AMLA and AMLR — the end of national differences in AML from 2027.

What AMLA is and whom it will supervise

AMLA (the Anti-Money Laundering Authority) is the first EU authority dedicated to anti-money laundering. It was established by Regulation (EU) 2024/1620; it is seated in Frankfurt am Main and started operating on 1 July 2025. AMLA has three roles:

• Direct supervision of selected cross-border credit and financial institutions with the highest risk. The first selection is to be completed in 2027 and direct supervision to start in 2028. For a Polish accounting office or real estate agent this means little — supervision of the non-financial sector stays with national authorities, in Poland GIIF.
• Indirect supervision and coordination — AMLA issues regulatory and implementing technical standards and guidelines and reviews national supervisors, including those for the non-financial sector. Through these standards the harmonisation reaches every obliged entity: templates for risk assessments, the data set for identification, criteria for enhanced measures.
• Support for financial intelligence units — joint analyses and an information exchange platform between FIUs (GIIF in Poland).

AMLA does not replace GIIF or KNF. It does set the standard national authorities must meet — and it will be able to tell a member state that its supervision is too lenient.

What the AMLR changes

Regulation (EU) 2024/1624 applies directly: it needs no Polish implementing act and takes precedence over it. From 10 July 2027 it — not art. 2, 33–37 or 49 of the Polish Act — is the source of an obliged entity's duties.

• The catalogue of entities (art. 3 AMLR). Besides the familiar categories (banks, accounting offices, notaries, real estate agents, exchange offices, crypto-asset service providers) it adds: dealers in precious metals and stones and in high-value goods (vehicles, yachts, aircraft, jewellery, watches above the thresholds in the annex), crowdfunding service providers, investment migration operators, non-financial mixed-activity holding companies and, from 10 July 2029, football clubs and agents for specified transactions.
• The cash limit (art. 80 AMLR). Traders in goods and services may not accept or make cash payments above EUR 10,000 — a ban, not, as in Poland today, a threshold that triggers AML duties. Member states may set a lower limit.
• The beneficial owner (art. 51–53 AMLR). The threshold of shares or voting rights is 25% — the regulation says "25% or more", while the Polish Act today says "more than 25%". Next to ownership the regulation expressly lists "control via other means": the right to appoint the board, veto rights, shareholder agreements, family or informal ties. In multi-layered structures the threshold is calculated through the whole structure.
• Due diligence (art. 19–30 AMLR). A uniform data set for identifying natural and legal persons, due diligence for an occasional transaction from EUR 10,000 (EUR 15,000 in Poland today), for crypto-asset service providers — from EUR 1,000. Verification of the beneficial owner "to a reasonable extent" stays, but the regulation specifies what that means depending on risk.
• Policies, procedures, responsible persons (art. 9–11 AMLR). A compliance manager at board level and a compliance officer — in small entities the same person; a business-wide risk assessment proportionate to size. Record keeping — 5 years (art. 77 AMLR), extendable by at most 5 years in specified cases.
• High-risk countries and financial sanctions. The regulation expressly makes checking targeted financial sanctions part of due diligence — sanctions screening of the client and the beneficial owner becomes an element of every KYC, not a separate duty.

Beneficial ownership registers: access on legitimate interest

After the judgment of the Court of Justice of the EU of November 2022 (joined cases C-37/20 and C-601/20), general public access to beneficial ownership registers was found disproportionate. Directive AMLD6 (EU) 2024/1640 sets a new model: authorities and obliged entities (within due diligence) have full access, while journalists, NGOs, researchers and persons checking a counterparty — on showing a legitimate interest. Member states must implement the register provisions by 10 July 2026 and the whole directive by 10 July 2027.

In Poland the government bill amending the AML Act (Sejm print no. 3163 of September 2026) brings this model to the CRBR: a beneficial owner will be able to ask for restricted access to their data, persons with a legitimate interest — for access, and the bill also provides a new SIGIIF system for obliged institutions and a transitional period for access decisions from 1 October 2027. Until the amendment is passed and in force, the CRBR remains public. How to check the CRBR today: the CRBR register.

What Polish firms should do in 2026

The regulation has no transition period after 10 July 2027 — from that day an inspection may judge your files by the new rules. The list for 2026:

1. Check whether you fall into the art. 3 AMLR catalogue — especially trade in high-value goods, precious metals and stones, crowdfunding. See also the Polish list: obliged institutions.
2. Review your procedure and risk assessment against the new thresholds: EUR 10,000 for an occasional transaction, 25% "or more" for the beneficial owner, control via other means.
3. Build an identification data set that matches art. 22 AMLR — names, date and place of birth, nationalities, address, identification number; for companies — legal form, name, registered office, registration number, beneficial owners.
4. Fold sanctions screening into KYC — the client and the owners checked at onboarding and periodically. Guide: sanctions and PEP.
5. Put the 5 years of records in order — the regulation does not shorten the period, and an inspection after 2027 will cover relationships started today. See: 5-year documentation.
6. Follow AMLA's technical standards — draft RTS on due diligence and risk assessment are published on the authority's site and consulted publicly; they will decide the details.
7. If you use a verification tool — check that the report shows the source and date of every item and the proposed level of measures: after 2027 a "documented risk-based approach" remains the core of the regulation.

Timeline

The Polish AML Act will not disappear: the provisions on GIIF, inspections, penalties, the CRBR and national supervisors remain, and the amendment in print 3163 aligns them with the directive. The substantive rules — whom to verify and how — pass to the regulation. Overview of today's duties: the AML Act.

Legal state: October 2026. Informational material, not legal advice.