.png)
It is five minutes to midnight. Not figuratively, literally. The new EU Anti-Money Laundering Regulation comes into force in July 2027, and institutions that wait will struggle. That was the clear message from our live webinar on 26 March 2026, held together with Sebastian Glaab, Partner at Annerton and one of the leading experts in financial market regulation in the German-speaking world.
What struck us: awareness of the scale of change is high. Preparation is lagging behind. This post summarises the key insights and gives compliance leaders a clear picture of what to do next.
The EU AML package consists of four components that collectively reshape the foundations of anti-money laundering compliance in Europe:
The practical consequence: the regulatory arbitrage that once made a Luxembourg or Dutch licence structurally more attractive than a German one is gone. Europe is harmonising, and the market is already feeling it.
The terminology is shifting, and so is the substance. The "economic owner" (wirtschaftlicher Eigentümer) will be more precisely defined under the new regulation. It is always and exclusively a natural person — never a legal entity. But the requirements around who qualifies as an economic owner, how they must be identified, what must be known about them, and how that must be documented are changing substantially.
Anyone entering into a business relationship with a legal entity must in future check not just the direct counterparty but also the economic owner behind it. That means:
We recently encountered this situation: a customer classified as low-risk, unchanged in the portfolio for years. Then the shareholder structure changes quietly — 51% is acquired — and behind it sits a connection to Russia, only visible through trade register monitoring. The customer had notified the institution as required by the general terms. But between receiving that notification and actually reviewing and reassessing the risk, there was a gap. Under the new regulation, gaps like that are no longer acceptable.
We ran three polls during the webinar. The results paint an honest picture of where the industry stands today.
Very confident 23%
Fairly confident 46%
Partially uncertain 29%
Frequently uncertain 2%
At first glance, encouraging: nearly 70% feel fairly or very confident. Sebastian Glaab's read was more nuanced — that confidence in the current methodology likely reflects the existing rules, not the incoming ones. Anyone who is confident today should check whether that confidence will hold after 2027.
Identifying the ownership structure 39%
Verifying the information 36%
Ongoing monitoring 11%
Documentation for auditors 9%
Integration into existing KYC processes 5%
75% of respondents cite identification and verification as their biggest pain point. That is exactly what we hear in conversations with compliance teams every day. Capturing basic master data is solvable. Working through complex, multi-layered international ownership structures and arriving at a defensible conclusion about who actually controls the entity — that is the real effort driver.
Very strong increase 15%
Significant increase 61%
Slight increase 24%
Barely any change 0%
Not a single participant expects barely any change. 76% anticipate a significant or very strong increase in UBO-related requirements. This is a clear signal from people who deal with these issues operationally every day.
The core tension here is the simultaneous demand for volume, speed, and compliance quality:
Banks active in international shipping or other sectors with multi-layer holding structures know the challenge well:
Regulators no longer expect answers in three weeks. They expect them now.
Sebastian Glaab cited a concrete example: the question that AML officers are already being asked today — what risk does the current geopolitical environment pose to your institution? What about exposure in the Middle East? What about potential Iran connections via crypto or other product channels?
These are not hypothetical scenarios. They are real examination questions that require a substantiated, data-backed answer. That demands the ability to run risk simulations:
These questions can only be answered with structured data and a compliance infrastructure capable of modelling scenarios. Manual processes cannot deliver this.
One point from the webinar that is often underestimated: responsibility for AML compliance does not sit solely with the Money Laundering Reporting Officer. It sits at the top of the organisation.
The new regulation reinforces this: the management board is responsible for ensuring that operational structures meet regulatory requirements. The MLRO can support and delegate tasks, but strategic accountability is non-transferable.
The practical implications: compliance budgets, IT investment decisions, and hiring decisions around KYC must be made and owned at board and executive level.
Sebastian Glaab summarised the action plan in one phrase: "Get ahead of the wave." Waiting until July 2027 to start is too late.
An honest gap analysis should address:
The new requirements apply not only to new customers. Existing customers must be reassessed under the new rules:
That may sound distant. But compliance system migrations are rarely straightforward. Data gaps need closing, IT systems need adjusting, teams need training, and processes need rebuilding. Starting this process in early 2027 means missing the deadlines.
The regulatory complexity of the EU AML package is substantial. Many of the new requirements are still being specified in regulatory technical standards (RTS) currently under development. Structured engagement with legal experts who know the requirements in depth saves time and prevents costly misjudgements.
Important caveat: external experts can support, but the institution must be able to explain and defend its own risk analysis methodology and decision logic. Pointing to a service provider without being able to explain the underlying approach is not an acceptable answer to a regulator.
Sebastian Glaab was direct: "Manual processes are, in my view, finished."
What a robust compliance infrastructure must deliver:
In short: the platform must be able to answer the question "Who is behind this entity, and how did we establish that?" in seconds, not hours.
The EU AML package is not an abstract regulatory project for lawyers. It is an operational transformation project for every institution that enters into business relationships with corporate entities. The requirements around identifying, verifying, and documenting the economic owner are increasing substantially. Supervisory scrutiny is intensifying. Tolerance for manual processes and incomplete documentation is approaching zero.
The good news: institutions that start now still have enough time to get their processes right. And those that deploy the right technology will find that compliance and growth are not in opposition — they reinforce each other. Onboarding speed and regulatory robustness are not a trade-off. Done well, they are the same thing.
If you would like to assess where your organisation stands today, or find out how Sinpex can support your team, we would be glad to talk. Book a demo with us.
