AMLA and the new EU AML regime: Is your data ready?

• The EU Anti-Money Laundering Regulation (AMLR) is raising the bar, requiring firms to collect, verify and maintain richer customer and risk data.
• As organisations move from planning to implementation, data quality, ownership and traceability are emerging as key determinants of compliance readiness.
• Firms that take a proactive approach to assessing their data foundations today will be better positioned for AMLR implementation tomorrow.

Picture a compliance team at a cross-border financial group preparing for the EU’s new anti-money laundering and countering the financing of terrorism (AML/CFT) regime. 

They have briefed senior management on the new EU-level AML/CFT Authority (AMLA) and the accompanying Anti-Money Laundering Regulation (AMLR). The team has also crafted an implementation roadmap leading up to 10 July 2027, when many of the AMLR’s key provisions are expected to begin applying [note1]. On paper, the programme is progressing well. 

But as the team turns from planning to implementation, harder questions surface. Where is the required customer and ownership data held? Who owns it? Can it be traced, kept current and used consistently across the group? The firm understands what is changing. But the real work is only just beginning.

Let’s back up a little. AMLA and the AMLR are both part of a wider EU AML package, but they play different roles. AMLA is the new authority; the AMLR is the regulation containing many of the substantive obligations firms must implement.

AMLA is expected to directly supervise a limited number of higher-risk, cross-border institutions. Its first selection round is planned for 2027, with direct supervision projected to begin in 2028 [note2] and initially covering up to 40 entities or groups [note3].

Most organisations won’t fall under AMLA’s direct supervision – but that’s no reason to relax. National authorities will continue to supervise most firms, while AMLA will promote greater consistency across the EU and closer cooperation between national supervisors.

Crucially, the AMLR applies much more widely than the cohort AMLA will directly supervise. It marks a significant shift from a directive-led framework implemented through national law to a single, directly applicable EU rulebook specifically intended to reduce variation between Member States.

Important technical standards and guidance are still being developed, consulted on and clarified. Even so, the direction of travel is clear, giving firms a strong basis to begin preparing while some implementation details continue to evolve.

What makes implementation so demanding? In short, data.

The ability to collect, access, verify and monitor customer and risk data will be central to implementation for “obliged entities” – the organisations and professionals subject to AML/CFT duties under the regulation. 

Many firms are likely to need more detailed data on customers, beneficial owners and other relevant connected persons, supported by appropriate evidence and ongoing review.

New and evolving requirements introduce additional expectations for customer identification and verification, beneficial ownership, politically exposed person (PEP) identification, sanctions screening and enhanced due diligence. Firms must establish not just who a customer is, but who owns or controls an entity and whether connected individuals require additional scrutiny.

The task doesn’t end once the information has been collected. That data must support ongoing monitoring, periodic refreshes and event-driven reviews. Firms will also need appropriate records, supporting their CDD and monitoring activities and decisions, to show where that information came from, when it was checked and how it informed a decision.

For those processes to work, data needs to be reliable, structured and usable by screening, monitoring and reporting systems. It must also be sufficiently consistent across entities for cross-border groups to apply controls effectively and provide clear evidence to supervisors.

That’s where some implementation challenges can emerge. Customer information is often spread across multiple systems and entities, beneficial ownership records use different formats, and some data can’t easily be traced to its source. Local teams may follow different refresh processes, and even where information exists, it isn’t always structured for screening and monitoring systems to use consistently.

PwC’s 2026 EMEA AML Survey illustrates the scale of the gap. Depending on the sector, between 14% and 29% of EU respondents reported having completed both a detailed analysis and an impact assessment, while only approximately one-third believed that they will be ready to comply by 10 July 2027 [note4].

Across the wider EMEA survey, data quality was seen as the leading barrier to scaling technology and AI adoption – cited by 52%-89% of respondents, depending on sector [note5].

Technology may ease some of the pressure, but fragmented, incomplete or outdated data will ultimately constrain what firms can automate.

Firms aren’t all starting from the same place. Some have moved from interpretation and gap analysis into detailed implementation; others still have substantial work ahead on data, technology, processes and operating models.

Larger institutions may have more resources but can also have more complex structures to manage. Smaller or newly in-scope firms may have simpler operations, but fewer people and less mature technology. Either way, a completed gap analysis is not the same as being ready to operate.

Answering the opening questions about where data sits, who owns it and whether it is traceable and consistent often reveals gaps in external data, internal records, governance or the connections between systems. The exercise turns a broad regulatory change programme into specific decisions about sourcing, verification, remediation and ongoing monitoring.

With the deadline approaching, a practical next step is for firms to test whether their data and processes will support implementation in practice. Organisations that operate across multiple jurisdictions should consider whether information is sufficiently consistent, traceable and reliable to support a more harmonised AML framework. Once they have identified potential gaps, they can prioritise remediation activities ahead of the implementation deadline.