The EU AML Package: Why 2026 Is the Action Year

The EU AML Package has moved from preparation to implementation.

On 1 October 2026, the EU Anti-Money Laundering Authority (AMLA) finalised key standards covering customer due diligence, business relationships and group-wide controls. The AMLR applies across all 27 EU Member States from 10 July 2027, followed by direct AMLA supervision of selected high-risk financial groups from 2028.

For EMIs, PSPs, crypto-asset service providers and investment firms, 2027 may be the regulatory. 

What Firms Need to Do Before July 2027

For firms in Cyprus and across the EU, the practical work is already beginning.

Compliance teams are reviewing onboarding and due diligence processes, recalibrating customer risk models, strengthening sanctions screening, assessing outsourced services and making sure automated and AI-supported decisions remain explainable and auditable.

The firms that move early have an opportunity to go beyond simply meeting another regulatory deadline. Better data, more consistent controls and smarter automation can also reduce manual work and improve the customer experience.

The question is no longer whether the new AML framework is coming. It is whether firms will enter 2027 ready for it.deadline, but 2026 is the action year.

One EU Rulebook Changes the Game

The AMLR replaces differing national approaches with a directly applicable EU rulebook, bringing greater consistency to customer due diligence, identity verification and group-wide controls.

For cross-border firms, this means less room for different interpretations between jurisdictions and greater pressure to ensure systems, customer data and compliance processes work consistently across the group.

The changes will also affect everyday customer journeys, particularly when enhanced due diligence is triggered and how firms classify and review customer relationships.

AMLA Is Changing How Firms Will Be Supervised

From 2028, AMLA will directly supervise up to 40 of the EU’s highest-risk financial institutions and groups.

Selection will consider more than size. Cross-border activity, customer risk and the quality of controls will all play a role.

For groups operating across Europe, decisions being made today around outsourcing, governance, information sharing and group-wide controls could directly influence how they are supervised tomorrow.

Join the Conversation in Limassol

Continue the conversation at the 27th NextGen Payments & RegTech Forum, taking place on 19 November 2026 at the Four Seasons Hotel, Limassol, Cyprus.

Senior contributors from Eurobank, Revolut, Mastercard, IBM, FIS, eToro, National Bank of Greece, Latvijas Banka, payabl., XM, HFM, Deriv, StoneX Europe, DECTA, BPC, Unlimit, Plum, Freedom24, Admirals Europe, Pay.com, Damex, Infocredit, INGOT, Copla, Recomply.ai, Inventi, Unipesa, Profee, Sepaga EMI, MoneyGate, Axia, UMCA, Solanteq, MDS, Coreless Technologies, Capital Vault, The Vault - Wise Wolves, Finvasia Wealth, Alchemy Markets, FXIFY, XOALA, Abacus Limited, MK Fintech Partners, Enalian Consulting, DKA Financial Consultants, Profit Insight, circl3.tech, Veracloud, Vivox.ai, Spatzia.eu, JayBee Ltd. and Colibrix will address AMLA supervision, sanctions screening at scale, cross-border controls and the operating-model changes facing EMIs, PSPs and VASPs across the full forum agenda.

Request the full agenda or secure your place: https://www.qubevents.com/nextgen-payments-regtech-cyprus

For sponsorship or registration enquiries: info@qubevents.com 

By Zinah Abdaki, CMO at QUBE Events