AMLR explained: what changes for Nordic banks' financial crime workflows in practice in 2027
Stockholm, Sweden – The Anti-Money Laundering Regulation (AMLR), Regulation (EU) 2024/1624, is the EU's first directly applicable anti-money laundering rulebook. It applies identically in every Member State from 10 July 2027, replacing the national variations that grew up under successive AML directives. It sits alongside a new directive, AMLD6, and a new EU-level supervisor, AMLA.
Since 1991, AML obligations were set through directives, each transposed into national law and interpreted twenty-seven different ways. The result was a workable but fragmented system: different customer due diligence standards, different definitions of a politically exposed person, and different thresholds from one Member State to the next.
For Nordic banks, the significance is twofold. The rulebook standardises how customer due diligence, beneficial ownership, PEP screening and reporting must be performed. In parallel, AMLA introduces a European supervisory layer that will directly supervise a small group of the largest, highest-risk cross-border institutions from 2028, and several of the largest Nordic groups operate across enough markets to fall within the criteria. The practical work sits in 2026 and 2027, not on the application date itself.
Key facts at a glance
The AMLR applies from 10 July 2027, directly and identically in all EU Member States, with no national transposition.
The legal basis is Regulation (EU) 2024/1624.
The beneficial ownership threshold becomes 25% or more, down from more than 25%, and the Commission may lower it to 15% for high-risk sectors.
The due diligence threshold for occasional transactions falls to EUR 10,000, down from EUR 15,000.
An EU-wide limit of EUR 10,000 applies to cash payments in commercial transactions.
Obliged entities must respond to financial intelligence unit requests within five working days.
AMLA begins direct supervision of up to 40 high-risk cross-border groups from 1 January 2028.
The AMLR sits alongside AMLD6, which sets the national framework, and the AMLA Regulation, which creates the EU supervisor.
Why is AMLR different from previous AML directives?
The change is the legal form. A directive sets an objective and leaves each Member State to legislate the detail; a regulation is the detail. From 10 July 2027, obliged entities across the EU follow one set of rules for the same activities, and the era of divergent national interpretation largely ends.
For institutions operating in a single market, this is a re-papering exercise: existing controls are mapped to the harmonised standard and gaps closed. For cross-border groups, the profile of most large Nordic banks, it removes the need to reconcile several national rulebooks, but also removes the local discretion those rulebooks allowed. A group that ran market-by-market variations of a CDD process will need one process that meets the common standard everywhere.
Much of the operational specificity is not in the AMLR text itself but in the regulatory and implementing technical standards AMLA is drafting through 2026. The effective preparation deadline is therefore earlier than July 2027: the detail that determines system and process design is landing before the rules apply.
AMLR vs AMLD6 vs AMLA: what is the difference?
The three instruments do different things. The AMLR sets the obligations for firms; AMLD6 sets the national institutional framework; the AMLA Regulation creates the EU-level supervisor. Only the AMLR applies directly, while AMLD6 must be transposed into national law.
The AMLR, Regulation (EU) 2024/1624, is a regulation. It governs the obligations of obliged entities, including customer due diligence, beneficial ownership, cash limits and reporting. Because it is directly applicable, it requires no national transposition and applies from 10 July 2027.
AMLD6, Directive (EU) 2024/1640, is a directive. It governs the national framework: competent authorities, financial intelligence units and beneficial ownership registers. Member States must transpose it into national law by 10 July 2027.
The AMLA Regulation, Regulation (EU) 2024/1620, establishes the EU-level supervisor based in Frankfurt. AMLA sets technical standards for all obliged entities and will directly supervise a selected group. It has been operational since 1 July 2025, with direct supervision beginning on 1 January 2028.
What changes in customer onboarding and CDD?
Customer due diligence is standardised and tightened. Identity data must be verifiable against independent, reliable sources rather than accepted as self-reported. Standard, simplified and enhanced due diligence each gain defined entry conditions, and the threshold triggering due diligence for occasional transactions falls from EUR 15,000 to EUR 10,000.
Credit institutions also carry specific obligations to verify identities linked to virtual IBANs they issue, relevant for the embedded-finance and platform arrangements common in the Nordic market.
In practice, this means reviewing every onboarding and periodic-review workflow against the harmonised categories, and being able to show not only what checks were done but why a given diligence level was chosen.
What is the new beneficial ownership threshold under AMLR?
The beneficial ownership threshold becomes 25% or more, replacing the previous more than 25%. This brings holders at exactly 25% into scope and, across a portfolio, widens the population of individuals a bank must identify and verify. For corporate entities deemed high-risk, the European Commission may lower the threshold to 15%.
The regulation also clarifies how ownership is calculated through multi-tier structures, closing the ambiguity where Member States applied different pass-through principles. Where no natural person meets the threshold, the senior managing official is treated as the beneficial owner of last resort. Trusts and similar arrangements face materially stronger transparency requirements, with settlor, trustees, protector and beneficiaries all to be identified.
For Nordic banks with significant corporate and cross-border books, the practical task is a remediation review: re-running beneficial ownership identification against the revised threshold and calculation logic, and capturing owners the previous test excluded.
How does AMLR change PEP screening?
The AMLR replaces divergent national PEP catalogues with a single harmonised definition. Enhanced measures apply for at least twelve months after a person leaves a prominent public function, and extend to family members and known close associates. National expansions fall away unless a Member State expressly maintains them in a published list.
The operational effect is a reconfiguration of PEP screening logic against the unified definition, neither simply importing old national lists nor assuming the previous local scope still holds.
When is enhanced due diligence required under AMLR?
Enhanced due diligence moves from discretion to a defined catalogue of mandatory trigger cases, each with entry conditions: high-risk third countries, certain correspondent relationships and specified higher-risk scenarios. Under the previous framework, a purely risk-based approach let institutions decide when enhanced due diligence applied; the AMLR prescribes it.
The regulation also introduces wealth-linked triggers: enhanced measures for business relationships involving substantial assets, and specific treatment of high-net-worth individuals, with AMLA guidance due on how to assess the relevant thresholds.
For compliance teams, this means checking every enhanced due diligence pathway against the trigger catalogue, with the basis for each decision documented and applied consistently.
What is the AMLR deadline for responding to FIU requests?
Obliged entities must respond to financial intelligence unit (FIU) information requests within five working days. This is a hard legal requirement, not a guideline. Suspicious transaction reporting is also harmonised, including the formats used.
Meeting the deadline consistently depends on internal escalation paths and data access being built for that response time, a systems and process question as much as a compliance one.
Does AMLR require explainable AML models?
For entities under its direct supervision, AMLA can require records of algorithmic decision-making: the logic behind automated risk-scoring, screening and monitoring. In effect, models must be documented and explainable, not merely effective. Model documentation, versioning and audit trails become supervisory artefacts, not internal engineering notes.
Nordic banks have invested heavily in automated transaction monitoring and screening, often built and tuned over years. The AMLR raises the governance bar around those systems: an institution needs to show how a model reaches a decision, what factors it weighs, and why its output is defensible.
Who will AMLA directly supervise?
From 1 January 2028, AMLA will directly supervise a group of selected obliged entities, capped at 40 at any one time, chosen from financial and credit institutions active in at least six Member States and assessed as carrying high residual money laundering and terrorist financing risk. The selection process runs during 2027, using a common risk methodology, with the list reviewed every three years.
For selected entities, AMLA exercises supervisory and investigatory powers in place of the national authority: information requests, on-site inspections, and the algorithmic-records powers noted above. It can fine an entity under its direct supervision up to EUR 2 million or 1% of annual turnover, whichever is higher. Institutions outside the selected list remain under national supervision, but AMLA still shapes their obligations through the binding technical standards it sets.
The Nordic relevance is direct. The region has been at the centre of Europe's most significant AML enforcement cases, and several of the largest Nordic groups operate across enough markets to meet the objective cross-border criterion. The list is not yet published and selection has not occurred, so no outcome should be assumed, but the largest cross-border Nordic banks have clear reason to prepare as if EU-level supervision may apply to them.
Timeline: what happens next?
The AML package was adopted in May 2024, published in the Official Journal on 19 June 2024, and entered into force on 9 July 2024. AMLA has been operational in Frankfurt since 1 July 2025. Through 2026, AMLA is consulting on and publishing the technical standards and risk methodology that define compliance in detail, and testing the selection process with national supervisors.
The AMLR applies from 10 July 2027, and Member States must transpose AMLD6 by the same date. Selection of entities for AMLA's direct supervision runs during 2027, with direct supervision beginning on 1 January 2028. A narrow set of sectors, notably football clubs and agents, are brought into scope later, from 2029.
What should Nordic banks do now?
The application date is 2027. Four steps are concrete enough to start against the current texts and draft standards.
First, run a gap assessment: map existing CDD, EDD, PEP and beneficial ownership processes to the harmonised standard, market by market, and identify where national variations need to converge. Second, plan beneficial ownership remediation for the 25%-or-more threshold and the revised multi-tier logic, since this affects the existing book, not only new customers. Third, treat model governance as a deliverable: document monitoring and screening logic to a standard that would satisfy an external supervisor's request for algorithmic records. Fourth, for the largest cross-border groups, prepare on the assumption that AMLA direct supervision is a realistic outcome, and engage with the data-collection and selection process accordingly.
Conclusion
The AMLR does not so much add new obligations as consolidate and harden existing ones, then place them under a common rulebook and, for the largest institutions, a common supervisor. For many Nordic banks, already running mature AML functions built up after a decade of high-profile enforcement, the task is less about raising the bar from a standing start and more about re-documenting, harmonising and making defensible the controls they already run. The institutions that treat starts working now will be the ones for whom the application date is uneventful.
Frequently asked questions
Does AMLR replace AMLD6? No, they work together. The AMLR sets the obligations for firms and applies directly, while AMLD6 sets the national institutional framework and must be transposed into national law by 10 July 2027.
When does AMLR apply? From 10 July 2027, directly in all EU Member States, without national transposition. Football clubs and agents are brought into scope from 2029.
What is the AMLR cash payment limit? An EU-wide limit of EUR 10,000 on cash payments in commercial transactions, whether made in a single operation or across several linked operations.
Who does AMLA supervise directly? Up to 40 high-risk financial groups operating in at least six Member States, from 1 January 2028. All other obliged entities remain under national supervision, though AMLA sets the technical standards they follow.
Does AMLR apply to Nordic banks outside the EU, such as in Norway? The AMLR applies directly in EU Member States, including Sweden, Finland and Denmark. EEA states such as Norway and Iceland generally align with EU AML rules through the EEA framework, though the timing of adoption can differ. Non-EU banks are also caught where they operate EU branches or subsidiaries.
References
Regulation (EU) 2024/1624 (AMLR), on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng
European Commission, EUR-Lex summary: Preventing abuse of the financial system for money laundering and terrorism purposes (from 2027). https://eur-lex.europa.eu/EN/legal-content/summary/preventing-abuse-of-the-financial-system-for-money-laundering-and-terrorism-purposes-from-2027.html
Directive (EU) 2024/1640 (AMLD6), on the mechanisms to be put in place by Member States. Available on EUR-Lex.
Regulation (EU) 2024/1620, establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). Available on EUR-Lex.
AMLA, AMLA takes major step toward harmonised EU supervision, 18 December 2025. https://www.amla.europa.eu/amla-takes-major-step-toward-harmonised-eu-supervision_en
AMLA, Explainer: Towards AMLA's direct supervision. https://www.amla.europa.eu/
Götgatan 22A - 559226-0128