News & Insights

AMLA Technical Standards: Preparing for the EU’s New AML Framework

Key Developments in Customer Due Diligence, Business Relationships and Group-Wide Controls

Introduction

The European Union’s anti-money laundering and counter-terrorist financing (AML/CFT) framework is entering an important phase of regulatory development, as the European Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) progresses the technical standards intended to support the implementation of the new EU AML rulebook.

On 1 October 2026, AMLA announced the completion of three sets of draft Regulatory Technical Standards (RTS) addressing customer due diligence, the identification of business relationships and occasional transactions, and group-wide AML/CFT arrangements.

The Cyprus Securities and Exchange Commission (CySEC) subsequently issued Circulars C806, C807 and C808 on 13 October 2026, drawing regulated entities’ attention to these developments and related consultation activities.

Although the three sets of draft RTS have been submitted to the European Commission, they have not yet completed the formal adoption process. Their provisions should therefore be distinguished from requirements already applicable under existing legislation.

1. The New EU AML Framework

Regulation (EU) 2024/1624 (the AML Regulation or AMLR) establishes harmonised requirements for the prevention of money laundering and terrorist financing across the European Union.

The Regulation will generally apply from 10 July 2027, subject to the specific exceptions provided for certain categories of obliged entities.

AMLA is responsible for developing regulatory instruments intended to clarify and support the consistent application of the new framework. These include draft RTS that are submitted to the European Commission for adoption in accordance with the applicable legislative procedures.

The three sets of final draft RTS announced in October 2026 concern Articles 28(1), 19(9), 16(4) and 17(3) of the AMLR.

2. The Three Sets of Draft Regulatory Technical Standards

Customer Due Diligence — Article 28(1) AMLR

The draft RTS address the information to be collected and verified when applying customer due diligence measures.

They cover matters including the verification of customer information, proportionate approaches in lower-risk situations, non-face-to-face verification, electronic identification and screening of politically exposed persons, their family members and close associates.

These standards are intended to provide greater consistency in how obliged entities identify and verify customers and apply risk-based due diligence measures.

Business Relationships and Occasional Transactions — Article 19(9) AMLR

The second set of draft RTS specifies criteria for identifying business relationships, occasional transactions and linked transactions. Although the mandate under Article 19(9) AMLR also covers the identification of higher-risk situations warranting lower customer due diligence thresholds, AMLA has not proposed additional lower thresholds at this stage.

A clearer distinction between an ongoing business relationship and an occasional transaction is important because it affects when customer due diligence obligations arise.

The proposed standards seek to promote consistent classification of business relationships and transactions, while reducing the risk of circumvention of applicable customer due diligence thresholds.

Group-Wide AML/CFT Arrangements — Articles 16(4) and 17(3) AMLR

The third set of draft RTS addresses minimum requirements for group-wide AML/CFT policies, procedures and controls.

These include governance arrangements, risk management, internal controls and the secure exchange of relevant information within a group.

The standards also address additional measures concerning subsidiaries and branches established in third countries, including circumstances where local legal requirements may restrict the implementation of group-wide AML/CFT arrangements. The draft RTS also set out criteria for identifying the parent undertaking in the Union where two or more EU-established obliged entities have a common head office outside the Union but no parent-subsidiary relationship between them. They further address the circumstances in which group-wide requirements apply to entities forming part of structures other than conventional corporate groups.

For groups operating across multiple jurisdictions, these provisions are particularly relevant to the coordination of compliance responsibilities and internal reporting arrangements.

3. CySEC Circulars C806–C808: The Cyprus Regulatory Perspective

On 13 October 2026, CySEC issued three circulars concerning AMLA’s ongoing regulatory work.

Circular C806 informed regulated entities of AMLA’s three Final Reports on draft RTS concerning customer due diligence, business relationships and group-wide AML/CFT arrangements. Importantly, CySEC also urged regulated entities to study the published material and make the necessary adjustments to their policies, checks, systems and procedures in preparation for the new requirements.

Circular C807 concerned AMLA’s planned sectoral roundtables on simplified customer due diligence, intended to inform the development of future AMLA Guidelines. The discussions, scheduled between 9 November and 2 December 2026, will focus on the application of simplified due diligence in lower-risk situations.

Circular C808 announced a public hearing scheduled for 3 November 2026 concerning separate draft RTS under Article 11(6) of Regulation (EU) 2024/1620. These draft standards concern the establishment and operation of a central AML/CFT supervisory database, including the categories of information to be transmitted by supervisory authorities and the applicable transmission procedures, formats and timelines.

These initiatives are distinct from the three sets of final draft RTS announced under Circular C806 and do not constitute their formal adoption.

Taken together, the circulars highlight the continuing development of the EU AML/CFT supervisory framework and its relevance to CySEC-regulated entities in Cyprus.

4. Practical Implications for Regulated Entities

The new framework is relevant to Cyprus investment firms, administrative service providers, fund managers, crypto-asset service providers and other obliged entities falling within the applicable legislation.

In light of CySEC’s communication, regulated entities should review the published draft standards and assess the adjustments that may be required to their existing AML/CFT policies, checks, systems and procedures. Particular attention should be given to customer onboarding and verification, the classification of business relationships and linked transactions, and the operation of group-wide compliance arrangements. Preparatory changes should be assessed against existing legal obligations, while recognising that the draft RTS remain subject to formal adoption.

For cross-border groups, particular attention should be given to the allocation of compliance responsibilities, information-sharing arrangements and potential conflicts between group-wide requirements and the laws of third countries.

5. Adoption and Implementation Timeline

The final draft RTS announced by AMLA on 1 October 2026 have been submitted to the European Commission for adoption.

The draft RTS envisage entry into force on the twentieth day following publication in the Official Journal of the European Union and application six months thereafter, subject to the exceptions specified in the respective draft instruments. For the categories of obliged entities referred to in Article 3(3)(n) and (o) of the AMLR, the draft provisions specify an application date of 10 July 2029.

These provisions remain subject to formal adoption by the European Commission. Separately, Article 90 of the AMLR provides for the Regulation’s general application from 10 July 2027, with a later application date of 10 July 2029 for the specified categories of obliged entities.

Conclusion

The publication of AMLA’s final draft technical standards represents a significant step towards the implementation of the EU’s harmonised AML/CFT framework.

For Cyprus-regulated entities, the developments provide an opportunity to assess whether existing customer due diligence procedures, transaction classification practices and group-wide compliance arrangements are appropriately structured for the forthcoming regulatory environment.

However, the distinction between final draft technical standards and legally adopted requirements remains essential.

Early preparation, informed by the evolving EU framework and applicable CySEC communications, can support an orderly transition without treating proposed requirements as already binding.

Disclaimer: This publication is intended for general information purposes only and does not constitute legal or regulatory advice. The application of EU and Cyprus AML/CFT requirements depends on the relevant legislation, the regulatory status of the entity and the circumstances of each case. Specific professional advice should be obtained where appropriate.