The new EU Anti-Money Laundering Package, in force since July 2024, marks a decisive shift toward a unified and more rigorous AML framework across Europe. With a directly applicable regulation, an updated directive, and the creation of AMLA in Frankfurt, the landscape is evolving quickly. The mandatory implementation date in July 2027 places real pressure on organizations to act now. To understand how far companies have progressed, Deloitte and Sinpex surveyed 117 organizations across financial and non-financial sectors. The complete results can be downloaded here.
The results reveal a significant preparedness gap across industries. Most organizations are still early in their AML journey, with financial institutions generally more advanced, more informed, and more digitized. Non-financial companies, many of which are newly brought into scope, face substantial challenges related to awareness, staffing, and system readiness.
The survey shows that 47% of all respondents are only slightly familiar or not familiar at all with the requirements of the new AML Package. This includes 34% who feel only slightly familiar and 13% who are not familiar at all. Meanwhile, 41% say they are quite familiar, and only 12% describe themselves as very familiar. Financial institutions are far ahead: close to 70% classify themselves as quite or very familiar. In contrast, more than 80% of non-financial companies report only slight familiarity or none at all, confirming that many newly obliged sectors have not yet fully internalized the scope of the coming changes.
Only 29% of surveyed organizations have started a company-wide implementation strategy for the new AML framework. A much larger share, 53%, has not started but is planning to, and 18% are not planning at all. The sectoral contrast is striking. Among financial institutions, 39% have already begun implementation. Among non-financial companies, only 6% have done so, while nearly half report that they have no plans to start. This indicates that many organizations may underestimate the effort required to achieve compliance by 2027.
Across all respondents, 56% identify staffing as one of their main internal gaps in preparing for the AML Package. Another 55% point to missing or insufficient IT and monitoring systems, and 54% say lack of time is a major constraint. Knowledge and training gaps follow at 38%, while budget limitations are named by 30%. The nature of these challenges differs by sector. Financial institutions struggle most with upgrading or integrating IT systems, while non-financial companies face higher pressure from staffing shortages and lack of internal capacity. These bottlenecks illustrate why progress toward implementation remains slow.
Top challenges related to EU AML
Many companies still underestimate how time-intensive the shift to the new AML standard will be. While 56% believe they will need fewer than 30 internal hours per month for implementation, an additional 22% expect 30 to 70 hours, and another 22% anticipate more than 70 hours every month. Some even expect more than 100 hours. Financial institutions tend to forecast significantly higher workloads, suggesting a more realistic assessment of what the new regulatory obligations require. Non-financial organizations, by contrast, may be underestimating the long-term resource commitment required for full compliance.
The survey reveals that smaller companies face the highest proportional cost burden. Organizations with 1 to 50 employees report average AML-related implementation costs around 5% of annual revenue, with a median value of about 3%. Mid-sized companies report average costs between 4.5% and 4.8%, while the largest companies, with more than 5,000 employees, report an average of about 4.4% and a median of roughly 2%. The results show a clear economy-of-scale effect: larger companies can distribute fixed investments more efficiently, while smaller firms experience disproportionately high financial pressure. Financial institutions are particularly impacted, with an average expected cost of 5.3% of annual revenue, more than double the average for non-financial organizations, which stands at 2.5%.
Just 53% of all surveyed organizations use digital solutions for AML, KYC/KYB, or UBO processes. Another 19% are planning to do so, while 28% are not planning at all. The gap between sectors is large. Among financial institutions, 71% already rely on digital AML solutions. Among non-financial organizations, the figure is only 11%, and 63% have no plans to adopt digital tools. This digital divide may become one of the most critical risk factors as the 2027 deadline approaches, especially since manual processes will not scale with increased regulatory complexity.
Screening is the most automated process, with 68% of companies using automated checks for sanctions, PEP, or adverse media. Suspicious activity reporting is automated by 31%, and KYC or KYB processes by only 30%. About 6% of organizations have no automation at all. Financial institutions lead again, with 85% automating screening and significantly higher automation levels across all areas. Non-financial companies, by contrast, remain heavily dependent on manual work. This not only increases workloads but also introduces operational risks and limits scalability.
When asked if they are open to greater automation in compliance, 51% say yes, 35% are unsure, and 14% say no. Organizations already using automation are much more likely to want more of it, suggesting that practical experience increases confidence in digital solutions. The sector comparison is especially revealing. In the financial industry, 62% express openness toward further automation, and only 12% oppose it. Among non-financial companies, only 26% say yes, and 57% remain unsure. This uncertainty shows that many organizations lack visibility into how automation can support their compliance processes or underestimate its value.
The survey makes one point unmistakably clear. Europe is at the beginning of a considerable AML transformation, and readiness levels are not where they need to be. With low awareness, limited strategic planning, structural staffing gaps, and a lack of digitalization across large parts of the market, the next two years will be decisive. Companies that act early can reduce regulatory risk, strengthen operational efficiency, and build scalable onboarding and monitoring processes. Companies that postpone action risk facing a compressed and costly implementation race.
Organizations can access the full survey results, visual analyses, and detailed sector comparisons here.
