In 2026, regulators are calling for a move away from the compliance checkbox mentality towards customer lifecycle compliance, where a risk-based approach is central, perpetual monitoring is key and new threats mean that even low-risk cases require scrutiny.
If you are a compliance officer in 2026, all you should know is that KYC and AML in the EU are in full transition and we have gathered the top 6 to keep for 2026 below.
Keep 6 for 2026
1. Prepare for the harmonized EU AML regime and the AMLA
In 2026, compliance officers should start preparing for the new AML regime as this directly impacts internal policies, processes and controls expected of regulated entities in the European Union.
The reformed AML regime is made up of 3 legislative documents listed below that aim to create a level playing field in the EU internal market.
The AML Regulation – establishes a single rulebook of AML rules directly applicable across the EU to create a harmonized landscape.
The 6th Money Laundering Directive – contains AML rules that repeal the previous AML Directives and require member state transcription into national law, thus allowing flexibility.
The AMLA Regulation – establishes the AML Authority, its powers and responsibilities as well as supervisory powers for high-risk financial institutions.
We call for your immediate attention to the AML Regulation which is effective from July 2027 and will be creating a Single Rulebook for all obliged companies across Europe.
2. Welcome the new “Compliance Manager”
The AML Regulation is introducing a new mandatory compliance role joining at management level, the Compliance Manager who is personally accountable for AML/CFT effectiveness.
The Compliance Manager is responsible for ensuring compliance with the AML Regulation and consistency of internal policies, procedures and controls with the entire AML framework. They are tasked with allocating sufficient resources to compliance and reporting to management on all of the above.
The Compliance Officer role is refined and no longer required to be part of the management team. They are responsible for the day-to-day operation of policies, procedures and controls for an entity, and reporting of suspicious activity to the national Financial Intelligence Unit (FIU) and remain the point of contact for the competent authorities.
Where necessary, depending on the institution’s size, nature and complexity, the Compliance Manager role may be taken on by the Compliance Officer on top of their responsibilities.
Additionally, these changes extend to group-wide structures and where applicable, the Compliance Manager will be responsible for reporting to the parent management body on group-wide policies, procedures and controls.
3. Update Customer due diligence (CDD) policies
Due diligence obligations are now established in the Single Rulebook, aiming for greater harmonization across EU member states. Simplified due diligence (SDD) is restricted even further with new trigger scenarios, lower transaction thresholds and criteria being added to CDD and Enhanced due diligence (EDD).
For CDD verification of natural and legal persons the following data points must be collected:
Natural persons
- Complete full name
- Place of birth
- Date of birth
- Nationalities
- Residential address
- National and tax identification numbers (where applicable)
Legal entities
- Legal name
- Legal form
- Office address and if different, principal place of business
- Country of incorporation
- Legal representatives’ names
- Registration number
- LEI and tax numbers (where applicable)
- Full names of shareholders and directors
- Status as nominee shareholders or directors
The information that must be collected for beneficial owners is listed below, alongside further changes.
Furthermore, customer information must be updated at least every five years for customers subject to CDD and annually for those subject to EDD.
How then is perpetual KYC added? Obliged entities will need to keep customer data up to date where circumstances change as well. Effectively, this means that obliged entities and compliance teams will need to go beyond knowing who their customers are, and understand them, ensuring that they are placed within the appropriate due diligence bracket at all times to avoid repercussions.
Additionally, where specific risks justify and in accordance with the risk-based approach, Member States are still able to gold-plate requirements. To do so, these must be notified to the Commission within five days of application. Then, the EU Commission may extend these measures to the entire EU or, if found to be unnecessary, mandate that the Member State removes the measure.
4. Revise beneficial ownership policies
The threshold for beneficial ownership is now changed to “25% or more of the shares or voting rights or other ownership interest”, replacing the previous “25% plus one share or an ownership interest of more than 25%”. Additionally, for company categories identified as high-risk, Member States can lodge a request with the Commission to lower the threshold to 15%.
CDD procedures require the identification and verification of beneficial owners, collecting the following data:
- Complete full name
- Place of birth
- Date of birth
- Residential address
- Country of residence
- Nationality/ies
- Identity document number
- Unique personal identification number (where applicable)
Verification can be done via ID documents or digital IDs and beneficial owners should be checked against beneficial ownership registers. Where the beneficial owners cannot be identified, all senior management must be identified instead.
To enhance oversight, the 6th Money Laundering Directive empowers national beneficial ownership registries to carry out checks and on-site inspections to verify the data on the register, also requiring obliged entities to report discrepancies.
5. Refine risk-based approach to third countries
The new Single Rulebook brings clarity to the risk-based approach, aligning more closely with the Financial Action Task Force (FATF) black and grey lists on dealings with customers and counterparties in countries that pose added risk. The European Commission is empowered to mandate specific EDD measures and countermeasures in certain cases. The distinctions include:
High-risk third countries
These are countries with significant strategic AML/CTF deficiencies in their national regimes that are subject to a “call for action” by the FATF, which will be identified by the EU Commission as high-risk third countries. In these cases, obliged entities will need to apply EDD measures and any additional countermeasures required.
Third countries with compliance weaknesses
These are countries subject to “increased monitoring” by the FATF and will be identified as third countries with compliance weaknesses by the EU Commission, requiring EDD measures to be proportionately applied.
Third countries not identified as subject to calls for action or increased monitoring
The EU Commission reserves a third category for third countries not identified by the FATF, that do not fit into the first or second category, which nevertheless pose a specific and serious threat to the EU financial market. Depending on the nature of the threat, these third countries will be subject to all or certain EDD measures, as stated in delegated acts by the Commission.
6. Be aware of sanctions fines for non-compliance
A periodic penalty payments framework is being introduced for non-compliance, which comes on top of the powers national supervisors already have to impose financial penalties and administrative sanctions – however these too are being raised. Fines for non-compliance are raised to EUR 10 million or 10% of the total annual turnover, whichever is higher.
Conclusion
As regulation increases and the agility of financial criminals increases with AI, the business-as-usual outlook is a dead end. In practice, we are seeing a shift with firms adopting technology solutions that create an orchestrated, unified view of risk; end-to-end workflows, from customer onboarding to monitoring and beyond.
In 2026, firms that understand the risks are choosing dynamic customer lifecycle solutions that enable automated KYC and AML checks, dynamic risk ratings, transparent review and readily available audit trails. The firms that do this well flip compliance from a defense center to a business advantage, elevating customer experience, boosting operational efficiency, protecting their reputation and eliminating drop-offs.
Get in touch and start future-proofing your compliance today.
