Compliance Briefing — January 10, 2020

Executive briefing: The transposition deadline for the Fifth Anti-Money Laundering Directive (AMLD5) arrived on 10 January 2020. Member states were required to transpose the directive's provisions into national law, strengthening KYC, beneficial ownership transparency, and oversight of virtual asset service providers. The European Commission reminded lagging governments in infringement notices that failure to transpose exposes them to referral to the Court of Justice. For regulated entities, the deadline marks the point at which supervisors expect compliance evidence covering expanded customer due diligence, politically exposed person (PEP) controls, and interconnection of beneficial ownership registries.

Regulatory scope and critical changes

AMLD5 amends AMLD4 to close weaknesses identified in the 2017 Council agreement. Key updates include extending AML requirements to virtual currency exchanges and custodian wallet providers, reducing anonymous prepaid card thresholds from EUR 250 to EUR 150, strengthening due diligence for transactions involving high-risk third countries, and mandating public access to corporate beneficial ownership registers. Financial Intelligence Units gain broader access to centralised bank account registries, while credit institutions must respond swiftly to FIU queries. Obligations also cover art dealers and estate agents letting property with monthly rents above EUR 10,000, tightening controls on non-financial gatekeepers.

Supervisors now expect institutions to adapt customer risk assessment models to incorporate virtual asset exposure, complex ownership structures, and politically exposed persons from new categories. The EBA risk-factor guidelines, updated for AMLD5 alignment, emphasise that firms cannot rely solely on simplified due diligence when dealing with digital service providers or shell structures, even if they previously fell outside regulated sectors.

State of national implementation

As of January 2020, only a subset of EU and EEA states met the transposition deadline. Countries including Germany, the Netherlands, and Italy enacted enabling laws in late 2019, while others (e.g., Portugal and Romania) faced infringement proceedings for delays. Luxembourg published the beneficial ownership register guidance just days before the deadline. Financial institutions operating cross-border must map each jurisdiction's implementation nuances, such as France’s extension of AML obligations to virtual asset service providers under loi PACTE and Ireland's Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Act 2020 aligning national law with AMLD5.

Supervisors including the European Supervisory Authorities warned firms that transposition delays in a member state do not exempt institutions from preparing compliance. The ESAs’ joint opinion of October 2019 called out persistent weaknesses in customer due diligence, beneficial ownership verification, and transaction monitoring; national competent authorities are expected to intensify on-site inspections and thematic reviews during 2020 to ensure AMLD5 controls are operational.

Operational implications for compliance programmes

Compliance leaders must update AML policies, risk assessment methodologies, and monitoring technology stacks. KYC onboarding flows should capture source of funds, purpose of the relationship, and beneficial ownership data for customers in all EU jurisdictions. System integrations with commercial beneficial ownership registries need to be validated so that alerts trigger when new filings contradict existing records. Institutions relying on simplified due diligence for prepaid cards or e-money customers must re-evaluate thresholds and apply enhanced due diligence when transactions exceed the new lower limits.

Virtual asset service relationships require new playbooks. Banks onboarding cryptocurrency exchanges or wallet custodians need to obtain governance policies demonstrating blockchain analytics capabilities, transaction monitoring thresholds, and travel rule compliance. Non-compliant partners should be escalated to relationship exit committees. Risk functions must ensure transaction monitoring scenarios capture typologies from the FATF virtual asset guidance and Europol’s financial intelligence reports. The combination of AMLD5 and FATF standards means cryptocurrency exposures face the same suspicious activity reporting rigor as fiat relationships.

Data management and technology upgrades

Firms must reconcile multiple data sources to support beneficial ownership verification. Customer lifecycle systems should cross-reference company registries (e.g., the UK’s Companies House and the Danish CVR) with third-party data providers. Legal entity identifier (LEI) integration aids screening, while network analytics can flag opaque corporate structures. Fintechs and payment institutions that grew rapidly pre-AMLD5 often lack centralised customer risk scoring; they must unify data warehouses, implement sanctions screening that covers crypto wallet addresses, and update suspicious activity reporting workflows to include new predicate offenses like environmental crime referenced in AMLD5 recitals.

Technology teams should evaluate regtech vendors offering identity verification, screening, and case management solutions tailored to AMLD5. The directive’s requirement to interconnect national beneficial ownership registers—implemented through the European e-Justice portal—means APIs and data governance controls must support cross-border queries while respecting GDPR principles. Logging and monitoring must capture all access to beneficial ownership data to satisfy supervisory audits and privacy impact assessments.

Governance, training, and assurance

Boards must review AML risk appetite statements to reflect new exposure categories and ensure senior management functions (SMFs) responsible for financial crime have adequate resources. The EBA expects firms to enhance staff training, especially for front-office teams handling high-risk customers and for compliance analysts reviewing virtual asset activity. Internal audit should schedule targeted reviews of AMLD5 implementation covering policy updates, technology configuration, and suspicious activity reporting. Metrics for management reporting should include the number of high-risk customer reviews triggered by virtual asset involvement, beneficial ownership discrepancies resolved, and enhanced due diligence cases initiated because of revised thresholds.

Supervisory bodies have increased cooperation through the Europol European Financial and Economic Crime Centre (EFECC). Firms must be prepared for cross-border information-sharing requests and ensure legal teams understand obligations under AMLD5 Article 32a, which empowers FIUs to suspend suspicious transactions. Documentation of decision-making is essential for demonstrating compliance during regulatory enquiries or enforcement proceedings.

Action plan

1. Immediate: Map business lines and customer segments affected by AMLD5, cataloguing legal entity, beneficial ownership, and virtual asset relationships. Update risk assessments to prioritise remediation activities.
2. 30–60 days: Refresh policies, procedures, and customer-facing disclosures to reflect new due diligence thresholds. Validate integration with national beneficial ownership registers and adjust transaction monitoring scenarios.
3. 60–90 days: Deliver targeted training for frontline and compliance staff, run model validation on AML monitoring systems, and document control effectiveness through internal audit or second-line assurance reviews.
4. Continuous: Track European Commission infringement actions, national guidance from competent authorities, and FATF updates. Maintain a change log showing how the institution updates controls in response to new typologies or supervisory expectations.

By meeting AMLD5 requirements, institutions enhance resilience against financial crime, avoid administrative penalties that can exceed 10 percent of annual turnover, and build customer trust through transparent ownership data and responsive suspicious activity handling.

Follow-up: The Commission pursued infringement actions against late transposing member states through 2021, and the Parliament and Council adopted the single-rulebook AML package in 2024—including the new EU Anti-Money Laundering Authority in Frankfurt—which will replace AMLD5 measures as it phases in from 2025 through 2027.

Sources

• Directive (EU) 2018/843 amending Directive (EU) 2015/849 — Official Journal of the European Union; Official Journal text establishing the Fifth Anti-Money Laundering Directive with a transposition deadline of 10 January 2020 and expanded due diligence requirements.
• European Commission overview of EU anti-money laundering directives — European Commission; Commission guidance describing the 5AMLD obligations, including beneficial ownership access, prepaid card thresholds, and high-risk third-country measures required by January 2020.