Understanding the EU's 6th AML Directive

The 5th AML Directive (AMLD5) focused mainly on transparency and emerging risks, introducing public registers of beneficial ownership, stricter monitoring of politically exposed persons (PEPs), and the first EU-wide rules for cryptocurrency exchanges and custodian wallet providers. It also addressed anonymous prepaid cards and closer scrutiny of high-risk third countries.

The 6th Directive harmonizes and broadens the definition of money laundering breaches across EU member states. It explicitly criminalizes not only the act of laundering money but also related activities such as aiding, abetting, inciting, and attempting to launder funds. The directive also standardizes a comprehensive list of 22 predicate offenses³ that constitute money laundering when their proceeds are involved. By enumerating these offenses EU-wide, the law ensures that all member states prosecute the same core crimes feeding money laundering, closing gaps where criminals previously exploited differences in national laws.

Another keystone of the Sixth Directive is the significant expansion of those covered by AML/CFT obligations. Under the previous regulations, certain businesses and professions, known as "obliged entities", such as banks, insurers, real estate agents, gambling services, and high-value dealers, were required to implement AML programs. The 6th Directive casts a wider net. It brings most of the crypto-asset sector⁴ fully into scope, meaning all crypto-asset service providers (CASPs) must conduct customer due diligence and monitor transactions. It also extends AML requirements to additional high-risk spheres of activity, for example traders of

• luxury goods
• precious metals and stones
• art and cultural artifacts,

and even professional football clubs and agents involved in major transactions are now classified as obliged entities.

The 6th AML/CFT Directive introduces more stringent Customer Due Diligence (CDD)⁵ obligations and transparency requirements. Enhanced Due Diligence (EDD) will be required in more situations, reflecting an amplified risk-based approach. For instance, financial institutions must apply EDD in cross-border correspondent relationships, particularly when involving crypto service providers.⁶ Banks will also need to conduct extra scrutiny when dealing with high-net-worth individuals who control significant assets; failing to do so will be considered an aggravating factor if a violation occurs.

The directive also bolsters beneficial ownership transparency⁷. Companies must not only identify their ultimate beneficial owners (the real individuals behind a business), but do so following clearer, harmonized criteria across the EU. Member states are required to maintain central beneficial ownership registers, and the 6th Directive mandates that those with a legitimate interest,⁸ such as investigative journalists and civil society groups, have access to this ownership information in order to shine light on opaque corporate structures. This is a direct response to past shortcomings: Under the 5th Directive, public access to beneficial ownership data was promoted, but legal challenges led to uncertainty. The new rules reaffirm a commitment to transparency while balancing privacy concerns by defining who can access such sensitive data. Additionally, the directive prescribes that national authorities create a single access point⁹ for bank account registers, allowing authorized agencies to quickly find out which banks individuals and companies use.

The Directive also introduces the Bank Account Registers Interconnection System¹⁰ (BARIS), a new EU platform that will connect national bank account registries. From 2029, financial intelligence units and other competent authorities will be able to search across the EU for bank account information in real time. The aim is to speed up investigations, improve cooperation between Member States, and make it harder for criminals to hide assets across borders, all while ensuring strict logging and data-protection safeguards.

The new Directive reinforces enforcement and accountability by requiring Member States to impose effective and dissuasive penalties for breaches of AML rules, targeting both companies and the individuals responsible for failures. The Directive empowers authorities to impose significantly higher financial penalties for AML/CFT breaches up to €10 million or 10% of a company's turnover, whichever is greater. It also introduces periodic penalty payments, enabling regulators to enforce compliance more dynamically and effectively under the new framework.

Recognizing that financial crime often crosses borders, the 6th Directive emphasizes greater cooperation among EU member states' enforcement bodies. It establishes uniform rules for information-sharing, joint investigations, and conflict-of-jurisdiction scenarios, so that cases that span multiple countries can be handled more efficiently and without bureaucratic hurdles. National Financial Intelligence Units (FIUs) and other supervisors will be expected to work hand-in-hand and share data more freely. According to the Regulation (EU) 2024/1620, the EU is also creating a centralized supervisory authority, the Anti-Money Laundering Authority¹¹ (AMLA), based in Frankfurt. While set up by a separate regulation, AMLA complements the 6th Directive's framework. Starting in 2025, this new agency will directly oversee certain high-risk institutions (for example, some of the largest banks and crypto firms) and ensure consistent enforcement of AML/CFT rules across Europe.

For banks and other financial institutions, many AML/CFT obligations in the 6th Directive will feel like an evolution of what they're already doing, but the stakes and scope are unquestionably higher. Large banks¹² in the EU may come under the direct supervision of the new European AML Authority (AMLA) by 2025, which means a centralized team of EU regulators could be assessing their compliance instead of (or in addition to) the national supervisors they’re used to. Banks will need to ensure group-wide compliance programs meet the new single rulebook standards; the upside is greater consistency across their EU operations, but the downside is zero tolerance for weak links in any branch or subsidiary.

Enforcement will tighten, a bank that had lenient practices in one country can no longer count on lighter local enforcement if AMLA flags it as high-risk and steps in. On a practical level, banks must integrate the new requirements into their day-to-day operations. This includes adjusting KYC processes to capture additional data. Transaction monitoring systems at banks will need updates to incorporate new red flag patterns, including those related to crypto and emerging predicate crimes like cyber fraud.

Overall, the financial sector will likely need to allocate significant resources to update internal systems and train staff compliance on the 6th Directive changes. The reward is not just avoiding penalties but also reducing the risk of being used as a conduit for criminal money, which in turn protects the institution's reputation and stability.

Real estate agents and property developers have long been subject to AML rules (since buying property is a known way to launder large sums). The new directive reinforces the need for diligence in this sector, potentially introducing a single access point¹³ for real estate ownership information.

Real estate professionals should expect more scrutiny of transactions, especially involving foreign buyers or complex financing. They must continue to report suspicious transactions, like when a buyer uses an unexpected funding source or a series of flips occur with increasing prices. Real estate firms should also be aware of new beneficial owner transparency, for example if selling to a company or trust, they should verify who's really behind it, as shell companies frequently purchase property for money laundering.

To navigate the changes brought by the 6th AML/CFT Directive and stay ahead of compliance obligations, businesses should take proactive steps now. Below is a list of recommendations to help organizations prepare for AMLD6:

• Conduct a gap analysis: Review current AML systems against the new rulebook and directive requirements.
• Update policies: Align internal policies to EU rulebook, including due diligence, registers, and reporting.
• Invest in RegTech: Integrate technologies for digital ID, transaction monitoring, automated AML screening and blockchain analytics.
• Train staff: Provide sector-specific AML training to ensure everyone understands and enforces the new requirements.
• Enhance reporting: Develop systems for comprehensive suspicious activity reporting and register cross-checking.
• Monitor implementation dates: Track phase-in deadlines like the transparency registers (2025), full directive application (2027), real estate register access (2029).
• Engage with AMLA and industry networks: Participate in consultations¹⁴ and follow guidelines as they emerge from AMLA.