VOVE ID Compliance Research

Union européenne KYC, KYB & AML compliance checklist

Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Union européenne.

Dernière revue: Dernière revue: 31 July 2026
Version: Version 1.2

Union européenne KYC, KYB and AML compliance checklist cover

Réponse directe

Que couvre la checklist de conformité pour Union européenne ?

La checklist pour Union européenne traduit les principales règles KYC, KYB et AML en 13 domaines de contrôle et 67 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.

Faits réglementaires clés

Current preventive framework: Directive (EU) 2015/849, as amended, implemented through each Member State's national law until 10 July 2027
Future single rulebook: Regulation (EU) 2024/1624 generally applies from 10 July 2027; football agents and professional football clubs from 10 July 2029
EU-level authority: AMLA assumed EU-level AML/CFT tasks on 1 January 2026; national authorities and FIUs retain their statutory roles
Current general CDD floor: Business relationships always; occasional transactions EUR 15,000 or more; lower and sector-specific national triggers may apply
Current sector triggers: Transfers exceeding EUR 1,000; cash goods transactions EUR 10,000 or more; gambling transactions EUR 2,000 or more
Suspicious reporting: No EU monetary threshold; report promptly to the FIU designated by the applicable Member State using its national channel
Beneficial ownership: Current national transposition generally uses more than 25% ownership plus control and senior-manager fallback; verify the national act and register
Core AML retention: EU baseline five years after the relationship ends or occasional transaction; national extension and deletion rules vary
Transfers and crypto: Regulation (EU) 2023/1113 has applied since 30 December 2024 to covered funds and crypto-asset transfers
Financial sanctions: EU regulations bind operators, but licensing, reporting, investigation and enforcement are handled by national competent authorities
Privacy: GDPR applies across the EU, with national laws, supervisory authorities and permitted Member-State specifications
FATF public lists: Bulgaria was the only EU Member State named on the FATF increased-monitoring list reviewed 31 July 2026; no EU Member State was on the call-for-action list

Détail d’implémentation

Exigences et actions de conformité pour Union européenne

Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.

01Legal layers, scope and transitionStart with the date, entity, activity and Member State. A directive does not create one identical national operating rule, and a directly applicable regulation does not create one national reporting or enforcement channel.4 éléments+

Until 10 July 2027, Directive (EU) 2015/849 as amended remains the EU preventive baseline through 27 national transposition regimes.
Action d’implémentation
Map every establishment and cross-border service to the current national act, obliged-entity perimeter, exemptions, supervisor and FIU; apply stricter national rules where valid.
Preuves à conserver
Entity and branch map, national-law inventory, perimeter opinions, supervisory allocation, effective-date register and counsel approvals.
Source primaire
Directive (EU) 2015/849, arts. 2, 4-5 and 67; Directive (EU) 2024/1640, art. 77
Regulation (EU) 2024/1624 generally applies from 10 July 2027, with a 10 July 2029 start for football agents and professional football clubs.
Action d’implémentation
Keep the AMLR as a dated change programme, not current operative customer law; map new obliged entities, the EUR 10,000 cash cap and harmonized controls to the correct commencement date.
Preuves à conserver
Transition plan, legal gap assessment, product backlog, training plan, configuration tests and dated launch gates.
Source primaire
Regulation (EU) 2024/1624, arts. 80 and 90
Directive (EU) 2024/1640 has staged national transposition deadlines and replaces the current directive from 10 July 2027.
Action d’implémentation
Track each Member State's enacted measures rather than assuming identical or timely transposition; preserve earlier deadlines for designated provisions and later timing for single FIU access points.
Preuves à conserver
27-state transposition tracker, official-gazette links, legal comparison, dependencies and escalation record.
Source primaire
Directive (EU) 2024/1640, arts. 77-78
AMLA has held transferred EU-level AML/CFT responsibilities since 1 January 2026; its first direct supervision of selected high-risk cross-border financial entities begins in 2028.
Action d’implémentation
Identify the current national financial, professional or self-regulatory supervisor; do not replace the national supervisor or FIU with AMLA, and do not treat the ECB's prudential mandate as general AML supervision.
Preuves à conserver
Authority matrix, future direct-supervision assessment, current supervisory correspondence and FIU routing tests.
Source primaire
Regulation (EU) 2024/1620, arts. 5, 12-17 and 54; AMLA direct-supervision explainer

02Governance and risk assessmentThe current directives require national risk-based systems; the precise governance allocation, fit-and-proper rules, independent audit and supervisor expectations remain sector- and state-specific.3 éléments+

Obliged entities must identify and assess ML/TF risk using customer, country, product, transaction and delivery-channel factors and keep the assessment current.
Action d’implémentation
Maintain EU group methodology plus entity- and Member-State-specific risk assessments; incorporate national and supranational risk assessments and document divergence.
Preuves à conserver
Business-wide and local risk assessments, source register, methodology, approval minutes, control mapping and update log.
Source primaire
Directive (EU) 2015/849, arts. 6-8
Policies, controls and procedures must be proportionate and include model risk management, CDD, reporting, records, internal control, compliance management and staff screening where appropriate.
Action d’implémentation
Assign accountable management, local MLRO or contact roles required by national law, independent assurance and escalation; reconcile group standards with local mandatory rules.
Preuves à conserver
Governance charter, appointment records, policies, local addenda, training, testing, issues and board reporting.
Source primaire
Directive (EU) 2015/849, arts. 8, 45 and 46
Group-wide controls and information sharing do not override GDPR, national secrecy rules or host-state obligations.
Action d’implémentation
Map controller/processor roles, permitted AML data flows, host requirements and escalation where third-country law prevents group controls.
Preuves à conserver
Group policy, data-flow map, legal-basis analysis, transfer mechanism, conflicts register and regulator communications.
Source primaire
Directive (EU) 2015/849, arts. 45 and 46; GDPR, arts. 5, 6, 28 and 44-49

03CDD triggers and natural-person KYCThe directive amounts are minimum harmonization points, not a safe universal configuration. Member States may impose lower thresholds and additional event-, sector- or risk-based triggers.4 éléments+

CDD is required when establishing a business relationship, on suspicion regardless of threshold, and when prior identification data is doubtful.
Action d’implémentation
Make relationship creation, suspicion and data-quality failure hard triggers in every Member State; overlay local definitions and sector rules.
Preuves à conserver
Trigger matrix, onboarding rules, suspicion override, refresh logic, tests, exceptions and approvals.
Source primaire
Directive (EU) 2015/849, art. 11(a), (e) and (f)
The current directive sets CDD floors at EUR 15,000 for occasional transactions, more than EUR 1,000 for covered funds transfers, EUR 10,000 cash for goods traders and EUR 2,000 for gambling transactions.
Action d’implémentation
Configure the lower of applicable EU and national triggers, aggregate linked operations, preserve sector scope and never describe these as universal transaction-reporting thresholds.
Preuves à conserver
Country threshold table, currency-conversion method, linked-transaction logic, sector mapping, test cases and legal sign-off.
Source primaire
Directive (EU) 2015/849, art. 11(b)-(d)
Identify the customer and verify identity using reliable independent documents, data or information; understand purpose and intended nature and monitor the relationship.
Action d’implémentation
Define risk-based evidence standards, validate authenticity and identity binding, capture purpose and expected activity, and refresh on risk or material change.
Preuves à conserver
Identity evidence, validation result, customer profile, risk decision, timestamps, monitoring and refresh history.
Source primaire
Directive (EU) 2015/849, arts. 13-14
A representative must be authorized and identified and verified; failure to complete required CDD normally prevents the relationship or transaction and requires an STR assessment.
Action d’implémentation
Validate mandates and signatory power; block activation or transaction on unresolved CDD, document national exceptions and escalate reporting without tipping off.
Preuves à conserver
Mandate, representative KYC, restriction, exit record, exception analysis, STR decision and approval.
Source primaire
Directive (EU) 2015/849, arts. 13(1), 14 and 39

04KYB, ownership and registersCorporate CDD, the entity's own national filing duty and access to a national beneficial-ownership register are separate controls. Register access and content differ following EU case law and national legislation.4 éléments+

For legal persons, understand ownership and control and take reasonable measures to verify beneficial owners, using senior-management fallback only after all possible means are exhausted and no suspicion remains.
Action d’implémentation
Trace each ownership layer to natural persons, test control through other means, record every unsuccessful step before fallback and apply the operative national definition.
Preuves à conserver
Registry extracts, constitutional documents, ownership calculations, control analysis, exhaustion log and reviewer approval.
Source primaire
Directive (EU) 2015/849, arts. 3(6), 13 and 30
The current directive's indicative corporate ownership threshold is more than 25%, but ownership percentage does not displace control through other means and national law can be stricter.
Action d’implémentation
Do not encode 25% as the sole test; identify lower national or sector thresholds and verify direct, indirect, voting, contractual and de facto control.
Preuves à conserver
Country rule table, cap table, indirect ownership calculation, voting agreements, control memo and sign-off.
Source primaire
Directive (EU) 2015/849, art. 3(6)(a)
Member States maintain national central beneficial-ownership registers and BORIS interconnects available national information, but authorization, authentication, fees, covered arrangements and access conditions vary.
Action d’implémentation
Use the correct national company and BO register, evidence lawful access, obtain current extracts and corroborate them; do not treat missing public access or an extract as proof of no beneficial owner.
Preuves à conserver
National register query, BORIS result, access basis, source documents, discrepancy decision and refresh schedule.
Source primaire
Directive (EU) 2015/849, arts. 30-31; European e-Justice Portal, BORIS directory
Obliged entities must report discrepancies found between CDD and register information under the applicable national process.
Action d’implémentation
Define the national recipient, materiality or scope, filing route and timing; retain comparison and resolution evidence without delaying necessary CDD remediation.
Preuves à conserver
Register-to-CDD reconciliation, discrepancy classification, report, acknowledgement, correction and closure record.
Source primaire
Directive (EU) 2015/849, arts. 30(4) and 31(5)

05PEPs, EDD and remote onboardingEDD is risk- and trigger-based. National PEP lists, domestic treatment, high-risk-country measures and acceptable digital identity evidence must be mapped locally.3 éléments+

For a PEP, family member or known close associate, obtain senior-management approval, establish source of wealth and source of funds, and conduct enhanced ongoing monitoring.
Action d’implémentation
Screen customers, representatives and beneficial owners; adjudicate matches, distinguish the national PEP definition and document relationship-specific approval and evidence.
Preuves à conserver
Screening results, role and relationship analysis, wealth narrative, funds evidence, approval and monitoring plan.
Source primaire
Directive (EU) 2015/849, arts. 20-23
EDD applies to high-risk situations and relationships or transactions involving third countries identified under the EU process, with national additional measures possible.
Action d’implémentation
Maintain separate EU, FATF and national lists, record the legal consequence of each and apply proportionate measures rather than automatic blanket rejection.
Preuves à conserver
List versions, trigger mapping, risk decision, additional evidence, approvals, monitoring and review.
Source primaire
Directive (EU) 2015/849, arts. 18a and 18b; FATF public-list statements
Remote or electronic identification must meet the applicable national assurance, reliability and risk requirements; use of a vendor does not transfer the obliged entity's responsibility.
Action d’implémentation
Assess eIDAS or notified schemes where relevant, document fraud and impersonation controls, accessibility, fallback, vendor assurance and ongoing performance.
Preuves à conserver
Digital-identity assessment, assurance evidence, biometric and liveness tests, exceptions, monitoring and vendor governance.
Source primaire
Directive (EU) 2015/849, art. 13(1)(a); Regulation (EU) No 910/2014 as amended

06Monitoring, STRs and tipping offThere is no single EU STR portal or monetary suspicion threshold. Each Member State designates its FIU, national channel, form, language, timing formulation and additional reporting regimes.4 éléments+

Conduct ongoing monitoring, including scrutiny of transactions for consistency with customer knowledge, risk and source of funds where necessary, and keep CDD information current.
Action d’implémentation
Set Member-State and sector scenarios, investigate unusual activity, refresh profiles and document disposition, escalation and model performance.
Preuves à conserver
Monitoring inventory, alert files, customer refresh, source-of-funds evidence, tuning, testing and governance.
Source primaire
Directive (EU) 2015/849, art. 13(1)(d) and (4)
Where an obliged entity knows, suspects or has reasonable grounds to suspect ML/TF or criminal proceeds, it must inform the applicable national FIU promptly, including attempted transactions where national law so requires.
Action d’implémentation
Route the report to the establishment's designated FIU through the live national portal, preserve urgency, language and form requirements and document why each state nexus was selected.
Preuves à conserver
FIU routing matrix, report, timestamps, acknowledgement, attempted-transaction flag, rationale and follow-up correspondence.
Source primaire
Directive (EU) 2015/849, arts. 32-35 and 37
Do not execute a suspicious transaction before informing the FIU where national law permits the required restraint; if restraint is impossible or could frustrate pursuit, report immediately afterwards.
Action d’implémentation
Implement jurisdiction-specific stop, consent, moratorium and emergency rules; obtain legal escalation before moving funds or disclosing the report.
Preuves à conserver
Hold decision, FIU instruction, legal advice, transaction timestamp, exception rationale and release approval.
Source primaire
Directive (EU) 2015/849, art. 35
Protect FIU reports and related information from prohibited disclosure, subject to defined group, professional and authority exceptions in national law.
Action d’implémentation
Restrict access, train staff, control customer communications and document the legal basis for any permitted information sharing.
Preuves à conserver
Access log, confidentiality labels, scripts, training, sharing assessment and incident record.
Source primaire
Directive (EU) 2015/849, arts. 38-39

07Threshold reports, payments and crypto-assetsCDD thresholds, cash-payment limits, declarations and threshold reports are different concepts. National objective or systematic reports must not be inferred from the EU CDD amounts.4 éléments+

The current EU framework does not create one universal cash-transaction report for all obliged entities.
Action d’implémentation
For each Member State, distinguish CDD triggers, legal cash-payment caps, customs cash declarations, sector-specific notifications and automatic or systematic FIU reports from suspicion-based STRs.
Preuves à conserver
Country reporting matrix, statutory basis, form, portal, frequency, aggregation rule, tests and filing receipts.
Source primaire
Directive (EU) 2015/849, arts. 11 and 33; Regulation (EU) 2018/1672
Regulation (EU) 2023/1113 requires prescribed originator and beneficiary information and risk-based handling of missing information for covered funds and crypto-asset transfers.
Action d’implémentation
Map payer/payee and originator/beneficiary data by role and transfer type, validate completeness, reject or suspend where required and monitor repeated failures.
Preuves à conserver
Message schema, transfer samples, missing-data rules, rejections, counterparty monitoring and quality metrics.
Source primaire
Regulation (EU) 2023/1113, arts. 4-22
Covered payment service providers and crypto-asset service providers need controls for Union and national restrictive measures when performing transfers.
Action d’implémentation
Screen transfer parties and ownership/control using current EU legal acts and national requirements; connect alerts to freeze, reject, licence and reporting workflows.
Preuves à conserver
Screening configuration, list provenance, alert files, ownership analysis, freeze or rejection, licence and report.
Source primaire
Regulation (EU) 2023/1113, art. 23
MiCA's maximum grandfathering period ended on 1 July 2026; an in-scope provider serving EU clients after that date needs MiCA authorization or another valid status.
Action d’implémentation
Confirm scope, home-state competent authority, authorization and passport status; stop in-scope service where no valid authorization or exclusion exists.
Preuves à conserver
Service classification, authorization, ESMA register extract, passport notice, exclusion analysis and launch gate.
Source primaire
Regulation (EU) 2023/1114, arts. 59-65 and 143; ESMA, end of MiCA transitional period

08Targeted financial sanctionsEU restrictive-measures regulations are directly applicable, but the operative regulation, ownership/control analysis, licences, reporting and penalties remain programme- and Member-State-specific.3 éléments+

Operators must comply with asset-freeze, non-availability and other prohibitions in the exact EU restrictive-measures regulation that applies.
Action d’implémentation
Screen the current EU consolidated data as an aid, verify matches and obligations against the Official Journal act, assess ownership/control and block prohibited dealings.
Preuves à conserver
Legal-act version, list snapshot, match decision, ownership analysis, freeze or rejection, approval and audit trail.
Source primaire
Applicable Council Decision and Council Regulation; Commission sanctions resources
Licensing, derogations, frozen-asset reporting and suspected-breach routes are administered by the national competent authority or authorities identified for the relevant Member State and programme.
Action d’implémentation
Use the Commission national-authority directory to select the correct authority; do not treat the Commission whistleblower tool as a substitute for mandatory national reporting.
Preuves à conserver
Authority selection, licence application, frozen-asset report, acknowledgement, legal advice and renewal calendar.
Source primaire
Commission, Contacts on EU sanctions and national competent-authority directory
Directive (EU) 2024/1226 establishes minimum criminal-law rules for sanctions violations, but national transposition, enforcement bodies and Denmark's treaty position must be checked.
Action d’implémentation
Map applicable national offences, attempts, circumvention, liability and penalties; escalate potential violations to the competent national investigative or enforcement authority.
Preuves à conserver
National transposition, offence analysis, incident file, escalation, report and remediation.
Source primaire
Directive (EU) 2024/1226, arts. 3-15 and 20

09Records and authority accessThe five-year EU baseline is implemented through national law and can coexist with longer lawful periods, regulatory holds, sector records and GDPR deletion duties.3 éléments+

Keep CDD documents and information and transaction records for five years after the business relationship ends or the occasional transaction, subject to national extension within EU limits.
Action d’implémentation
Define each record trigger, national extension, legal hold and deletion event; prevent indefinite retention justified only by generic AML need.
Preuves à conserver
Retention schedule, trigger fields, national-law mapping, deletion jobs, holds, test results and exceptions.
Source primaire
Directive (EU) 2015/849, art. 40
Records must allow reconstruction and be available to the competent FIU and authorities in accordance with national law and secure-channel requirements.
Action d’implémentation
Index identity, ownership, transaction, monitoring and report evidence; authenticate authority requests and deliver complete records through approved channels.
Preuves à conserver
Evidence index, request log, authority verification, production record, access controls and chain of custody.
Source primaire
Directive (EU) 2015/849, arts. 32, 40 and 44
Regulation (EU) 2023/1113 sets a five-year retention period for required transfer information, with national law able to permit or require a further period not exceeding five years after assessment.
Action d’implémentation
Separate transfer-rule records from other AML records, document any national extension and delete personal data when the lawful period expires.
Preuves à conserver
Transfer record class, national extension assessment, retention controls, deletion log and sampled reconstruction.
Source primaire
Regulation (EU) 2023/1113, art. 26

10GDPR, biometrics and transfersAML duties do not displace data-protection principles. KYC processing needs a purpose-specific lawful basis, minimization, security, retention and rights analysis in every operating model.4 éléments+

Process KYC personal data lawfully, fairly and transparently for specified purposes, minimize it, keep it accurate, limit retention and secure it with demonstrable accountability.
Action d’implémentation
Document controller roles and Article 6 bases, notices, purpose limits, data minimization, accuracy, retention and technical and organizational measures.
Preuves à conserver
Record of processing, lawful-basis assessment, notices, data map, retention schedule, security controls and DPIA decisions.
Source primaire
GDPR, arts. 5, 6, 24, 25, 30 and 32
Biometric data used to uniquely identify a person is special-category data and requires both an Article 6 basis and an Article 9 condition, including any national-law condition relied on.
Action d’implémentation
Prove necessity and proportionality, document the condition, limit templates and raw media, offer appropriate fallback and assess accuracy and bias.
Preuves à conserver
Biometric assessment, legal basis and condition, DPIA, vendor tests, fallback records, deletion and incident controls.
Source primaire
GDPR, arts. 4(14), 6 and 9
Complete a DPIA before likely high-risk processing; notify the supervisory authority of a qualifying breach without undue delay and, where feasible, within 72 hours.
Action d’implémentation
Screen each KYC use case for high risk, consult where residual high risk remains, operate 24-hour incident escalation and apply individual-notification rules.
Preuves à conserver
DPIA screen and assessment, consultation, breach log, risk analysis, authority notice, individual notice and lessons learned.
Source primaire
GDPR, arts. 33-36
Transfers outside the EEA require a valid Chapter V route and, where necessary, supplementary measures; processor and onward-transfer controls remain separate.
Action d’implémentation
Map destinations and remote access, select adequacy, SCCs, BCRs or a narrow derogation, assess destination law and control onward transfers.
Preuves à conserver
Transfer map, mechanism, transfer impact assessment, SCC module, supplementary controls, approvals and reassessment.
Source primaire
GDPR, arts. 44-49; Commission Implementing Decision (EU) 2021/914

11National implementation - Austria to IrelandThese state rows identify the implementation route and a material operational distinction. They do not replace the operative national act, sector rule or live authority instruction. Suspicion reporting is threshold-free unless a separate national reporting regime expressly applies.14 éléments+

Austria - FIU Austria receives goAML reports; FMA is the principal financial AML supervisor, with OeNB involvement; Firmenbuch and WiEReG provide company and BO data; sanctions competence is split among OeNB, FMA and other authorities.
Action d’implémentation
Report suspicion without undue delay through goAML. No universal CTR was verified. Reconcile five-year core retention with lawful extension; complete WiEReG annual verification and report or confirm non-exempt entities within four weeks.
Preuves à conserver
FIU receipt, FMA perimeter, Firmenbuch/WiEReG extracts, annual BO review, national threshold decision and measure-specific sanctions routing.
Source primaire
Austrian FM-GwG; BMF WiEReG and sanctions guidance; Commission sanctions NCA directory
Belgium - CTIF-CFI is the FIU; NBB and FSMA supervise financial sectors; BCE/KBO and the FPS Finance UBO Register are distinct sources; FPS Finance Treasury leads financial-sanctions functions.
Action d’implémentation
Report immediately, normally before execution. Do not confuse Belgium's generally EUR 3,000 cash-payment restriction with a CTR. Apply ten-year AML retention and the 30-day plus annual UBO filing/confirmation duties where applicable.
Preuves à conserver
CTIF-CFI report, NBB/FSMA allocation, BCE and UBO extracts, cash-limit control, ten-year schedule and Treasury routing.
Source primaire
Belgian AML Law of 18 September 2017; CTIF-CFI, NBB and FPS Finance guidance
Bulgaria - SANS Financial Intelligence Directorate is the FIU; BNB and the Financial Supervision Commission supervise financial sectors; BO information sits in Commercial, non-profit and BULSTAT registers.
Action d’implémentation
Report suspicion immediately and before execution where possible through the current SANS route. No universal CTR was verified; treat national cash-payment limits as payment controls, not FIU threshold reports. Route sanctions by measure.
Preuves à conserver
SANS submission, BNB/FSC perimeter, Registry Agency extract, cash-control analysis, retention decision and sanctions authority selection.
Source primaire
Bulgarian Measures Against Money Laundering Act; BNB and Registry Agency official material
Croatia - the Ministry of Finance Anti-Money Laundering Office is the FIU; CNB, HANFA and the Financial Inspectorate divide supervision; FINA maintains the BO Register.
Action d’implémentation
Report without delay and before execution, or by the next working day where the statutory post-execution exception applies. Report cash transactions of EUR 10,000 or more and enforce the separate EUR 10,000 cash-payment prohibition; apply ten-year retention.
Preuves à conserver
AMLO report, timing rationale, cash report, payment block, CNB/HANFA mapping, FINA extract and ten-year schedule.
Source primaire
Croatian AML/CFT Law; Ministry of Finance and government BO Register guidance
Cyprus - MOKAS is the FIU; CBC, CySEC and the insurance supervisor divide financial supervision; the corporate BO register and CyTBOR for trusts are separate; NSIU handles sanctions implementation and licensing.
Action d’implémentation
Use MOKAS goAML and the May 2026 reporting guidance promptly. No universal CTR was verified. Query the register matching the legal arrangement, apply five-year retention and use NSIU plus the relevant sector authority.
Preuves à conserver
MOKAS filing, CBC/CySEC perimeter, corporate/CyTBOR extracts, five-year schedule, NSIU licence or report and acknowledgement.
Source primaire
Cyprus AML Law and MOKAS guidance; CySEC CyTBOR; NSIU guidance
Czechia - FAU is the FIU and central financial-sanctions authority; CNB supervises financial institutions; the Ministry of Justice system maintains the BO Register.
Action d’implémentation
File through MoneyWeb without undue delay; where circumstances require, particularly where delay is dangerous, report immediately after detection. The current Act has no five-calendar-day outer limit. No universal CTR was verified. Apply ten-year retention.
Preuves à conserver
MoneyWeb receipt, urgency/timing record, CNB allocation, BO extract, ten-year schedule and FAU sanctions decision.
Source primaire
Czech AML Act, s. 18(1), current text effective 11 January 2026; FAU and CNB guidance
Denmark - the NSK Money Laundering Secretariat is the FIU; Finanstilsynet and the Danish Business Authority divide supervision; CVR contains company and BO information; sanctions competence is measure-specific.
Action d’implémentation
Submit goAML immediately when suspicion cannot be rebutted. No universal CTR was verified; do not treat the business cash-payment ceiling as a report. Apply five-year retention and select the Business Authority, Finanstilsynet or other competent body by measure.
Preuves à conserver
goAML receipt, suspicion decision, supervisory map, CVR extract, cash-limit analysis, retention and sanctions routing.
Source primaire
Danish AML Act; hvidvask.dk, Finanstilsynet and CVR guidance
Estonia - the Financial Intelligence Unit is the FIU and financial-sanctions authority; Finantsinspektsioon supervises licensed finance; the e-Business Register holds BO data under restricted access from 10 July 2026.
Action d’implémentation
Report suspicion without delay and no later than two working days. Except for credit institutions, report within that period a cash monetary obligation over EUR 32,000, including linked payments over up to one year. For credit institutions, the category is an occasional cash FX transaction over EUR 32,000 without a business relationship.
Preuves à conserver
RABIS receipt, two-day clock, entity classification, linked-payment or FX threshold report, lawful BO access and sanctions filing.
Source primaire
Estonian AML/CFT Act, ss. 49(3), 49(5) and 49(8), consolidated 16 February 2026
Finland - the National Bureau of Investigation FIU receives reports; FIN-FSA supervises finance; PRH maintains BO data; the Foreign Ministry, Enforcement Authority and sector bodies divide sanctions roles.
Action d’implémentation
Report electronically without delay. No universal CTR was verified. Apply five-year retention, obtain PRH data under the applicable purpose/entitlement rules and route licences, freezes and investigations to the correct body.
Preuves à conserver
FIU submission, FIN-FSA mapping, PRH access and extract, retention record, sanctions licence/freezing route and acknowledgement.
Source primaire
Finnish AML Act; Police, FIN-FSA, PRH and Foreign Ministry guidance
France - TRACFIN is the FIU; ACPR and AMF divide financial supervision; INPI operates the national enterprise/BO system; Treasury administers financial sanctions.
Action d’implémentation
File through ERMES before execution where required, using the statutory post-execution exceptions only. File COSI independently for covered cash/e-money transfers over EUR 1,000 per operation or EUR 2,000 monthly and cash deposits/withdrawals over EUR 10,000 monthly.
Preuves à conserver
ERMES report, execution decision, COSI file and receipt, ACPR/AMF allocation, INPI extract, five-year schedule and Treasury sanctions record.
Source primaire
French Monetary and Financial Code; TRACFIN declarative-obligations guidance
Germany - the General Customs Directorate FIU receives goAML reports; BaFin supervises most regulated finance; Handelsregister and Transparenzregister are separate; Bundesbank and BAFA split financial and trade sanctions.
Action d’implémentation
Register and report in goAML without undue delay. No universal CTR exists; implement fact-pattern real-estate reports and the real-estate cash-payment prohibition where applicable. Retain five years and destroy no later than ten years absent another basis.
Preuves à conserver
goAML registration/receipt, BaFin mapping, register extracts, real-estate control, retention/deletion record and Bundesbank/BAFA routing.
Source primaire
German Money Laundering Act and GwGMeldV; BaFin and FIU guidance
Greece - Unit A of the Hellenic AML Authority is the FIU; Bank of Greece and HCMC divide financial supervision; the Central BO Register is distinct from GEMI; Unit B handles financial sanctions.
Action d’implémentation
Report electronically without delay. No universal CTR was verified. File BO data within the national 60-day rule where applicable, apply five-year retention and keep Unit A reporting separate from Unit B sanctions action.
Preuves à conserver
FIU receipt, BoG/HCMC perimeter, Central BO and GEMI extracts, 60-day filing proof, retention and Unit B record.
Source primaire
Greek Law 4557/2018; Hellenic AML Authority and government BO Register guidance
Hungary - the NAV Financial Intelligence Unit receives reports and handles financial sanctions; MNB supervises finance; NAV maintains central BO, bank-account and safe-deposit registers.
Action d’implémentation
Report immediately through the protected national route. No universal CTR was verified. Apply the national eight-year retention period and reconcile BO reliability-index or discrepancy results rather than relying on the register alone.
Preuves à conserver
FIU submission, MNB allocation, BO reliability result, discrepancy action, eight-year schedule and NAV sanctions record.
Source primaire
Hungarian Pmt and Afad Acts; NAV FIU/register and MNB guidance
Ireland - FIU Ireland receives goAML reports and the Central Bank supervises finance; company, trust and certain financial-vehicle BO registers are separate; sanctions roles include the Central Bank and government departments.
Action d’implémentation
Make both required filings as soon as practicable: goAML to FIU Ireland and ROS to Revenue. No universal CTR was verified. Apply at least five-year retention and select the correct BO register and sanctions authority.
Preuves à conserver
goAML and ROS receipts, dual-filing reconciliation, Central Bank perimeter, correct BO extract, retention and sanctions report.
Source primaire
Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, s. 42; Revenue and Central Bank guidance

12National implementation - Italy to SwedenUse the state-specific FIU, supervisor, register and sanctions authority. Cross-border groups may need more than one filing or supervisory engagement where establishments or services create multiple national nexuses.13 éléments+

Italy - UIF is the autonomous FIU at Banca d'Italia; Banca d'Italia, IVASS and CONSOB divide supervision; the Business Register hosts the BO filing system; MEF's Financial Security Committee coordinates financial sanctions.
Action d’implémentation
File SOS through Infostat-UIF without delay and where possible before execution. Covered firms also send monthly objective communications for aggregate cash activity of at least EUR 10,000, counting individual cash operations of at least EUR 1,000. Apply ten-year retention.
Preuves à conserver
SOS and objective-report receipts, supervisory map, register result with access caveat, ten-year schedule and CSF routing.
Source primaire
Italian Legislative Decree 231/2007; UIF SOS and objective-communications rules
Latvia - FIU Latvia receives goAML reports, supervises major sanctions functions and works with Latvijas Banka and other sector supervisors; the Enterprise Register holds BO data under access rules changed 1 July 2026.
Action d’implémentation
Report suspicion and sanctions triggers immediately through goAML. Apply Cabinet Regulation 550 category thresholds rather than one generalized amount, five-year retention and the restricted-access BO model including new nationality/control fields.
Preuves à conserver
goAML receipt, threshold category and filing, Latvijas Banka allocation, lawful BO extract, retention and sanctions action.
Source primaire
Latvian AML/CFT/PF Prevention Law; FIU and Enterprise Register guidance
Lithuania - FCIS is the FIU and a core financial-sanctions authority; Bank of Lithuania supervises finance; JAR and JADIS are distinct company and BO systems.
Action d’implémentation
Report suspicion immediately through the FCIS route and report covered cash transactions of EUR 15,000 or more, including linked transactions, under current implementing instructions. Apply the national eight-year period to the correct CDD/transaction record classes.
Preuves à conserver
FCIS receipts, threshold aggregation, Bank of Lithuania allocation, JAR/JADIS extracts, record-class schedule and sanctions routing.
Source primaire
Lithuanian AML/CFT Law; FCIS, Bank of Lithuania and Centre of Registers guidance
Luxembourg - the CRF is the FIU; CSSF and CAA divide financial supervision; LBR operates RCS and RBE; Finance and Foreign Ministries divide sanctions functions.
Action d’implémentation
File STR or SAR exclusively through goAML promptly, including attempts. No universal CTR was verified. Apply five-year retention, lawful RBE access after CJEU restrictions and the ministry/sector route matching the sanction.
Preuves à conserver
goAML receipt, STR/SAR classification, CSSF/CAA allocation, RCS/RBE extracts, retention and sanctions licence/report.
Source primaire
Luxembourg Law of 12 November 2004; CRF, CSSF, LBR and Finance Ministry guidance
Malta - FIAU is the FIU and AML supervisor working with MFSA; MBR maintains corporate BO data; the Sanctions Monitoring Board is the central sanctions body.
Action d’implémentation
Report through goAML as soon as reasonably practicable and no later than five working days after suspicion first arose unless exceptional circumstances justify otherwise. Do not delay to the outer limit. No universal CTR was verified; apply five-year retention.
Preuves à conserver
goAML receipt, first-suspicion timestamp, delay exception if any, FIAU/MFSA mapping, MBR extract, retention and SMB record.
Source primaire
Malta PMLFTR; FIAU reporting guidance; MBR and SMB guidance
Netherlands - FIU-Nederland receives reports of unusual transactions; DNB, AFM and other designated bodies divide supervision; KVK maintains company and separate UBO registers; sanctions supervision is sector-split.
Action d’implémentation
Report an unusual transaction without delay under the applicable objective or subjective indicator; do not wait until FIU declares it suspicious and do not invent one national threshold. Apply five-year retention and current restricted UBO access.
Preuves à conserver
FIU report, indicator selection, DNB/AFM allocation, KVK/UBO extract, five-year schedule and measure-specific sanctions route.
Source primaire
Dutch Wwft and Implementing Decree; FIU-Nederland, DNB and KVK guidance
Poland - GIIF is the FIU; KNF and GIIF/other bodies divide supervision; KRS and CRBR are distinct; sanctions enforcement is divided around the Interior Ministry list and KAS/sector bodies.
Action d’implémentation
Apply the two-working-day descriptive suspicion route and immediate transaction-specific route as applicable. Report Article 72 cash and specified transfers above EUR 15,000 generally within seven days. Apply five-year retention and independently verify CRBR data.
Preuves à conserver
GIIF receipt and clock, threshold report, KNF allocation, KRS/CRBR extracts, retention and national-sanctions-list check.
Source primaire
Polish AML Act, arts. 72, 74 and 86; GIIF and CRBR guidance
Portugal - the Polícia Judiciária UIF is the FIU; Banco de Portugal, CMVM and ASF divide financial supervision; RCBE is distinct from the Commercial Register; sanctions roles are distributed.
Action d’implémentation
Immediately report through Portal COS to both UIF and DCIAP, regardless of amount. Apply the periodic/systematic Article 45 typologies under Portaria 310/2018 rather than one cash threshold, and retain records for seven years.
Preuves à conserver
UIF and DCIAP delivery proof, systematic report, supervisory allocation, RCBE extract, seven-year schedule and sanctions routing.
Source primaire
Portuguese Law 83/2017 and Portaria 310/2018; Portal BCFT and Banco de Portugal guidance
Romania - ONPCSB is the FIU and supervises specified sectors; NBR and ASF supervise finance; ONRC maintains company BO information; sanctions competence is split by measure.
Action d’implémentation
Report suspicion immediately; use the statutory post-execution exception and 24-hour outer wording only where its conditions are met. Report linked cash operations and covered external account transfers at or above EUR 10,000 under the current filing deadline.
Preuves à conserver
SETD receipt, execution/timing analysis, threshold aggregation/report, NBR/ASF mapping, ONRC extract, five-year schedule and sanctions route.
Source primaire
Romanian Law 129/2019; ONPCSB and ONRC guidance
Slovakia - the Police Force FIU receives reports; NBS and the FIU/other bodies divide supervision; the Commercial Register BO record and RPVS public-sector-partner register have different scopes; sanctions competence is measure-specific.
Action d’implémentation
Report unusual business transactions without undue delay, including attempts. No universal CTR was verified; do not treat cash ceilings as FIU reports. Apply five-year retention and never substitute RPVS for AML BO work.
Preuves à conserver
FIU submission, NBS allocation, Commercial Register and RPVS results, five-year schedule, cash-limit analysis and sanctions authority selection.
Source primaire
Slovak Act 297/2008, consolidated 15 January 2025; FIU, NBS and Justice Ministry guidance
Slovenia - the Office for Money Laundering Prevention is the FIU; Bank of Slovenia, Securities Market Agency and Insurance Supervision Agency divide finance; AJPES maintains the BO Register.
Action d’implémentation
Report before execution and immediately, documenting any statutory impossibility. File reports for cash transactions of EUR 15,000 or more and covered transfers involving designated high-risk countries of EUR 15,000 or more, generally within three working days. Retain ten years.
Preuves à conserver
FIU receipt, pre-execution decision, threshold reports, supervisory map, lawful AJPES access, ten-year schedule and sanctions route.
Source primaire
Slovenian APMLTF-2; OMLP and AJPES guidance
Spain - SEPBLAC is the FIU and specialist AML supervisor, coordinating with Banco de Espana, CNMV and DGSFP; RCTIR is distinct from the Mercantile Registry; Treasury handles financial sanctions.
Action d’implémentation
Report suspicion without delay. File monthly DMO systematic reports for applicable categories, including specified physical cash/bearer movements over EUR 30,000, remitter physical movements over EUR 1,500 and designated-country transactions over EUR 30,000; apply ten-year retention.
Preuves à conserver
SEPBLAC receipt, DMO and nil reports, supervisory map, RCTIR extract, ten-year schedule and Treasury record.
Source primaire
Spanish Law 10/2010 and implementing rules; SEPBLAC systematic-reporting guidance
Sweden - the Police Finanspolisen is the FIU; Finansinspektionen supervises most regulated finance; Bolagsverket maintains BO data; sanctions implementation is divided among government, FI, ISP, Customs and enforcement bodies.
Action d’implémentation
Report in goAML without delay when reasonable grounds exist. No universal CTR was verified. Apply five-year retention, obtain current Bolagsverket information and separate FI supervisory data collection from transaction reporting.
Preuves à conserver
goAML receipt, FI perimeter, BO extract, five-year schedule, reporting-classification note and competent sanctions route.
Source primaire
Swedish Money Laundering Act; Police, Finansinspektionen and Bolagsverket guidance

13Practical evidence pack and launch gateNo EU-wide checklist row is complete until the directly applicable rule and the relevant national implementation are reconciled for the actual entity, service, customer and transaction.4 éléments+

Maintain a 27-state authority and rule matrix with effective dates, FIU portals, supervisors, registers, sanctions authorities, reporting regimes, thresholds and retention.
Action d’implémentation
Assign local legal owners, recheck live links and forms before launch, record conflicts and version every change.
Preuves à conserver
Approved matrix, source snapshots, link checks, form samples, owners, effective dates and change tickets.
Source primaire
Directive (EU) 2015/849, arts. 5, 32-33, 45 and 48
For every product and country, determine applicable authorization, AML supervision, payment or e-money status, MiCA treatment, passporting and agent or distributor duties.
Action d’implémentation
Gate launch on written perimeter analysis and register confirmation in the home and relevant host states.
Preuves à conserver
Permission matrix, register extracts, passport notifications, agent filings, terms, approvals and launch record.
Source primaire
Applicable national law; PSD2; EMD2; MiCA
Test reporting and restraint workflows with the actual national FIU and sanctions-authority routes without sending test personal data to production portals.
Action d’implémentation
Use documented dry runs, verify credentials and availability, maintain emergency contacts and capture evidence after each real filing.
Preuves à conserver
Dry-run results, access validation, contact tree, incident exercise, receipts and post-filing review.
Source primaire
Directive (EU) 2015/849, arts. 33-39; applicable sanctions regulation and national law
Each row requires an explicit applicability decision, current source, owner, operating evidence and independent review before launch.
Action d’implémentation
Mark applicable, not applicable or pending counsel confirmation; close blockers and obtain compliance, legal, privacy, security and product approval.
Preuves à conserver
Completed checklist, rationale, source version, control test, gap ticket, reviewer sign-off and launch approval.
Source primaire
Directive (EU) 2015/849, arts. 8, 40, 45-46

Registre des sources primaires

56 sources utilisées pour cette checklist

Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.

Réponses directes

Questions KYC, KYB et AML pour Union européenne

Is there one AML law and one FIU for all 27 EU Member States?+

No. Until 10 July 2027 the principal preventive directive operates through national transposition. AMLA has EU-level roles, but suspicious reports go to the applicable national FIU and national authorities retain major supervisory and enforcement functions.

Does the AMLR already replace national AML laws?+

No. Regulation (EU) 2024/1624 entered into force in 2024 but generally applies from 10 July 2027, with a later 10 July 2029 start for football agents and professional football clubs. Current national law remains essential.

What is the current EU occasional-transaction CDD threshold?+

The current directive sets EUR 15,000 as the general occasional-transaction floor, with more than EUR 1,000 for covered funds transfers, EUR 10,000 cash for goods traders and EUR 2,000 for gambling. Member States and sectors may impose lower or additional triggers.

Is there an EU-wide cash transaction report?+

No universal report follows from the directive's CDD amounts. Some Member States require objective, systematic or threshold reports, and cash-payment caps and external-border cash declarations are separate controls.

Where should a suspicious transaction be reported?+

To the FIU designated by the applicable Member State, using that FIU's live national channel and timing rules. AMLA coordinates FIUs but is not a substitute universal STR portal.

Can a business use 25% as its only beneficial-owner test?+

No. The current directive's indicative ownership threshold is more than 25%, but control through other means must be assessed and national law may be stricter. Senior-management fallback requires documented exhaustion of reasonable means.

Can BORIS or a national register replace KYB verification?+

No. Register information is an important source, but access and content vary and it must be reconciled with independent evidence and the actual ownership and control structure.

Who enforces EU financial sanctions?+

The relevant EU regulations bind operators, while Member States are primarily responsible for implementation and enforcement. Licensing, frozen-asset and breach reporting must go to the correct national competent authority for the programme.

Does AML law permit unlimited KYC retention?+

No. The current EU baseline is five years from the relationship or transaction trigger, subject to lawful national extensions and holds. GDPR purpose limitation, minimization, security and deletion duties continue to apply.

Is every EU Member State off the FATF public lists?+

No. On the public-list page reviewed 31 July 2026, Bulgaria remained under increased monitoring, although FATF had made an initial determination that its action plan was substantially completed subject to an on-site assessment. No EU Member State was subject to a call for action.

Méthode de recherche et de revue

VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.

General regulatory information, not legal advice, an authorization decision or a substitute for operative national law. Reviewed 31 July 2026. EU directives require national implementation, while directly applicable regulations still use national authorities. Confirm entity, activity, customer, transaction, thresholds, reporting channel, sanctions route, register access, privacy role and later developments with qualified counsel and the relevant authorities.

Union européenne KYC, KYB & AML compliance checklist

Que couvre la checklist de conformité pour Union européenne ?

Faits réglementaires clés

Exigences et actions de conformité pour Union européenne

Until 10 July 2027, Directive (EU) 2015/849 as amended remains the EU preventive baseline through 27 national transposition regimes.

Regulation (EU) 2024/1624 generally applies from 10 July 2027, with a 10 July 2029 start for football agents and professional football clubs.

Directive (EU) 2024/1640 has staged national transposition deadlines and replaces the current directive from 10 July 2027.

AMLA has held transferred EU-level AML/CFT responsibilities since 1 January 2026; its first direct supervision of selected high-risk cross-border financial entities begins in 2028.

Obliged entities must identify and assess ML/TF risk using customer, country, product, transaction and delivery-channel factors and keep the assessment current.

Policies, controls and procedures must be proportionate and include model risk management, CDD, reporting, records, internal control, compliance management and staff screening where appropriate.

Group-wide controls and information sharing do not override GDPR, national secrecy rules or host-state obligations.

CDD is required when establishing a business relationship, on suspicion regardless of threshold, and when prior identification data is doubtful.

The current directive sets CDD floors at EUR 15,000 for occasional transactions, more than EUR 1,000 for covered funds transfers, EUR 10,000 cash for goods traders and EUR 2,000 for gambling transactions.

Identify the customer and verify identity using reliable independent documents, data or information; understand purpose and intended nature and monitor the relationship.

A representative must be authorized and identified and verified; failure to complete required CDD normally prevents the relationship or transaction and requires an STR assessment.

For legal persons, understand ownership and control and take reasonable measures to verify beneficial owners, using senior-management fallback only after all possible means are exhausted and no suspicion remains.

The current directive's indicative corporate ownership threshold is more than 25%, but ownership percentage does not displace control through other means and national law can be stricter.

Member States maintain national central beneficial-ownership registers and BORIS interconnects available national information, but authorization, authentication, fees, covered arrangements and access conditions vary.

Obliged entities must report discrepancies found between CDD and register information under the applicable national process.

For a PEP, family member or known close associate, obtain senior-management approval, establish source of wealth and source of funds, and conduct enhanced ongoing monitoring.

EDD applies to high-risk situations and relationships or transactions involving third countries identified under the EU process, with national additional measures possible.

Remote or electronic identification must meet the applicable national assurance, reliability and risk requirements; use of a vendor does not transfer the obliged entity's responsibility.

Conduct ongoing monitoring, including scrutiny of transactions for consistency with customer knowledge, risk and source of funds where necessary, and keep CDD information current.

Where an obliged entity knows, suspects or has reasonable grounds to suspect ML/TF or criminal proceeds, it must inform the applicable national FIU promptly, including attempted transactions where national law so requires.

Do not execute a suspicious transaction before informing the FIU where national law permits the required restraint; if restraint is impossible or could frustrate pursuit, report immediately afterwards.

Protect FIU reports and related information from prohibited disclosure, subject to defined group, professional and authority exceptions in national law.

The current EU framework does not create one universal cash-transaction report for all obliged entities.

Regulation (EU) 2023/1113 requires prescribed originator and beneficiary information and risk-based handling of missing information for covered funds and crypto-asset transfers.

Covered payment service providers and crypto-asset service providers need controls for Union and national restrictive measures when performing transfers.

MiCA's maximum grandfathering period ended on 1 July 2026; an in-scope provider serving EU clients after that date needs MiCA authorization or another valid status.

Operators must comply with asset-freeze, non-availability and other prohibitions in the exact EU restrictive-measures regulation that applies.

Licensing, derogations, frozen-asset reporting and suspected-breach routes are administered by the national competent authority or authorities identified for the relevant Member State and programme.

Directive (EU) 2024/1226 establishes minimum criminal-law rules for sanctions violations, but national transposition, enforcement bodies and Denmark's treaty position must be checked.

Keep CDD documents and information and transaction records for five years after the business relationship ends or the occasional transaction, subject to national extension within EU limits.

Records must allow reconstruction and be available to the competent FIU and authorities in accordance with national law and secure-channel requirements.

Regulation (EU) 2023/1113 sets a five-year retention period for required transfer information, with national law able to permit or require a further period not exceeding five years after assessment.

Process KYC personal data lawfully, fairly and transparently for specified purposes, minimize it, keep it accurate, limit retention and secure it with demonstrable accountability.

Biometric data used to uniquely identify a person is special-category data and requires both an Article 6 basis and an Article 9 condition, including any national-law condition relied on.

Complete a DPIA before likely high-risk processing; notify the supervisory authority of a qualifying breach without undue delay and, where feasible, within 72 hours.

Transfers outside the EEA require a valid Chapter V route and, where necessary, supplementary measures; processor and onward-transfer controls remain separate.

Austria - FIU Austria receives goAML reports; FMA is the principal financial AML supervisor, with OeNB involvement; Firmenbuch and WiEReG provide company and BO data; sanctions competence is split among OeNB, FMA and other authorities.

Belgium - CTIF-CFI is the FIU; NBB and FSMA supervise financial sectors; BCE/KBO and the FPS Finance UBO Register are distinct sources; FPS Finance Treasury leads financial-sanctions functions.

Bulgaria - SANS Financial Intelligence Directorate is the FIU; BNB and the Financial Supervision Commission supervise financial sectors; BO information sits in Commercial, non-profit and BULSTAT registers.

Croatia - the Ministry of Finance Anti-Money Laundering Office is the FIU; CNB, HANFA and the Financial Inspectorate divide supervision; FINA maintains the BO Register.

Cyprus - MOKAS is the FIU; CBC, CySEC and the insurance supervisor divide financial supervision; the corporate BO register and CyTBOR for trusts are separate; NSIU handles sanctions implementation and licensing.

Czechia - FAU is the FIU and central financial-sanctions authority; CNB supervises financial institutions; the Ministry of Justice system maintains the BO Register.

Denmark - the NSK Money Laundering Secretariat is the FIU; Finanstilsynet and the Danish Business Authority divide supervision; CVR contains company and BO information; sanctions competence is measure-specific.

Estonia - the Financial Intelligence Unit is the FIU and financial-sanctions authority; Finantsinspektsioon supervises licensed finance; the e-Business Register holds BO data under restricted access from 10 July 2026.

Finland - the National Bureau of Investigation FIU receives reports; FIN-FSA supervises finance; PRH maintains BO data; the Foreign Ministry, Enforcement Authority and sector bodies divide sanctions roles.

France - TRACFIN is the FIU; ACPR and AMF divide financial supervision; INPI operates the national enterprise/BO system; Treasury administers financial sanctions.

Germany - the General Customs Directorate FIU receives goAML reports; BaFin supervises most regulated finance; Handelsregister and Transparenzregister are separate; Bundesbank and BAFA split financial and trade sanctions.

Greece - Unit A of the Hellenic AML Authority is the FIU; Bank of Greece and HCMC divide financial supervision; the Central BO Register is distinct from GEMI; Unit B handles financial sanctions.

Hungary - the NAV Financial Intelligence Unit receives reports and handles financial sanctions; MNB supervises finance; NAV maintains central BO, bank-account and safe-deposit registers.

Ireland - FIU Ireland receives goAML reports and the Central Bank supervises finance; company, trust and certain financial-vehicle BO registers are separate; sanctions roles include the Central Bank and government departments.

Italy - UIF is the autonomous FIU at Banca d'Italia; Banca d'Italia, IVASS and CONSOB divide supervision; the Business Register hosts the BO filing system; MEF's Financial Security Committee coordinates financial sanctions.

Latvia - FIU Latvia receives goAML reports, supervises major sanctions functions and works with Latvijas Banka and other sector supervisors; the Enterprise Register holds BO data under access rules changed 1 July 2026.

Lithuania - FCIS is the FIU and a core financial-sanctions authority; Bank of Lithuania supervises finance; JAR and JADIS are distinct company and BO systems.

Luxembourg - the CRF is the FIU; CSSF and CAA divide financial supervision; LBR operates RCS and RBE; Finance and Foreign Ministries divide sanctions functions.

Malta - FIAU is the FIU and AML supervisor working with MFSA; MBR maintains corporate BO data; the Sanctions Monitoring Board is the central sanctions body.

Netherlands - FIU-Nederland receives reports of unusual transactions; DNB, AFM and other designated bodies divide supervision; KVK maintains company and separate UBO registers; sanctions supervision is sector-split.

Poland - GIIF is the FIU; KNF and GIIF/other bodies divide supervision; KRS and CRBR are distinct; sanctions enforcement is divided around the Interior Ministry list and KAS/sector bodies.

Portugal - the Polícia Judiciária UIF is the FIU; Banco de Portugal, CMVM and ASF divide financial supervision; RCBE is distinct from the Commercial Register; sanctions roles are distributed.

Romania - ONPCSB is the FIU and supervises specified sectors; NBR and ASF supervise finance; ONRC maintains company BO information; sanctions competence is split by measure.

Slovakia - the Police Force FIU receives reports; NBS and the FIU/other bodies divide supervision; the Commercial Register BO record and RPVS public-sector-partner register have different scopes; sanctions competence is measure-specific.

Slovenia - the Office for Money Laundering Prevention is the FIU; Bank of Slovenia, Securities Market Agency and Insurance Supervision Agency divide finance; AJPES maintains the BO Register.

Spain - SEPBLAC is the FIU and specialist AML supervisor, coordinating with Banco de Espana, CNMV and DGSFP; RCTIR is distinct from the Mercantile Registry; Treasury handles financial sanctions.

Sweden - the Police Finanspolisen is the FIU; Finansinspektionen supervises most regulated finance; Bolagsverket maintains BO data; sanctions implementation is divided among government, FI, ISP, Customs and enforcement bodies.

Maintain a 27-state authority and rule matrix with effective dates, FIU portals, supervisors, registers, sanctions authorities, reporting regimes, thresholds and retention.

For every product and country, determine applicable authorization, AML supervision, payment or e-money status, MiCA treatment, passporting and agent or distributor duties.

Test reporting and restraint workflows with the actual national FIU and sanctions-authority routes without sending test personal data to production portals.

Each row requires an explicit applicability decision, current source, owner, operating evidence and independent review before launch.

56 sources utilisées pour cette checklist

Questions KYC, KYB et AML pour Union européenne

Méthode de recherche et de revue

Vérifiez une fois. Partout.

Union européenne KYC, KYB & AML compliance checklist

Que couvre la checklist de conformité pour Union européenne ?

Faits réglementaires clés

Exigences et actions de conformité pour Union européenne

Until 10 July 2027, Directive (EU) 2015/849 as amended remains the EU preventive baseline through 27 national transposition regimes.