AMLD6 for Fintechs: What Actually Changes in 2026 and How to Prepare

The Sixth Anti-Money Laundering Directive (AMLD6, Directive (EU) 2024/XXXX) entered into force on 7 January 2025. Member states have until 7 January 2027 to transpose it into national law. That means the clock is running and your legal team needs to be working now.

This post cuts through the jargon. Here's what actually changes, what's harder to comply with, and what your engineering team needs to build.

What Is AMLD6?

AMLD6 is the sixth iteration of the EU's anti-money laundering directive framework. It replaces AMLD5 (2018/843) and does three things that matter for fintech operators:

1. **Criminalizes new and expanded predicate offences** — making it easier to prosecute money laundering
2. **Tightens corporate liability** — making it a criminal matter for your company, not just individuals
3. **Updates the Travel Rule** — expanding its scope to more crypto asset transfers

It also paves the way for the AMLA Regulation (2024/... on the establishment of the EU Anti-Money Laundering Authority), which creates a new supranational supervisor for high-risk entities from 2027.

The Predicate Offence Expansion: 22 Offences Now

AMLD6 Art. 3 lists **22 predicate offences** — the underlying crimes that create money laundering liability. The key changes from AMLD5:

**What's new or expanded:**

• **Cybercrime** — including ransomware, phishing, and cryptojacking. If a client transfers funds from a wallet you know is associated with a ransomware payout, you have a predicate offence indicator.
• **Environmental crime** — illegal waste trafficking, illegal emissions trading, illegal logging. Operators in the carbon credit or waste management sectors face new exposure.
• **Counterfeit currency and payment instruments** — explicitly including digital payment instruments.
• **Insider trading and market manipulation** — now a standalone predicate offence, not just a regulatory breach.
• **Tax crimes** — expanded from "tax crimes relating to direct and indirect taxes" to a broader range of tax evasion offences including VAT fraud.

**What this means in practice:** Your transaction monitoring system needs to flag transactions linked to any of these 22 categories. For crypto operators, the cybercrime and insider trading expansions are the most operationally significant.

Corporate Liability: Up to 5% of Global Turnover

This is the change that gets board attention.

AMLD6 Art. 6 introduces **direct corporate criminal liability** for money laundering — not just for individuals. If a director, officer, or employee commits a money laundering offence "for the benefit of" the legal entity, the entity itself is criminally liable.

The penalties:

| Threshold | Fine |
|---|---|
| Minimum floor | €5,000,000 |
| Maximum for serious offences | Up to **5% of total worldwide annual turnover** (or €40,000,000, whichever is higher) |

For a fintech with €50M annual revenue, that's a potential **€2.5M fine**. For a company with €200M revenue, it's €10M.

• Winding up of the legal person
• Temporary or permanent ban on exercising certain commercial activities
• Judicial surveillance measures
• Prohibition from public funding
• Publication of the conviction

This makes D&O insurance coverage review urgent. Your insurance broker needs to know about the corporate liability provisions. Many existing policies don't cover administrative sanctions arising from criminal proceedings.

The Travel Rule — More Transfers, More Data

The Travel Rule (AMLD6 Art. 5, building on AMLD4's Art. 8) requires financial institutions and CASPs to collect, transmit, and retain originator and beneficiary information for transfers.

**What's changing:**

Crypto asset transfer threshold drops to **€0**

Under the AMLD5 implementation, many member states applied the Travel Rule only above €1,000. AMLD6 removes this threshold for crypto asset transfers — every single on-chain transaction between two CASPs (or a CASP and a bank) must carry originator and beneficiary information.

• Every customer withdrawal must have KYC-verified beneficiary data attached
• Every counterparty wallet address must be screened against sanctions lists before the transfer is initiated
• Full packet of originator data must be embedded in the transfer protocol (or attached via a secure side-channel)

The beneficiary data must be stored

Both originator and beneficiary data must be retained for **5 years** after the transaction. Your database schema needs to accommodate this, and your data retention policy must reflect it.

Cross-border transfers to high-risk third countries

If you're sending a transfer to a wallet associated with a high-risk third country (the EU maintains a list), you need enhanced due diligence and — critically — **prior approval** from your MLRO before initiating the transfer.

UBO Registers — Stricter Verification

AMLD6 Art. 31 updates the Ultimate Beneficial Owner register requirements:

• **Lower threshold:** UBO status now triggers at **15% ownership or control** (down from 25%). This catches more entities.
• **More verification required:** UBO information must be verified, not just self-declared. You need documented evidence of ownership structure, not just a signed form.
• **Discrepancy reporting:** If you discover a discrepancy between your UBO records and the national register, you must report it within 14 days.
• **Access for competent authorities:** Regulators, LEAs, and FIUs will have direct access to UBO data from 2027 onward without going through the company.

**For fintech operators onboarding business clients:** Your KYB process must now include tracing ownership chains down to the 15% level. This requires a structured ownership diagram, not just a company registration number.

The AMLA Regulation — 2027 and Beyond

The EU's new Anti-Money Laundering Authority (AMLA) starts supervising high-risk entities from Q3 2027. "High-risk" includes:

• Credit institutions with significant cross-border activity
• CASPs with >€1B in assets under custody
• Any entity designated by the Commission as high-risk

For smaller fintechs, direct AMLA supervision is not immediate — but the indirect effects are:

• NCAs will align their supervision practices with AMLA guidance
• The AMLA will publish binding technical standards that all member states must follow
• Cross-border information sharing between NCAs improves, which means enforcement actions in one member state propagate faster across the EU

**What to do:** Treat the AMLA standards as the floor for your compliance program. Start aligning your policies and procedures with anticipated AMLA guidance on transaction monitoring thresholds, risk scoring methodologies, and SAR filing formats.

SAR Filing Under AMLD6 — What Changes

The suspicious activity report (SAR) framework remains substantially similar, but with two important changes:

1. Tipping-off offences strengthened

If you file a SAR and then disclose to the subject that you've filed — including during the client relationship — the tipping-off offence carries a maximum penalty of **4 years imprisonment** (up from 2 years under AMLD5).

Train your front-line staff on this. The client asking "why was my transfer held?" is a tipping-off risk.

2. No-Refusal regime for SARs above €10,000

When you file a SAR and the FIU issues a freezing instruction on a transaction above €10,000, you cannot complete that transaction without FIU authorization — even if the client pushes back or threatens to close the account.

This creates a business continuity risk. If a high-value client demands you release funds and you have a pending FIU freeze, you need legal cover. Document everything.

Engineering Implementation Guide

Here's what your engineering team needs to build or update to achieve AMLD6 readiness:

1. Transaction Monitoring Rules — Update Your Typology Matrix

• Cryptocurrency-linked predicate offence flags (ransomware, darknet market proceeds, Ponzi scheme distributions)
• Environmental crime transaction indicators (carbon credit payments to non-registered entities, waste disposal to sanctioned jurisdictions)
• Insider trading indicators (concentration of transactions around corporate announcement windows)
• Tax evasion indicators (round-tripping through multiple jurisdictions, Layer 2 anonymization tools used without explanation)

**Engineering note:** Store your typology matrix as a versioned JSON schema with source citations (FIU guidance documents, FATF recommendations). When a regulator asks "why did you flag this?", your answer should reference your typology matrix version and the regulatory source that triggered the rule.

2. Travel Rule Compliance — Full Implementation

• Implement the IVMS101 data standard for originator/beneficiary messaging
• Embed wallet address screening against sanctions and PEPLists as a pre-transfer gate
• Store all originator and beneficiary data with a 5-year retention policy
• Add a Travel Rule audit log to every transaction

3. UBO Verification Pipeline

• Accept structured ownership documentation (shareholder registers, trust deeds)
• Build a verification workflow that flags discrepancies against public registry data
• Store the verification evidence with a 5-year retention policy
• Add automated discrepancy reporting (14-day SLA) to your compliance workflow

4. SAR Drafting System

• Build a structured SAR template with mandatory fields (subject identity, transaction amounts, suspicion narrative, predicate offence classification)
• Integrate with FIU portal for electronic filing
• Add a filing acknowledgement tracker so you can respond to FIU follow-up requests

AMLD6 vs AMLD5: The Core Differences

| Obligation | AMLD5 (2018) | AMLD6 (2025) |
|---|---|---|
| Predicate offences | ~11 listed | 22 listed |
| Corporate liability | Administrative only | **Criminal, up to 5% turnover** |
| UBO threshold | 25% ownership | 15% ownership |
| Travel Rule crypto threshold | €1,000 (varies by state) | **€0 — all transfers** |
| Tipping-off penalty | 2 years imprisonment | **4 years imprisonment** |
| AMLA supervision | None | Supranational body from 2027 |

Your AMLD6 Readiness Checklist

1. **Board briefing** — ensure directors understand corporate liability exposure
2. **AML manual update** — incorporate 22 predicate offences, new Travel Rule thresholds, tipping-off rules
3. **Transaction monitoring update** — add new typologies for crypto predicate offences
4. **Travel Rule engineering** — implement IVMS101 for all transfers, remove €1,000 floor
5. **UBO threshold review** — update KYB process to 15% ownership tracing
6. **SAR filing system** — verify FIU portal integration, update tipping-off training
7. **D&O insurance review** — confirm corporate criminal liability coverage
8. **Discrepancy reporting procedure** — implement the 14-day reporting workflow
9. **Data retention audit** — verify all required fields are retained for 5 years
10. **MLRO sign-off** — compliance officer must formally review and approve the updated AML program

Arkē's Role in Your AMLD6 Compliance

| AMLD6 Obligation | Arkē Coverage |
|---|---|
| Transaction monitoring | AML typology detection across batched CSV/JSON |
| Predicate offence indicators | Adverse media screening + sanctions/PEP checks |
| SAR drafting | FIU-format draft generation |
| Travel Rule wallet screening | Counterparty screening before transfer initiation |
| Ongoing risk scoring | Real-time risk scores 0–100, updated per transaction |

*This post is for informational purposes and does not constitute legal advice. Member state transposition timelines vary. Consult a qualified AML compliance specialist for your specific situation.*

*→ [Explore Arkē Pricing →](/pricing)*