EU AML Directives and the AML Regulation

1. Why This Topic Matters for the CAMS Exam

The European Union is one of the most influential AML/CFT jurisdictions in the world. Its directives have shaped the national laws of 27 member states and have served as a reference model for many non-EU countries. The CAMS exam tests your understanding of regulatory regimes beyond the United States, and the EU framework is a core part of that. Questions on this topic typically appear in the domain covering Regulatory Regimes, Risk Assessments and Collaboration, where candidates are expected to understand how international standards (such as the FATF Recommendations) are translated into binding regional and national rules.

Understanding this topic is important for three practical reasons:
- Many compliance professionals work for institutions with EU operations, EU customers or EU correspondent relationships, so EU rules directly affect day-to-day controls.
- The EU framework illustrates the difference between a directive (which must be transposed into national law) and a regulation (which applies directly and uniformly). This distinction is a favourite source of exam questions.
- The EU recently completed its most significant AML reform ever, the AML Package, which replaces much of the directive-based system with a single rulebook and creates a new EU-level supervisor, the Anti-Money Laundering Authority (AMLA). Exam writers expect candidates to know the direction of travel.

2. What It Is: Directives Versus Regulations

A directive is an EU legislative act that sets an objective and a minimum standard which every member state must achieve, but it leaves each state to choose the exact wording and mechanism of its national law. This process is called transposition, and the directive sets a deadline by which transposition must be complete. Because of this flexibility, the EU AML directives historically produced a patchwork of national rules, with some countries adopting stricter requirements than others. This fragmentation was exploited by criminals and is the main reason the EU moved toward a regulation.

A regulation is directly applicable in every member state from the date it enters into force. No national transposition is needed, and the text applies identically everywhere. The AML Regulation (AMLR) therefore creates a single rulebook of obligations for private-sector obliged entities across the entire EU.

3. The Evolution of the EU AML Directives

First AML Directive (1AMLD, 1991)
Focused on the laundering of drug trafficking proceeds and applied mainly to the financial sector. It introduced customer identification, record keeping and the duty to report suspicious transactions. It closely followed the original FATF 40 Recommendations.

Second AML Directive (2AMLD, 2001)
Expanded predicate offences beyond drug crime to a broader range of serious crimes and extended obligations to certain non-financial professions, including lawyers, notaries, accountants, real estate agents, casinos and dealers in high-value goods.

Third AML Directive (3AMLD, 2005)
Incorporated the revised FATF 40 Recommendations and the Special Recommendations on terrorist financing. It formally introduced the risk-based approach, customer due diligence (CDD) with simplified and enhanced tiers, the concept of the beneficial owner (using a 25% ownership threshold) and requirements for politically exposed persons (PEPs), initially focused on foreign PEPs. It also brought trust and company service providers within scope.

Fourth AML Directive (4AMLD, adopted 2015, transposition deadline June 2017)
A major overhaul aligned with the 2012 FATF Recommendations. Key features:
- Strengthened the risk-based approach and required national risk assessments by member states and a supranational risk assessment (SNRA) by the European Commission.
- Required central beneficial ownership registers for companies and other legal entities in each member state.
- Extended PEP requirements to domestic PEPs and to persons entrusted with prominent functions at international organisations.
- Added tax crimes explicitly as predicate offences.
- Lowered the cash threshold for traders in goods to EUR 10,000 and brought the gambling sector more fully into scope.
- Set out criteria for identifying high-risk third countries through Commission delegated acts.
- Introduced stronger administrative sanctions, including publication of penalties.

Fifth AML Directive (5AMLD, adopted 2018, transposition deadline January 2020)
A response to the Panama Papers and the terrorist attacks in Paris and Brussels. Key features:
- Brought virtual currency exchange platforms and custodian wallet providers within the scope of AML obligations for the first time.
- Made beneficial ownership registers for companies publicly accessible, and required registers for trusts (with access based on legitimate interest). Note: in November 2022 the Court of Justice of the EU ruled that unrestricted public access was an invalid interference with privacy rights, which led to the legitimate-interest model adopted in the later package.
- Required interconnection of national beneficial ownership registers.
- Lowered thresholds for anonymous prepaid cards (EUR 150 in general and EUR 50 for remote or online transactions).
- Introduced mandatory enhanced due diligence measures for business relationships and transactions involving high-risk third countries.
- Required centralised bank account registers or retrieval systems so that FIUs and competent authorities can quickly identify account holders.
- Extended scope to art dealers and intermediaries (for transactions of EUR 10,000 or more), auditors, external accountants and tax advisers, and letting agents for high-value rentals.
- Gave FIUs expanded access to information, including from obliged entities, even without a prior suspicious transaction report.

Sixth AML Directive (6AMLD, adopted 2018, transposition deadline December 2020)
Unlike the previous directives, this one is a criminal law directive rather than a preventive one. Key features:
- Harmonised the definition of money laundering across member states and set out a list of 22 predicate offences, including cybercrime and environmental crime.
- Criminalised aiding and abetting, inciting and attempting money laundering.
- Extended criminal liability to legal persons (companies), not just individuals.
- Set a minimum maximum penalty of at least four years imprisonment for natural persons.
- Clarified that self-laundering (laundering the proceeds of one's own crime) should be punishable.
- Strengthened cross-border cooperation on prosecution and jurisdiction.

4. The 2024 AML Package: The AML Regulation and Its Companions

In 2024 the EU adopted a comprehensive legislative package designed to close the gaps created by uneven transposition and weak national supervision. The package has four main components:

(a) The Anti-Money Laundering Regulation (AMLR)
This is the single rulebook that applies directly to obliged entities across the EU. Most of its provisions apply from 10 July 2027. Key features include:
- A unified and expanded list of obliged entities, including crypto-asset service providers, crowdfunding platforms, traders in luxury goods (such as precious metals, jewellery, high-value vehicles, yachts and aircraft), and, from 2029, professional football clubs and agents.
- Harmonised customer due diligence rules, including detailed requirements for identifying and verifying customers and beneficial owners.
- A harmonised beneficial ownership definition based on ownership or control of 25% or more, with a mechanism for the Commission to apply a lower threshold (15%) to higher-risk sectors or entity types.
- An EU-wide cash payment limit of EUR 10,000 for traders, with member states free to set lower limits.
- Enhanced due diligence obligations for high-net-worth individuals, for high-risk third countries and for certain crypto-asset transactions, including self-hosted wallets.
- Rules on group-wide policies, outsourcing, internal controls, the role of the compliance officer and the compliance manager at board level.
- Harmonised PEP treatment and continued monitoring for at least 12 months after a PEP leaves office.
- Requirements for targeted financial sanctions screening to be integrated with AML controls.

(b) The new AML Directive (often referred to as the Sixth AML Directive of the package, AMLD6)
This directive addresses matters that remain in the hands of member states: the organisation of national supervisors and FIUs, the operation of beneficial ownership registers (access limited to competent authorities, obliged entities and persons with legitimate interest such as journalists and civil society), bank account registers, national and supranational risk assessments, and cooperation between authorities. Transposition is required by July 2027, with some register-related provisions following later.

(c) The AMLA Regulation
Establishes the Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt. AMLA began operating in 2025 and will:
- Directly supervise a selected group of the highest-risk cross-border financial institutions (around 40 entities), with direct supervision expected to start in 2028.
- Oversee and coordinate national supervisors to ensure consistent application of the rules, including the power to step in where national supervision fails.
- Support and coordinate FIUs, host the FIU.net system and facilitate joint analyses.
- Develop regulatory and implementing technical standards and guidelines, taking over the AML-related functions previously performed by the European Banking Authority (EBA).

(d) The recast Transfer of Funds Regulation (2023)
Extends the FATF travel rule to crypto-asset transfers, requiring crypto-asset service providers to collect and transmit originator and beneficiary information, and aligns with the Markets in Crypto-Assets Regulation (MiCA).

5. How the Framework Works in Practice

Risk assessment at every level. The Commission publishes a supranational risk assessment, member states perform national risk assessments, and obliged entities must perform their own business-wide risk assessment considering customers, geography, products, transactions and delivery channels. Controls must be proportionate to identified risks.

Customer due diligence. Obliged entities must identify and verify customers and beneficial owners, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring. Simplified due diligence applies in lower-risk situations; enhanced due diligence is mandatory for PEPs, high-risk third countries, correspondent relationships with third-country institutions, and complex or unusual transactions.

Reporting and FIUs. Every member state has a single FIU that receives suspicious transaction reports. Obliged entities must report promptly and must not tip off the customer. FIUs exchange information through FIU.net, now hosted by AMLA.

Beneficial ownership transparency. Companies and trusts must obtain and hold accurate beneficial ownership information and file it with national registers. Obliged entities must report discrepancies they discover between register data and their own findings.

Third-country risk. The Commission maintains a list of high-risk third countries, largely aligned with the FATF grey and black lists, and obliged entities must apply enhanced measures to relationships connected with those jurisdictions.

Supervision and sanctions. National supervisors (now overseen by AMLA) conduct inspections and impose administrative sanctions, which can include fines of up to EUR 10 million or 10% of annual turnover for institutions, public reprimands and withdrawal of authorisation.

6. How to Answer Exam Questions on This Topic

CAMS questions on EU rules are usually scenario-based or definitional. They rarely demand article numbers. Instead they test whether you understand the purpose of a rule, which directive introduced it, and how it compares with FATF standards or other regimes. Use the following approach:

Step 1: Identify the key word. Words like transposition, member state discretion or minimum standard point to a directive. Words like directly applicable, uniform or single rulebook point to the regulation.

Step 2: Match the feature to the directive. Virtual currencies, prepaid card limits, public registers and interconnection belong to 5AMLD. Domestic PEPs, tax crimes, national risk assessments and central registers belong to 4AMLD. Harmonised predicate offences, corporate criminal liability and minimum prison terms belong to 6AMLD (the 2018 criminal law directive). Luxury goods dealers, football clubs, the EUR 10,000 cash limit and AMLA belong to the 2024 package.

Step 3: Think like a regulator. When a question asks for the best or most appropriate action, choose the answer that reflects the risk-based approach, enhanced due diligence for higher risk, and prompt reporting to the FIU without tipping off.

Step 4: Eliminate distractors. Wrong answers often mix up thresholds (for example, EUR 15,000 occasional transaction threshold versus EUR 10,000 cash threshold), confuse FATF with the EU, or attribute a 5AMLD feature to 4AMLD.

7. Exam Tips: Answering Questions on EU AML Directives and the AML Regulation

Tip 1: Master the directive versus regulation distinction. If a question asks why the EU moved from directives to a regulation, the answer is almost always to eliminate inconsistent national transposition and create a harmonised single rulebook.

Tip 2: Memorise the signature feature of each directive. 1AMLD = drug proceeds and banks; 2AMLD = wider predicate crimes and non-financial professions; 3AMLD = risk-based approach, beneficial owner, PEPs; 4AMLD = central beneficial ownership registers, domestic PEPs, national risk assessments, tax crimes; 5AMLD = virtual currencies, public registers, prepaid cards, high-risk third-country EDD; 6AMLD (2018) = harmonised criminal offences, 22 predicates, corporate liability, four-year minimum maximum sentence.

Tip 3: Know the key numbers. 25% beneficial ownership threshold; EUR 10,000 cash threshold for traders (and now an EU-wide cash payment limit); EUR 15,000 occasional transaction CDD threshold; EUR 150 and EUR 50 prepaid card thresholds under 5AMLD; EUR 1,000 threshold for occasional crypto transfers under the AMLR; five-year record retention; 12 months of continued monitoring after a PEP leaves office.

Tip 4: Know the new institutions and dates. AMLA is based in Frankfurt, began work in 2025, and will directly supervise selected high-risk cross-border entities from 2028. The AMLR applies from July 2027. The new directive must be transposed by July 2027.

Tip 5: Remember the privacy ruling. If a question refers to public access to beneficial ownership registers, recall that the Court of Justice of the EU invalidated general public access in 2022, and the current framework grants access to competent authorities, obliged entities and persons with a legitimate interest.

Tip 6: Link to FATF. The EU directives are the regional implementation of FATF Recommendations. If asked about the origin of a requirement such as the risk-based approach or the travel rule, recognise that FATF set the standard and the EU gave it legal force.

Tip 7: Watch for the word minimum. EU directives set minimum standards, so member states may be stricter. If a scenario describes a country with tougher cash limits or wider PEP definitions than the directive, that is permitted and not a violation.

Tip 8: Do not overthink legal detail. The CAMS exam is a practitioner exam. Choose the answer that demonstrates sound AML judgement consistent with the EU framework rather than the one that cites an obscure provision.

8. Quick Revision Summary

- Directives set minimum standards and require national transposition; regulations apply directly and uniformly.
- Six generations of directives progressively widened scope, introduced the risk-based approach, created beneficial ownership transparency and harmonised criminal law.
- The 2024 AML Package introduces a directly applicable single rulebook (AMLR), a new directive covering supervisors, FIUs and registers, a new EU supervisor (AMLA in Frankfurt) and travel rule coverage for crypto-assets.
- Core practical mechanisms are risk assessments at EU, national and entity level; tiered customer due diligence; beneficial ownership registers; FIU reporting without tipping off; high-risk third-country lists; and dissuasive sanctions.
- In the exam, identify the key term, match the feature to the correct directive or regulation, apply the risk-based approach, and eliminate distractors that confuse thresholds or jurisdictions.