Obliged entity — who the EU AML rules actually bind

“Obliged entity” is the switch that turns the whole EU AML rulebook on. Everything else — customer due diligence, monitoring, reporting, retention — is owed by obliged entities and by nobody else. Article 3 of Regulation (EU) 2024/1624, the AMLR, sets out the list directly, which is a change in itself: under the old directive each member state transposed its own perimeter, and firms operating across borders had to reconcile them. This is what the list actually says, how a payments firm gets caught by it, how narrow the exemptions are, and what to do with the answer before the Regulation applies.

1. The Article 3 list

The list opens with two very short limbs and then a long one. Points (1) and (2) are simply credit institutions and financial institutions — no qualifiers, no thresholds, no activity gate. Point (3) then names natural or legal persons acting in the exercise of their professional activities, and runs from (a) to (o).

Two things follow from reading the list in full. Football is in it, and so is investment migration — both sectors that no previous EU AML instrument named. And the professions are gated by activity while the financial sector is not, which is the structural asymmetry the rest of this article turns on.

2. Where a payment firm sits

Payment institutions, e-money institutions and crypto-asset service providers are not named individually in Article 3. They arrive through the financial institution limb, which is why the definition of that term — at Article 2(1), point (6) — rather than the list itself is what a payments compliance officer needs to read. That definition has ten limbs, and it is broader than most firms assume.

Point (6)(a) is the operative one for payments: an undertaking other than a credit institution or an investment firm carrying out one or more of the activities listed in points (2) to (12), (14) and (15) of Annex I to Directive 2013/36/EU, expressly including currency exchange offices, and an undertaking whose principal activity is acquiring holdings, including financial holding companies. The remaining limbs reach life and investment-related insurance undertakings and the intermediaries selling those products, investment firms, collective investment undertakings including UCITS and alternative investment funds and their managers, central securities depositories, creditors and certain credit intermediaries under the mortgage and consumer credit directives, crypto-asset service providers at point (6)(i), and — at point (6)(j) — a branch of any of them located in the Union, whether the head office is in a member state or in a third country.

The branch limb matters more than its length suggests. A third-country group with a single EU branch does not sit outside the perimeter because its parent does; the branch is a financial institution in its own right, and therefore an obliged entity in its own right.

3. The exemptions, and how narrow they are

Articles 4 to 6 let member states exempt certain gambling services, certain professional football clubs, and certain financial activities carried on occasionally or on a very limited basis. The financial-activity exemption in Article 6 is the one payments teams reach for, and it is drafted as a set of cumulative conditions with an exclusion at the top rather than as an open door.

The exclusion first: persons engaged in the activity of money remittance as defined in Article 4, point (22), of Directive (EU) 2015/2366 cannot be exempted at all. For everyone else, all six of the following must be met — the activity is limited in absolute terms; limited on a transaction basis; not the person’s main activity; ancillary and directly related to the main activity; the main activity is not one of the listed professional or gambling activities; and the financial activity is offered only to the customers of the main activity and not to the public generally.

Two of those conditions carry hard numbers. Under Article 6(3), the maximum threshold per customer and per single transaction — whether in one operation or through linked transactions — is set nationally but may not exceed EUR 1 000. Under Article 6(4), the turnover of the financial activity may not exceed 5 % of the person’s total turnover. Article 6(2) adds an absolute turnover ceiling, also set nationally and required to be sufficiently low.

The exemption is also visible rather than local. Article 7 requires member states to notify the Commission without delay of any exemption they intend to grant, with a justification based on their risk assessment; the Commission has two months to confirm it or to declare by reasoned decision that it may not be granted, and may ask for more information in the meantime. Exemptions already in place under the old directive on 10 July 2027 must be notified by 10 October 2027, and the Commission publishes the list annually in the Official Journal.

4. Worked example — the ancillary-activity test

Facts: a retail group in a single member state wants to top up store gift balances and let customers reload them, without a payments licence, arguing the activity is ancillary to retail.

What the rule says: Article 6 asks six cumulative questions, and failing any one of them ends the analysis. Even assuming the activity is ancillary, offered only to the group’s own customers, and outside money remittance, it must also stay under a national per-customer and per-transaction cap that cannot exceed EUR 1 000, and the turnover of the financial activity must stay under 5 % of the group’s total turnover.

What the practitioner does: tests the numeric limbs first, because they are the ones that can be measured today and the ones that will be measured by a supervisor later. The linked-transaction wording is the trap: a per-transaction cap that is enforced per authorisation rather than across linked operations does not meet Article 6(3), and a design that requires customers to split top-ups is evidence of the very structuring the threshold exists to prevent. The second point is jurisdictional: the exemption is a member-state decision confirmed by the Commission, so a group operating in five markets cannot assume it travels.

5. Worked example — operating in another member state

Facts: an e-money institution authorised in one member state plans to distribute through agents and distributors in two others under the freedom to provide services.

What the rule says: Article 8 governs both notification and applicable law. An obliged entity intending to carry out activities in another member state for the first time notifies its home supervisor as soon as it takes steps to do so and, for establishments, at least three months before commencement — unless it is already subject to a specific notification procedure for the freedom of establishment or services under other Union law, or to a specific authorisation requirement in that state. Planned changes to the information notified go to the home supervisor at least one month beforehand. Where an obliged entity operates establishments in several member states, each establishment applies the rules of the state in which it is located. And where the entity operates in other member states through agents, distributors or other infrastructure under the freedom to provide services, it applies the rules of the states in which it provides services in relation to those activities.

What the practitioner does: stops treating the home-state AML framework as travelling intact. The practical output is a matrix of host-state additional rules by activity and channel, owned by the compliance function rather than by legal, and refreshed when a new distribution channel opens — because the trigger in Article 8(5) is the channel, not the licence.

6. When it applies

Article 90 sets the date: the AMLR applies from 10 July 2027, except for the obliged entities in Article 3, points (3)(n) and (o) — football agents and professional football clubs — to which it applies from 10 July 2029. Until then the national transpositions of the current directive continue to govern, which is why a firm operating in several member states is still reconciling perimeters today, and why the mapping work is worth doing once against the AMLR text rather than repeatedly against each national law. Article 89 provides that references to Directive (EU) 2015/849 are to be construed as references to the AMLR and to Directive (EU) 2024/1640, read against the correlation table in Annex VI — which makes that annex the practical instrument for converting an existing policy set rather than rewriting it.

FAQ

What to do, today

• Compliance officer: write down, once, which limb of Article 2(1), point (6) each licensed entity in the group falls under — including branches, which qualify separately.
• Legal counsel: if any exemption is being relied on anywhere in the group, check it against the six Article 6 conditions and confirm it has been notified under Article 7 and confirmed by the Commission.
• Head of expansion: build the Article 8 matrix now — host-state rules by market and by channel — and attach the three-month and one-month notification clocks to the market-entry plan.
• Policy owner: use the Annex VI correlation table to convert the current policy set rather than rewriting it, and date the conversion against 10 July 2027.

Related: The EU AML package timeline · AMLR governance · AMLR outsourcing · Branch versus freedom of services · Enhanced due diligence