AML compliance in 2027: 12 changes and your first 90 days

On 1 October 2026, AMLA sent the European Commission its final draft standards. They cover customer due diligence, lower thresholds for occasional and linked transactions, and group wide minimum requirements. AMLA is the European Union's anti money laundering authority. Once adopted, the standards are proposed to apply six months after they enter into force. So 10 July 2027, the day the EU's single AML rulebook starts, arrives with part of its detail still landing.

AML compliance comes down to meeting the laws that bind your firm, and in 2027 those laws arrive in three states. Some dates are fixed in the text. Some are deadlines an authority owes. The rest are still proposals, and a plan built on them has to say so.

Which AML changes take effect in 2027?

Table 1. AML changes dated in 2027, as of 9 November 2026

Nine rows are fixed in law. The date sits in the text, and only an amendment moves it. Rows 3 and 10 are deadlines AMLA owes, so firms feel them through what AMLA publishes, not on the day itself.

Row 1 is mixed. The GENIUS Act's own date is set. But the FinCEN and OFAC rules that would give stablecoin issuers AML and sanctions programs were still proposals on 9 November 2026.

Six rows land on 10 July in the EU, and AMLA's guidelines are due by then. For an EU firm, that's the date the year is planned around.

What moved in AML during 2026?

• 28 January: OFSI closed its Consolidated List. Since then every UK designation comes from the UK Sanctions List alone (gov.uk).
• 1 July: MiCA's longest transition for crypto firms active before 30 December 2024 ended (Article 143(3)).
• 10 July: member states owed AMLD6's register articles (11, 12, 13 and 15) in national law.
• 14 August: FinCEN's final beneficial ownership rule kept US person owners out of reporting.
• 1 October: AMLA's final draft standards went to the Commission.
• 6 October: FinCEN withdrew its 2020 proposal on unhosted wallet transactions and said it would take no further action on it (notice).
• 23 October: the OCC published its GENIUS Act rule for stablecoin issuers, effective 18 January 2027.
• 9 November: FinCEN and the Federal Reserve withdrew the 2020 proposal to lower the $3,000 funds transfer threshold.

What does the EU AML Regulation change on 10 July 2027?

Article 90 of Regulation (EU) 2024/1624, the AML Regulation (AMLR), takes one line: "It shall apply from 10 July 2027". Football agents and professional clubs wait until 10 July 2029. A regulation needs no national law to carry it, so from that date your policy's rules come from the AMLR. They no longer come from a national version of Directive 2015/849, the fourth anti money laundering directive.

Which thresholds and duties become one rulebook?

National numbers become one set. Customer due diligence (CDD) starts at an occasional transaction of EUR 10,000 (Article 19(1)(b)). Lower values apply to transfers of funds and crypto asset service providers (EUR 1,000), gambling (EUR 2,000) and identification on cash (EUR 3,000) (Article 19(2) to (5)). AMLA's standards can set a lower value. Beneficial ownership starts at 25 percent of the shares, voting rights or other ownership interest (Article 52(1)).

A firm owes the financial intelligence unit (FIU) a reply within 5 working days. In urgent cases the FIU can cut that to under 24 hours (Article 69(1)). Article 11 asks for two roles. A compliance manager sits on the management body. A compliance officer runs the daily AML work.

How often must customer data be updated under the AMLR?

At least once a year for a higher risk customer, meaning one under enhanced due diligence (EDD). At least every five years for everyone else (Article 26(2)). Those are ceilings. The period must follow the risk, and Article 26(3) forces an earlier review when a customer's relevant circumstances change.

Picture a corporate customer rated standard risk and last reviewed in May 2024 (an illustrative case). Its next update is due by May 2029. A new beneficial owner in September 2027 is a trigger, and the review moves to September. A higher rating then cuts it to a year. Both clocks need the rating, the review date and the triggers on one record. On the complead platform, behavior, exposure and screening results trigger a rescore automatically, on event or on schedule, while the periodic review by tier still takes place.

Must a bank rescreen customers on every new sanctions designation?

Yes, for credit and financial institutions. Article 26(4) asks every obliged entity to check regularly whether a customer or any beneficial owner is subject to targeted financial sanctions. That includes a company that designated persons, alone or together, control or own more than 50 percent of (Article 20(1)(d)). For credit and financial institutions, the check "shall also be carried out upon any new designation".

Picture a name listed on a Tuesday. The book is checked against it, and the file shows when. In complead's client screening and ongoing monitoring, each search is logged. The log holds the user, the name searched, the timestamp and the outcome, even when nothing matched.

What happens to anonymous accounts and privacy coins?

Under Article 79(1), banks, other financial institutions and crypto asset service providers (CASPs) may not keep anonymous accounts, passbooks or safe deposit boxes. Nor may they keep any account that hides its holder or obscures transactions, anonymity enhancing coins included. For a provider that lists such coins, that's a product decision for the first half of 2027.

Where does the 10,000 euro cash cap apply?

From 10 July 2027, a business selling goods or services can take or pay up to EUR 10,000 in cash (Article 80). Linked payments count together. Lower national caps stay, and member states may set lower ones after consulting the European Central Bank. The cap doesn't cover payments between private individuals. Nor does it cover payments or deposits at the premises of banks, electronic money issuers and payment service providers. Those above the limit are reported to the FIU.

What do AMLA and the new AML directive bring in 2027?

Two parts of the 2024 package bind authorities and governments before they reach firms. One is AMLA's own deadlines. The other is the directive each member state writes into law.

What will AMLA deliver in 2027?

Most of AMLA's 2027 is deadlines it owes under the AMLR and its founding text, Regulation (EU) 2024/1620 (AMLAR). Early 2027 brings the eligibility data. Firms marked provisionally eligible in 2026 send data to confirm they still met the criteria on 31 December 2026 (AMLA, 4 August 2026). That's the reference date. The data shows who still qualifies for the selection.

AMLA must start the first selection by 1 July 2027 and has six months to finish it (AMLAR Article 13(4)). If more than 40 firms qualify, the first round takes the 40 operating in the most member states (AMLAR Article 106(2)). Supervision begins six months after the list is published. AMLA places that in 2028 (AMLA, 12 May 2026).

By 10 July 2027 the AMLR also wants nine sets of AMLA guidelines. They cover outsourcing, geographic risk, close associates of politically exposed persons (PEPs), reliance and indicators of suspicious activity, among others. A policy written in 2026 may need a second pass once they're out.

The final standards sit with the Commission. The customer due diligence standard shows as "Final report published" on AMLA's instrument tracker, whose latest update is dated 7 October 2026. The standards bind firms once the Commission adopts them as a regulation, which applies directly in every member state.

What must member states transpose by 10 July 2027?

The new AML directive, Directive (EU) 2024/1640 (AMLD6), is the part of the package national parliaments write into law. Article 78(1) gives them until 10 July 2027 for most of it. Directive 2015/849, the current directive, is repealed with effect from the same day (Article 77). By then the Commission also hands AMLA the management of FIU.net, the network financial intelligence units use to exchange information (Article 73).

For a firm, the directive changes the supervisor and the registers around it more than its own checks. The AMLD names invite mix ups. AMLD6 is the 2024 directive, while 6AMLD is the 2018 directive on the laundering offense.

What must UK firms do under the AML and CTF amendments in 2027?

Picture a trust set up in Jersey that bought a London flat in 2019 and still owns it (an illustrative case). None of its trustees is resident in the UK. S.I. 2026/621 brings trusts like it into the Trust Registration Service. The rule covers a non UK trust, with or without a UK trustee, that has held UK land since before 6 October 2020. If it still held that land when the amendment came into force, it must register with HMRC on or before 1 September 2027 (regulation 26, amending regulation 45ZA). For a firm with trust customers, a trust of this kind with no registration after that date is a question to ask.

S.I. 2026/621, formally the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, changes the UK's AML and counter terrorist financing (CTF) rules. Most of it has been in force since 30 June 2026, 21 days after it was made. Two parts wait for 2027.

On 1 February 2027, regulation 34A starts. It covers a cryptoasset exchange or custodian wallet provider in a correspondent relationship with a provider from a third country. On top of the standard EDD measures, its duties include understanding the respondent's business and assessing its reputation, supervision and AML and CTF controls. They also include senior management approval and a record of who does what. It must not enter or keep a correspondent relationship with a shell bank.

On 25 October 2027, S.I. 2026/102, the UK's new cryptoasset regulations, reaches full commencement. From then the FCA's register under the Money Laundering Regulations covers fewer firms: only exchange and custodian wallet providers that are not authorized or specified investment cryptoasset firms. An authorized firm that starts acting as one tells the FCA under new regulation 56B (regulation 48). Schedule 6B, on changes in control of registered cryptoasset businesses, takes full effect the same day.

What changes in the US in 2027?

Section 20 of the GENIUS Act sets its own start. It's the earlier of two dates: 18 months after enactment, or 120 days after the primary federal payment stablecoin regulators issue final rules. The Act was approved on 18 July 2025. So the 18 month date, 18 January 2027, comes first. The Office of the Comptroller of the Currency (OCC) put out its final rule for the issuers it oversees on 23 October 2026. That rule is also effective on 18 January 2027.

The AML side isn't final. On 10 April 2026, FinCEN and OFAC proposed rules for permitted payment stablecoin issuers (proposed rule). Issuers would count as financial institutions under the Bank Secrecy Act, with AML programs and sanctions compliance programs.

A customer identification program proposal followed on 22 June. By 9 November 2026, no FinCEN or OFAC final rule for these issuers had appeared in the Federal Register.

Two other US changes will not land in 2027. FinCEN delayed the investment adviser AML rule by two years, from 1 January 2026 to 1 January 2028 (rule of 2 January 2026). And on 9 November 2026, FinCEN and the Federal Reserve withdrew a 2020 proposal on funds transfer records. It would have cut the threshold for cross border transfers from $3,000 to $250. So $3,000 stays (withdrawal notice).

The US side of 2027 adds one new kind of regulated firm to AML in the US, the payment stablecoin issuer. So far it adds no new program rule for banks.

Which 2027 dates still depend on draft rules?

In the EU, AMLA's final standards have sat with the Commission since 1 October 2026. They are proposed to apply six months after entry into force, so the adoption date sets the start. AMLAR Articles 27(7) and 77 also ask the Commission for delegated acts on AMLA's penalty procedure and fees by 1 January 2027. This edition doesn't confirm their adoption.

In the US, FinCEN's program rule proposal of 10 April 2026 would take effect 12 months after a final rule (proposed rule). A matching Federal Reserve proposal for its banks followed on 9 July.

Both turn on whether a program works. FinCEN also proposed a whistleblower program on 1 April 2026, and comments closed on 1 June 2026.

Two MiCA dates sit outside AML law and are already fixed. The Commission reports on MiCA by 30 June 2027 (Article 140). By 31 December 2027, trading platforms must have white papers for tokens admitted to trading before 30 December 2024 (Article 143(2)(b)).

What should a compliance team do in the first 90 days of 2027?

Table 2. First 90 days of 2027 for an EU payment institution (illustrative)

Picture a payment institution licensed in Lithuania with 30,000 business customers in four member states (an illustrative firm). Its first quarter of 2027 runs in four blocks, and each ends in a record a supervisor or auditor can read.

Weeks 3 to 6 take the most effort. Every customer under EDD moves onto the one year ceiling. So the firm's definition of high risk customers decides the size of that group. The FIU test in weeks 7 to 10 is short: one mock request, one dated answer.

How does a platform carry the new checks?

The 2027 rules ask software for two things: checks that run when the trigger happens, and a record of each one. No tool makes a firm compliant.

For screening, complead keeps 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Among them are the OFAC, EU, UN, UK, DFAT and SECO lists, with 200+ national regimes beside them. Through the API, a firm starts or stops ongoing monitoring per name, so a customer who leaves drops out of screening.

When the policy changes, the rules change too. A changed rule can be backtested on 30, 60 or 90 days of real history before it ships, and every version rolls back in one click. Agents close the routine cases, and every case they close holds a narrative, the evidence and the work log. A reviewer decides, and the case record names who. When a supervisor asks, the regulatory compliance workflow provides an evidence pack per entity or per period. It lists the decisions and the approvers.

The first supervisor visit after 10 July 2027 will ask for proof. Proof means the review dates, the rescreening log for a new designation and the dated reply to the FIU.