# AMLR Source: https://ordergroup.co/glossary/amlr/ Last updated: 2026-10-20 > The AMLR, Regulation (EU) 2024/1624, explained for lenders: who it covers from July 10, 2027, what changes in customer due diligence and what your loan app must handle. [Fintech](https://ordergroup.co/glossary/fintech/) 5 min read # AMLR Anti-Money Laundering Regulation Also known as: Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, AML Regulation Definition The AMLR is Regulation (EU) 2024/1624, the EU's single rulebook against money laundering and terrorist financing. It applies directly in all Member States from July 10, 2027 and sets the customer due diligence duties of obliged entities, including lenders. Cite this entry Text "AMLR". Order Group, Software glossary, 20 October 2026. https://ordergroup.co/glossary/amlr/ HTML `AMLR - Order Group` Reviewed by [Mateusz Widenka](https://ordergroup.co/experts/mateusz-widenka/), Head of Delivery Last reviewed 20 October 2026 ## How the AMLR works The AMLR (Anti-Money Laundering Regulation) is Regulation (EU) 2024/1624, which sets the anti-money laundering rules that companies follow across the EU from July 10, 2027. It is one of three acts of the EU anti-money laundering package adopted on May 31, 2024. Directive (EU) 2024/1640 covers what Member States must put in place, such as supervisors, financial intelligence units and beneficial ownership registers. Regulation (EU) 2024/1620 sets up the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). Because the AMLR is a regulation, its customer due diligence rules apply as written in every Member State, without a national act that implements them. The regulation calls the companies it covers obliged entities (Article 3). Credit institutions and financial institutions are on that list, and the definition of a financial institution includes a creditor under the consumer credit directive 2008/48/EC and the mortgage credit directive 2014/17/EU (Article 2(1), point (6)(g)). A consumer lender is therefore an obliged entity, whether it is a bank or a non-bank loan company. A credit intermediary is covered when it holds customer funds in connection with the credit agreement, unless it acts under the responsibility of a creditor (point (6)(h)). Customer due diligence applies in the situations listed in Article 19(1), for example when a business relationship is established, when there is a suspicion of money laundering or terrorist financing, and when there are doubts about previously obtained identification data. A loan agreement starts a business relationship, so the checks happen at onboarding. ## What changes in customer due diligence Article 20(1) lists the measures an obliged entity applies. Among them are identifying and verifying the customer, identifying the beneficial owner, understanding the purpose of the relationship, checking targeted financial sanctions, checking whether the customer is a politically exposed person, and ongoing monitoring. The extent of each measure depends on the risk of the customer and the relationship (Article 20(2)). For a natural person, Article 22(1) names the minimum data: all names and surnames, place and full date of birth, nationalities and the national identification number where applicable, and the usual place of residence. Article 22(6) then allows two ways to verify identity. The first is an identity document, passport or equivalent, where relevant with information from reliable and independent sources. The second is electronic identification at assurance level "substantial" or "high" under the eIDAS Regulation (EU) No 910/2014, together with relevant qualified trust services. The [KYC](https://ordergroup.co/glossary/kyc/) entry covers that check in more detail. Verification takes place before the business relationship starts (Article 23(1)), with limited exceptions where the risk is lower. When the checks cannot be completed, the obliged entity must not establish the relationship, and it keeps a record of that decision too (Article 21(1) and (3)). Customer data has to be kept up to date, at least once a year for higher-risk customers and at least every five years for the others (Article 26(2)). Documents and information from due diligence, including those obtained through electronic identification, are kept for five years from the end of the relationship or from the refusal to enter into one (Article 77(3)). ## What the AMLR means for your system In a lending app or a [borrower portal](https://ordergroup.co/fintech-software-development/loan-management-software-development/), customer due diligence runs inside the application flow. Requirements for the system: - The form collects the Article 22(1) data. Check that the application asks for every field the lender needs for identification, including place of birth and nationality, and that the backend stores them in a structured way. - Identity verification offers the Article 22(6) routes. A document check and an electronic identity are two methods with different integrations, so keep the list and the order of methods in backend configuration. - The agreement waits for verification. The application cannot move to the agreement while verification is pending or has failed, and a refusal is stored with its reason. - Sanctions and politically exposed person checks run as their own steps, apart from identity verification. Store when each check ran, on what data and with what result. - Records are kept for five years. Retention runs from the end of the relationship or from a refusal, so the system needs both dates. - Data has a review date. Ongoing monitoring needs a field that says when customer data was last confirmed and a way to ask the customer for an update in the app. - Bank account checks stay a separate step. A verification transfer or a bank login through [open banking](https://ordergroup.co/glossary/open-banking/) confirms the account and helps against fraud, but neither appears among the means listed in Article 22(6). Writing the specification? Add AMLR to your requirements checklist Collect the terms your project touches and get their system requirements in one e-mail, ready for an RFP. AMLR customer due diligence duties and what the lending system needs | Duty | AMLR article | What the system needs | |---|---|---| | Identify the customer: names, place and date of birth, nationality, national ID number, residence | Art. 22(1)(a) | Form fields and structured storage for each item | | Verify identity with a document or eID (substantial or high) with qualified trust services | Art. 22(6) | Integrations with verification providers, method order in configuration | | Verify before the relationship starts | Art. 23(1) | Application status that blocks the agreement until verification passes | | Refrain from the relationship when checks fail, and record it | Art. 21(1) and (3) | Rejection status with a stored reason | | Check sanctions and politically exposed persons | Art. 20(1)(d) and (g) | Screening step with its result in the customer record | | Update customer data at least yearly (higher risk) or every five years (others) | Art. 26(2) | Review date per customer and an update flow in the app | | Keep records for five years | Art. 77(3) | Retention tied to the end of the relationship or the refusal date | ## AMLA and technical standards AMLA has its seat in Frankfurt am Main. It writes the regulatory technical standards that fill in the AMLR. Under Article 28(1), the standards on customer due diligence specify what information to collect at each level of due diligence (standard, simplified, enhanced). They also name the reliable and independent sources for verification and the attributes that electronic identification means must have. On October 1, 2026 AMLA announced that the final draft of these standards had been submitted to the European Commission. They become binding only after the Commission adopts them and they are published in the Official Journal, and AMLA proposes that they apply six months after entry into force. AMLA will also supervise some institutions directly. Under Article 13 of Regulation (EU) 2024/1620 it selects credit and financial institutions with a high residual risk profile that operate in at least six Member States, starts the first selection by July 1, 2027 and begins direct supervision six months after it publishes the list. Other obliged entities stay with national supervisors. The AMLR itself applies from July 10, 2027 (Article 90); only football agents and professional football clubs get a later date, July 10, 2029. This entry is not legal advice; which duties apply depends on the company's status. ## From our projects We build the customer side of [lending apps](https://ordergroup.co/fintech-software-development/) for consumer lenders supervised by the Polish Financial Supervision Authority (KNF): the application flow, KYC and integrations with the lender's core system. In those apps, KYC is a separate status in the application, with a document scan done by an external identity verification service. After a negative result the customer can try again. Checks that fail for technical reasons run again automatically, and the app asks for the result again when the customer returns to a pending application. Bank account verification, by bank login or verification transfer, runs as a separate step. We did not build the identity verification service or an AML system, and the lender decides which due diligence measures apply. ## Related terms - [CCD2](https://ordergroup.co/glossary/ccd2/) Consumer Credit Directive 2 CCD2 is the common name of Directive (EU) 2023/2225 on credit agreements for consumers, which replaces Directive 2008/48/EC. Member States must apply the national rules implementing it from November 20, 2026. - [KYC](https://ordergroup.co/glossary/kyc/) Know your customer Know your customer (KYC) is the process in which a financial company identifies a customer and verifies their identity, usually at onboarding, as part of its anti-money laundering duties. eKYC is the remote, digital form of that process. - [Open banking](https://ordergroup.co/glossary/open-banking/) Open banking is regulated third-party access to a customer's payment account, with the customer's consent. In the EU it rests on PSD2, which defines account information services (AIS) and payment initiation services (PIS). ## Sources 1. [Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR)](https://eur-lex.europa.eu/eli/reg/2024/1624/oj) - EUR-Lex 2. [Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA)](https://eur-lex.europa.eu/eli/reg/2024/1620/oj) - EUR-Lex 3. [Directive (EU) 2024/1640 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing](https://eur-lex.europa.eu/eli/dir/2024/1640/oj) - EUR-Lex 4. [AMLA finalises key standards for the private sector](https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en) - AMLA 5. [Regulation (EU) No 910/2014 on electronic identification and trust services (eIDAS)](https://eur-lex.europa.eu/eli/reg/2014/910/oj) - EUR-Lex Mateusz Widenka reviewed this entry. Ask how it applies to your project. [Ask an engineer](https://ordergroup.co/contact-us/) ## FAQ ![Mateusz Widenka](https://ordergroup.co/media/images/T02DHCC1Z-U039G6G3JS1-8e7d2cd80ccb-512.format-webp.webp) Mateusz Widenka Head of Delivery [Talk to an engineer](https://ordergroup.co/contact-us/) ### What is the AMLR? The AMLR is Regulation (EU) 2024/1624 on preventing the use of the financial system for money laundering or terrorist financing. It lays down a single set of customer due diligence rules for obliged entities across the EU and applies from July 10, 2027. ### Does the AMLR apply to lenders? Yes. A creditor under the consumer credit directive and the mortgage credit directive is a financial institution under Article 2(1)(6)(g), and financial institutions are obliged entities under Article 3. ### What is the difference between the AMLR and AMLA? The AMLR is the regulation with the rules for companies. AMLA is the EU authority set up by Regulation (EU) 2024/1620. It drafts technical standards under the AMLR and will directly supervise selected high-risk cross-border institutions. ### Does the AMLR replace national anti-money laundering laws? The due diligence rules for companies move into the AMLR, which applies directly from July 10, 2027. Member States still transpose Directive (EU) 2024/1640 on supervisors, financial intelligence units and registers, so national anti-money laundering laws remain for those parts. ## Building a system with AMLR in scope? See how we build software for this domain, with case studies and the stack we use. [See Fintech Software Development Services](https://ordergroup.co/fintech-software-development/) Requirements checklist For each term we send the definition and what it requires from your software. Free, no sales call needed. Your checklist is empty. Use the plus next to a term to add it.