#Core Banking
- From July 2027, financial institutions across the European Union will operate under a single anti-money laundering rulebook.
- Only around one-third of respondents expected to be ready by the deadline, and customer due diligence was named as the main operational bottleneck.
- For serious, repeated or systematic breaches, maximum fines rise to €10 million or 10% of annual turnover, whichever is higher.
The countdown to the EU’s new anti-money laundering (AML) framework is well underway. From July 2027, financial institutions across the European Union will operate under a single anti-money laundering rulebook. From 1 January 2028, the Anti-Money Laundering Authority (AMLA) will directly supervise up to 40 high-risk financial groups active in at least six member states. For many institutions, the challenge extends beyond compliance. In PwC’s EMEA AML Survey 2026, covering more than 500 institutions in 40 countries, only around one-third of respondents expected to be ready by the deadline, and customer due diligence was named as the main operational bottleneck. Furthermore, supervisory expectations continue to evolve, financial crime grows increasingly sophisticated, and pressure is mounting to improve the quality, consistency and traceability of AML data.
The result is a fundamental shift in how AML must operate. Traditional approaches built around periodic reviews, fragmented controls and siloed compliance systems are increasingly difficult to sustain. Instead, financial institutions are being pushed toward more continuous due diligence, better-connected customer data and greater operational visibility across the customer lifecycle.
In this environment, AML readiness becomes as much a technology challenge as a regulatory one. It also raises important questions about how institutions combine data, workflow automation, specialist AML systems and AI within a broader compliance architecture.
What is the EU AML package?
The EU AML Package is a major overhaul of anti-money laundering and counter-terrorist financing rules across the European Union. Adopted in 2024, it introduces a harmonized regulatory framework designed to reduce the fragmentation and divergent national implementation that have traditionally shaped AML compliance across member states.
At the center of the package is the creation of AMLA, a new European supervisory authority responsible for strengthening coordination, improving consistency and directly overseeing selected high-risk institutions. Alongside AMLA, the package introduces a single AML rulebook, enhanced customer due diligence requirements, more harmonized beneficial-ownership rules and stronger expectations around reporting, governance and risk management.
For serious, repeated or systematic breaches, maximum fines rise to €10 million or 10% of annual turnover, whichever is higher. That ceiling applies through national supervisors under the Sixth Anti-Money Laundering Directive (AMLD6) and through AMLA for the groups it supervises directly.
Customer due diligence, beneficial-ownership identification and record-keeping are now set in law that applies identically in every member state, with the detail supplied by AMLA technical standards. AMLA consulted on its draft due diligence standards between February and May 2026 and submitted final drafts to the Commission on 1 October 2026.
For financial institutions, the significance of the package is not simply that new rules are arriving. It is that AML is increasingly being treated as a continuous, data-driven capability that must operate consistently across jurisdictions, business lines and customer interactions.
The EU AML package creates a new supervisory reality
For decades, AML compliance in Europe has been shaped by national interpretation. While institutions have operated under common directives, implementation and supervision have often varied significantly between jurisdictions.
The EU AML Package changes that dynamic. A single rulebook reduces national variation and establishes more consistent expectations across the European banking sector. At the same time, AMLA introduces a new layer of centralized supervision focused particularly on institutions with significant cross-border exposure.
For many banks, this represents a shift from managing compliance market by market toward demonstrating compliance at an enterprise level. Governance structures, reporting frameworks, customer due diligence processes and risk models will increasingly need to stand up to scrutiny across the entire organization, not simply within individual jurisdictions.
The implications extend beyond regulatory compliance. Institutions that continue to rely on fragmented operating models, disconnected data sources and inconsistent controls may face rising compliance costs, greater operational complexity and increasing difficulty adapting as AMLA standards evolve.
Why periodic AML models are under pressure
The EU AML Package does not simply introduce new regulatory requirements. It reflects a broader shift in how financial institutions are expected to identify, assess and manage financial crime risk.
Traditionally, AML processes have often relied on periodic customer reviews, siloed data sources and manual interventions. Customer information is typically collected during onboarding and may then be refreshed according to a fixed schedule. Documents may be requested manually, while information and tasks pass between customer channels, compliance teams and specialist AML platforms.
That model is becoming increasingly difficult to sustain as financial crime networks become more sophisticated, transaction volumes continue to rise and compliance operations become more complex.
As a result, many institutions are being pushed toward a more continuous model of AML. Monitoring shifts from isolated controls toward broader visibility across the customer lifecycle.
Much of the market commentary describes the Anti-Money Laundering Regulation (AMLR) as a move from periodic reviews to continuous monitoring. The regulation is more precise, and more demanding.
Article 26 requires customer information to be updated within fixed maximum intervals, at least once a year for higher-risk customers and at least every five years for everyone else, and additionally whenever relevant circumstances change. Under AMLA’s draft due diligence standards, existing customer files must be brought up to the new requirements on a risk-sensitive basis, and in any case within those same windows.
So the shift is not from periodic to continuous. It is from periodic-only to periodic and event-driven, with evidence for both. For any bank with a large retail or SME book, that is a permanent refresh pipeline, not a remediation project.
The cost is easy to underestimate. More triggers mean more hits: more files flagged for review, more analyst time on each, and more requests to customers for documents and explanations. Those requests usually go out through relationship managers and other commercial staff, not compliance, so front-line bankers end up chasing paperwork instead of selling. Banks already assign up to 10 to 15 percent of their full-time staff to KYC and AML, according to McKinsey; absorbed manually, the AMLR pushes that number up. And an unanswered request is not just a delay. Where due diligence cannot be completed, Article 21 requires the bank to stop the transaction or end the relationship, though AMLA’s draft guidance allows a temporary restriction first. Silence from a customer becomes lost revenue.
| Traditional AML model | Emerging AML model |
| Periodic customer reviews | Periodic reviews within legal maximums (one year / five years), plus event-driven updates |
| Siloed compliance processes | Better-connected, enterprise-wide workflows |
| Manual investigations and reviews | Greater workflow automation and AI-supported analysis |
| Multiple local approaches | More harmonized, group-wide frameworks |
| Reactive risk identification | Dynamic and ongoing risk assessment |
| Compliance as a standalone function | Compliance embedded within banking operations |
Preparing for the EU AML package: three decisions for leaders
Preparing for the EU AML Package is not simply a question of implementing new controls. For many institutions, it requires a broader reassessment of how compliance capabilities are designed, operated and embedded across the organization.
While every institution starts from a different position, three strategic decisions are emerging as common priorities for executive teams.
1. Modernize AML infrastructure or continue layering onto legacy systems?
Many banks have expanded their AML capabilities over time by adding new tools, controls and reporting layers to existing platforms. While this approach can address immediate regulatory requirements, it often creates fragmented architectures that are increasingly difficult to manage, scale and audit.
The shift toward continuous monitoring, greater data transparency and more consistent reporting raises questions about whether legacy environments can support future requirements efficiently.
2. How centralized should AML operations become?
The introduction of a single EU rulebook creates opportunities to standardize AML processes across jurisdictions. At the same time, many institutions continue to operate through a mix of local compliance teams, market-specific controls and jurisdictional reporting structures.
Neither extreme is likely to be appropriate for every organization. Excessive centralization can reduce local responsiveness, while highly decentralized models can create duplication, inconsistent controls and fragmented reporting.
As supervision becomes increasingly harmonized, institutions will need to determine the right balance between centralized oversight and local execution.
3. How should AI be integrated into AML processes?
Institutions are exploring how AI can support capabilities such as transaction monitoring, behavioral analytics, dynamic risk scoring and alert prioritization. The challenge is that regulatory expectations are evolving alongside the technology.
Article 76(5) of the AMLR allows decisions based on automated processes, including AI, but any decision to onboard or refuse a customer, to maintain or end a relationship, or to change the level of due diligence needs meaningful human intervention, and the customer must be able to obtain an explanation and challenge it. As AMLA develops its supervisory approach and technical standards continue to evolve, financial institutions will need to demonstrate how decisions are made, how risks are assessed and how compliance outcomes can be audited. Models that cannot be explained, governed or validated may create new regulatory risks even as they improve operational efficiency.
As a result, AI adoption cannot be treated solely as a technology initiative. The institutions most likely to succeed will be those that combine automation with explainability, governance and human oversight. This mirrors SBS’s own approach to AI in banking: a deterministic, auditable system of record, with AI in a separate layer that assists rather than decides.
Where SBS fits
SBS Digital Banking Suite sits in the orchestration layer, between customers, bank staff, the core banking system and the specialist identity-verification and AML providers a bank already uses, connected through APIs. Banks use it to run digital onboarding and KYC journeys, trigger document and data requests from risk events, let customers update their information through self-service, and orchestrate perpetual KYC reviews, with journeys and rules configurable through low-code tools as AMLA’s standards are finalized.
It does not replace a bank’s screening or transaction-monitoring engine. Its job is to make sure the right data reaches that engine, and that each step is recorded.
FAQs: Key questions on the EU AML Package
The EU AML Package is a new regulatory framework designed to strengthen anti-money laundering and counter-terrorist financing controls across the European Union. It introduces a single AML rulebook, establishes the Anti-Money Laundering Authority (AMLA), and aims to create more consistent supervision and enforcement across member states.
The new AML rules will apply from July 10, 2027. AMLA, operating in Frankfurt since July 2025, selects the entities it will supervise directly during 2027 and takes over their supervision from 1 January 2028.
No. It requires both: periodic updates within maximum intervals (one year for higher-risk customers, five years for others) and updates whenever relevant circumstances change, alongside ongoing transaction monitoring.
Probably not. The first selection covers up to 40 high-risk groups or entities operating in at least six member states. Everyone else stays with national supervisors, who apply the same rulebook and the same maximum fines.
The new framework places greater emphasis on continuous monitoring, data quality, auditability and operational consistency. Many institutions rely on fragmented compliance processes and legacy systems that were not designed to support these requirements at scale. As a result, AML transformation increasingly requires changes to technology architecture and operating models, not just regulatory processes.
AI can support specialist AML capabilities including transaction monitoring, behavioral analytics, dynamic risk scoring and alert prioritization. However, financial institutions must ensure that AI remains explainable, auditable and supported by appropriate validation, governance and human oversight.