AMLR & AMLA: What Changes for CASPs From July 2027

On 10 July 2027 the EU AML Package becomes the most consequential change in European AML supervision since the Sixth Anti-Money Laundering Directive. Three instruments operate together: the Anti-Money Laundering Regulation, applicable directly across all 27 member states with no national variation; the Sixth Anti-Money Laundering Directive recast (AMLD6), updating the procedural and criminal-law framework; and the Authority for Anti-Money Laundering — a new EU agency in Frankfurt with direct supervisory powers over ~40 highest-risk obliged entities.¹^[1]²^[2]³^[3]

For Crypto-Asset Service Providers, the package compounds three existing pressures. The Markets in Crypto-Assets Regulation already brought CASPs into the obliged-entity perimeter via national 5AMLD/6AMLD transpositions; the Transfer of Funds Regulation imposed Travel Rule obligations from 30 December 2024; the new AMLR overlays a single rulebook from 10 July 2027 that replaces the patchwork of 27 national AML laws with one harmonised text. Cross-border CASPs — exactly the operators MiCA passporting was designed to enable — are the obvious candidates for direct AMLA supervision.⁵^[4]⁶^[5]

This guide explains the AML Package end-to-end: what AMLR changes substantively for CASP CDD, EDD, sanctions screening, and Travel Rule workflow; how AMLD6 updates the procedural backbone; what AMLA does and does not directly supervise; the selection methodology for the ~40 directly-supervised obliged entities; the governance, fees, and reporting cadence under direct supervision; the timeline through 2026–2028; and how CASPs of different sizes should prepare for either direct AMLA oversight or indirect supervision via the home NCA under the new harmonised standards.

The EU AML Package replaces a patchwork of directives with a directly-applicable regulation, a recast directive, and a new EU agency. Understanding which instrument controls which question is the foundation of any compliance plan for the post-2027 regime.

The AMLR replaces 27 national AML transpositions with a single text. This is the operational change every CASP feels — your Master AML Programme stops being 'aligned to national transposition with member-state variations' and becomes 'aligned to AMLR with the same content across every operating jurisdiction'. AMLR overlays the Markets in Crypto-Assets Regulation perimeter, sitting on top of MiCA's authorisation framework with substantive AML obligations.

• Harmonised CDD. Customer onboarding requirements identical across all 27 member states. ID verification, UBO identification (≥25% threshold or control), purpose of relationship, ongoing monitoring.

• Harmonised EDD triggers. Specific triggers — high-risk third countries, PEPs, complex structures, unusual transactions, crypto self-hosted wallet flows — defined in the Regulation rather than diverging by member state.

• Beneficial-ownership thresholds. ≥25% direct or indirect ownership; ≥25% voting rights; or control by other means. Beneficial-ownership register access expanded across member states under AMLD6.

• Cash-payment limit. €10,000 EU-wide ceiling on cash payments by obliged entities — relevant for any CASP-adjacent merchant flows.

• Travel Rule overlay. AMLR codifies the Transfer of Funds Regulation Travel Rule obligations into the substantive AML framework — the €1,000 threshold, full data set above threshold, self-hosted wallet treatment.

AMLD6 (the recast directive — Directive 2024/1640) replaces the existing Anti-Money Laundering Directives. Where AMLR defines the substantive what, AMLD6 defines the procedural how: how member-state FIUs operate, how NCAs supervise non-selected obliged entities, how beneficial-ownership registers operate across the EU, and how criminal-law penalties are harmonised.

• FIU coordination. Strengthened cross-border FIU cooperation; faster information exchange; AMLA-coordinated joint analyses for cross-border cases.

• Beneficial-ownership registers. Each member state maintains a UBO register; access expanded to legitimate-interest parties beyond the original ECJ-narrowed scope (post the 2022 ECJ ruling restricting general public access).

• NCA powers. Strengthened powers for national supervisors — administrative penalties, public censure, fitness-and-propriety findings, supervisory-letter publication.

• Criminal-law harmonisation. Continuation of 6AMLD's criminal-law framework — predicate offences, corporate liability up to 10% of annual turnover, minimum-maximum imprisonment terms.

AMLA — the Authority for Anti-Money Laundering and Countering the Financing of Terrorism — is the structural innovation. Headquartered in Frankfurt, operational from 1 July 2025, with direct supervisory powers from January 2028, AMLA is the EU's first AML-specific supervisor with binding authority over individual obliged entities. The model echoes the Single Supervisory Mechanism for banks under the ECB but applied to AML.

AMLA's selection methodology, set out in the AMLA Regulation and forthcoming technical standards, applies a multi-criterion scoring model. The threshold is not a single number but a composite assessment. Indicative criteria for a CASP:

• Cross-border footprint. Active operations in ≥6 member states.

• Customer base scale. Material EU-resident customer numbers (likely millions for a crypto exchange).

• Transaction volume. High aggregate annual transaction throughput on the obliged-entity activity.

• Inherent ML/TF risk profile. Customer mix, asset mix, jurisdictional exposure, prior supervisory findings.

• Significance to financial-stability or AML risk. Qualitative assessment by AMLA in conjunction with member-state NCAs.

Three categories of CASP face different operational changes from the AML Package. Pure non-EU CASPs are out of scope but increasingly affected via passporting Travel Rule counterparties. EU-licensed non-significant CASPs face AMLR-harmonised national supervision. Significant CASPs face AMLA direct supervision.

The AML Package phases in over five years. Each milestone has compliance and operational implications worth planning around.

• 1 July 2025 — AMLA operational start. Frankfurt offices open; staff onboarding; preparatory work on technical standards and selection methodology begins.

• January 2026 — AMLA full operational capacity. AMLA begins coordination of national supervisory work; technical standards finalised; preparatory engagement with potential selected entities.

• 10 July 2027 — AMLR + AMLD6 application date. Substantive new rules apply across the EU; existing AML programmes must be aligned.

• Late 2027 — First AMLA selection list published. ~40 directly-supervised entities named; transition to direct supervision begins.

• January 2028 — AMLA direct supervision live. Joint supervisory teams operate for selected entities; supervisory fees commence.

• 2030 — First selection cycle completes; second cycle's selection methodology refines.

• Refresh AML programme to AMLR draft. Use the published AMLR text — finalised May 2024 — as the rulebook against which to upgrade existing programmes. Do not wait for AMLA technical standards.

• Audit cross-border footprint. Map the member states where you have material activity. ≥6 member states is the AMLA selection trigger; if you are at 4–5 today, decide whether to expand or to consolidate before the 2027 selection cycle.

• Engage proactively with the home NCA. The home NCA's view feeds into AMLA's selection assessment; building a constructive relationship pre-selection is materially valuable.

• Reporting infrastructure investment. AMLA-supervised entities face monthly data feeds + standing reporting + ad-hoc requests. Most CASPs need 6–12 months of engineering work to be inspection-ready under this cadence.

• Budget for supervisory fees. AMLA fees for selected entities are tiered with material annual cost (likely €100,000–€500,000+ depending on size) on top of NCA fees.

• Travel Rule + blockchain analytics maturity. AMLA's supervision will be at least as rigorous as the most demanding NCA today. Travel Rule provider deployments and blockchain analytics integration must be inspection-ready.

Almost certainly not in the first selection cycle. AMLA's selection methodology weights cross-border footprint heavily; a CASP authorised in only one member state with operations concentrated there is a candidate for indirect supervision via the home NCA under AMLR. Direct supervision is reserved for the cross-border, scaled, and high-risk-profile entities. The first 40 selected entities will skew toward groups operating in 6+ member states with millions of EU customers.

No — AMLR overlays the Markets in Crypto-Assets Regulation rather than replacing it. MiCA authorisation continues to control which entities can provide crypto-asset services in the EEA; AMLR controls how those entities run their AML programmes. A CASP must satisfy both regimes simultaneously: authorisation under MiCA, AML compliance under AMLR. The two operate in parallel.

EBA Guidelines remain in force as the operational baseline through the AMLR transition. From AMLR application date (10 July 2027), AMLA inherits authority for issuing AML technical standards across the EU and will progressively update the EBA Guidelines into AMLA-issued standards. Practical effect: AML programmes built to the 2021 EBA Guidelines remain useful as a starting point but should be refreshed against AMLR text and forthcoming AMLA standards.

AMLR codifies the Transfer of Funds Regulation Travel Rule obligations into the substantive AML framework — the €1,000 data threshold, full data set above, self-hosted wallet treatment. Practically: existing TFR-compliant Travel Rule capability remains compliant under AMLR; the regime becomes more rigorous via AMLA-issued technical standards rather than the Regulation text itself.

Indirectly. AMLA's funding mix includes industry-funded levies on selected entities plus member-state contributions; non-selected CASPs do not pay direct AMLA fees but may see slightly elevated NCA fees as member states recoup AMLA contribution costs through national supervisory fee structures. Direct cost differential between selected and non-selected supervision is material — €100,000–€500,000+ for selected.

Maybe — depends on commercial trade-offs. Limiting active operations to fewer than 6 member states avoids the cross-border-footprint trigger; concentrating customer base in lower-tier-risk jurisdictions reduces the risk-profile score. But AMLA selection is also a credibility signal — Tier-1 institutional counterparties view directly-supervised entities favourably. Most large CASPs accept selection as the price of meaningful EEA scale, focus on cooperative engagement with AMLA rather than selection avoidance.

• AML Compliance for Crypto Firms: What the 6AMLD requires from CASPs and VASPs

• The Significant CASP Threshold: When ESMA Takes Over: MiCA Article 84 thresholds, ESMA direct supervision, and dual oversight with AMLA

• Sanctions Screening for Crypto: OFAC, EU Consolidated, UN — architecture and vendors

• MLRO Hiring Guide for CASPs: What to look for, what to pay

AMLR + AMLD6 + AMLA together represent the most ambitious EU AML reform of the 2020s. For most CASPs, the single rulebook is positive — fewer national variations, easier multi-state operations, more predictable supervisory expectations. For the 40 selected entities under AMLA direct supervision, the change is operationally heavier — monthly reporting cadences, joint supervisory teams, AMLA-issued technical standards. Either way, the substantive AML bar tightens. The CASPs that are inspection-ready under AMLR by 1 January 2027 will navigate the transition cleanly. Those that wait until July 2027 will spend the second half of 2027 in remediation mode.