AMLA explained: new EU AML rules for dutch businesses

The reason AMLA exists at all comes down to one word: fragmentation. The previous system ran on directives, and each of the 27 member states transposed those directives into national law in its own way, producing 27 different interpretations of what were meant to be the same rules. A major Dutch bank and a major Romanian bank were technically subject to the same EU AML directive, yet faced materially different requirements, different enforcement cultures, and different supervisory expectations depending purely on which country they happened to sit in. AMLA's mandate is to end that fragmentation, through binding technical standards that apply uniformly, coordination of national supervisors, and, for the highest-risk cross-border entities, direct supervision from Frankfurt itself.

Key takeaway: AMLA does not replace DNB or AFM as the supervisor for Dutch businesses. For the vast majority of Dutch obliged entities, accountants, notaries, real estate agents, jewellers, car dealers, payment providers, the day-to-day supervisor stays exactly the same Dutch authority it has always been. What changes is the rulebook those supervisors enforce. From 10 July 2027, the AMLR replaces the Wwft as the primary source of AML obligations.

The Wwft is still the operative law today, and its most recent visible change, the cash payment ban that took effect on 1 January 2026, was itself simply an amendment added to that existing framework; Dutch cash payment ban covers exactly what that amendment introduced and gives a sense of what the Wwft still governs today.

Three Instruments, One Package

Most of the confusion around what AMLA actually means for a Dutch business comes from treating three separate legal instruments as though they were one thing. They are connected, but each has a different legal form, a different application date, and a different practical consequence, and knowing which one is being discussed determines exactly what action is actually needed and when.

The distinction between the AMLR, directly applicable from Brussels, and AMLD6, which needs a Dutch parliamentary process to actually land, matters in practice because it determines whether an obligation simply arrives automatically or depends on domestic legislation clearing the Tweede Kamer and Eerste Kamer first. The practical upshot either way is the same for a Dutch business: from 10 July 2027, understanding your obligations means reading both the AMLR and the Iwt, not the Wwft that has been the reference document since 2008, since that document will no longer be the one that actually governs you.

The reason 2026 specifically matters, rather than simply waiting for the 2027 deadline, comes down to a genuinely practical detail. Between now and 2027, AMLA has to publish 23 separate Level 2 and Level 3 measures, regulatory technical standards, implementing technical standards, and guidelines, and most of them are due by 10 July 2026. That makes 2026 the year compliance teams actually need to act rather than wait, since these technical standards are what define the real, granular detail of what the AMLR requires once it applies. Organisations that start reviewing their processes against these standards as they get published through the second half of 2026 will walk into July 2027 genuinely ready. Organisations that wait for the application date itself will be building compliance under real time pressure, with far less room to get it right the first time. Since payment providers in particular sit at the intersection of this AML framework and the broader payments regulation landscape, PSD2 and open banking Netherlands gives useful context for how the two regimes overlap.

What the AMLR Changes for Dutch Obliged Entities

For the Dutch accountant filing UBO notifications, the real estate agent conducting cliëntenonderzoek on a property buyer, the notary applying enhanced due diligence to an unusual transaction, and the bank monitoring payments for suspicious patterns, the Wwft has been the operational framework since 2008. From 10 July 2027, the AMLR applies directly across the EU as a regulation, and the Wwft is revoked as a result. This is not a renewal of the same obligations under a new name. It is a genuine replacement with a harmonised EU standard that raises the bar in several specific areas.

The business-wide risk assessment becomes considerably more structured. Under the current Wwft, an obliged entity has to assess the money laundering and terrorist financing risks relevant to its own business, but neither the format nor the minimum content of that assessment is prescribed in much detail. The AMLR requires a formal business-wide risk assessment with content specified by AMLA's own regulatory technical standards, expected by 10 July 2026. Dutch businesses that have gotten by with an informal or summary version of this assessment need to upgrade it properly before the 2027 deadline arrives, not after.

Customer due diligence standards get harmonised, and in some cases genuinely raised. The AMLR keeps the risk-based approach at the heart of CDD, more risk demands more scrutiny, but the specific categories, triggers, and methods used to apply that principle are harmonised across the whole EU. Where Dutch practice under the Wwft has historically been more lenient than the new harmonised standard, a Dutch business needs to upgrade. Where Dutch practice has actually been stricter, the harmonised standard simply becomes the new floor rather than the ceiling.

Sanctions screening moves inside the CDD process entirely, and this is a structural change rather than a paperwork update. Under current Dutch law, sanctions checks under the Sanctiewet 1977 are frequently handled by a separate compliance function sitting apart from ordinary Wwft due diligence. The AMLR requires targeted financial sanctions screening to be embedded directly within the CDD process itself, not treated as a standalone obligation running in parallel. Any obliged entity whose compliance function still treats these as two separate workflows needs to redesign that structure before July 2027, since the AMLR does not simply ask for both checks to happen somewhere; it asks for one integrated framework.

Suspicious transaction reporting shifts to a harmonised format. Reporting an unusual transaction currently goes to FIU-Nederland in whatever format Dutch law specifies. From 10 July 2027, AMLA's own implementing technical standards define a harmonised STR format applying across every member state at once. Organisations that have already automated their reporting need to update those systems to the new format; organisations still reporting manually need to become familiar with what that new format actually looks like well before the switchover date arrives. Since documentation quality is exactly what any supervisor, Dutch or European, actually examines when something goes wrong, boekenonderzoek Belastingdienst covers what audit-readiness genuinely looks like in a Dutch compliance context, and eHerkenning Netherlands covers the digital identity infrastructure that regulatory reporting of this kind increasingly runs through.

Who Is in Scope, and Who Was Not Before

The AMLR expands the list of obliged entities, the businesses legally required to run an AML programme, conduct customer due diligence, and report unusual transactions, in ways that bring entire sectors into scope for the first time at EU level. For Dutch businesses newly caught by this expansion, the jump from no obligation at all to a full obligation by 10 July 2027 is the single most significant planning challenge in the whole package.

Crypto-asset service providers make up the largest new category by volume. Dutch CASPs already hold MiCA licences from the AFM and already carry Wwft obligations under the current Dutch framework, so this is not entirely new territory for them, but the AMLR layers harmonised EU-level AML standards on top that may genuinely differ from what the Wwft currently demands. A CASP operating across several EU member states needs to work out which standard, Dutch or EU-harmonised, is actually more demanding in each specific area, and bring its compliance up to whichever bar is higher before July 2027 rather than assuming its current setup already covers the new requirement.

Professional football clubs and player agents form a genuinely new category, and one that surprises most people the first time they hear about it. Large, hard-to-explain cash flows in player transfers, image rights payments, and broadcasting deals make football a recognised money laundering vector, and the EU has decided to address it directly rather than leave it as a gap. Dutch Eredivisie clubs, and any licensed agent handling player transfers, will carry full AML obligations from 10 July 2027: appointing a compliance officer, running a genuine business-wide risk assessment, building customer due diligence procedures, and implementing transaction monitoring. Building a compliance programme from literally nothing typically takes twelve to eighteen months, which means a club that has not started this work by early 2026 is already running against a genuinely tight clock.

Luxury goods dealers face expanded and more specific obligations than the current Wwft imposes. Dealers in precious metals, precious stones, jewellery, watches, motor vehicles, aircraft, and vessels all see more detailed requirements under the AMLR. The DFEI stays their supervisor either way, but the standards it enforces become the AMLR's standards rather than the Wwft's, and any dealer currently relying on the Wwft's relatively lighter touch for certain transaction categories needs to check specifically whether the new rulebook raises the bar in their particular corner of the market.

Watch out: AMLA's own direct supervision covers roughly 40 entities, almost entirely large, cross-border financial groups operating in at least six EU member states with a genuinely high money laundering risk profile. Essentially no Dutch SME will ever face direct AMLA supervision. But AMLA sets the standards that DNB, AFM, and the DFEI actually enforce, and those standards apply to every single Dutch obliged entity regardless of size. The harmonisation of supervisory methodology across the EU means national supervisors themselves will be held to more consistent enforcement quality, which raises, rather than lowers, the odds that a genuine gap in a Dutch business's AML programme actually gets found and penalised.

Since the crypto side of this scope expansion connects directly to how Dutch businesses handle newer payment methods, stablecoins payment method Netherlands covers exactly how CASP obligations and the MiCA licensing framework fit together.

The 2026 and 2027 Planning Window

A Dutch obliged entity starting to prepare for the AMLR in September 2026 has a little over ten months until the 10 July 2027 application date. That is genuinely enough time, provided the organisation is reasonably organised, understands specifically what needs to change, and has a compliance function actually capable of executing the necessary updates. It is not remotely enough time for an organisation that treats the AMLR as a future problem and waits for the official application date before opening the rulebook for the first time.

The first useful action is a proper gap analysis: comparing the current Wwft-based AML programme directly against the AMLR's requirements as they get published in AMLA's technical standards through the rest of 2026. The business-wide risk assessment RTS due by 10 July 2026, the CDD guidelines, and the sanctions screening integration requirement are the three areas most worth assessing first, since they represent the biggest structural shifts rather than incremental adjustments. A law firm, a compliance consultant, or a sector association can genuinely help with this assessment rather than an organisation needing to work through the full technical text alone.

The second useful action is a documentation upgrade. The AMLR raises the expected standard for how AML decisions actually get documented: the business-wide risk assessment, customer risk classifications, CDD records, and unusual transaction reports all need to be genuinely auditable and meet the new minimum content requirements once the AMLR applies. Organisations that have relied on informal or purely oral processes up to now need those processes formalised on paper well before 2027, not scrambled together once an inspector actually asks for them.

The third useful action is a systems review. Any organisation running automated transaction monitoring, CDD screening, or STR reporting needs to check whether its current systems can actually accommodate the harmonised formats and standards AMLA is publishing throughout 2026. Vendors of AML screening tools, transaction monitoring platforms, and KYC automation software are updating their own products to the AMLR standard as this rolls out, and lining up contract renewal timelines with the July 2027 application date avoids a genuinely unpleasant last-minute systems scramble that nobody actually wants to be managing under deadline pressure.

For Dutch businesses in the newly covered sectors specifically, football, luxury goods, and certain CASP activities, the action is more foundational than any of the above. It starts with simply recognising that an AML obligation now exists at all, appointing someone specifically responsible for it, and beginning the process of building a basic CDD and reporting framework from scratch. The DFEI remains the supervisor for most of these businesses, and it has already signalled that it expects genuine preparedness from the effective date itself, not preparedness that quietly arrives some months after the fact. Since a professional advisor is exactly the kind of resource most of these newly covered businesses will need to lean on, accountant or bookkeeper covers where that kind of guidance typically fits in, and starting a company in the Netherlands covers the wider regulatory landscape a new Dutch BV needs to navigate from day one.

Get Ahead of 10 July 2027, Not Behind It

None of this requires panic, and it does not mean your Dutch supervisor is about to change. It does mean the rulebook that supervisor enforces is being rewritten in real time, with most of the technical detail landing throughout 2026, and the businesses that read that detail as it arrives will be considerably better positioned than the ones waiting for a deadline that, by the time it arrives, leaves no room left to adjust.

If you want help understanding how your current AML obligations map against what the AMLR will actually require, book a demo and we will walk through your specific situation. Our team can also help you incorporate your BV or get bookkeeping and payroll running correctly alongside whatever compliance framework your business actually needs.

FAQs

What is AMLA?

AMLA is the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, the first EU authority set up exclusively to fight financial crime. It was established on 26 June 2024, became operational on 1 July 2025, and took over the EU's AML and counter-terrorist financing mandate from the European Banking Authority on 1 January 2026.

Is AMLA the same as the AMLR?

No. AMLA is the institution, the EU agency itself. The AMLR is the separate rulebook, Regulation (EU) 2024/1624, that AMLA helps develop and that will apply directly across the EU from 10 July 2027, replacing the Dutch Wwft.

When does AMLA start directly supervising businesses?

AMLA's direct supervision of selected high-risk entities begins in 2028, following a selection process running through 2027. Data collection from national supervisors to inform that selection was due by 15 August 2026.

Will AMLA directly supervise my Dutch business?

Almost certainly not. AMLA directly supervises only around 40 large, cross-border financial groups operating in at least six EU member states with a high money laundering risk profile. Nearly every Dutch business continues to be supervised by DNB, AFM, the DFEI, or the BFT, exactly as before.

What is the AMLR and when does it apply?

The AMLR, the Anti-Money Laundering Regulation, is the EU's single rulebook for AML and counter-terrorist financing obligations. It applies directly in all 27 member states from 10 July 2027, at which point the Dutch Wwft is effectively revoked.

What happens to the Dutch Wwft?

It remains fully in force through 2026 and into 2027, including its recent cash payment ban amendment. From 10 July 2027, it is replaced by the directly applicable AMLR, with the remaining matters requiring national implementation transposed through the Dutch Iwt.

Who are the obliged entities under the AMLR?

Broadly the same categories the Wwft already covers, banks, accountants, notaries, real estate agents, and payment providers, plus newly added categories including crypto-asset service providers, professional football clubs and agents, and expanded obligations for dealers in precious metals, jewellery, watches, motor vehicles, aircraft, and vessels.

Do football clubs really have to have AML programmes?

Yes. Professional football clubs and licensed player agents become obliged entities under the AMLR from 10 July 2027, given the recognised money laundering risk in player transfers, image rights, and broadcasting revenue, and need a genuine compliance programme in place by that date.

What does AMLA's direct supervision mean in practice?

For the roughly 40 entities selected, it means AMLA itself, rather than a national supervisor, oversees compliance directly, with penalty powers reaching up to 10% of total annual turnover or 10 million euros per breach, whichever is higher, for serious, systematic, or repeated violations.

What should a Dutch business do now to prepare for the AMLR?

Run a gap analysis comparing current Wwft compliance against the AMLR's emerging technical standards, formalise and document risk assessments and CDD procedures, review whether AML systems can handle the new harmonised formats, and, for newly covered sectors, begin building a basic compliance framework well before the 10 July 2027 deadline.