Anti-Money Laundering AML

Money laundering is conduct that EU criminal law already defines, so the anti-money laundering rules point to that definition and do not write their own. Article 2(1) of the Anti-Money Laundering Regulation (AMLR) defines it as the conduct set out in Article 3(1) and (5) of Directive (EU) 2018/1673 on combating money laundering by criminal law.

Recital 5 gives the reason. Union criminal law has already produced a common understanding of the crime of money laundering and of the offences that generate the property, so the anti-money laundering rules no longer need to define them. The regulation takes two more definitions from the same directive, "criminal activity" and "property" (Article 2(1)(3) and (4)). To the criminal activities covered it adds fraud affecting the Union's financial interests, corruption and misappropriation, as defined in Directive (EU) 2017/1371.

The AMLR definition adds three points. Aiding and abetting, inciting and attempting all count. It makes no difference whether the crime that produced the property took place in a member state or in a third country. Knowledge, intent or purpose may be inferred from objective factual circumstances.

The rules pair money laundering with terrorist financing, which the AMLR defines by reference to Directive (EU) 2017/541. This is why official texts write AML/CFT: anti-money laundering and countering the financing of terrorism. Firms must also manage a related risk, that targeted financial sanctions are not implemented or are evaded (Article 9(1)).

They are a regulation for businesses, a directive for member states and a regulation that creates an EU authority. The table shows what each one covers, whom it addresses and when it starts to apply.

The split follows a simple logic. Rules that a firm can apply directly sit in the regulation, so a firm in any member state reads the same text. Rules about how each state organises its own authorities sit in the directive (Article 1), because those structures differ from country to country.

The package replaces Directive (EU) 2015/849, which is repealed with effect from 10 July 2027 (Article 77 of the new directive). Until that date, the national laws that implement the older directive continue to set the duties of firms.

The work is divided between firms, national authorities and EU bodies. Firms come first. The businesses and professions listed in Article 3 of the AMLR, called obliged entities, assess their own risks, check their customers, report suspicions and keep records.

Each member state must establish a financial intelligence unit (FIU). It is the single central national unit that receives and analyses the reports obliged entities submit (Article 19 of the directive). Each member state must also appoint one or more supervisors to monitor obliged entities and take the measures needed to make them comply (Article 37(1)). For auditors, accountants, tax advisors, notaries and lawyers, a member state may give that function to a self-regulatory body, meaning a body that represents the profession and has a role in regulating it (Article 37(3)).

Risk is assessed at two levels above the firm. The Commission assesses the risks that affect the internal market (Article 7). Each member state carries out a national risk assessment and reviews it at least every four years (Article 8).

AMLA sits above the national authorities. It will supervise some firms itself. Credit institutions and financial institutions that operate in at least six member states and whose residual risk profile is classified as high qualify for selection, and the number selected can be limited (Articles 12 and 13 of Regulation (EU) 2024/1620). The first selection must start by 1 July 2027, and direct supervision begins six months after the list of selected firms is published (Article 13(4)). For the non-financial sector it does not supervise firms directly. It coordinates peer reviews of the national supervisors and can investigate possible breaches of EU law by them (Article 5(4)). It also supports the FIUs, for example by organising joint analyses of cross-border cases (Article 5(5)).

They follow international standards, above all the Recommendations of the Financial Action Task Force (FATF). The recitals to the AMLR say that EU measures should be compatible with action taken at international level and at least as stringent. They say EU law should be aligned, where appropriate, with the standards the FATF adopted in February 2012 and their later amendments.

The FATF also appears in the operative rules. A firm's own risk assessment must take account of relevant information published by international standard setters (Article 10(1)). The list of higher risk factors in Annex III to the AMLR includes third countries that the FATF has placed under increased monitoring.

Inside the EU, the rules are not new. The recitals record that they have existed and evolved over three decades. The 2024 package changed their form more than their purpose. The recitals name the main problem with the older directive as a lack of direct applicability and a fragmented approach along national lines.