AMLA Just Dropped Three New AML Standards — Here's What Changes

Alejandro Martínez · 2026-10-15

On October 1, 2026, the Anti-Money Laundering Authority (AMLA) quietly finalized three regulatory technical standards under the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624). If you work in payments, compliance, or fintech, this isn't just another regulatory footnote. It's the kind of shift that can ripple through how you onboard customers, structure relationships, and manage risk across borders. Let's break down what actually happened and why it matters. ### What the Three Standards Cover The standards tackle three core areas: - **Customer due diligence (CDD):** How firms verify who they're doing business with, and how deep that verification needs to go. - **Business relationship vs. occasional transaction:** A distinction that sounds academic until you realize it determines which compliance obligations kick in. - **Group-wide arrangements:** How AML rules apply across parent companies, subsidiaries, and branches operating in different jurisdictions. Here's the part that catches people off guard: these standards apply to both financial and non-financial obliged entities. That means banks, payment providers, crypto firms, real estate agents, lawyers, and accountants are all in the same boat. ### The "Principles-Based" Catch AMLA has been clear that these standards are principles-based and don't add new obligations beyond what's already in the AMLR itself. Sounds reassuring, right? Not so fast. > "Principles-based" shifts the burden of justification onto each firm. Supervisory expectations, not a tick-box rule, become the real test. That quote captures the tension perfectly. When rules are prescriptive, you can point to a checklist and say, "We did X, Y, and Z." When they're principles-based, you have to demonstrate that your approach actually manages risk — and that's a much harder conversation to have with a regulator. In practice, this means compliance teams need to think more like risk managers and less like form-fillers. You'll need to document not just what you did, but why you did it and how it addresses the specific risks your business faces. ### Why This Matters for U.S. Professionals Watching Europe If you're based in the United States but work with European counterparties, subsidiaries, or clients, these standards will eventually touch your workflows. European AML rules have a long history of influencing global compliance norms, and AMLA's approach here is no exception. A few practical implications: - **Enhanced documentation:** Expect to justify your CDD approach in more detail, especially for higher-risk customers. - **Clearer relationship definitions:** The business relationship vs. occasional transaction distinction will force firms to revisit how they classify and monitor different types of clients. - **Group-wide consistency:** Multinationals will need to align AML policies across entities, which sounds simple until you're dealing with conflicting local requirements. ### What to Do Next First, don't panic. The standards are finalized, but implementation timelines give firms room to adapt. Second, start reviewing your current CDD processes against the new expectations. Third, talk to your legal and compliance teams about what "principles-based" means for your specific risk profile. The bottom line? AMLA isn't handing out gold stars for checking boxes. It's asking firms to prove they understand their own risk — and that's a higher bar than most are used to. For payment professionals and compliance officers on both sides of the Atlantic, this is one to watch closely. The rules may be European, but the ripple effects won't stop at the border.