AMLR and AMLD6: Why Perpetual KYC and KYS Must Be Automated

Spherity

15 hours ago

6 min read

Summary: The AMLR (Regulation (EU) 2024/1624) applies from 10 July 2027 and sets fixed outer limits for KYC updates: at least annually for higher-risk customers and at least every five years for all others, plus event-driven reviews. AMLD6 (Directive (EU) 2024/1640) strengthens the beneficial ownership registers that obliged entities check against. Perpetual KYC and KYS, automated on top of signed primary-source data, is the most scalable way to meet both.

What is the AMLR?

The Anti-Money Laundering Regulation (AMLR), formally Regulation (EU) 2024/1624, is the EU's single rulebook for anti-money laundering and counter-terrorist financing (AML/CFT) obligations in the private sector. It was published in the Official Journal on 19 June 2024 and applies from 10 July 2027. Because it is a regulation, it applies directly in every Member State without national transposition.

The AMLR replaces the obligations that the Fourth and Fifth Anti-Money Laundering Directives left to national law. It governs business-wide risk assessments, customer due diligence (CDD), beneficial ownership, enhanced and simplified due diligence, politically exposed persons, targeted financial sanctions and suspicious transaction reporting. Banks, payment and e-money institutions, insurers, crypto-asset service providers and many non-financial businesses are obliged entities under the AMLR.

The operational detail sits in technical standards from the new EU Anti-Money Laundering Authority (AMLA) in Frankfurt. AMLA published its final draft Regulatory Technical Standards on customer due diligence under Article 28(1) AMLR on 30 September 2026. They specify what information obliged entities must collect for standard, simplified and enhanced due diligence, and they now await adoption by the European Commission.

What is AMLD6, and how does it relate to the AMLR?

The Sixth Anti-Money Laundering Directive (AMLD6), formally Directive (EU) 2024/1640, sets the rules Member States, supervisors and Financial Intelligence Units must put in place to prevent money laundering. Where the AMLR tells obliged entities what to do, AMLD6 builds the national infrastructure they rely on. Member States must transpose AMLD6 by 10 July 2027, when AMLD4 as amended by AMLD5 is repealed.

For KYC teams, the most relevant part of AMLD6 is the overhaul of central beneficial ownership registers. Register operators gain powers to verify submitted data, including on-site inspections where accuracy is in doubt, so that register information becomes more adequate, accurate and up to date. Access for persons with a legitimate interest had to be in place by 10 July 2025, and further register provisions by 10 July 2026, as eucrim's analysis of AMLD6 sets out.

A note on naming: some publications use "6AMLD" for the earlier Directive (EU) 2018/1673 on combating money laundering by criminal law. In this article, AMLD6 always refers to Directive (EU) 2024/1640, which is part of the 2024 EU AML package alongside the AMLR and the AMLA Regulation (EU) 2024/1620.

What changes for KYC under AMLR and AMLD6?

The AMLR turns several flexible national practices into fixed EU-wide rules, and AMLD6 raises the quality of the registers KYC teams rely on. The table summarises the changes with the most direct impact on customer due diligence.

Topic	Before (AMLD4/AMLD5)	Under AMLR / AMLD6	Applies from
Legal form	Directive, transposed differently in 27 Member States	AMLR: one directly applicable regulation	10 July 2027
KYC update intervals	Set by national law and internal risk policy	At least once a year for higher-risk customers, at least every 5 years for all others (Art. 26 AMLR), plus event-driven updates	10 July 2027
Beneficial ownership threshold	More than 25%	25% or more, with ownership and control assessed in parallel (Art. 52 AMLR)	10 July 2027
Register discrepancies	Reporting rules varied nationally	Material discrepancies with central registers generally reported within 14 calendar days	10 July 2027
Targeted financial sanctions	Often a separate screening process	Part of customer due diligence	10 July 2027
Beneficial ownership registers	National rules, uneven data quality	AMLD6: register operators can verify data and inspect entities	Phased, 10 July 2025 to 10 July 2027
CDD detail	National guidance	AMLA Regulatory Technical Standards under Art. 28(1) AMLR (final draft published 30 September 2026)	On adoption by the European Commission

Sources: Regulation (EU) 2024/1624, eucrim on AMLD6.

What is perpetual KYC, and why do periodic reviews fall short?

Perpetual KYC (pKYC) is a due diligence model in which customer data is monitored continuously and a review starts when relevant data changes, rather than on a fixed calendar date. The AMLR's maximum intervals are a floor. A customer file that is reviewed only every five years can be wrong for most of that period.

Company data changes constantly. Managing directors are replaced, shareholdings shift above or below the 25% threshold, companies relocate, merge or enter insolvency. In a periodic model, each of these events stays invisible until the next scheduled review or until a supervisor asks.

Periodic reviews also create workload peaks. Under the AMLR, every customer file carries a fixed deadline, and large portfolios of legal entities must be refreshed in waves. Manual re-checks against company registers, PDF extracts and email requests to customers scale linearly with portfolio size and leave little evidence of what was checked, when, and against which source.

A perpetual approach changes three things:

Timeliness: a change in the register triggers a review within days instead of years.
Focus: analysts work on files where something actually changed, instead of re-confirming unchanged data.
Evidence: every data point carries its source and timestamp, which makes the file auditable for supervisors and AMLA.

Why does Know Your Supplier (KYS) belong in the same process?

Know Your Supplier (KYS) applies the same verification logic to the other side of the business: the suppliers, service providers and partners a company pays. The AMLR regulates customer due diligence, but the underlying question is identical: is this legal entity who it claims to be, who owns and controls it, and has anything changed?

EU sanctions law prohibits making funds or economic resources available to designated persons, regardless of whether they appear as a customer or a supplier. A supplier whose ownership changes after onboarding can become a sanctions or reputational risk without any change on the buyer's side. Supply chain due diligence obligations add further pressure to know who stands behind each supplier.

Running KYC and KYS on one verified data foundation avoids two parallel processes, two data sources and two audit trails for the same legal entities. Many companies are both customers and suppliers of a bank or corporate, so a single golden record per legal entity reduces duplicate checks and contradictory data.

What does automated perpetual KYC and KYS require?

Automated perpetual KYC and KYS only works if the data underneath it is trustworthy. Automating a workflow on top of outdated or unverified data simply produces wrong results faster. Four building blocks matter most:

Primary-source data. Company and ownership data should come directly from official registers, or from a publisher validated against them, rather than from self-declarations or scraped copies.
Signed, verifiable data. Each record should be cryptographically signed so its origin and integrity can be checked later. Verifiable credentials are tamper-evident digital attestations whose issuer and integrity anyone can check without contacting the issuer.
Change detection and status updates. The system must notice when a register entry changes or a previously issued attestation is no longer valid, and push that change into the customer or supplier master data.
Audit trail. Every check needs a timestamp, a source and a result, so that compliance teams can show supervisors what was known at the time of each decision.

The AMLR also anticipates digital identity: under Art. 22(6)(b) AMLR, obliged entities can verify identity using eID means at assurance level “substantial” or “high” and qualified trust services under the eIDAS Regulation (eIDAS 2.0). The details are set out in AMLA’s final draft standards on customer due diligence, which the Commission has yet to adopt. With the planned European Business Wallets, company data could in future be exchanged as verifiable credentials instead of documents.

How does Spherity help with AMLR-ready KYC and KYS?

Primary-source data. Company and ownership data should come directly from official registers, or from a publisher validated against them, rather than from self-declarations or scraped copies.
Signed, verifiable data. Each record should be cryptographically signed so its origin and integrity can be checked later. Verifiable credentials are tamper-evident digital attestations whose issuer and integrity anyone can check without contacting the issuer.
Change detection and status updates. The system must notice when a register entry changes or a previously issued attestation is no longer valid, and push that change into the customer or supplier master data.
Audit trail. Every check needs a timestamp, a source and a result, so that compliance teams can show supervisors what was known at the time of each decision.

Next steps

With less than nine months until the AMLR applies, compliance teams can prepare in three steps: map which customer and supplier files will hit their AMLR review deadline first, identify where legal entity data still comes from manual register lookups, and define which data changes should trigger a review automatically.

To see how Spherity's KYLE automates perpetual KYC and KYS with signed data from Bundesanzeiger Verlag, get in touch with our experts or learn more on the KYC and KYS solution page.