The European Anti-Money Laundering Authority is no longer a proposal. It has a seat in Frankfurt, a chair, an executive board and a published work programme, and it took over the EBA’s AML mandate at the end of 2025. The Regulation it will enforce — the AML Regulation, (EU) 2024/1624 — applies from 10 July 2027. That is roughly eleven months away, which sounds comfortable until you look at what has to be finished before it arrives.
Most firms we speak to have filed this under “2027”. That is a mistake for a specific reason: two of the decisions that matter most have to be taken during 2026, and one deadline has already passed.
What actually changes on 10 July 2027
The substantive change is not any single rule. It is the instrument. Today, AML obligations in Cyprus come from Law 188(I)/2007 and a set of supervisory directives built on an EU directive. From July 2027 the operative text is a regulation — directly applicable, identical in every Member State, and not open to national elaboration on the matters it covers.
For a jurisdiction that built a detailed national framework on the AMLD5 base, that is the largest structural shift in twenty years. Policies, onboarding manuals and monitoring rules citing Cypriot article numbers need re-basing on the Regulation’s own articles. Where a Cypriot rule is stricter on a matter the Regulation covers, it generally cannot survive — although Member States keep latitude where the Regulation expressly allows it, for example in setting a cash limit below the EU ceiling.
Directive (EU) 2024/1640, the accompanying sixth directive, has to be transposed by the same date. One tranche of it — the beneficial ownership register provisions in Articles 11 to 13 and 15 — was due on 10 July 2026. That deadline has already gone.
The numbers that will change your files
Several thresholds move, and each of them requires a systems change rather than a policy note:
- Cash: an EU-wide ceiling of €10,000 for anyone accepting or making payment in a professional capacity. Member States may go lower, not higher.
- Occasional transactions: customer due diligence from €10,000, down from €15,000. For transfers of funds and for crypto-asset service providers, from €1,000. Minimum measures on cash from €3,000, and on gambling stakes or winnings from €2,000.
- Beneficial ownership: the test becomes 25% or more. Under most national AMLD5 implementations it was “more than 25%”, so a holder of exactly 25.00% frequently sat outside. That is a deliberate design in a great many Cyprus holding structures, and every one of them now needs re-running. Indirect holdings are multiplied along each chain and then added across chains — which is not how most files are currently assessed.
- Refresh cycles: a hard maximum of one year for customers subject to enhanced due diligence and five years for everyone else. These are caps in the text, not supervisory expectations.
That last item is the one that quietly turns 10 July 2027 into a deadline for your existing book rather than a start date for new business. Every legacy file has to be current within one or five years of that date. For a corporate service provider with several thousand administered structures, or an electronic money institution with a large dormant customer base, that is a two-year remediation programme — and it implies a commercial decision most firms have not yet taken: which legacy relationships to exit rather than re-paper.
Why 31 December 2026 is the date to plan around
Direct supervision is governed by a different instrument — the AMLA Regulation, (EU) 2024/1620 — and it selects entities by a formula rather than by size. The eligibility gate is activity in at least six Member States including the home state, counting remote provision of services, branches, agents and distributors alike. Activity in a market only counts if it is material there: broadly, more than 20,000 resident customers or more than €50 million of annual transaction flows.
That Regulation frames the first selection around forty entities, though the text permits more, and guarantees at least one directly supervised entity per Member State. AMLA begins the first selection by 1 July 2027 and concludes it within six months; direct supervision follows six months after the list is published. Commentary has attached various 2028 dates to that sequence — we would not put a specific one in front of a client until AMLA publishes it.
The measurement date, however, is already visible: AMLA’s draft reporting framework for the 2027 eligibility collection uses 31 December 2026 as its reference. For a payment institution, EMI or crypto-asset service provider sitting at five active markets, the decision to activate a sixth passport before year-end — or to let a marginal market drift past 20,000 customers — is no longer a commercial decision alone. It determines whether the group enters the 2027 selection pool at all; a separate risk assessment then decides who is actually selected from it. The converse is equally true: dormant passports with no material activity are disregarded, so they can be tidied up. This is a Q4 2026 modelling exercise, not a 2027 one.
The outsourcing perimeter, and the Russia problem inside it
Article 18 draws a hard line around functions that may not be outsourced at all: proposing or approving the business-wide risk assessment, approving internal policies and controls, assigning customer risk profiles, deciding whether to enter a relationship or execute a transaction, approving the criteria for detecting suspicious activity, and reporting suspicions to the FIU (subject to a narrow same-group, same-Member-State exception). Everything that remains outsourceable requires a written agreement, ongoing monitoring, and notification to the supervisor before the provider starts work. Liability stays with the obliged entity in all cases.
There is a second edge to this. Outsourcing to a high-risk third country is prohibited unless the provider sits inside the group, applies group standards and falls under home-state group supervision. Russia was added to the EU high-risk list by Delegated Regulation (EU) 2026/46, applicable from 29 January 2026 — an autonomous EU listing, not a FATF one. Bolivia and the British Virgin Islands were added by a separate delegated regulation applying from the same date. Any Cyprus obliged entity with compliance, KYC or monitoring functions performed from those jurisdictions needs that mapped now. Service contracts of this kind typically carry twelve-month notice periods, which means the decision belongs to 2026 even though the prohibition bites in 2027.
Two points that land specifically on Cyprus
The first is supervisory architecture. Cyprus supervises AML through roughly ten competent authorities, and administrative service providers sit under CySEC, ICPAC or the Cyprus Bar depending on the provider’s professional status. The Regulation removes each supervisor’s ability to set different substantive rules; what survives is how intensively each inspects. More pointedly, the sixth directive requires that where a self-regulatory body supervises, a public authority must oversee it, with power to compel information and issue binding instructions, and publish an annual report copied to the Commission and to AMLA. That is the most likely trigger for restructuring the Cyprus split.
The second is a provision that has been widely reported as a private-banking rule. Article 34(5) requires enhanced due diligence where a customer holds at least €50 million in total assets — financial, investable or real estate, excluding their private residence — and the firm manages at least €5 million for them. As drafted, the article names trust or company service providers alongside credit and financial institutions, although some published commentary reads it as financial-sector only. If the wider reading is right, a Cyprus fiduciary administering a family holding structure will cross both thresholds routinely, and will owe source-of-funds enquiry, personalised-service risk procedures and a conflicts register between client and senior management. Very few fiduciary files are built to evidence a client’s total net worth. AMLA guidance on measuring the threshold is not due until July 2027 — an argument for starting now rather than waiting.
What we would do in the next six months
- Model the six-market test against a 31 December 2026 balance sheet and take the passport decisions deliberately.
- Start the remediation clock. Segment the back book by refresh obligation and decide, now, which relationships get re-papered and which get exited.
- Map every outsourced compliance function by jurisdiction and unwind or restructure anything running from a high-risk third country.
- Re-run beneficial ownership across the portfolio as a data exercise — every 25.00% holder, and every multi-chain indirect holding, aggregated.
- Respond to the open consultations. AMLA’s level-two texts are where the commercially painful detail sits, and several remain open through September and October 2026. CySEC has twice publicly urged Cyprus firms to engage. It is a cheaper lever than arguing the same point after the rules are final.
Where SK Consult can help
We work on this from the structuring side rather than the software side: whether a group’s licensing footprint puts it inside or outside AMLA’s direct-supervision perimeter, how an ownership chain reads under the new beneficial ownership test, what an outsourcing arrangement must look like to survive Article 18, and how a fiduciary book should be segmented before the refresh obligations bite. If you hold a licence in more than one Member State, or administer structures for clients with genuine wealth, the useful conversation happens before the 31 December 2026 reference date, not after it.
This article reflects the position as at August 2026 and is general information, not legal advice on any particular structure. Several implementing standards under the AML package remain in consultation and the detail may change.
