AML Package 6.0: The EU Directive and AMLA in Detail

Nikita Veremeev

08.02.2026 | 6 min read

Updated: 08.02.2026

When I launched COREDO in 2016, entrepreneurs had an obvious request: to enter new markets quickly, safely and transparently. Over the past few years the puzzle has become more complex: requirements for company registration, licensing and AML compliance have tightened. Today it is impossible to build an international business without a well-designed compliance function, and the EU AML Package 6.0, the launch of AMLA and 6AMLD are turning “due diligence” from a formality into a strategic discipline. In this article I systematize our experience and explain how to build a working AML and KYC/KYB system without losing scaling momentum.

COREDO’s practice confirms: companies that design compliance in advance get faster access to banking services, close deals more confidently and are less likely to face de-risking. The COREDO team has implemented dozens of projects in the EU, the UK, Singapore and Dubai, helping clients register legal entities, obtain financial licenses and build an effective AML framework. Below is a concentrated action plan, case studies and tools that work in 2026.

EU regulatory map: AMLA and 6AMLD

$Illustration for the section \$
The EU AML Package 6.0 formalizes the shift toward more unified regulation: it creates AMLA (the European Anti‑Money Laundering Agency), the provisions of 6AMLD come into force, and the main body of requirements is consolidated into pan‑European AML regulation. For businesses this means uniform technological and procedural standards across the EU and fewer gray areas in the interpretation of rules. At the same time, the role of national regulators remains: they will interact with AMLA by sharing data, coordinating inspections and harmonizing local procedures.

AMLA will receive supervisory powers over selected high‑risk credit and financial institutions, as well as a mandate for risk methodology, STR/SAR standards and information exchange with FIUs. Regulatory cooperation between the EBA, the ECB and AMLA will improve the consistency of requirements for banks and non‑bank PSPs, and will also affect cross‑border banking operations through a uniform approach to KYC/KYB, sanctions screening and transaction monitoring. Our experience at COREDO has shown that fintech companies and payment providers benefit from this predictability, especially when expanding into multiple EU countries.

A separate topic is international mutual cooperation on AML between Europe and Asia. FIU data‑exchange agreements, FATF standards and enforcement practices in the Singapore and Dubai markets form a clear roadmap for companies building cross‑border operations. The solution developed at COREDO for clients with Asian structures includes unified policies and checkpoints that take into account the requirements of the EU, the UK and key Asian regulators, which reduces fragmentation and compliance risk.

Company registration with AML considerations

$Illustration for the section \$
Registration of legal entities in the EU with AML requirements in mind is not just articles of association and an address. Competent preparation of a UBO dossier, analysis of source of funds, assessment of the business model from the AML-risk perspective, and the mandatory elements of the starter package. I recommend starting with a jurisdiction map: the Czech Republic, Slovakia and Cyprus are convenient for trading and holding structures; Estonia and United Kingdom — for tech and service companies; Singapore and Dubai — for regional headquarters and structures with active payment activity.

The register of beneficial owners (UBO register in the EU) and beneficiary disclosure requirements vary in depth and access regime. In some countries the register is partially public, in others special requests from “obligated persons” are required. At the registration stage we establish the corporate policy for preventing money laundering and compliance for cross-border corporate registration: we determine the documentation for banks’ and PSPs’ KYC/KYB, and design the ownership chain taking into account transparency and requirements for trusts and anonymous companies. This approach helps to expedite bank onboarding and reduces the risk of refusals.

Registration and support of companies in the EU from an AML perspective includes alignment with future licenses and banking needs. If the goal is: payment services, it is worth building in advance a functional compliance structure, the allocation of responsibilities of “obligated persons” for AML, and an initial set of CDD/EDD controls. When these elements are embedded before applying for an account or a license, the process proceeds noticeably faster.

AML Program Architecture

Illustration for the section 'AML Program Architecture' in the article 'AML Package 6.0 – analysis of the EU Directive and AMLA'
Compliance program AML for companies is a managed system of policy, procedures, a technology platform and metrics. I recommend starting with a risk-based approach: conduct an AML risk assessment, identify client and country risk profiles, determine high-risk scenarios, and then embed them in the corporate policy. It is important to describe roles and the chain of responsibility, including the director’s and corporate structure’s responsibility for AML, and an internal control plan.

Data privacy and GDPR in AML processes are a critical part of the design. We configure data retention rules and a retention policy: clear retention periods for KYC files, access logging, legal bases for processing and cross-border transfer. Integration of AML requirements into ERP and accounting systems via connectors provides a unified view of transactions, and reporting standards and compliance dashboards create managerial transparency. Such dashboards show compliance KPIs and ROI, onboarding time, the share of false positives and the conversion of CDD into successful account openings.

From a cost perspective, a cost-benefit analysis of implementing AML platforms is needed already at the RegTech selection stage. AML effectiveness metrics (KPIs and ROI) are not only about reducing fines and administrative measures for AML non-compliance, but also accelerating M&A, access to correspondent banking and reducing operating costs. Scaling AML processes as the business grows becomes a routine task when the architecture already supports new jurisdictions, languages and data sources.

How to implement KYC, KYB, CDD and EDD?

Illustration for the section «How to implement KYC, KYB, CDD and EDD?» in the article «AML Package 6.0 – analysis of the EU Directive and AMLA»
KYC and KYB requirements in the EU are based on 6AMLD and national laws, but expect the same logic: verification of identity, address, tax residency status, source of funds and UBO/BO status. For corporate clients, KYB includes checking registers, the charter, ownership structure, as well as assessing the business reputation of executives. We use automation of KYC processes and tools for VASP/PSP to reduce document collection time and minimize human errors.

CDD (Customer Due Diligence) is structured in levels: simplified, basic and enhanced. EDD (Enhanced Due Diligence) is triggered under increased risk: complex structures, PEP (politically exposed persons), transactions with high-risk jurisdictions. Sanctions and screening in the context of AML Package 6.0 include a regular reconciliation cycle against EU, OFAC and UK lists, as well as monitoring of connections. Practical implementation of UBO identification involves collecting confirmations along the chain up to individuals with a controlling interest, using cross-border counterparty screening tools and configuring repeat checks when the structure changes.

“Know-your-partner” procedures in the supply chain are useful not only for manufacturers. Payment services and fintechs often underestimate the risk of third parties: processors, outsourcers and referrers. The solution developed by COREDO includes a supplier risk matrix and standardized questions for the KYB questionnaire, which speeds up assessment and improves data quality.

Transaction monitoring and risk assessment

Illustration for the section «Transaction monitoring and risk assessment» in the article «AML Package 6.0 – analysis of the EU Directives and AMLA»
risk assessment for AML is a living document that is tied to transactional behavior models. We apply customer profiling and risk scoring, using historical and behavioral parameters: geography, average transaction amounts, types of counterparties, temporal patterns. Technologies for AML, transaction monitoring, screening, analytics: form an observation framework that operates in real time while also supporting off-chain monitoring for non-standard scenarios.

Transaction monitoring technologies require precise tuning of rules (rules tuning). Without this, a company faces an avalanche of false positives, loses operational efficiency and degrades the customer experience. Approaches to managing false positives include segmentation, adaptive thresholds, feedback from analysts and, where appropriate, the implementation of machine learning and regtech solutions for AML. We also create risk scenarios and conduct AML stress testing, simulating a surge in suspicious transactions or the loss of a data source to test the resilience of processes.

Monitoring the risks of counterparties and supply chains complements transactional rules. For cross-border companies we implement off-chain indicators: reputation in industry databases, court cases, changes in ownership structure. This layer improves the accuracy of EDD and helps promptly identify triggers for revising the risk profile.

Strategies for crypto and VASP

Regulation of virtual assets and VASP under the AMLA aligns the framework for crypto services with traditional financial institutions. Virtual asset service providers (VASP) and KYC requirements should cover customer identification, source-of-funds verification, sanctions screening, and monitoring of on-chain and off-chain transactions. Blockchain chain analysis and blockchain analytics help build a link-based risk model for addresses, wallets, and exchanges, and identify mixers, obfuscation, and connections to the darknet.

risk management when working with crypto assets requires correlating on-chain signals with off-chain customer profiles. For tokens and stablecoins, an additional layer evaluates the issuer, reserve model, and counterparties involved in redemptions. Regulatory tests and pilot projects (sandboxes) are a useful option if the market allows testing new compliance models under controlled risk. In several projects the COREDO team supported KYC pilots for VASP in the EU and Dubai, which enabled clients to obtain licenses faster and establish a dialogue with the regulator.

STR/SAR: interaction with the FIU

The obligations of obliged persons (obliged entities) under AML include detection and reporting of STR/STRs (or SAR), record keeping and cooperation with the FIU. Preparing and submitting STR/SAR requires a clear checklist: indicators of suspiciousness, escalation logic, the level of detail in the description of the pattern and attachments. We configure signal handling routes from first line to the MLRO to eliminate delays and improve the quality of reports.

Investigation of financial crimes and cooperation with the FIU is built on legal mechanisms of compelled data exchange and procedural deadlines. It is important to consider the legal risks of data transfer in AML investigations: legal bases under the GDPR, assessment of the recipient’s status and protection mechanisms, use of standard contractual clauses for cross-border exchange. financial intelligence (FIU) and information exchange in the EU and Asia are becoming increasingly structured, which reduces uncertainty and increases the predictability of regulatory interaction.

Licensing: payments, forex, crypto

obtaining financial licenses – is an assessment of the maturity of your AML system. For payment providers and PSPs, regulators assess governance, the independence of the compliance function, the quality of KYC/KYB, EDD and transaction monitoring. For forex and investment licenses, particular attention is paid to sources of liquidity, policies on high-risk jurisdictions and stress testing. Crypto licensing in the EU and Dubai integrates requirements for VASPs, blockchain analytics and counterparty risk management.

The impact of AML obligations on corporate transactions and due diligence has noticeably increased. The integration of AML requirements into M&A and corporate transformation includes audits of the client base, retrospective analysis of STRs, assessment of regulatory history and vendor due diligence. The participation of banks and non-bank institutions in AML is now assessed in the context of the single EU AML Package, and the alignment of national legislation with the AMLA reduces divergences in requirements for cross-border licensing.

Outsourcing third-party compliance

Outsourcing compliance functions and its risks are often underestimated. Outsourcing vs in-house – it’s not about “cheaper”, but about control, competencies and resilience. We usually set up a hybrid: key roles and decision-making in-house, while part of monitoring and screening is with external providers under clear SLAs and with audit rights. This approach simplifies scaling the AML infrastructure when entering new markets, while maintaining manageability.

Audit and internal control of AML programs are a mandatory practice that strengthens the chain of accountability in corporate AML governance. Staff training and certification of compliance officers improve the quality of CDD/EDD and reduce operational errors. If the system fails, fines and administrative measures for non-compliance with AML in the EU are substantial, and enforcement practice and fine cases in the EU show a trend of increasing sanctions for ineffective monitoring and weak sanctions screening.

COREDO: access to banks and de-risking

One of the recent projects was a fintech from Central Europe with a payment model for cross-border e-commerce. The client faced difficulties accessing banking services due to de-risking. The COREDO team rebuilt the compliance package: detailed suppliers’ KYB, strengthened sanctions screening, and implemented transaction profiling with adaptive thresholds. The bank reconsidered its decision, opening correspondent accounts after a pilot period with KPIs on false positives and alert handling time.

Another case: a VASP expanding into the EU and Dubai. We aligned policies with AMLA requirements and the local regulator, implemented blockchain analytics and off-chain monitoring, and ran a regulatory pilot within a sandbox. The result – accelerated licensing, a predictable dialogue with supervisors, and a ready infrastructure for scaling into new countries.

Third example: a corporate restructuring of a holding with assets in the EU and Asia. COREDO’s analysis identified bottlenecks in UBO identification and the retention policy for AML documents. We updated compliance dashboards, coordinated procedures with corporate security, and integrated AML into the ERP. This reduced the KYC re-evaluation time for counterparties from weeks to days and improved the quality of M&A due diligence.

AML Package 6.0 Compliance Plan

Every compliance officer benefits from a pragmatic roadmap. Below is the checklist we use during implementation.

Conduct an AML risk assessment and record the risk appetite. Ensure that client, country, product and sales channel profiles reflect the current strategy and growth plans. Update the risk map at least once a year and after major business changes.
Update the AML compliance program, roles and accountability. Define MLRO authorities, describe escalation and independence of control. Document the corporate policy on anti-money laundering and sanctions screening.
Review KYC/KYB, CDD/EDD and PEP procedures. Include automation of KYC processes, regular sanctions screening and relationship checks. Clarify the practical implementation of UBO identification and the frequency of data updates.
Reconfigure transaction monitoring and rules tuning. Introduce metrics for false positives, average alert handling time and the share of escalations to STR/SAR. Conduct transaction analysis in real time and off-chain monitoring for atypical scenarios.
Approve the STR/SAR playbook and interaction with the FIU. Describe suspicion criteria, the quality of the evidentiary base and filing deadlines. Check legal data-exchange mechanisms and GDPR compliance.
Check AML integration into ERP/accounting and dashboards. Ensure data integrity, access log audits and consistency of reporting standards. Set compliance KPIs and ROI to demonstrate business impact.
Organize training and testing for staff. Run targeted modules for the front office, analysts and management every six months. External certification and participation in industry programs are useful for compliance officers.
Agree the outsourcing process and third-party controls. Document SLAs, audit rights, security requirements and continuity plans. Verify vendor approaches’ compatibility with 6AMLD and local regulations.
Prepare a high-risk and sanctions policy. Develop a policy for working with high-risk jurisdictions and client profiles. Clarify the approach to tokens, stablecoins and VASPs, if relevant.
Plan regulatory engagement and pilots. If the product is innovative, consider participation in sandboxes and supervised pilots. This will speed up feedback and reduce regulatory uncertainty.

COREDO supports such projects “turnkey”: from diagnostics and a roadmap to RegTech selection and implementation. Our experience at COREDO has shown that phased implementation and transparent metrics reduce internal resistance and strengthen the trust of banks and regulators.

What to consider when entering new countries

AML analysis when entering the markets of Asia and the CIS must take into account local standards and the FATF’s international recommendations. Differences in access to UBO registries, document retention periods and STR formats can affect process design. The impact of AMLA on fintech and payment services in the EU makes the European part of the infrastructure more predictable, which simplifies integration with Singapore and Dubai.

Interaction with law enforcement during investigations requires a clear role for the legal function. Corporate policies on receipt and storage of documents, legal bases for data sharing and documented criteria for suspicion reduce legal risks. When all of this is described and embedded into tools, compliance stops slowing the product down and helps the business grow.

Why I support systemic compliance

Compliance is not an “insurance against fines”, but an operational discipline that increases a company’s capitalization. AML Package 6.0, the EU Directive on anti-money laundering and the launch of AMLA are creating a common playing field with clear rules, and those who adapt their processes earlier will gain an advantage. I see COREDO clients opening accounts faster, obtaining licenses with confidence, and shortening deal cycles when compliance is integrated into the business architecture.

The COREDO team has implemented projects in the EU, the UK, Singapore and Dubai, from registration and licensing to setting up monitoring and providing full AML support for companies. I continue to personally oversee complex cases and am convinced: transparency, technological sophistication and discipline deliver the best results. If you plan to scale, pursue M&A, or expand into new markets, build compliance into your growth strategy: it will save time and strengthen the trust of partners, banks and regulators.

AML Package 6 0 analysis of the EU Directive and the AMLA