COREDO – EU Legal & Compliance Services Expert legal consulting, financial licensing (EMI, PSP, CASP under MiCA), and AML/CFT compliance across the European Union. Headquartered in Prague, we provide seamless regulatory solutions in Germany, Poland, Lithuania, and all 27 EU member states.
Gregory Lutsenko
01.08.2025 | 6 min read
Updated: 14.10.2026
KYC and AML requirements in the EU are changing in stages, not all at once. Customer and beneficial owner checks have long been mandatory, and crypto businesses have been subject to MiCA and the travel rule since 30 December 2024. AMLA has been operating since 1 July 2025, but the main turning point comes on 10 July 2027, when AMLR starts to apply. Companies from the CIS entering EU markets are checked by European banks and partners under exactly these rules.
As Head of Compliance at COREDO, I see every day how these changes affect our clients' projects. In this article, I will walk through the timeline of EU KYC and AML requirements from 2015 to 2029: what is already mandatory and what will apply later. I will share practical solutions that the COREDO team has implemented for clients in the EU, Singapore, Dubai, and the CIS. At the end of the article, you will find specific steps to help prepare your business for 10 July 2027.
KYC for Business in the EU and CIS: What Already Applies
KYC for business in the EU and CIS is a key tool for ensuring transparency and preventing financial crimes in international activities. KYC requirements vary significantly between jurisdictions, so it is important to separate the rules in force from those still to come. Below, we look at the KYC standards that companies must already comply with and at what will change in the coming years.
KYC Standards for Companies: What Is Already Mandatory
In the EU, customer due diligence (CDD) has long been mandatory, and the fourth AML directive (Directive (EU) 2015/849, AMLD4) set it out in its current form. Member states had to transpose the directive into national law by 26 June 2017. The directive requires identifying the customer and the beneficial owner and ongoing monitoring of the business relationship based on a risk-based approach. Where the risk is higher, enhanced due diligence (EDD) applies. Remote identification (eKYC) through digital onboarding is allowed, but neither the AML rules nor eIDAS 2.0 make it mandatory.
COREDO's practice confirms: implementing platforms with automated document verification, biometric identification, and integration with state registries allows not only to speed up onboarding but also significantly reduce operational risks. For instance, a project launching digital onboarding for a European payment provider reduced the client verification time from 3 days to 40 minutes while the false positive rate in sanctions screening dropped by 60%.
Identification of Business Beneficiaries
Identifying beneficial owners (ultimate beneficial owner, UBO) is not a new obligation of 2025. AMLD4 required companies to hold accurate and current information on their beneficial owners and required member states to keep this information in central registers. By 10 July 2025, member states had to update the rules on access to these registers: obliged entities carrying out customer due diligence and persons with a legitimate interest have access. From 10 July 2027, AMLR introduces uniform EU-wide rules for identifying beneficial owners, while source of funds verification and client status monitoring remain part of the checks.
A solution developed by COREDO for a large holding with offices in the Czech Republic and Estonia allowed the automation of the collection and verification of beneficiary data, the implementation of continuous customer monitoring, and effective sanctions screening including PEP and their associates. This approach minimizes the risks of fines and account freezes and facilitates interactions with regulators.
KYC for CIS Companies and International Deals
CIS companies entering EU markets face differences in KYC standards and in the rules on disclosing beneficial owners. Each CIS country has its own anti-money laundering law and its own supervisory authority. In Russia, for example, the core act is Federal Law No. 115-FZ of 7 August 2001, and the Bank of Russia issues separate guidance to financial organisations on identifying clients' beneficial owners. A European bank or payment provider, however, checks the client under EU rules, whatever the client's country of origin.
Registering a company in Singapore or Dubai adds the requirements of one more jurisdiction, and they need to be aligned with EU rules. Our experience shows that only a comprehensive strategy including due diligence procedures, cross-jurisdictional compliance, and regular compliance audits allows for risk minimization and sustainable business development.
That is why it pays to prepare for the new EU AML requirements early: all the key dates are already known.
EU AML Requirements 2024–2029, Business Changes
On 19 June 2024, the AML package was published in the Official Journal of the EU, setting a new basis for EU AML requirements. It includes the AMLR regulation, the sixth AML directive (AMLD6), and the regulation establishing AMLA. The package takes effect in stages, so businesses need to know which requirements apply now and which apply only from 2027.
AMLR and AMLD6: What Changes and When
AMLR (Regulation (EU) 2024/1624) applies from 10 July 2027, and from 10 July 2029 for football agents and professional football clubs. By 10 July 2027, member states must also transpose AMLD6 (Directive (EU) 2024/1640) into national law. AMLR replaces national transpositions with a single, directly applicable rulebook: customer due diligence, beneficial owners, reporting of suspicions, and limits on large cash payments. The industry also uses the name "6AMLD" for Directive (EU) 2018/1673 on combating money laundering by criminal law. Member states had to transpose it by 3 December 2020, and among other things it introduced the liability of legal persons.
The European anti-money laundering authority AMLA (Regulation (EU) 2024/1620) has been operating in Frankfurt am Main since 1 July 2025. AMLA must start the first selection of entities for its direct supervision by 1 July 2027, and direct supervision itself will begin in 2028. For most companies, supervision will remain with national authorities even after that.
COREDO's team implemented a project for an international investment fund where new suspicious activity reporting (SAR) procedures and internal control automation allowed not only compliance with new requirements but also increased the company's investment attractiveness through transparency of compliance processes.
Monitoring and Reporting of Suspicious Activities
Ongoing monitoring of the business relationship and of the client's transactions is an obligation that already applies under AMLD4 and continues under AMLR. The company checks whether transactions match what it knows about the client, the client's business, and risk profile. The obliged entity promptly reports suspicious transactions to the financial intelligence unit (FIU), which is known as suspicious activity reporting (SAR). The law does not require full automation, but AI-supported transaction monitoring systems, transaction scoring, and screening against sanction lists and PEP help meet these obligations.
Implementing such systems at COREDO for a European fintech startup enabled the integration of machine learning into KYC and AML, improved the accuracy of detecting suspicious transactions, and reduced the costs associated with manual data processing. As a result, the company successfully passed a compliance officer audit and received a license for payment services in the EU.
Preventing Money Laundering: Control
A money laundering prevention policy requires not only formal procedures but also their deep integration into the company's internal processes. From 10 July 2027, AMLR requires appointing a member of the management body responsible for AML compliance and a compliance officer. The regulation also governs the reporting of breaches (whistleblowing) and the protection of reporting persons. Compliance officer duties include regular internal AML/KYC audits, self-assessment compliance, and outsourcing of certain functions if necessary.
COREDO's experience shows that an effective internal control policy is not just about compliance but a tool for risk management and enhancing trust from partners and investors. Implementing automated compliance audits and regular employee training minimizes the human factor and increases the business's resilience to regulatory changes.
KYC/AML Automation: Trends 2025–2027
KYC/AML automation is a lasting trend that helps businesses respond more quickly to new requirements and counter financial fraud more effectively. The law, however, requires a result, namely proper customer due diligence and monitoring, not a specific technology. Artificial intelligence, anti-fraud tools, and digital identity help achieve this result faster.
KYC Automation and Anti-Fraud Integration
KYC process automation and anti-fraud system integration are becoming the standard for companies working with fintech, payment services, and cryptocurrencies. AI, digital onboarding, KYC utilities, and anti-fraud tools speed up identification and improve the quality of client checks. The eIDAS 2.0 regulation (Regulation (EU) 2024/1183) adds a new tool: by the end of 2026, each member state must provide a European Digital Identity Wallet. By the end of 2027, banks and financial services that must use strong user authentication have to accept such a wallet at the client's voluntary request. Micro and small enterprises are exempt from this rule. AMLR expressly allows verifying a client's identity through electronic identification means that meet eIDAS requirements.
The COREDO team implemented a platform for one of the large European merchant aggregators, which combines automated KYC, transaction scoring, and integration with external anti-fraud services. This approach ensures a high level of identity theft prevention and effectively identifies high-risk clients at early stages of interaction.
GDPR and AML/KYC: How to Comply with Requirements?
One of the main challenges is balancing GDPR requirements and AML/KYC. AMLR devotes a separate chapter to the processing of personal data and record retention. Remote verification and digital onboarding using eIDAS require strict adherence to data privacy vs. AML principles. Companies should check in advance what data they collect, on what basis, and for how long they keep it.
A solution implemented by COREDO for a fintech company in Estonia allowed the integration of AML/KYC compliance with internal IT systems, ensured automatic reporting, GDPR compliance, and enhanced client trust through transparency in data processing.
AML in Fintech and Cryptocurrencies
For crypto businesses, the key changes have already happened. MiCA (Regulation (EU) 2023/1114) has applied in full since 30 December 2024, and its Titles III and IV on stablecoins since 30 June 2024. Regulation (EU) 2023/1113 has also applied since 30 December 2024: in transfers of crypto-assets, providers pass on information about the originator and the beneficiary (travel rule). Providers of exchange services between cryptocurrencies and fiat currencies and custodian wallet providers became obliged entities under AMLD5, whose transposition deadline expired on 10 January 2020. KYC procedures for crypto companies should be continuously updated in line with FATF recommendations.
COREDO's practice shows that only adaptive AML/KYC processes based on machine learning and continuous customer monitoring allow fintech companies and crypto businesses to successfully pass Licensing and scale operations in international markets.
Effective management of these processes is impossible without the involvement of a qualified compliance officer, whose role becomes crucial at all stages of AML/KYC.
The Role of a Compliance Officer in AML/KYC Business
The role of a compliance officer in AML/KYC business is becoming increasingly key, as these specialists are responsible for building, implementing, and continuously improving the systems combating financial crimes. In modern realities, the compliance officer ensures compliance with AML and KYC requirements, acting as a liaison between the business and the regulator.
Duties of a Compliance Officer: What AMLR Changes
The duties of a compliance officer go beyond classic monitoring: they require a deep understanding of AML/KYC standards, regular compliance audits, whistleblowing implementation, and management of internal policies. From 10 July 2027, AMLR sets out this function directly: an obliged entity must have a compliance officer appointed by its management body. Until then, the requirements for the compliance function are set by the national law of each EU country. That is why compliance officers should build their expertise now and compare internal procedures with the text of AMLR.
The COREDO team, in accompanying clients in the UK and Slovakia, implemented an internal audit system that allows compliance officers to promptly identify and eliminate discrepancies and prepare the company for regulatory inspections.
Preparing for Audits and Company Inspections
Legal business support in the EU and CIS includes preparation for compliance audits, self-assessment compliance, and reporting under current and future standards. It is important not only to have formal policies but to ensure their actual implementation in practice.
A solution implemented by COREDO for an international holding included checklists for audits, data collection automation, and integration with state registries. This approach significantly reduces preparation time for inspections and the risk of fines.
How to Reduce Risks and Costs for AML/KYC
COREDO's experience shows that compliance cost optimization is possible through the introduction of technologies, outsourcing some functions, and selecting effective platforms for KYC/AML. For example, transferring to cloud compliance platforms with AI support allowed one of the clients to reduce AML costs by 35% without compromising quality.
Best practices for risk management include regular reviews of the risk-based approach, client segmentation by risk, transaction monitoring automation, and staff training. This approach ensures not only compliance with new standards but also the long-term sustainability of the business.
AML and KYC: Timeline of EU Requirements 2015–2029
Since 2015, AML and KYC regulation in the EU has changed several times, and further stages are still ahead. Companies working in EU and CIS markets find it easier to plan their processes when all the dates are in one table. Below are the key EU acts, the dates they apply from, and what they change for businesses.
Key AML/KYC Dates in the EU
| Date | EU act | What changes for businesses |
|---|---|---|
| 26.06.2017 | AMLD4, Directive (EU) 2015/849, Art. 67 | Transposition deadline: CDD, EDD, identification of beneficial owners, central UBO registers (Arts. 13, 18, 30) |
| 10.01.2020 | AMLD5, Directive (EU) 2018/843, Art. 4 | Crypto-to-fiat exchanges and custodian wallet providers become obliged entities |
| 03.12.2020 | Directive (EU) 2018/1673, Art. 13 | Criminal law measures against money laundering, liability of legal persons (Art. 7) |
| 19.06.2024 | AMLR 2024/1624, AMLD6 2024/1640, AMLA Regulation (EU) 2024/1620 | The AML package is published in the Official Journal of the EU |
| 30.06.2024 | MiCA, Regulation (EU) 2023/1114, Art. 149(3) | MiCA Titles III and IV on stablecoins apply |
| 30.12.2024 | MiCA, Art. 149(2); Regulation (EU) 2023/1113, Arts. 14 and 40 | MiCA applies in full; travel rule for transfers of crypto-assets |
| 01.07.2025 | Regulation (EU) 2024/1620, Art. 108 | AMLA starts operating in Frankfurt am Main |
| 10.07.2025 | AMLD6, Arts. 74 and 78 | New rules on access to beneficial ownership registers: obliged entities and persons with a legitimate interest |
| End of 2026 | eIDAS 2.0, Regulation (EU) 2024/1183, Art. 5a | Each member state provides a European Digital Identity Wallet |
| 10.07.2027 | AMLR, Art. 90; AMLD6, Art. 78 | Single directly applicable rulebook; AMLD6 transposition deadline |
| End of 2027 | eIDAS 2.0, Art. 5f | Banks and financial services using strong authentication accept the wallet at the client's request |
| 2028 | Regulation (EU) 2024/1620, Art. 13 | AMLA direct supervision of selected entities; first selection by 01.07.2027 |
| 10.07.2029 | AMLR, Art. 90 | AMLR applies to football agents and professional football clubs |
The table shows the main point: the basic KYC obligations have applied for a long time, and 2025 was a transition year rather than a single turning point. For crypto businesses, the changes have already arrived with MiCA and the travel rule. For other obliged entities, the key date is 10 July 2027, when AMLR starts to apply.
Harmonization of EU and CIS Standards: What to Know
The common reference point for the EU and the CIS countries is the FATF recommendations, the international standard for combating money laundering. Within the EU, AMLR will provide harmonization, while in the CIS each country's requirements must be checked against its national law. For international businesses, this means a single KYC system that passes checks under EU rules and takes into account the requirements of each country of operation.
COREDO's experience shows that the implementation of KYC/AML in the B2B segment, company registration in Asia and Africa, as well as integration with international platforms, allows businesses not only to meet the requirements of different jurisdictions but also to increase investment attractiveness through transparency and sustainability of compliance processes.
Practical Recommendations for Business
Summary of Key Changes:
- Basic KYC obligations (CDD, EDD, identification of beneficial owners) have applied in the EU for a long time, not since 2025; AMLD4 set them out in their current form.
- For crypto businesses, MiCA and the travel rule have applied since 30 December 2024; AMLA has been operating since 1 July 2025.
- AMLR and AMLD6 apply from 10 July 2027, and AMLA's direct supervision of selected entities will begin in 2028.
- The compliance officer becomes a key figure responsible for internal audit, whistleblowing implementation, and staff training.
- Technologies (AI, machine learning, anti-fraud tools) allow cost optimization and increase compliance efficiency.
Checklist for Preparing a Company for New KYC/AML Standards:
- Perform an audit of current KYC/AML procedures and a gap analysis against the text of AMLR.
- Implement digital onboarding and eKYC considering eIDAS 2.0 and the European Digital Identity Wallet.
- Update the policy for beneficiary verification and source of funds verification.
- Automate transaction monitoring and integrate anti-fraud systems.
- Appoint a compliance officer with expanded powers.
- Ensure GDPR compliance in personal data processing.
- Prepare the company for compliance audit and interaction with regulators.
Recommendations for Choosing Technologies and Partners:
- Evaluate the ROI of implementing new AML/KYC platforms.
- Use solutions supported by AI and automation.
- Choose partners with experience in cross-jurisdictional compliance and deep knowledge of EU, CIS, Asia, and Africa legislation.
Advice on Reducing Risks and Costs:
- Regularly review the risk-based approach and client segmentation.
- Outsource some compliance functions to optimize costs.
- Implement staff training and internal whistleblowing procedures.
COREDO's practice confirms that timely adaptation to new KYC/AML standards is not only a regulatory requirement but a strategic asset for international business development. Readiness for changes, investment in technology, and partnership with COREDO experts will ensure your business's sustainability and competitive advantage in the global market.