AMLA Hub

• From 10 July 2027, industrial holding companies that do not hold investments in the financial sector and have at least one subsidiary in the non-financial sector that is an obliged entity will be classified as non-financial mixed holding companies under the EU Anti-Money Laundering Regulation (AMLR) (Article 2 (1) Nr. 13 AMLR). This definition also includes previously exempted pure industrial holdings, if they have a subsidiary that is an obliged entity.

• Once such a holding company controls at least one obliged subsidiary in the non-financial sector, group-wide obligations apply to them under Article 16 AMLR. Even a single obliged subsidiary is sufficient to subject the holding company and, consequently, the entire corporate group to groupwide anti-money laundering requirements. These obligations include conducting a group-wide risk analysis, implementing group-wide strategies, procedures and controls, as well as establishing a compliance function at group level.

• The definition of a parent undertaking in Article 2 (1) Nr. 42 AMLR requires that at least one subsidiary is classified as an obliged entity. A parent company that does not hold an interest in an obliged company is therefore not considered a parent undertaking under AMLR, regardless of how many subsidiaries it controls.

• Yes, one single subsidiary that qualifies as an obliged entity under AMLR is sufficient to establish a non-financial mixed holding company under AMLR and to trigger group-wide obligations.

• According to Article 2 (1) Nr. 13 AMLR, a non-financial mixed holding company is an undertake that does not hold investments in the financial sector and has at least one obliged subsidiary in the nonfinancial sector. The definition of a parent undertaking under Article 2 (1) Nr. 42 AMLR only requires that at least one subsidiary is classified as an obliged entity.

• AMLR’s wording confirms that a single obliged subsidiary is enough to subject the holding company – and thereby the entire group – to the anti-money laundering obligations of AMLR. There is no required minimum number of obliged subsidiaries.

The AMLR sets a fixed threshold of 'at least 25%' for determining the beneficial owner. An actual shareholding of 24.991 % does not meet this threshold, even if it is rounded-up to 25.00 % in the Transparency Register. Such rounding-up in the Transparency Register cannot effectively lower the threshold established by the AMLR. The AMLR sets clear criteria that cannot be altered by rules applicable to the Transparency Register.

On the parallel application of ownership and control criteria:

• A natural person may qualify as a beneficial owner if they either (1) hold at least 25 % of the capital shares or voting rights (Article 52 AMLR), or (2) exercise control in a comparable manner (Article 53 AMLR). These criteria are independent and must be applied in parallel.
• In case of a person such as “Person 3” in the given example, beneficial ownership can be established through an indirect shareholding under Article 52 AMLR and, additionally, through control under Article 53 AMLR. Control may result from dominant influence, veto rights, pooling agreements, or other comparable arrangements.
• If a “dual status” exists, both justifications for qualifying as a beneficial owner should be documented, as the procedures for determining beneficial ownership based on ownership and control are independent and not interchangeable (see Recital 106 of the AMLR). According to the FAQ of the Transparency Register, it is sufficient to state one reason, however, from a compliance perspective, it is recommended to document both paths in full.

Aggregation of direct and indirect shareholdings:

• If capital or voting rights are held both directly and indirectly, they must be aggregated. For indirect holdings, the shareholdings are multiplied along the ownership chain. If a natural person holds interests in multiple intermediate entities, the results of the multiplications are added up together.
• Note: Thresholds and parallel application of ownership and control criteria are explicitly regulated in the new AMLR. For certain high-risk sectors, the European Commission may lower the threshold to 15 % in the future.

The EBA’s draft RTS on customer due diligence under Article 28(1) AMLR provides early clarification on beneficial ownership identification, directly supporting the implementation of Article 54 AMLR. The RTS emphasizes that obliged entities must apply both the ownership and control criteria in parallel and not sequentially. It outlines that institutions must understand the ownership and control structure of the customer and verify the identity of all beneficial owners, even in complex or layered structures.

The RTS also introduces expectations for documenting the steps taken to identify beneficial owners, including the rationale for identifying senior managing officials when no beneficial owner can be determined. It encourages the use of reliable and independent sources and requires institutions to assess the plausibility of the information obtained.

While the RTS does not yet provide a fixed methodology for calculating ownership thresholds or control indicators, it sets the foundation for harmonized application and anticipates further guidance from AMLA. This is particularly relevant given Article 52(2) AMLR, which allows the European Commission to lower the ownership threshold for certain high-risk entities in the future.

• The verification and identification of beneficial owners have been significantly tightened by the AMLR. Obliged entities must verify the identity of the customer and the beneficial owner using multiple reliable and independent sources. Official registers, such as the Transparency Register, should be used but may not serve as an only source (Article 22 (7) AMLR).

• In Germany, access to the Transparency Register is generally possible, however, comes with technical and administrative hurdles, especially for foreign applicants or undertakings. However, this is expected to change under the AMLR, as EU-wide interconnection of registers is envisaged. It is uncertain when and how specific legislative changes will be implemented in Germany to simplify access.

• Banks may only share information about beneficial owners with the explicit consent of the individuals concerned; banking secrecy still exists unless a legal exception applies (e.g., criminal proceedings, suspicious activity reports).

• For identification purposes, a valid identification document of the beneficial owner will be required in the future. If a person refuses to present such a document and their identity cannot be verified otherwise, no business relationship may be established or continued. In such cases, a suspicious activity report may need to be considered (Article 21 (1) AMLR).

• The AMLR, like the current German Money Laundering Act (Geldwäschegesetz; GwG), allows for the identification of an obliged entity to be carried out by “another obliged entity” (Articles 48 et seq. AMLR and Section 17 (1) GwG). Accordingly, a notary (as “another obliged entity”) may perform the identification, provided the further requirements under Articles 48 et seq. AMLR (or Section 17 GwG) are met. One of the conditions for relying on another obliged entity is that the primary obliged entity must take all necessary steps to ensure that the obliged entity being relied upon can, upon request, provide copies of the information obtained for customer identification, as well as all documents or reliable sources used to verify the identity of the customer and, where applicable, the beneficial owner or the persons on whose behalf the customer is acting. It is also important to note that the ultimate responsibility for fulfilling customer due diligence remains with the obliged entity that relies on another obliged entity (Article 49 (1) AMLR, Section 17 (3) GwG).

• Note: The AMLR does not impose an obligation on banks to disclose data in violation of banking secrecy, except in legally regulated exceptional cases.

• The Video-Ident procedure has been an established method for digital customer identification in Germany for years, particularly in the financial sector. Until now, its use has been based on a circular issued by the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht; BaFin) in 2017, which, however, only applied to entities supervised by BaFin.

• In April 2024, the German Federal Ministry of Finance presented a draft regulation for the Money Laundering Video Identification Regulation (GwVideoIdentV). This draft aimed to legally Video-Ident, open it to all obliged entities under the GwG – including those in the non-financial sector – and allow for partially and fully automated identification procedures. Additionally, it proposed that the use of Germany’s online ID function (eID) must be offered as an alternative method whenever Video-Ident is used.

• However, the draft regulation was not adopted. Due to the new legislative period, it remains unclear whether and when the draft will be revisited in its current form. As a result, the Video-ident continues to be permitted based on the BaFin circular, but only for entities supervised by BaFin.

• The AMLR does not contain specific provisions on Video-ident, however, it sets high general standards for the identification of customers and beneficial owners. Starting in 2027, identification is expected to follow uniform EU standards, with a strong emphasis on promoting digital identity solutions. The traditional Video-Ident may remain permissible in principle, provided it meets the required standards of security and reliability.

• Under the new AMLR, the Anti-Money Laundering Authority (AMLA) is granted extensive powers. It can request information, conduct investigations and on-site inspections, and impose significant administrative fines and coercive penalties (up to EUR 2 million or 1 % of annual turnover per violation).

• AMLA will specifically monitor compliance with and implementation of financial sanctions by the institutions it directly supervises. Supervision will be carried out by joint teams composed of AMLA staff and national authorities. For obliged entities that are not directly supervised by AMLA, supervisory responsibility remains with the national authorities. However, AMLA will coordinate cooperation among them and ensure a consistent supervisory culture across Europe.

• Regardless of AMLA’s role, Deutsche Bundesbank remains responsible for supervising compliance with financial sanctions in Germany. AMLA’s role focuses on verifying compliance with obligations as defined in the AMLA Regulation, particularly regarding the establishment of effective internal strategies, procedures, and controls (SCPs) to ensure the enforcement of asset freezes, prohibitions on making funds or economic resources available, and restrictions on business dealings with sanctioned individuals and entities (Articles 17, 19, 27 AMLA Regulation). Additionally, AMLA will support cooperation between national Financial Intelligence Units (FIUs), even though it will not take over their responsibilities.

• According to Article 11 (1) of the AMLR, compliance managers must be a member of the management body in its management function and is responsible for ensuring compliance with the AMLR as well as for establishing appropriate internal strategies, procedures, and controls. The AMLR itself does not specify any concrete qualification requirements for compliance managers. Instead, it focuses solely on the membership in the management body and the responsibility for implementing and ensuring compliance with anti-money laundering obligations.

• The specific set-up of the requirements may vary depending on the industry, company size, and risk profile. The AMLR does not establish uniform, legally binding qualification standards across the EU but rather emphasizes the function and responsibility within the management body. Further clarifications from supervisory authorities may follow in the future.

Yes, such services are likely to be considered outsourcing under Article 18 AMLR, because they involve a non-obliged third party performing a core AML task – namely, customer identification and verification – on behalf of an obliged entity.

Obliged entities may outsource AML-related tasks to non-obliged service providers. These providers do not become subject to AMLR obligations themselves; their duties arise only from the contractual relationship. The obliged entity retains full responsibility for AML compliance. Remote identification services, such as PostIdent, are explicitly mentioned as permissible outsourcing, provided a risk-based approach is applied.

Recital 47 also states that mere use of tools (e.g., third-party software, databases, or screening services) does not constitute outsourcing if the AML task itself is not performed by the provider.

PostIdent is outsourcing under AMLR because: (a) Deutsche Post performs the identification task. (b) It is not an obliged entity under AMLR. The obliged entity must ensure: (a) A written outsourcing agreement is in place. (b) Supervisory notification is made. (c) Ongoing oversight and a risk-based approach are applied.

Virtual IBANs (vIBANs) can create challenges for consumers by presenting a misleading picture of where a payment account is located. A vIBAN may carry a country code that suggests the account is domestic, even though the underlying account is held in another jurisdiction. This can give consumers a false sense of security, leading them to believe they are transacting under familiar national rules and protections.

This perception is often exploited in fraud schemes. Consumers may initiate what appears to be a local payment, unaware that the funds are being routed internationally. By the time the deception is discovered, the money may have passed through several countries, making recovery difficult and enforcement complex.

Additionally, the mismatch between the vIBAN and the actual account location can create uncertainty about which national authority is responsible for oversight or handling complaints. This can affect the clarity of consumer rights, including which deposit guarantee scheme applies and how to seek redress in case of issues.

While these risks are being addressed in the upcoming regulatory technical standards by AMLA, the goal is to strike a balance – enhancing fraud prevention while preserving the efficiency and convenience of legitimate cross-border payments.

Under Article 22(3) of Regulation (EU) 2024/1624 (AMLR), the obligation to identify and verify applies to the person using the virtual IBAN (vIBAN) which, in most cases, is the merchant or end user of the vIBAN.

This interpretation is supported by the EBA Report on virtual IBANs (EBA/Rep/2024/08), which consistently refers to the person using the vIBAN as the “end customer” or “end user”. In typical use cases, this end user is also the holder of the master account to which the vIBAN is linked. Therefore, the merchant as the party actively using the vIBAN to receive or initiate payments is the subject of the identification and verification requirements.

However, the EBA also highlights more complex structures, such as Use Case 6, where the master account holder and the vIBAN user differ. In this scenario, a payment service provider (PSP) may issue vIBANs to a corporate client (e.g. a parent company), which then allocates those vIBANs to its subsidiaries. These subsidiaries, as end users, use the vIBANs to transact with third parties. In such cases, each subsidiary using the vIBAN must be identified and verified, even though the master account is held by the parent company.

This approach aligns with the legal requirement in Article 22(3) AMLR, which states that obliged entities must identify and verify the natural or legal persons using the vIBANs. The regulation does not limit this obligation to account holders but extends it to any party using the vIBAN for payment purposes.

Institutions can assess risk themselves but the formal assessment of a firms risk profile will be made by banking supervisor(s) and submitted to AMLA. For the first wave of direct supervision, AMLA will not be involved in making discretionary judgements about the riskiness of a business; however it will ensure that national supervisors are approaching the risk assessment consistently in accordance with the methodology in the RTS on direct supervision. There will be a further Implementing Technical Standard on the specifying the respective roles of the Authority and the financial supervisors in the assessment process. The risk assessment will be repeated periodically, typically on an annual basis.

If this is referring to general auditing requirements there is no specific AMLA requirement, so usual regular auditing requirements apply. If this is referring to the assessment of the firm's risk profile under the AML regulations, this will happen yearly. Additional risk assessments can also be necessary if there is a material change in circumstances.

In order to ensure the homogeneous supervision of groups and a more granular analysis of the risk of the cross-border entities assessed, the assessment of the ML/TF risk of obliged entities which are part of a group should always be done at the level of the group, resulting in a single group-wide risk score to be considered for the purposes of the selection. The entire group should then be considered as the selected obliged entity. (See recital 26 of the AMLA Regulation). Where groups are selected for direct supervision each relevant EU supervisor will normally be involved in the Joint Supervisory Team.

That is one expectation. The March 2025 RTS do not refer to anything on geographical balance. But there are some provisions in the level 1 text that suggest this is what will happen (Article 13(3) AMLA regulation).

The materiality thresholds relating to cross border services are per member state and per annum. As a reminder, under the proposed RTS on direct supervision ( Article 1), the cross border services threshold will be met if:

(i) the firm has over 20,000 customers resident in a member state

OR

(ii) the total value of incoming and outgoing transactions generated by its customers is above 50,000EUR based on data for the last calendar year. (See Annex 1, Section C of the RTS on direct supervision.)

Note that the materiality threshold tells you how many Member States (besides your home State) you are active in, in addition to those where you have a branch or subsidiary. There is no materiality threshold for branches or subsidiaries.

To be considered for direct supervision you normally have to be present in 6 or more Member States.