EU AMLR 2027: The Complete Onboarding Readiness Guide

On 10 July 2027, EU Member States stop interpreting anti-money laundering law their own way. Regulation (EU) 2024/1624, the AMLR, becomes law that day, applied identically across all 27 Member States, with no national version to fall back on. This changes more than it might first appear to. 

For twenty years, Anti Money Laundering (AML) compliance across Europe has been a patchwork. A firm operating in three Member States has run, in effect, three different onboarding programmes, each shaped by how that country's regulators chose to interpret the last directive. The AMLR ends that by having one rulebook, one standard, applied identically from Lisbon to Helsinki.

The AMLR doesn't only tighten rules for banks and law firms who already do KYC. It also pulls in businesses that have never had to check a customer's identity: crypto firms, crowdfunding platforms, credit intermediaries who aren't already regulated, residence-by-investment operators, dealers in high-value goods like precious metals or yachts. Most of them have never run a KYC programme. This is a whole new set of businesses figuring out compliance from scratch.

If your onboarding process still runs on scanned passports, spreadsheets, and a compliance officer's judgement call, 10 July 2027 is not a distant deadline. It's the date your current process stops being legally sufficient.

What actually has to change

The AMLR doesn't just raise the bar in general terms. It writes the bar into law, article by article, with enough specificity that "we did KYC" is no longer an adequate answer. These four areas matter most:

1. Identity verification gets a prescribed standard

Article 22 doesn't just say "verify the customer." It specifies the fields: full names, place and date of birth, nationalities (plural, because a customer can hold more than one), national identification numbers, tax identification numbers, and for legal entities, the legal entity identifier and registration details. A document scan and a selfie match won't capture half of this.

Verification itself has to meet a specific technical standard too: either a passport or equivalent document cross-checked against independent sources, or an eID meeting eIDAS assurance level "substantial" or "high." 

This is where good verification comes into play. Reading a passport’s NFC chip directly, authenticating it against the issuing country’s official signing certificate, and running biometric liveness detection that meets ISO 30107-3 does more than satisfy the letter of Article 22. It removes the two biggest failure points in remote onboarding: forged documents and photo substitution. This is exactly what Verify does today, and firms already verifying this way are well placed for 2027.

2. Beneficial ownership gets harder to fake, and harder to ignore

The ownership threshold moves from "more than 25%" to "25% or more," which sounds like a rounding error until you realise it closes a loophole firms have used for years. A holder sitting at exactly 25% used to sit outside scope. Not anymore.

More consequential: registers can no longer be treated as sufficient on their own. Obliged entities have to cross-check register data against what they've independently collected, and if the two disagree, they have 14 calendar days to report the discrepancy. Fourteen days, from a standing start, to detect a mismatch, classify it, and file a report with supporting evidence.

Doing that by hand, across trusts, funds, and multi-tier corporate structures, is not a realistic operating model. Verify already handles this: visualising ownership structures, calculating percentages automatically, and flagging a discrepancy the moment it appears, turning a two-week scramble into a same-day task.

3. Monitoring stops being a policy and becomes a clock

Article 26 sets hard refresh ceilings: customer information reviewed at least every five years, and at least every twelve months for higher-risk customers. This is not a target, but a ceiling. Miss it and the firm is non-compliant regardless of how good its risk assessment looked on paper.

On top of the calendar, there's an event trigger: whenever a new sanctions designation is announced, credit and financial institutions have to re-check affected customers, not wait for the next scheduled cycle. A once-a-year screening habit, however well-documented, doesn't meet a "continuous" standard.

The firms that will struggle here are the ones treating monitoring as an annual project. The ones that won't are already running daily automated re-screening against sanctions, PEP, and adverse media sources, with re-checks triggered the moment a list updates rather than the next time someone opens the file.

4. Automated decisions need a human standing behind them

This is the one most onboarding teams haven't thought about yet. Article 76 puts real constraints on how automated screening and profiling can be used: the data behind a decision has to be reliable and current, outcomes can't be biased or discriminatory, and wherever an automated result feeds into a decision about the customer relationship, there has to be meaningful human intervention, not a rubber stamp. Customers get a right to an explanation and a right to challenge the outcome.

Practically, that means a "flagged" status from a screening tool can't be the end of the story. There needs to be a human decision on record: who reviewed it, when, and on what basis, in a form the firm can produce if asked. Verify runs the check automatically, but every result still lands in a clear decision state, accept, reject, with the human decision and reasoning captured against it. The balance Article 76 is actually asking for is speed from automation, with a recorded human call and audit trail. 

‍

Build on the right foundations

Some parts of the AMLR are still being finalised industry-wide. AMLA, the EU's new AML authority in Frankfurt, is still consulting on the technical standards that will pin down exactly how some of this works, with final guidance not expected until late 2026.

What matters more, at this stage, is whether a platform is built on the right foundations and has a credible, dated plan for the rest. Firms already covering identity verification, beneficial ownership, and continuous monitoring at the standard the AMLR demands are not starting from zero when the remaining pieces land. Firms starting their onboarding rebuild from scratch in 2027 will be.
‍

What to do before the deadline stops being theoretical

The temptation with a 2027 date is to treat it as a 2027 problem. It isn't. The Anti Money Laundering Authority’s (AMLA) technical standards are due to the Commission through late 2026. Member States begin transposing the institutional side of the package from the second half of 2026. Firms that wait until the deadline is close will be starting their audit and remediation work at the same time as every other obliged entity in Europe.

The firms in the strongest position now are asking a narrower, more useful question: not "are we AMLR compliant," but "which of these four areas would fail an audit today, and what would it take to fix each one." That's a project that can start this quarter, not in 2027.

Verify already covers the ground that matters most under the AMLR: identity verification built to the hardware-grade standard Article 22 demands, beneficial ownership mapping that turns a manual two-week scramble into a same-day task, continuous monitoring that treats "continuous" as a literal requirement rather than an annual habit, and a clear human decision recorded behind every automated result. Firms building on that foundation now aren't reacting to a 2027 deadline. They're already ahead of it.

If you want to see how Verify's platform maps against the AMLR in detail, article by article, get in touch at https://www.tiller-verify.com/contact

‍