What AML law requires of a firm
In the EU, Directive (EU) 2015/849 calls the firms it covers obliged entities. Each one has to:
- Assess and document its own money laundering and terrorist financing risks (Article 8)
- Keep policies, controls and procedures, approved by senior management (Article 8)
- Apply customer due diligence and monitor each relationship (Articles 11 and 13)
- Report to the financial intelligence unit when it knows or suspects that funds are proceeds of crime (Article 33)
- Keep due diligence and transaction records for five years after the relationship ends (Article 40)
Where AML rules come from
The international standard is the FATF Recommendations, adopted on 16 February 2012 and last amended in June 2026. Countries write them into their own law.
The EU's current law is Directive (EU) 2015/849, amended by AMLD5 and applied through each Member State's legislation. From 10 July 2027 the rules for firms move to Regulation (EU) 2024/1624, which applies directly in every Member State.
In the UK the rules are in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
Why AML matters at launch
AML duties sit with the firm that holds the licence or registration. A company launching under a partner's licence works to the partner's AML programme, and its onboarding flow, monitoring rules and case tools have to fit that programme.
AML, KYC or CFT?
- KYC
- Know your customer is the identification and verification step. AML is the whole programme around it.
- CFT
- Counter-terrorist financing uses the same controls against a different target: money headed for terrorism, whatever its origin.
- Sanctions
- A separate legal regime that forbids dealing with listed persons. Screening for it usually runs beside AML checks.
Where AML shows up in a platform
Modules that do the work
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- Compliance reportingTransaction monitoring, the Travel Rule and regulatory reports, ready for your regulator.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Merchant onboardingBusiness sign-up, verification and underwriting, from application to first payment.
Platforms that need it
Guides that go deeper
- How to launch a neobank without a banking licenceYour own e-money licence, an EMI's agent, a partner bank or a bank licence: how each route works, who holds the money, and what safeguarding and deposit protection cover.
- MiCA checklist: launching a crypto exchange in the EUWhat the EU's Markets in Crypto-Assets Regulation asks of an exchange: authorisation, capital, governance, client assets, the trading platform rules, and the laws that sit beside it.
- FCA cryptoasset registration: what UK crypto firms needWhat FCA registration under the Money Laundering Regulations asks of a UK crypto business, how crypto promotions are controlled, and what changes on 25 October 2027.
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/849, the Anti-Money Laundering Directive, consolidated (EUR-Lex)
- Regulation (EU) 2024/1624, the AML Regulation, Article 90 (EUR-Lex)
- Money Laundering Regulations 2017 (legislation.gov.uk)
- FATF, The FATF Recommendations, as amended June 2026
General information, not legal advice: what applies to you depends on your services and your market.