Who Does AMLR Apply To? A Sector-by-Sector Guide to Obliged Entities

The EU’s new AML rulebook reaches far beyond banks. Businesses involved in property, crypto-assets, corporate structures, high-value goods, gambling, crowdfunding, investment migration, and professional football can fall within the framework as obliged entities.

The EU AML Package establishes a more harmonised framework through the Anti-Money Laundering Regulation (AMLR), Regulation (EU) 2024/1624. The AMLR generally applies from 10 July 2027, while specific provisions covering professional football clubs and football agents apply from 10 July 2029.

For compliance teams, the challenge is determining exactly where their business fits. This guide breaks down AMLR obliged entities by sector, explains important scope conditions, and outlines the controls businesses should prepare before the application date.

What Are AMLR Obliged Entities?

Article 3 of Regulation (EU) 2024/1624 identifies the categories of businesses and professionals that qualify as obliged entities under the AMLR. The AMLR refers to covered businesses and professionals as ‘obliged entities.’ These include credit institutions and financial institutions, specified professional services, real-estate professionals, gambling service providers, certain traders, crowdfunding service providers, investment migration operators, and specified participants in professional football. 

Importantly, AMLR scope depends on the activities and conditions specified in the regulation rather than simply the company’s industry label. A lawyer, for example, does not fall within scope merely because the business provides legal services. The AMLR covers independent legal professionals when they participate in specified financial, real-estate, corporate, or asset-related activities.

Article 3 therefore provides the starting point for assessing whether a business falls within the AMLR’s scope. The wider EU AML framework also includes AMLD6, which Member States must transpose into national law and which contains additional requirements relevant to the national AML/CFT framework.

Article 3 therefore provides the starting point for assessing whether a business falls within the AMLR’s scope. The wider EU AML framework also includes AMLD6, which Member States must transpose into national law and which contains additional requirements relevant to the national AML/CFT framework.

Which Financial Institutions Fall Under the AMLR?

The AMLR covers a broad range of financial institutions beyond traditional banks, with scope determined by the specific financial activities, services, and regulatory definitions applicable to each business.

Financial Institutions Under AMLR

The category of financial-sector obliged entities under the AMLR extends beyond conventional banks. Article 3 covers credit institutions and specified financial institutions, with the exact scope depending on the activities and definitions set out in EU financial-services legislation and the AMLR.

The wider category includes specified payment and electronic money activities, investment services, certain investment and collective investment structures, life insurance activities, specified insurance intermediaries, money-transfer and currency-exchange activities, and other financial activities identified by the regulation.

Fintech status alone does not determine AMLR scope. The relevant financial activities must meet the definitions and conditions established by the AMLR and related EU financial-services legislation.

Covered financial institutions will need AML/CFT controls proportionate to their activities and risk profile, including customer due diligence, beneficial ownership measures, risk assessment, ongoing monitoring, suspicious activity reporting, record keeping, and internal controls. AMLA is developing and consulting on technical standards and guidelines that will provide further detail on how several of these requirements should be applied across financial and non-financial sectors.

Crypto Asset Service Providers (CASPs) Under AMLR

Crypto-asset service providers have a defined place within the EU’s AML framework. Not every crypto company or crypto-asset issuer automatically becomes an obliged entity under the AMLR. Scope depends on the services provided and the legal definitions and conditions established by the applicable EU framework.

The AMLR also addresses risks associated with crypto-assets, including the use of anonymous crypto-asset accounts and services that can increase transaction obfuscation. Covered CASPs therefore need controls appropriate to their AML/CFT obligations, including customer due diligence, beneficial ownership measures where applicable, and ongoing monitoring of relevant activities.

For compliance teams, the practical challenge is maintaining customer and transaction visibility across fast-moving, cross-border activity. Crypto activity requires controls that can maintain customer information and identify unusual activity across transactions that may move rapidly between jurisdictions.

AMLR Obligations for Lawyers, Accountants and Corporate Service Providers

The AMLR also places professional gatekeepers firmly within its preventive framework. This includes auditors, external accountants, tax advisers, notaries, lawyers, other independent legal professionals, and trust or company service providers.

However, AMLR obligations for legal professionals are activity-specific. Lawyers and other independent legal professionals fall within scope when carrying out the specified activities covered by Article 3, including participating in certain financial or real-estate transactions, managing client money or assets, assisting with the opening or management of financial or crypto-asset accounts, organising contributions for companies, or creating and managing companies, trusts, foundations, or similar structures.

For these businesses, compliance controls become particularly important where professional services intersect with ownership structures, asset transfers, corporate arrangements, and client funds. Those activities can create points where illicit funds enter legitimate commercial structures.

Real Estate AMLR Compliance and High-Value Goods

Real estate remains an important non-financial AML sector. Real estate AMLR compliance applies to estate agents and other real-estate professionals covered by Article 3 when acting as intermediaries in property transactions.

The scope also includes letting transactions where monthly rent reaches €10,000, regardless of the payment method.

The regulation also covers specified professional traders in precious metals and stones and high-value goods. Traders and intermediaries in cultural goods, including certain art galleries and auction houses, can fall within scope where transactions or linked transactions reach the applicable €10,000 threshold. The AMLR also contains specific provisions covering certain activities involving cultural goods and high-value goods in free zones and customs warehouses.

AMLR requirements therefore depend on the specific activities and risk exposure of these businesses.

Gambling, Crowdfunding and Credit Intermediaries

The AMLR extends its reach to gambling service providers, crowdfunding service providers and intermediaries, and certain mortgage and consumer-credit intermediaries that are not already credit or financial institutions.

Gambling providers require particular attention because the AMLR allows Member States to provide for full or partial exemptions in specified circumstances where the money laundering and terrorist financing risks associated with certain gambling services are sufficiently low. Such exemptions are subject to the conditions established by the regulation.

Crowdfunding represents another important expansion because platforms can connect investors and recipients across multiple transactions. Credit intermediaries similarly enter scope where they facilitate covered lending activities outside the traditional financial-institution perimeter.

Investment Migration and Professional Football: New AMLR Sectors

Investment migration operators are expressly included where they assist third-country nationals seeking residence rights through qualifying investments. The AMLR identifies associated vulnerabilities involving money laundering, corruption, and tax evasion.

Professional football is another newly covered area. Football agents fall within the obliged-entity framework, while professional football clubs are covered for specified activities and transactions involving investors, sponsors, football agents, intermediaries, and player transfers.

These football provisions apply from 10 July 2029, rather than the general 2027 application date. Member States may also exempt certain lower-risk clubs under conditions established by the regulation.

The provisions reflect AML/CFT risks associated with the sector’s international financial flows, transfers, ownership structures, sponsorship arrangements, and intermediary relationships.

What Are the Main AMLR Compliance Requirements for Each Sector?

AMLR compliance measures must reflect the nature, size, complexity, and risk profile of the obliged entity. AMLA’s 2026 work on business-wide risk assessment and ongoing monitoring further develops how these principles apply across financial and non-financial sectors.

Core requirements include:

• Risk assessment: Identify and assess money laundering and terrorist financing risks across operations.
• Customer due diligence: Identify and verify customers when the regulation requires CDD.
• Beneficial ownership: Establish relevant ownership and control information.
• Screening and risk identification: Apply appropriate measures for identifying relevant PEP, sanctions, adverse media, and other risk indicators where required by the business’s risk-based framework.
• Ongoing monitoring: Keep customer information current and monitor transactions and activities.
• Suspicious activity reporting: Escalate and report suspicions to the relevant financial intelligence unit.
• Record keeping and internal controls: Maintain required records, documented procedures, internal policies, controls, and appropriate compliance responsibilities.

In June 2026, AMLA also launched a consultation on draft guidelines for ongoing monitoring of business relationships. The draft guidance addresses how obliged entities should maintain customer information and monitor transactions and activities, with the consultation open until 3 September 2026. The proposed principles apply across financial and non-financial sectors, with the consultation open until 3 September 2026.

When Does AMLR Apply? Key Dates for Obliged Entities

The AMLR entered into force in July 2024, but most of its substantive requirements will apply from 10 July 2027.

• 19 June 2024: Regulation (EU) 2024/1624 was published in the Official Journal of the European Union.
• 9 July 2024: The AMLR entered into force.
• 10 July 2027: The AMLR generally starts applying.
• 10 July 2029: Specific AMLR provisions covering professional football clubs and football agents apply.

The implementation period is already active. In 2026, AMLA has been consulting on draft instruments covering areas including customer due diligence, business-wide risk assessment, business relationships, ongoing monitoring, group-wide requirements, and suspicious activity reporting.

How to Determine Whether Your Business Is an AMLR Regulated Entity

An initial AMLR scope assessment can follow three practical checks:

• Identify the activities your business actually performs.
• Compare those activities against Article 3 of the AMLR.
• Review applicable national AMLD6 transposition measures and other national AML/CFT requirements.

Being outside traditional banking does not automatically place a business outside the EU AML framework. The decisive question is whether its activities fall within an obliged-entity category.

How AML Watcher Supports AMLR Readiness

For businesses preparing for 2027, the priority is translating AMLR requirements into practical customer screening, risk assessment, and ongoing monitoring processes.

Preparing for AMLR can be difficult when businesses need to translate regulatory requirements into consistent screening, risk assessment, and ongoing monitoring processes.