Getting Ready for the EU’s New AML Regulation

In the AMLR, unduly ownership complexity is both a high‑risk factor (Annex III) and an issue to be investigated as part of EDD (Art. 20(1)(b)), reflecting the growing use of multi‑layered cross‑border structures to obscure beneficial ownership. EBA’s Guidelines define ownership as complex when “there are three or more layers between the customer and the beneficial owner” and involves legal arrangements, entities registered in foreign jurisdictions, ownership opacity, nominee shareholders/directors.

Chapter IV of the AMLR refines the definition of Beneficial Owners and how to assess ownership and control. The ownership threshold is set at “25% or more of the shares or voting rights or other ownership interest” (and no more than 15% in case of high-risk for money laundering and terrorist financing: Art. 52(2)). Indirect ownership is calculated by multiplying holdings along each chain and aggregating them. Art. 53 lists other forms of control or influence such as majority voting rights. Specific rules are set for trusts, foundations and other legal arrangements (Arts. 55 et seq.).

The AMLR requires obliged entities to treat as higher risk those relationships involving high risk third countries (Annex III), jurisdictions with weak AML/CFT controls, high levels of corruption or criminality, sanctions or embargoes, supporting terrorism, or with financial secrecy, triggering EDD procedures. EBA’s Guidelines underline that risk assessment methodologies should be adjusted according to the sector in which an entity operates.

Political Exposure and Negative Events (sanctions listings, enforcement actions and reputational risks) are higher risk factors requiring EDD (Annex III). The AMLR (Art. 2(34)) expands the definition of Politically Exposed Persons (PEPs) to include heads of regional and local authorities and extends controls to a wider group of family members and close associates (Art. 46). These individuals are treated as higher risk customers requiring ongoing monitoring (Art. 42).

The EBA’s Draft RTS emphasise “obliged entities shall put in place automated screening tools and measure” to properly comply depending on size, business model, complexity or nature of the business (Art.19). The Guidelines underlines that the customer’s reputation may be assessed through “adverse media screening or similar means, information on criminal investigations, proceedings and convictions or any other relevant information”, provided that such information is accurate and reliable.

AMLR’s Chapter V sets out strict reporting obligations, including short deadlines to respond to requests from competent authorities, which presuppose fast access to, and management of, structured and reliable customer and risk data. Also, The AMLR and EBA Guidelines make clear that risk assessment and CDD/EDD are not one off events. AMLR’s Art. 26 requires obliged entities to conduct ongoing monitoring and to review and update customer information whenever risk or circumstances change, with risk‑based maximum review intervals.

The AMLR allows the use of automated and AI based systems to strengthen AML/CFT controls (Art. 76(5)), and EBA consistently promotes models where risk is “first assessed in an automated manner based on objective criteria and then manually adjusted based on professional judgement”. This, provided that data quality, explainability, and human oversight are ensured (e.g. Arts. 76 and 75(4)(g) AMLR). Supervisors increasingly expect organisations using advanced tools to be able to explain their methodology, evidence validation and justify outputs in a way that authorities and stakeholders can understand and challenge.