date actually covers
• What the Authority does in 2027 and 2028
• What AMLR requires you to have finished before the date
• The AMLR Level 2 problem, and how to plan around it
• Working backwards from the AMLR date
• Frequently asked questions
• Getting the documentation in place

What AMLR is, and why a Regulation changes the timing

The EU anti-money-laundering package replaces a Directive with a Regulation. That single change drives most of the timeline pressure. A Directive has to be transposed into national law, so firms historically waited for their own legislator and then read the national text. A Regulation applies directly in all 27 Member States on its application date.

AMLR needs no transposition and no national implementing act to be read first. On 10 July 2027 the text that binds a firm in Dublin, Frankfurt and Valletta is the same text, and it is already published. The consequence for planning is uncomfortable: there is no legitimate reason to be waiting, and no national deadline that will arrive later than the European one.

The package also includes Directive (EU) 2024/1640, which does still require transposition, and Regulation (EU) 2024/1620, which created the new supervisory Authority. Those set the machinery around the obligations. The obligations themselves are in the Regulation.

The AMLR application dates in full

Article 90 is short and it is the whole answer. The Regulation entered into force on the twentieth day following publication, and applies from 10 July 2027 with exactly one carve-out.

Two rows deserve attention because they are routinely misread. The 10 July 2026 row is a deadline on the Authority, not on firms, and missing it did not move the 2027 date. The 2029 row is narrower than it looks.

Who the 2029 date actually covers

Article 90 defers the application of AMLR only for the obliged entities referred to in Article 3, points (3)(n) and (o). Point (n) is football agents. Point (o) is professional football clubs, and only in respect of four kinds of transaction: with an investor, with a sponsor, with football agents or other intermediaries, and for the purpose of a player’s transfer.

Nothing else moves to 2029. A club’s ticketing, merchandising and catering are not brought into scope by point (o) at all, and a firm that falls into both a general Article 3 category and one of these two works to the earlier date for its general activity. Any plan that treats 2029 as a general extension is planning against the wrong date.

What the Authority does in 2027 and 2028

AMLR supervision does not switch to Brussels on the application date. The Authority runs a selection process first, and only a small population is directly supervised at the end of it.

Article 12 of Regulation (EU) 2024/1620 limits periodic assessment to credit institutions and financial institutions, and groups of them, operating in at least six Member States including the home Member State — whether through establishments, under the freedom to provide services, or remotely with no local infrastructure at all. Those whose residual risk profile the Authority classifies as high qualify as selected obliged entities.

Article 13(4) then sets the clock: the first selection process commences by 1 July 2027, concludes within six months, and direct supervision begins six months after the list is published. On the statutory maxima that places the start of direct supervision around the middle of 2028 — after AMLR itself has begun to apply. A transitional provision caps the first selection at forty entities. Everyone else stays with their national supervisor, and the detail of who gets picked is in our guide to AMLA direct supervision.

What AMLR requires you to have finished before the date

Because the AMLR application date is an operating date rather than a submission date, the work has to land earlier. Six things in particular cannot be done in the final weeks.

• The business-wide risk assessment. Article 10 makes it the input to nearly everything else, so a customer due diligence policy written before it has nothing to be proportionate to.
• Approval at two different levels. Article 9(2) requires internal policies to be approved by the management body in its management function, and procedures and controls at least by the compliance manager. Board calendars are fixed points.
• Two appointments. Article 11 requires a compliance manager who sits on the management body and a compliance officer who runs the programme day to day.
• Identification data for existing customers. Article 22 asks for fields many legacy onboarding forms never collected, including the names and nominee status of nominee shareholders and directors.
• Retention and deletion. Article 77 requires records to be kept five years and then deleted. Where a firm has built retention but never built deletion, that capability has to be created from scratch.
• Training. Article 12 requires documented, ongoing programmes for employees and, expressly, for agents and distributors — and training can only follow final documents.

The AMLR Level 2 problem, and how to plan around it

AMLR mandates roughly two dozen regulatory technical standards, implementing technical standards and guidelines. Most carried a statutory deadline of 10 July 2026. As at the time of writing many were still in draft or in consultation, including the standards on the information necessary for customer due diligence and the guidelines on ongoing monitoring.

The application date does not move because Level 2 is late. That leaves three possible strategies and only one of them works. Waiting means being late. Guessing at draft content means unpicking the guess. The workable position is to implement the Level 1 text in full, record the interim position taken wherever detail is pending, and treat each outstanding measure as a scoped change rather than an unknown. The Authority publishes its regulatory instruments and open consultations on its own website, which is the only status source worth quoting.

Working backwards from the AMLR date

The AMLR dependencies run in one direction, and ignoring that order is the commonest reason an implementation stalls in its final quarter.

Each phase has a guide of its own: what changed from the Directive regime in AMLR vs AMLD, the two appointments in AML compliance officer under AMLR, the due diligence split in CDD vs EDD, the ownership arithmetic in beneficial owner 25 percent, the reporting route in suspicious transaction report deadline, and how to size the whole programme in AML compliance cost.

Firms already carrying EU financial-sector obligations will recognise the shape of this. It is the same sequencing problem that DORA requirements created, and the same one that catches entities working out who NIS2 applies to. Crypto-asset service providers authorised under the markets regime should read it alongside the MiCA regulation timeline, because AMLR brings them in as obliged entities in their own right.

Frequently asked questions

Does AMLR replace the money laundering directives entirely?

It replaces the operative obligations on obliged entities. Directive (EU) 2024/1640 continues to govern the mechanisms Member States put in place — registers, Financial Intelligence Units and supervision — and still requires transposition. Article 89 of the Regulation governs its relationship with the previous Directive.

Is there any transitional relief after 10 July 2027?

Not for the obligations themselves. There is one narrow transitional rule in Article 77(4): where legal proceedings concerning suspected money laundering are pending in a Member State on 10 July 2027 and a firm holds relevant material, it may retain that material for five years from that date. Identify what that covers before the date, because afterwards you cannot establish what was pending.

Do we have to wait for the technical standards before we start?

No, and waiting is the one strategy guaranteed to fail. The Level 1 text is final and the application date does not move. Build against the Regulation, record where you have taken an interim position, and revisit those areas as measures are adopted.

Will the Authority supervise our firm directly from 2027?

Almost certainly not. Direct supervision reaches a capped population of large cross-border credit and financial institutions, selected from 2027 with supervision beginning around mid-2028. Every other obliged entity continues to be supervised nationally.

Getting the documentation in place

The gap between reading Article 90 and operating a compliant programme is roughly a hundred documents: the risk assessment, the two sets of terms of reference, the customer due diligence suite, beneficial ownership, reporting, retention and deletion, and the registers that evidence all of it. Our EU AMLR Toolkit is 99 editable templates organised on the Regulation’s own chapter structure, built on the Level 1 text with the Level 2 position stated honestly wherever detail is still pending. The full text of the Regulation is on EUR-Lex if you want to read Article 90 for yourself.