EU AML Regulation 2027: what changes for holding companies and their service providers

One rulebook for the whole EU, from July 2027

Until now, anti-money laundering rules came from directives that each Member State wrote into its own law. A Luxembourg SOPARFI and a Dutch B.V. followed similar but not identical rules, with different thresholds, register deadlines and bank questions.

The EU AML package adopted in 2024 changes that. It has three parts. A Regulation, (EU) 2024/1624, known as the AMLR, sets a single rulebook directly applicable from 10 July 2027. A Directive, (EU) 2024/1640, known as AMLD6, governs national registers, supervisors and financial intelligence units. A third Regulation, (EU) 2024/1620, created the Anti-Money Laundering Authority, AMLA, based in Frankfurt.

For an owner-managed holding company, three things matter. Who counts as beneficial owner is now defined in detail, including how stakes are multiplied through a chain. What goes into the register, and how fast it must be updated, is the same in every Member State. And the due diligence your bank, notary and domiciliation agent perform becomes harmonised, so their questions converge.

This note is about the AML concept: which individuals own or control a company. It is different from beneficial ownership for treaty relief, which asks whether a holding company may keep the dividend it receives. Our note on beneficial ownership for treaty purposes covers that.

Three instruments and their timetable

The three acts were published in the Official Journal on 19 June 2024. The AMLR binds obliged entities and companies directly. AMLD6 binds Member States, who must change their laws on registers and supervision. The AMLA Regulation sets up the new authority and its powers.

AMLA. The authority will directly supervise about 40 high-risk financial groups active in at least six Member States from January 2028. Your holding will not deal with AMLA; its technical standards reach you through your bank and service providers.

The access deadline was missed widely. Member States had to transpose the AMLD6 provisions on register access by 10 July 2026. According to reports of the Commission's infringement package of 25 September 2026, 18 Member States, including Luxembourg and the Netherlands, received letters of formal notice for not doing so in full. That is the first step of an infringement procedure and explains why access regimes still differ.

Law and practice: Regulation (EU) 2024/1624, Article 90 (application); Directive (EU) 2024/1640, Article 78 (transposition); Regulation (EU) 2024/1620 (AMLA). Official Journal L, 19 June 2024. EUR-Lex; AMLA website, amla.europa.eu.

Ownership, control and the multiplication rule

A beneficial owner is any natural person who ultimately owns or controls a legal entity. The AMLR tests two routes, ownership and control, and the person qualifies through either.

Ownership. Under Article 52, an ownership interest means direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest, including rights to profits and liquidation proceeds. National law today says more than 25%. In practice it captures every four-way 25% split, where until now nobody qualified by ownership.

The multiplication rule. Indirect ownership is calculated by multiplying the stakes along each chain and adding the results where one person holds through several chains. All shareholdings at every level count. A person holding 60% of a company that holds 50% of your holding has 30%.

Control. Under Article 53, control by other means includes the majority of voting rights, the right to appoint or remove a majority of the board, veto or decision rights attached to shares, and the power to decide on profit distributions. Depending on the structure, it also includes shareholder or voting agreements, family relationships, and formal or informal nominee arrangements. A person with 10% and the right to appoint the board is a beneficial owner.

Lower thresholds later. Member States can tell the Commission which categories of company carry higher risk. By 10 July 2029 the Commission must assess whether a lower threshold is needed and may set it by delegated act, at no more than 15% for those categories. Nothing changes for ordinary holdings yet.

Senior managing official. Where nobody qualifies after all means are exhausted, or the company is substantially and justifiably uncertain, Article 63 requires it to state that there is no beneficial owner, explain why, keep records of the steps taken and report all its senior managing officials: the executive directors or managers running the company day to day. They are not beneficial owners; they are reported in that place.

Law and practice: AMLR, Article 2(28) (definition), Articles 51 to 57 (identification), Article 52(1) to (3) (25%, multiplication, 15% delegated acts), Article 53 (control), Article 63 (senior managing officials).

Where the chain gets complicated

Trusts and similar arrangements. Under Article 55, where a trust or a foundation-like entity holds an ownership interest in, or controls, a company, the beneficial owners of the company are the beneficial owners of the trust or foundation. For an express trust that typically means the settlor, the trustees, any protector, the beneficiaries or class of beneficiaries, and anyone else exercising control. A family trust holding 30% of your SOPARFI through two companies therefore puts several family members and a professional trustee into the register.

Trustees must register the trust in the Member State where they are established or resident. A trust administered outside the EU must also register when it enters a business relationship with an EU obliged entity in a higher-risk sector, acquires EU real estate or is awarded a public contract. The Dutch STAK is a legal entity, not a trust, but it is designed to separate voting control from economic interest. Both the board controlling the votes and the certificate holders with large economic stakes have to be examined.

Nominees. Article 66 requires nominee shareholders and nominee directors to hold accurate information on their nominator and the nominator's beneficial owners, and to disclose it, with their nominee status, to the company. The company reports it to the register and to the obliged entities performing due diligence. Professional directors from a domiciliation agent or trust office who use their own judgement are not nominees; a director who signs whatever the shareholder sends is.

Law and practice: AMLR, Article 55 (legal arrangements in the chain), Articles 58 and 64 (trusts and trustees), Article 66 (nominees), Article 67 (non-EU entities and arrangements). Dutch Wet toezicht trustkantoren 2018 (Wtt 2018).

Filing, deadlines and who can see the data

Filing and updates. Under Article 63, a company must report its beneficial owners without undue delay after it is created, report any change without undue delay and in any case within 28 calendar days, and check at least once a year that the register is correct. The annual check can be combined with the filing of the annual accounts or the Dutch B.V. calendar. The register entry will carry more data than today: full date and place of birth, residential address, nationality, identification number, the ownership chart and the percentages at each level.

Access after WM and Sovim. On 22 November 2022 the Court of Justice held in joined cases C-37/20 and C-601/20 that general public access to beneficial ownership information breached the rights to privacy and data protection. Luxembourg and the Netherlands closed public access within days. AMLD6 rebuilds access in tiers: competent authorities and obliged entities have full access; persons with a legitimate interest get a reduced set of name, month and year of birth, country of residence, nationality and the nature and extent of the interest. Journalists, civil society organisations and academics working on money laundering, and persons likely to transact with the company, are presumed to have a legitimate interest. Registers keep a log of who looked, and a beneficial owner can request it.

Luxembourg. The Law of 23 January 2025, in force since 1 February 2025, restricted access to national authorities, professionals subject to AML law, and persons with a legitimate interest, including journalists and non-profit organisations, with requests decided by Luxembourg Business Registers. In May 2026 the Luxembourg District Court referred further questions to the Court of Justice on when a beneficial owner can obtain a restriction because of exceptional risk.

Netherlands. The KvK suspended online access in November 2022. An act restricting access to the UBO registers was adopted in 2025. In 2026 the KvK is reopening access sector by sector to obliged entities, starting with notaries, banks, trust offices and licensed financial institutions, and to authorities. Digitally certified UBO extracts became available again in the second quarter of 2026. A draft decree on legitimate-interest access, with categorical access for journalists and civil society organisations, was sent to Parliament on 2 April 2026.

Interconnection and discrepancies. National registers are linked through the EU beneficial ownership interconnection system, BORIS. Under Article 24 AMLR, a bank or service provider that finds a difference between the register and its own due diligence must report it within 14 calendar days. For minor or outdated entries it may first ask the client to correct the register within 14 days. Where enhanced due diligence applies, it must report.

Law and practice: CJEU, judgment of 22 November 2022, WM and Sovim, C-37/20 and C-601/20; AMLD6, Articles 10 to 15; AMLR, Articles 24, 62 and 63; Luxembourg Law of 13 January 2019 and Law of 23 January 2025 (bill 7961); Guichet.lu, 'Filing of beneficial ownership details with the Register of Beneficial Owners'; kvk.nl, 'About the UBO register' and 'Status uitbreiding toegang'.

What your bank, notary and service provider will ask

The obliged entities around a holding company are its bank, its notary, its auditor or accountant, its lawyers and tax advisers when they assist with transactions, and its corporate service provider: a domiciliation agent in Luxembourg, a licensed trust office under the Wtt 2018 in the Netherlands. The AMLR adds crypto-asset service providers fully to the list and, from 2029, professional football clubs and agents.

Harmonised refresh periods. Under Article 26, customer information must be updated at intervals of no more than one year for higher-risk customers and no more than five years for the others, and earlier when circumstances change.

Enhanced due diligence. Where a customer has links to a high-risk third country identified by the Commission, or carries other higher-risk factors, the obliged entity must obtain more information on the beneficial owners, the source of funds and source of wealth, the purpose of transactions, and senior management approval. A director resident in a listed country can make the whole holding a higher-risk customer.

Cash. Under Article 80, traders in goods and service providers may not accept or make cash payments above EUR 10,000, in one or linked operations, from July 2027. Member States may keep or set lower limits. Payments between private individuals are outside the cap.

• Ownership chart. Every layer to the individuals, with percentages, the multiplication worked out and the date.
• Constitutional documents. Articles, register extracts for every entity in the chain, shareholders' and voting agreements.
• Trust documents. Trust deed, letter of wishes where relevant, identity of settlor, trustees, protector and beneficiaries.
• Source of wealth. A short narrative per beneficial owner backed by sale agreements, dividend statements, tax returns.
• Source of funds. Where the money for this holding came from: share capital, loans, dividends, sale proceeds.
• Register proofs. Current register extracts and the date of the last annual verification.

Our note on bank accounts for holding companies shows how these documents are used in onboarding. Where the structure also triggers cross-border reporting, see DAC6; the two regimes ask for many of the same charts.

Law and practice: AMLR, Articles 3 (obliged entities), 19 to 26 (customer due diligence), 29 to 34 (enhanced due diligence and high-risk third countries), 80 (cash limit). Luxembourg Law of 12 November 2004; Dutch Wwft; Dutch Wtt 2018.

Transition to July 2027

Luxembourg. The Law of 12 November 2004 on the fight against money laundering remains the base until the AMLR applies. The CSSF supervises banks and professionals of the financial sector, including domiciliation agents that are PFS. The Law of 23 January 2025 already anticipated part of the AMLD6 access regime. A comprehensive bill to align Luxembourg law with AMLD6 and the AMLR had not been tabled at the time of writing.

Netherlands. The Ministry of Finance consulted a draft Implementation Act on the prevention of money laundering and terrorist financing in July and August 2025. It implements AMLD6 and replaces the Wwft, while the AMLR applies directly to obliged entities. DNB and the AFM remain the supervisors of banks, trust offices and financial institutions. The parliamentary process continues into 2027.

1. NowDraw the full chart, multiply each chain, and check anyone at exactly 25%.
2. Before 31 March 2027Collect trust, nominee and source-of-wealth documents; align the register with your bank's file.
3. Before 10 July 2027Update the register to the AMLR data set and decide who will run the annual verification.
4. From 10 July 2027Report every change within 28 days and verify yearly.
5. 10 January 2028Deadline for non-EU entities already owning EU real estate.

In a share deal the buyer's notary and bank will test the register, and the register must change within 28 days of completion. Changes in shareholders, voting rights and trustees are what move the AML answer.

Law and practice: Luxembourg Law of 12 November 2004, as amended; CSSF circulars on AML/CFT. Netherlands: internetconsultatie.nl, 'Implementatiewet ter voorkoming van witwassen en terrorismefinanciering' (2025); rijksoverheid.nl; dnb.nl.

Test your chain against the new rules

Enter the number of layers and the largest indirect stake one person holds after multiplying through the chain, then answer four questions. The checker applies the AMLR tests above. It is a first orientation, not a legal opinion; control rights, family links and voting agreements can change the answer.

EU AML Regulation and holding companies: frequent questions