EU AML Regulation (AMLR): What Changes in Malta in 2027

From 10 July 2027, the EU Anti-Money Laundering Regulation (AMLR) replaces much of the national rulebook with one set of rules that applies directly in Malta. For almost a decade, Maltese subject persons have worked to the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR) and the FIAU’s Implementing Procedures, built on the EU’s AML directives. With eight months to go, this article explains what the EU AML Regulation changes in Malta, how the new EU Anti-Money Laundering Authority (AMLA) fits in, and what to do now.

A single EU rulebook from July 2027

The AMLR, Regulation (EU) 2024/1624, applies from 10 July 2027. As a regulation, it needs no transposition: it applies directly in every Member State, and Directive (EU) 2015/849, the Fourth AML Directive, is repealed on the same date.

The practical effect is that many of the rules you follow today will come from an EU regulation rather than Maltese law. The FIAU remains your supervisor, but it will apply a common EU rulebook, filled in by technical standards from AMLA.

What changes for subject persons

The AMLR keeps the familiar risk-based approach but fixes many of the details at EU level. The changes most relevant to Maltese businesses are:

Area	What the AMLR requires
Occasional transactions	Customer due diligence (CDD) from €10,000, in a single operation or linked operations, down from €15,000. Crypto-asset service providers apply CDD from €1,000.
Gaming	CDD when a customer wagers a stake or collects winnings of €2,000 or more, in a single operation or in several operations that appear to be linked.
Cash	Cash payments for goods or services are capped at €10,000 across the EU. Member States may set lower limits.
Beneficial ownership	A 25% threshold, with indirect holdings calculated by multiplying along each chain of ownership and adding the chains together. Control is assessed alongside ownership.
Sanctions	Checking whether a customer or its beneficial owners are subject to targeted financial sanctions becomes part of CDD.
Very wealthy customers	Banks, financial institutions and trust and company service providers apply extra measures to higher-risk relationships involving assets of €5 million or more, for customers with total assets of €50 million or more.
Customer reviews	Customer information must be updated at least once a year for higher-risk customers and at least every five years for all others.
Governance	A member of the management body, the compliance manager, is responsible for AML compliance and reports to the board at least once a year. The compliance officer, of sufficiently high standing, prepares that report.
Outsourcing	Allowed after notifying the supervisor, but six core tasks cannot be outsourced, including approving the business-wide risk assessment and deciding a customer’s risk profile.
New subject persons	Crowdfunding service providers, traders in high-value goods and, from 10 July 2029, professional football clubs and football agents.

For most firms, the biggest change is not any single rule but where the rules sit. Policies and procedures that cite the PMLFTR and the Implementing Procedures will need to be mapped to the AMLR’s articles and to AMLA’s standards.

AMLA and the timeline

AMLA, based in Frankfurt, began operating on 1 July 2025. It drafts the technical standards that fill in the AMLR and coordinates national supervisors such as the FIAU. According to AMLA’s own explainer, it will select up to 40 of the most significant financial institutions or groups in the EU from July 2027 and take over their direct supervision in 2028.

On 1 October 2026, AMLA submitted its final draft standards on customer due diligence to the European Commission, which must now adopt them. For most Maltese subject persons, the FIAU remains the day-to-day supervisor.

1 July 2025: AMLA starts operating in Frankfurt.
1 October 2026: AMLA submits its final draft CDD standards to the European Commission.
July 2027: AMLA begins selecting the entities it will supervise directly.
10 July 2027: the AMLR applies in Malta and across the EU.
2028: AMLA’s direct supervision of the selected entities begins.
10 July 2029: the AMLR applies to professional football clubs and football agents.

Five things to do before July 2027

Run a gap analysis. Map your current policies, procedures and controls against the AMLR, article by article, and list what must change.
Recalibrate thresholds and triggers. Update CDD triggers for occasional transactions and cash. Gaming operators should check how they aggregate linked stakes and winnings against the €2,000 threshold.
Review beneficial ownership. Recheck complex structures using the AMLR’s method for indirect holdings, and record how control is exercised as well as who owns what.
Fix governance. Name the board member who will act as compliance manager, confirm the compliance officer’s standing and reporting line, and schedule the first annual compliance report to the board.
Refresh the business-wide risk assessment and training. Rebuild the assessment on the AMLR’s risk factors as AMLA’s guidance is finalised, and train staff and the board on what has changed.

Starting now spreads the work over three quarters rather than one, and leaves time to absorb AMLA’s standards once the European Commission adopts them. For the related beneficial ownership changes already in force, see our article on Malta Beneficial Ownership BO4.

Frequently asked questions

When does the EU AML Regulation apply in Malta?

From 10 July 2027. It applies directly, without Maltese implementing legislation. Professional football clubs and football agents come into scope from 10 July 2029.

Will the FIAU still supervise my business?

Yes, for almost all Maltese subject persons. AMLA will directly supervise only up to 40 of the most significant financial institutions and groups in the EU, from 2028. Everyone else stays with their national supervisor, which in Malta is the FIAU.

What is the CDD threshold for gaming operators under the AMLR?

€2,000, triggered when a customer wagers a stake, collects winnings, or both, whether in a single operation or in several operations that appear to be linked.

Can AML tasks still be outsourced?

Yes, after notifying the supervisor, but six core tasks must stay in-house. They include approving the business-wide risk assessment, approving internal policies, deciding a customer’s risk profile, deciding whether to onboard a customer, reporting suspicions to the FIU, and approving the criteria for detecting suspicious transactions.

Sources

Cuschieri Advocates advises subject persons on AML/CFT compliance, including AMLR gap analyses, policy updates, business-wide risk assessments, board training and outsourced MLRO support. Read more about our AML/CFT services or contact us.

This article is general information only and is not legal advice. It reflects the position as at its last review in November 2026.