Ten years ago, a fintech lending app was legally considered a technology provider. Today, it is a licensed financial institution subject to the same due diligence obligations as a high-street bank. That shift happened directive by directive as regulators worked to close the gaps opened by rapid technical innovation.
Now, that same regulatory line is moving downstream. Responding to AI-generated identities and increasingly sophisticated synthetic fraud, the EU’s new Anti-Money Laundering (AML) package, comprising the AML Regulation (AMLR), AMLD6, and the central AML Authority (AMLA), moves beyond traditional financial entities. It pulls high-value goods traders above defined thresholds, high-value traders, crowdfunding, and BNPL providers directly into the regulated zone.
High-value goods today, broad e-commerce tomorrow
The AML package’s direct legal obligations now target luxury goods above specific transaction thresholds. But focusing solely on where the line sits today misses the broader story of the supply chain ripple effect. While general e-commerce merchants may not be directly classified as obliged entities, the providers powering their checkout, like PSPs, BNPLs, acquiring banks, and marketplaces, unquestionably are. The package also increases pass-through pressure. To meet continuous monitoring rules, payment providers are forced to pass strict verification requirements downstream. Every merchant in the payment chain will feel the operational friction, whether they hold a financial license or not.
While on the face of it, the AML packages involves piecemeal changes; it’s actually a structural realignment of who bears compliance risk. As AI-driven synthetic fraud accelerates, regulatory expectations will continue to penetrate deeper into everyday digital commerce.
What changes: The four axes of AMLR
The new framework extends the regulatory net along four distinct dimensions:
- Width: New categories of obliged entities, from BNPL platforms and crowdfunding portals to high-value goods traders (jewellery, vehicles, luxury goods), are pulled directly into the regulatory scope.
- Depth: Triggers for occasional Customer Due Diligence (CDD) drop from €15,000 to €10,000. Beneficial ownership thresholds shift from “more than 25%” to “25% or more,” with provisions to drop to 15% for high-risk sectors.
- Precision: Compliance shifts from a point-in-time check to an ongoing requirement. Obliged entities must continuously verify that customer behaviour matches their risk profile.
- No Geographical Gaps: AMLR applies directly and identically across all 27 EU member states starting 10 July 2027. The era of exploiting regulatory gaps for the lightest-touch jurisdiction is coming to a close.
Together, those four axes are designed to close exactly the loopholes that fraudsters and launderers have historically relied on. These include entities outside the scope of the rules, amounts and stakes kept just under a number, static checks that go stale, and jurisdictions with weak enforcement.
The front-row effect: Why AMLA matters to everyone
Operating out of Frankfurt, from 2028, AMLA will directly supervise a select tier of roughly 40 high-risk, cross-border entities, backed by powers to issue fines up to €10 million or 10% of global group turnover.
While only a small group faces direct oversight, the supervisory model functions like a classroom setting: moving the most disruptive students to the front row sets the standard for the entire room. Visible enforcement at the top establishes the compliance expectations and incentive structures for every entity operating downstream.
The operational challenge for existing and newly obliged entities
For BNPL providers, PSPs, e-money institutions, marketplaces, and newly obliged entities, the challenge is not just meeting the rules, it’s about minimising the friction required to meet them:
- Conversion Pressure: Lower CDD thresholds mean more transactions trigger mandatory verification during checkout.
- End of Static KYC: Annual document refreshes fail the new requirement to maintain real-time, up-to-date customer records.
- Overlapping Timelines: BNPL providers face Consumer Credit Directive (CCD2) affordability mandates by November 2026, followed by AMLR obligations in July 2027.
These obligations hurt a sector whose entire growth model has been built on removing checkout friction. If implemented through reactive, paper-heavy processes, such as asking users to manually re-upload bank statements or identity documents, compliance will solve the regulatory risk but also kill the business in the process.
Closing the compliance gap with real-time data
Meeting continuous CDD requirements without destroying checkout conversion requires shifting from manual document collection to automated open banking data. While the obligation to evaluate risk remains with the entity; open banking reduces onboarding and checkout friction for the end user.
| Common Control | Traditional Method (High Friction) | Qwist Solution (in-payment flow) |
| IBAN / Payout Ownership | Manual bank statement upload & review | Account Verification: Confirms account ownership directly from the bank in seconds. |
| Source of Funds & Affordability | Paper proof of income / pay slips | Income Verification: Supports affordability checks under CCD2 and can inform your own source-of-funds assessment. |
| Continuous Transaction Monitoring | Static file updates | Data Enrichment: Transforms raw transaction streams into structured, categorised data that feeds your own monitoring. |
July 2027 is the hard deadline
The EU AML package makes compliance continuous. Qwist makes continuous compliance far less visible to your customers.
The July 2027 deadline will split the market between operators who absorb these mandates through heavy, high-friction workflows and those who automate them into the background. Embracing financial data infrastructure isn’t just about avoiding AMLA sanctions, it is what will separate market leaders from those left behind.
