The Anti-Money Laundering Regulation replaces national rulebooks with one set of rules that applies directly from 10 July 2027, and names crypto-asset service providers as obliged entities in their own right. A new EU authority, AMLA, will supervise the largest cross-border firms itself.
the date the single rulebook applies in every member state
the size of occasional crypto-asset transaction that triggers due diligence
firms, at most, in AMLA’s first round of direct supervision
retention for due diligence and transaction records
The rules become the same across the EU. Avus turns each one into a control that runs, and a record that shows it ran.
Identify and verify customers and their beneficial owners, understand the purpose of the relationship and keep the picture current. For CASPs, occasional transactions from €1,000 require due diligence.
Identity, screening and wallet results meet on one customer profile, refreshed as they change.
Anyone holding 25% or more, or exercising control by other means, is a beneficial owner who must be identified and verified.
Owners and controllers sit on the customer and are screened with everyone else.
Higher-risk situations, including cross-border correspondent relationships with CASPs and business linked to high-risk third countries, need more checks and senior approval.
Your policy decides what counts as higher risk, and approvals are enforced rather than reminded.
CASPs may not keep anonymous accounts, or accounts that allow anonymisation, including accounts for anonymity-enhancing coins.
Exposure to mixers and privacy assets is scored by named rules, with the reason on file.
Transactions are monitored against what is known of the customer, and suspicion is reported to the FIU promptly, without tipping off the customer.
Reason-first alerts, cases worked to a decision, and reports drafted from the trail.
Due diligence documents and transaction records are kept for five years after the relationship ends or the transaction is made.
Every alert, case and decision is kept in an append-only log, with retention set per jurisdiction.
The package is law. The rulebook applies next summer, and direct supervision follows.
The same rule should give the same answer on a Monday in Malta and a Friday in Frankfurt.
Due diligence and monitoring rules run identically on every customer and transfer.
Case AI pulls screening, ownership and chain exposure around each alert before anyone opens it.
Analysts and the MLRO make the calls the regulation reserves for people, in their own name.
Every regime writes to the same controls and the same record, so meeting one helps you evidence the others.
Authorisation, governance and ongoing obligations, evidenced from day one.
Read moreOriginator and beneficiary data travels with every transfer and is checked before funds move.
Read moreOperational resilience, with the logs, controls and third-party records auditors ask for.
Read moreLicensing, a travel rule from AED 3,500 and AML records kept for eight years.
Read moreWe will walk through due diligence, monitoring and reporting under the AMLR on a sample of your customers.
A summary to help you find your way, not legal advice. The official texts are the reference, and your own counsel should confirm how they apply to you.