The EU’s new AML Regulation starts applying on 10 July 2027.
The EU’s new AML Regulation harmonises core due diligence and ownership rules, alongside AMLA’s supervisory role. National laws and other duties still matter for covered firms.
By Matthew Lee
10 July 2027 is the general application date for the AML Regulation, (EU) 2024/1624. It directly governs covered firms across member states, subject to its specific exceptions and later application provisions. National AML laws, other EU rules and supervisory duties still matter.
A new authority writes the detail and, from 2028, supervises the largest cross-border groups itself. The EU KYC and AML page sets out what the rules accept as evidence.
The authority in Frankfurt
The Anti-Money Laundering Authority (AMLA) was created by Regulation (EU) 2024/1620 and has its seat in Frankfurt am Main. The regulation gave it most of its tasks and powers from 1 July 2025.
AMLA drafts the technical standards that fill in the AML Regulation, coordinates national supervisors and supports the EU's financial intelligence units. National supervisors keep supervising almost every firm.
Direct supervision from 2028
AMLA will directly supervise credit and financial institutions, or groups, that operate in at least six member states and have a high residual risk profile. The first selection starts by 1 July 2027 and must finish within six months. Direct supervision begins six months after the list is published, which AMLA's own timeline puts in 2028.
AMLA's timeline names 40 entities for the first selection. The regulation lets it select a larger number if more qualify and it has the staff. Supervision runs through joint teams of AMLA and national staff.
One ownership test
Article 52 sets one threshold for every member state: 25% or more of the shares, voting rights or other ownership interest, including rights to profits. Indirect holdings are multiplied along each chain and the chains are added together, counting every level of ownership.
Control by other means is assessed separately and in parallel (Article 51). Control through ownership means 50% plus one (Article 53).
The threshold can only go down. By 10 July 2029 the Commission assesses whether higher-risk categories of company need a lower one, generally no more than 15% and in every case below 25%.
Hong Kong's test is more than 25% under the AMLO. On ownership alone, a shareholder at exactly 25% is a beneficial owner under the EU rule and not under the Hong Kong one.
The due diligence standards
On 1 October 2026 AMLA finalised three sets of regulatory technical standards and submitted them to the Commission: on customer due diligence, on telling business relationships from occasional transactions, and on group-wide arrangements. AMLA proposes that they apply six months after entry into force. The Commission can still amend them before adoption.
AMLA's factsheet on the due diligence standards says:
- Owner verification sources: public registers such as business and land registers, reputable data service providers, and documents of the entity that name the owner. The EU central register alone is not enough.
- Sanctions and PEP screening: part of due diligence on the customer and its beneficial owners, by automated tools, manual checks or both.
- Foreign-language documents: the firm must understand them, whatever the language.
- Existing customers: brought into line on a risk-sensitive basis, within one year for higher-risk customers and five years for the rest.
What changes for firms in Hong Kong and Malta
| Your firm | What applies |
|---|---|
| In Malta or elsewhere in the EU, onboarding a Hong Kong client | The AML Regulation directly from 10 July 2027, with the 25%-or-more test across every layer |
| The same, with a BVI company in the chain | Enhanced due diligence: the British Virgin Islands has been on the EU high-risk third countries list since 29 January 2026 |
| The same, where the non-EU client is in a higher-risk category | The client registers its beneficial owners in the member state's central register, and you ask for proof first (Article 67) |
| In Hong Kong, part of a group headquartered in the EU | Group-wide policies reach you (Article 16); where Hong Kong rules are less strict, the group applies the EU standard, and where local law prevents it, additional measures (Article 17) |
| In Hong Kong, with no EU parent, onboarding EU clients | The AMLO, as before. Your client's EU bank will apply the EU test to the same structure |
For a Hong Kong subsidiary of an EU group, the group-wide standards add the practical steps where local law gets in the way: tell the supervisor, seek customer consent where the law allows, apply additional measures, and exit if the risk cannot be managed.
How Fill Easy fits in
We supply the home-registry and government identity evidence for clients in Asia. CorpVerify returns company extracts and ownership traced layer by layer to the people at the top, with an English summary beside the original documents. GovVerify confirms a person through iAM Smart, China eID, Singpass or UAE Pass, with their consent.
Our API adds AML, sanctions and PEP screening on a person. Checking the EU central registers, and the due diligence decision, stay with your firm. Fill Easy (Malta) Limited is our EU operating hub.
How many of your corporate clients have an owner at exactly 25%?