EU Beneficial Ownership in 2026: AMLR, AMLD6 & AMLA Explained

For two decades, anti-money-laundering law in the European Union worked the same way: Brussels passed a directive, and each of the 27 member states transposed it into national law on its own terms, at its own pace, with its own thresholds and quirks. The result was a patchwork. The same company could face one definition of beneficial owner in Frankfurt and a subtly different one in Valletta. Criminals forum-shopped for the lightest-touch jurisdiction. Compliance teams reconciled 27 versions of the same rule.

That era is ending. In 2024 the EU adopted the most significant overhaul of its AML framework in twenty years: a directly applicable Anti-Money Laundering Regulation (AMLR) that imposes one single rulebook on all 27 member states, a Sixth Anti-Money Laundering Directive (AMLD6) that rebuilds the institutional and beneficial-ownership-register architecture, and a new central supervisor — the Authority for Anti-Money Laundering (AMLA), headquartered in Frankfurt and operational since 1 July 2025.

For beneficial-ownership work specifically, three things change. The threshold moves from "more than 25%" to "25% or more" — a small wording change that pulls more individuals into scope. The rules for multi-layered and aggregated ownership are tightened so that fragmented stakes can no longer hide a controller. And access to the beneficial-ownership registers themselves is being rebuilt around "legitimate interest," after the EU's top court struck down the public-access model in the landmark WM and Sovim ruling of November 2022.

The timing is staggered, and getting it right matters. The headline date — full application of the AMLR and general transposition of AMLD6 — is 10 July 2027. But the beneficial-ownership pieces arrive earlier: the register-access provisions had a transposition deadline of 10 July 2025 (which a third of member states missed, triggering Commission infringement proceedings), and the core beneficial-ownership-register provisions plus AMLA's technical standards are due by 10 July 2026. For anyone whose work touches EU beneficial ownership, 2026 is the year the register layer takes shape — not 2027.

This guide explains how the EU's new beneficial-ownership regime actually works: the three instruments and how they fit together, the lowered threshold and the new aggregation rules, the legitimate-interest access model that replaced public registers, the AMLA supervisory layer, the staggered timeline, and what all of it means for compliance teams verifying an EU beneficial owner. It is the EU-wide capstone to our country-by-country guides — and where the member-state detail matters, it links straight to them.

1. The 2024 package: AMLR, AMLD6, and AMLA

The EU's new AML framework rests on three interlocking instruments, all adopted in 2024. Understanding which is which — and which is directly applicable versus which needs national transposition — is the foundation for everything else.

The conceptual shift is from directive to regulation for the substantive rules. Under the old model, the core AML obligations lived in directives (AMLD4, AMLD5) that each state transposed differently. The AMLR pulls the substantive obligations — including the beneficial-ownership definition and threshold — into a regulation that applies directly and identically everywhere, with no national variation. AMLD6 keeps the directive form only for the institutional plumbing that genuinely has to be built at national level. The explicit purpose, in the EU's own words, is to eliminate the regulatory arbitrage that let obliged entities forum-shop for lighter-touch jurisdictions.

2. The WM and Sovim ruling: why public registers fell

To understand the new register-access regime, you have to understand the court case that forced it. The single most consequential event in EU beneficial-ownership law in the last decade was not a piece of legislation — it was a judgment.

Under the Fifth Anti-Money Laundering Directive (AMLD5), member states had to make their beneficial-ownership registers accessible to any member of the general public. Luxembourg implemented this through its Register of Beneficial Owners (RBO). Two parties — referred to in the case as WM and Sovim SA — challenged the public-access design, arguing it violated their fundamental rights to privacy and data protection under the EU Charter.

The ruling did not abolish beneficial-ownership transparency — it reshaped it. The Court was explicit that journalists, civil society organisations, and others whose work connects to anti-money-laundering have a legitimate role and must retain access. The effect was to replace a binary "public / not public" model with a graduated one: unrestricted access for competent authorities and obliged entities, and "legitimate interest" access for the press, academia, and civil society.

In the immediate aftermath, member states reacted in a scramble — many simply suspended public access overnight, and the approaches to "legitimate interest" diverged wildly from one country to the next. AMLD6 is the EU's attempt to re-harmonise that fragmented response into a single, predictable access framework. The WM and Sovim ruling is, in effect, the reason the access provisions of AMLD6 exist in the form they do.

3. The 25% threshold and the new aggregation rules

The AMLR harmonises the definition of beneficial owner across all 27 member states, and makes two changes that matter operationally for anyone running customer due diligence.

From "more than 25%" to "25% or more"

Under AMLD4, a beneficial owner was a natural person holding more than 25% of shares or voting rights — the so-called "25% + 1" formulation. The AMLR refines this to "25% or more." The practical effect is that a person holding exactly 25% is now a beneficial owner where previously they were not. It sounds trivial, but across a large client portfolio it pulls a meaningful number of additional individuals into scope, and it means existing beneficial-ownership records calibrated to the old threshold may need remediation.

The threshold of 25% aligns the EU with the UK PSC regime, the FATF Recommendation 24 baseline, and the offshore and Asian regimes — Cayman, Singapore, Hong Kong, and Bermuda all sit at 25%. The notable outlier in the other direction is the BVI at 10%.

The 15% high-risk derogation

The AMLR gives the European Commission the power to lower the threshold to a minimum of 15% for categories of legal entities that pose a high money-laundering or terrorist-financing risk (AMLR Article 52). This is not a blanket rule — it is a targeted power for specific high-risk sectors. But it means compliance teams should not assume 25% is a permanent floor for every entity type; for designated high-risk categories, the effective threshold can be lower.

Ownership AND control — and the aggregation of layered stakes

The AMLR clarifies that beneficial ownership rests on two components — ownership and control — both of which must be assessed. More importantly for complex structures, it tightens the rules on multi-layered ownership. Indirect ownership is calculated by multiplying the ownership percentages through each chain, and — critically — separate chains leading to the same person are aggregated.

4. The beneficial-ownership registers and legitimate-interest access

AMLD6 rebuilds the beneficial-ownership register architecture along the lines the WM and Sovim ruling demanded. There are three tiers of access.

The verification shift: registers are a cross-check, not a source

One of the most important operational points in the AMLR is easy to miss. Obliged entities must verify beneficial-ownership information using multiple sources, and the central registers are to be used to cross-check information — not to serve as the primary source of truth. This is a deliberate move away from over-reliance on registers, which the EU recognises can be incomplete or out of date. In practice, an obliged entity must gather beneficial-ownership data from the customer and from independent sources, then reconcile it against the register, and follow up on any discrepancy. The register is one input, not the answer.

The expanded data fields reinforce this. The AMLR requires obliged entities to collect, for each beneficial owner, full name, full place and date of birth, residential address, country of residence, and nationality or nationalities — verified using identification documents, electronic identification under eIDAS, or other reasonable measures from reliable sources.

Bank-account and real-estate register interconnection

AMLD6 goes beyond company beneficial ownership. It requires member states to make centralised bank-account registers and real-estate registers accessible to FIUs and competent authorities through single access points, interconnected at EU level. For non-EU entities that own real estate in the EU, beneficial-ownership registration is required retroactively to 1 January 2014 — a significant reach-back designed to unwind property holdings used to launder money over the past decade.

5. AMLA: the EU's new central supervisor

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) is the institutional centrepiece of the reform. Headquartered in Frankfurt, it became operational on 1 July 2025.

AMLA does not replace national supervisors or FIUs. It is a central coordinating body designed to ensure the new single rulebook is applied consistently across the Union. Its functions fall into three areas:

• Direct supervision of a selected group of the highest-risk cross-border obliged entities — expected to begin around 2028 — making AMLA the first EU-level AML supervisor with direct authority over private-sector entities.
• Indirect supervision and coordination of national supervisors, setting common standards and stepping in where national supervision falls short.
• FIU coordination — supporting joint analysis of cross-border cases, building IT tools for information-sharing between national FIUs, and maintaining a central AML database.

For 2026 specifically, AMLA's most important output is technical. By 10 July 2026, AMLA must publish a large body of Level 2 and Level 3 measures — regulatory technical standards, implementing technical standards, and guidelines — that flesh out how the AMLR and AMLD6 work in practice, covering risk-based supervision, customer due diligence for the newly covered sectors, and beneficial-ownership identification. These standards are where the high-level rules become operational detail, which is why 2026 is the year compliance teams build, not the year they wait.

6. Who is in scope: the expanded list of obliged entities

The AMLR significantly widens the population of "obliged entities" — the businesses required to perform customer due diligence, identify beneficial owners, and report suspicious transactions.

The AMLR also introduces an EU-wide limit on cash payments. Cash transactions are capped at €10,000 across the Union (member states may set a lower limit), and obliged entities must identify and verify any person carrying out an occasional cash transaction between €3,000 and €10,000. The definition of a politically exposed person (PEP) is extended to cover siblings of PEPs where the PEP is a head of state or government, a minister, or a deputy or assistant minister.

7. Crypto-asset service providers: the MiCA–AMLR alignment

One of the most consequential scope changes in the package concerns crypto. Crypto-asset service providers (CASPs) are brought fully into the AML perimeter and aligned with the Markets in Crypto-Assets Regulation (MiCA).

The mechanism is direct: a CASP authorised under MiCA is automatically an obliged entity under the AMLR. That means the full single rulebook applies — customer due diligence, beneficial-ownership identification to the "25% or more" threshold, suspicious-transaction reporting, the cash-limit rules, and record-keeping. There is no separate, lighter regime for crypto: a CASP faces the same beneficial-ownership obligations as a bank.

Three instruments interlock for crypto:

• MiCA governs market conduct and licensing for crypto-asset service providers.
• The AMLR imposes the AML/CFT obligations, including beneficial-ownership identification, on those licensed CASPs.
• The Transfer of Funds Regulation (TFR) applies the FATF "travel rule" to crypto transfers, requiring originator and beneficiary information to accompany transactions.

For compliance teams, the practical effect is that a CASP counterparty in the EU is, from a beneficial-ownership standpoint, indistinguishable from any other financial institution: it must identify and verify the beneficial owners of its corporate customers, apply enhanced due diligence to cross-border relationships, and be ready to evidence all of it to its supervisor. The era of crypto businesses operating outside the beneficial-ownership perimeter in the EU is over.

8. How to verify an EU UBO under the AMLR: workflow

Under AMLD4, an obliged entity assessing each chain in isolation would have found two 15% stakes, neither crossing the 25% threshold, and concluded there was no beneficial owner at the ownership level. The AMLR's aggregation rule defeats exactly that structuring: the two chains are summed to 30%, and the natural person at the top is a beneficial owner who must be identified, verified, and recorded.

9. Penalties: the harmonised sanctions regime

The package significantly tightens the penalty regime and — for the first time — creates an EU-level authority that can impose fines directly. Two layers operate in parallel: national supervisors enforcing under AMLD6, and AMLA enforcing directly against the entities it supervises.

The substance of the penalty regime has three notable features for beneficial-ownership compliance:

• Pecuniary sanctions vs administrative measures. AMLD6 draws a clear line. Pecuniary sanctions apply to serious, repeated, or systematic breaches — whether intentional or merely negligent. Administrative measures are the corrective toolkit: ordering specific remediation, restricting or limiting business, and, for authorised entities, suspending or withdrawing authorisation.
• Periodic penalty payments. Where an obliged entity fails to comply with an administrative measure within the deadline, supervisors can impose periodic penalty payments — recurring fines that accrue until compliance — to compel action.
• AMLA's direct sanctioning power. For the entities it directly supervises, AMLA can itself impose pecuniary sanctions of up to €10 million or 10% of turnover, apply periodic penalty payments, restrict activities, remove senior managers, or refer matters to national criminal authorities. AMLA published draft regulatory technical standards on pecuniary sanctions, administrative measures, and periodic penalty payments in early 2026.

Weak beneficial-ownership verification sits squarely within the conduct that attracts these sanctions. A failure to identify beneficial owners to the "25% or more" threshold, to apply the aggregation rule, or to keep beneficial-ownership data current and verified is exactly the kind of breach that — if serious, repeated, or systematic — moves an entity into the top penalty band.

10. The staggered timeline: 2024–2029

The package does not arrive all at once. The dates are staggered, and the beneficial-ownership pieces arrive ahead of the full application date.

11. Member-state detail: the country guides

The AMLR harmonises the substantive rules, but the registers themselves remain national, and each member state's transposition of AMLD6 — and its pre-existing register infrastructure — carries its own operational detail. Our country-by-country guides cover how beneficial ownership works in each major EU jurisdiction in 2026, and how each is adapting to the new package.

For the full set of jurisdictions, including non-EU regimes, see the global UBO regulations index. For the foundational concepts, see what is a UBO.

12. What it means for UK, US, and non-EU compliance teams

The package reaches well beyond the EU's 27 member states.

The UK is now on a divergent track

Post-Brexit, the UK is not bound by the AMLR or AMLD6. It runs its own People with Significant Control (PSC) regime and the Economic Crime and Corporate Transparency Act reforms. The thresholds are aligned at 25%, but the regimes are now evolving independently — and the EU's move to a single regulation while the UK pursues its own reforms means cross-border groups will face two distinct frameworks. See the UK PSC guide for detail.

Non-EU entities are pulled in through real estate and business activity

The AMLR's beneficial-ownership rules reach non-EU entities when they do business in the EU or purchase EU real estate. For foreign entities owning EU property, beneficial-ownership registration is required retroactively to 1 January 2014. A US, UK, or offshore holding structure with EU operations or EU real estate is therefore within the AMLR's beneficial-ownership perimeter, even though it is incorporated elsewhere.

The single rulebook simplifies cross-border CDD — eventually

For a non-EU bank with EU counterparties, the long-term effect of the AMLR is positive: one harmonised definition of beneficial owner across all 27 states, instead of 27 variations to reconcile. The complication is the transition. Between now and 2027, member states are at different stages — some have transposed the register-access provisions, some are subject to infringement proceedings for missing them, and the substantive single rulebook does not bite until 10 July 2027. For the next stretch, cross-border teams must track both the old national regimes and the incoming harmonised one.

13. Practical takeaways for compliance teams

14. Frequently asked questions