EU AML Package Tracker: Level 2 and Level 3 Text Status
Every RTS, ITS, and Guideline AMLA has published or opened for consultation under the EU AML Package, sourced directly from AMLA's own regulatory instruments page, not a secondary summary.
The EU AML Package, made up of the AML Regulation (AMLR), the sixth AML Directive (AMLD6), and the new Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), sets the Level 1 framework, but firms can’t actually build a compliant programme against Level 1 text alone. The operational detail sits in the Level 2 (Regulatory and Implementing Technical Standards) and Level 3 (Guidelines) instruments AMLA is still finalising. AMLR itself applies from 10 July 2027, and most Level 2/3 instruments were due to reach the European Commission by 10 July 2026, which makes the gap between “the law exists” and “the detail is final” the actual readiness question for the next several quarters.
This tracker follows every RTS, ITS, and Guideline AMLA has published or opened for consultation, sourced directly from AMLA’s own regulatory instruments page(amla.europa.eu). Each entry reflects that page’s status as of the date above, and each status links directly to AMLA’s own page for that instrument.
Where things standAMLA · About ↗
Instruments in consultation
| Instrument | Legal reference | Covers | Status |
|---|---|---|---|
| RTS | AMLD Art. 40(2) | Assessment of inherent and residual risk profile of obliged entities in the non-financial sector | Consultation open |
| RTS | AMLD Art. 31(3) | Cross-border information exchange between Financial Intelligence Units (FIUs) | Consultation open |
| ITS | AMLR Art. 69(3) | Format for reporting suspicions and providing transaction records | Consultation closed |
| GL | AMLR Art. 26(5) | Ongoing monitoring of business relationships | Consultation closed |
| GL | AMLR Art. 10(4) | Business-wide risk assessment | Consultation closed |
| RTS | AMLR Art. 16(4) & 17(3) | Group-wide minimum requirements for subsidiaries/branches in third countries | Consultation closed |
| RTS | AMLD Art. 46(4) | Home–host supervisory cooperation | Consultation closed |
| RTS | AMLR Art. 28(1) | Customer due diligence: standard, simplified, and enhanced measures | Consultation closed |
| RTS | AMLR Art. 19(9) | Criteria for business relationships, occasional and linked transactions, lower thresholds | Consultation closed |
9 instruments · 2 open for consultation, 7 closed and awaiting a final report.
Instruments finalised (final report published, pending adoption)
| Instrument | Legal reference | Covers | Status |
|---|---|---|---|
| ITS | AMLAR Art. 15(3) | Cooperation within the AML/CFT supervisory system for direct supervision | Final report published |
| RTS | AMLD Art. 53(10) | Pecuniary sanctions, administrative measures, periodic penalty payments | Final report published |
| ITS | AMLR Art. 81(1) | FIU reporting to the European Public Prosecutor's Office (EPPO) | Final report published |
| ITS | AMLAR Art. 41(2) | AMLA reporting to the EPPO | Final report published |
| ITS | AMLD Art. 31(2) | FIU-to-FIU exchanges | Final report published, with annexes |
| RTS | AMLD Art. 40(2) | Risk profile assessment for obliged entities in the financial sector | Final report published |
| RTS | AMLAR Art. 12(7) | Risk assessment for selecting institutions for direct AMLA supervision | Final report published |
7 instruments with a final report published, ahead of formal adoption/entry into force.
Still governed by existing EBA/EC instruments
Issued under the predecessor framework (AMLD5, the EBA Regulation). Worth tracking separately, since a firm building toward AMLR shouldn't assume these lapse the moment AMLR applies.
| Instrument | Legal basis | Covers | Status |
|---|---|---|---|
| RTS | AMLD5 Art. 45(6) | Mitigating ML/TF risk where third-country law restricts group-wide policies | Reg. (EU) 2019/758 in effect |
| RTS | AMLD5 Art. 45(9) | Criteria for appointing and the functions of a central contact point | 2025 amendment pending OJ publication |
| RTS | EBA Reg. Art. 9a(1) & 9a(3) | Central EU database on AML/CFT | Reg. (EU) 2024/595 adopted |
| GL | AMLD5 Art. 17; 18(4) | CDD and ML/TF risk factors for business relationships | Consolidated 2023 |
| GL | AMLD5 Art. 13(1) | Remote customer onboarding solutions | In effect |
| GL | TFR Art. 23 | Internal policies for implementing restrictive measures | In effect |
| GL | TFR Art. 36; AMLD5 Art. 19a(2) | Travel Rule: fund/crypto-asset transfer information requirements | In effect |
| GL | AMLD5 Art. 8; Ch. VI | Compliance management and the AML/CFT Compliance Officer's responsibilities | In effect |
| GL | EBA Reg. Art. 16 | De-risking: ML/TF risk management for access to financial services | In effect |
| GL | AMLD5 Art. 48(10) | Risk-based AML/CFT supervision: characteristics and procedures | In effect |
| GL | EBA/ESMA/EIOPA Art. 16 & 56 | AML/CFT colleges: cooperation and information exchange | Joint guidelines in effect |
Why this matters beyond a tick-box exercise
A firm that builds its AMLR-readiness programme purely against Level 1 text is building on the 20% that’s actually fixed. The remaining detail, the exact contents of a business-wide risk assessment, what “sufficient” customer due diligence looks like sector-by-sector, the reporting template a suspicious transaction has to use, only becomes buildable once the relevant RTS, ITS, or Guideline actually finalises. Tracking which instruments are still in consultation versus which have a final report published is the difference between building a compliance programme once, correctly, and rebuilding pieces of it every time AMLA finalises another measure.
How this tracker is kept current
This page is sourced directly from AMLA’s own regulatory instruments page and refreshed on a recurring schedule, roughly every three weeks. If you’re relying on this for a live compliance build, treat the “Last updated” date at the top as the freshness check, and cross-reference anything time-critical against AMLA’s own site directly.
You’ve just walked through the EU AML Package in the abstract.
See what your own obligations look like.
Check Your Regulations →