AMLA finalises private-sector AML standards pending adoption

AMLA has finalised three RTS that specify private-sector AML/CFT controls. The final draft standards have now been submitted to the European Commission, leaving the package pending adoption and publication before its proposed application timetable can run.

The standards are not binding law at this stage. AMLA's 1 October 2026 release says they cover business relationships and occasional transactions, customer due diligence, and group-wide arrangements. It proposes that they apply six months after entry into force, with a separate application date of 10 July 2029 for football agents and professional football clubs.

Three standards divide the control work

The first RTS addresses how companies and professionals distinguish business relationships from occasional transactions and identify linked transactions. The stated purpose is to support consistent application of customer due diligence thresholds where transactions are connected.

For obliged entities, the preparation question is whether existing onboarding and transaction-review processes can identify those categories and links consistently. The release does not prescribe a technical solution or a reporting format, so any gap analysis should be tested against the final adopted text.

The customer due diligence RTS covers information that companies and professionals must collect and verify. It includes proportionate measures for lower-risk situations, non-face-to-face verification, electronic identification, and screening of politically exposed persons, their family members and close associates.

Those topics provide a defined basis for preparatory review. Firms can examine how information is obtained and verified, how lower-risk treatment is calibrated, and how remote or electronic identification operates. These are preparation questions, not source-mandated evidence artefacts under a standard that has not yet entered into force.

The third RTS concerns group-wide AML/CFT arrangements. It covers minimum requirements for governance, risk management, internal controls and secure information sharing across a group.

Groups can use the draft scope to test whether central policies are implemented consistently across entities and jurisdictions. The release does not allocate responsibilities between parent and subsidiary or specify how information-sharing controls must be documented.

Adoption remains the procedural milestone

AMLA said the standards were developed with national supervisors and informed by written consultations and hearings. It described them as a framework intended to give obliged entities and supervisors clearer expectations while retaining a proportionate, risk-based approach.

The Commission must adopt and the Official Journal of the EU must publish the RTS before the application timetable starts. AMLA's release proposes application six months after entry into force. It identifies 10 July 2029 for football agents and professional football clubs, but gives no dates for Commission adoption or Official Journal publication.

The release therefore supports preparation against the three subject areas, not a claim that the new specifications already apply. The next official signals are Commission adoption and subsequent Official Journal publication; no dates for either are identified. Firms should continue treating the text as a preparatory reference until those procedural steps are complete, while avoiding assumptions about obligations, evidence standards or implementation deadlines that the release does not state.