Obliged entity — who the EU AML rules actually bind
“Obliged entity” is the switch that turns the whole EU AML rulebook on. Everything else — customer due diligence, monitoring, reporting, retention — is owed by obliged entities and by nobody else. Article 3 of Regulation (EU) 2024/1624, the AMLR, sets out the list directly, which is a change in itself: under the old directive each member state transposed its own version of the perimeter, and firms operating across borders had to reconcile them.
1. The Article 3 list
The list opens with two very short limbs and then a long one. Points (1) and (2) are simply credit institutions and financial institutions — no qualifiers, no thresholds. Point (3) then names natural or legal persons acting in the exercise of their professional activities, and that is where the detail sits.
| Limb | Who | Note |
|---|---|---|
| (1) | Credit institutions | No qualification |
| (2) | Financial institutions | The limb that catches payment and e-money institutions |
| (3)(a)–(c) | Auditors, external accountants, tax advisors; notaries, lawyers and other independent legal professionals for listed activities; trust or company service providers | Activity-gated for the legal professions |
| (3)(d) | Estate agents and other real estate professionals acting as intermediaries | Including letting where monthly rent is at least EUR 10 000 |
| (3)(e)–(f) | Dealers in precious metals and stones; dealers in high-value goods | As a regular or principal professional activity |
| (3)(g)–(i) | Gambling service providers; crowdfunding service providers and intermediaries; traders and intermediaries in cultural goods | Cultural goods gated at EUR 10 000 per transaction or linked transactions |
2. Where a payment firm sits
Payment institutions, e-money institutions and crypto-asset service providers are not named individually in Article 3. They arrive through the financial institution limb, which is why the definition of that term — rather than the list itself — is what a payments compliance officer needs to read. The practical effect is that there is no threshold, no size test and no activity gate: a licensed payment firm is an obliged entity from authorisation, not from its first transaction.
3. The exemptions, and how narrow they are
Articles 4 to 7 let member states exempt certain gambling services, certain professional football clubs, and — under Article 6 — certain financial activities carried on occasionally or on a very limited basis. The financial-activity exemption is the one payments firms sometimes reach for, and it is drafted with an express carve-out at the top of the article rather than as an open door. Any exemption a member state grants must be notified to the Commission under Article 7, which makes the perimeter visible rather than local.
4. When it applies
Article 90 sets the date: the AMLR applies from 10 July 2027. For the obliged entities in Article 3, points (3)(n) and (o), it applies from 10 July 2029. Until then the national transpositions of the current directive continue to govern, which is why a firm operating in several member states is still reconciling perimeters today — and why the mapping work is worth doing once, against the AMLR text, rather than repeatedly against each national law.
Article 8 adds a duty that is easy to miss in the meantime: obliged entities must notify supervisors of cross-border operations, and the article governs which national law applies to them. That is the provision to read before assuming a home-state framework travels intact.
FAQ
Is a payment institution an obliged entity?
Yes — through Article 3, point (2), the financial institution limb, rather than by being named. There is no threshold or activity gate, so the obligations attach from authorisation.
Does being small reduce the obligations?
No. Size and complexity shape how obligations are discharged under the risk-based approach — Article 10 requires the business-wide risk assessment to be proportionate to nature, risk, complexity and size — but they do not remove any obligation.
When does the AMLR replace national AML law?
It applies from 10 July 2027, and from 10 July 2029 for the obliged entities in Article 3, points (3)(n) and (o). Article 89 provides that references to Directive (EU) 2015/849 are to be construed as references to the AMLR.
Related: The EU AML package timeline · AMLR governance · AMLR outsourcing
