AMLD6 in France: practical transposition guide (2026-2027)

The AML (anti-money-laundering) package adopted by the European Union in 2024 rests on three complementary texts, each with its own application logic.

Regulation (EU) 2024/1624 (AMLR, the European anti-money-laundering regulation) is directly applicable in every Member State on July 10, 2027: it applies as is, with no transposition law required. It harmonizes customer due diligence rules (the mandatory client verification process), removing the national discretion that prevailed under the previous AMLD5 directive. Regulation (EU) 2024/1620 creates AMLA, the European Anti-Money Laundering Authority, operational in Frankfurt since July 1, 2025, which will directly supervise around 40 priority entities from January 1, 2028.

Directive (EU) 2024/1640 (AMLD6, the 6th Anti-Money Laundering Directive), published in the EU Official Journal on June 19, 2024, sets the minimum rules each Member State must transpose into national law no later than July 10, 2027. It harmonizes notably the predicate offenses (the underlying crimes that can generate laundered funds), the sanctions regime, and the powers of financial intelligence units (FIUs — the equivalent of Tracfin in France).

::: callout-info In brief

• AMLR (Regulation 2024/1624): directly applicable, full harmonization
• AMLD6 (Directive 2024/1640): transposition no later than July 10, 2027
• AMLA: direct supervision of 40 priority entities from 2028
• Cash threshold: €10,000 harmonized (vs €15,000 under AMLD5)
• Sanctions: up to €10M or 10% of turnover (vs €5M or 5% under AMLD5)

:::

The transposition timeline spans three years, with intermediate milestones. The position of the Direction générale du Trésor (French Treasury Directorate-General) published in March 2026 and echoed by the ACPR (Autorité de contrôle prudentiel et de résolution, the French prudential supervisor for banks and insurance) in its communiqué of the same month confirms the following dates.

The French transposition ordinance is expected in the second half of 2026. It will amend articles L.561-2 and following of the Monetary and Financial Code, in line with the guidelines published by the EBA (European Banking Authority, in charge of the transition to AMLA) and by AMLA's Prudential Regulation Committee.

AMLD6's most structuring contribution is not measured in percentages but in European criminal coherence. Directive (EU) 2024/1640 harmonizes 22 predicate offenses to the offense of money laundering — that is, the crimes whose proceeds can be the subject of laundering. These offenses now apply uniformly across all 27 Member States with a minimum penalty of 4 years' imprisonment and systematic confiscation of criminal proceeds.

List of the 22 harmonized offenses (article 3 of AMLD6):

• Participation in a criminal organization, racketeering
• Terrorism and terrorism financing
• Human trafficking, migrant smuggling
• Sexual exploitation, including child exploitation
• Illicit drug and psychotropic substance trafficking
• Illicit arms trafficking
• Trafficking in stolen goods and smuggling
• Corruption and influence peddling
• Serious tax fraud and VAT carousels
• Fraud against the financial interests of the EU
• Counterfeiting of currency and means of payment
• Product counterfeiting and piracy
• Cybercrime, including ransomware attacks
• Environmental crimes (trafficking in protected species, waste)
• Murder, grievous bodily harm, kidnapping, illegal restraint
• Theft and extortion
• Misappropriation of public funds
• Market-related crimes (manipulation, market abuse)
• Public procurement manipulation
• Electronic counterfeiting
• Intellectual property offenses
• Any offense punishable by at least 1 year's imprisonment (catch-all clause)

This list consolidates the suspicious activity reporting obligations to which obliged entities must respond: a suspicion relating to any of these 22 offenses requires immediate transmission to Tracfin in France.

Three structural shifts will affect every existing KYC framework (Know Your Customer — the customer identity verification process). Anticipating now means winning two quarters of compliance lead time.

The AMLR replaces national discretion with uniform rules. Standard due diligence now requires documented identification of the client, of the beneficial owner (the natural person who actually controls the company, harmonized 25% threshold), of the source of funds for significant transactions, and systematic screening (automated filtering) of international sanctions (EU, US OFAC, UN). Compliance directors must revise their due diligence policies, procedures, and tooling parameters.

The €10,000 threshold for cash payments replaces the European mosaic (€15,000 in France, €1,000 in Italy, etc.). Above this amount, cash payments are prohibited for obliged professionals (dealers, real estate agents, gaming operators). This single measure simplifies compliance while tightening controls.

The beneficial ownership register (RBE in France, the official register of natural persons controlling each company) sees its scope broadened: ownership threshold lowered to 25% (capital or voting rights), enhanced access for competent authorities, dynamic update required of professionals at every customer onboarding. The Tracfin position (the French financial intelligence unit) published in its 2025 annual report highlighted recurring failures in RBE updates by holding companies.

::: callout-info 3 priority KYC initiatives to launch in 2026

• Map the gaps between your current setup and AMLR requirements
• Revise simplified and enhanced due diligence policies
• Prepare the reporting interfaces with AMLA and Tracfin (standardized templates forthcoming)

:::

The sanctions regime is one of the most visible changes. The ceilings practically double compared with AMLD5.

The other structural change concerns the personal liability of executives. AMLD6 requires Member States to provide for financial sanctions against natural persons responsible for compliance (compliance officer, effective director, executive committee member). A temporary ban on practice is provided for in cases of established breach.

Over the 12 months following entry into application, the first AMLA controls will target the 40 priority entities identified: large cross-border banks, leading European CASPs (Crypto-Asset Service Providers), systemic fintechs. Compliance becomes competitive.

For banks and fintechs, the AMLR imposes documented 360° customer knowledge. Enhanced due diligence applies automatically to politically exposed persons (PEPs: political officials, senior civil servants, public-enterprise executives and their relatives), to clients based in countries on the FATF list (Financial Action Task Force: countries deemed high-risk by the international anti-money-laundering body), and to clients flagged as high-risk by internal analysis. Scoring tools (automated client risk rating) must be auditable, with parameters validated by the compliance committee.

CASPs (Crypto-Asset Service Providers: exchange platforms, wallets, custody services) become a cornerstone of AMLA controls. The directive requires moving to CASP authorization (the European status) under MiCA (Markets in Crypto-Assets, the European crypto-asset regulation), strict application of the TFR (Travel Rule, the obligation to transmit sender/beneficiary data on every crypto transfer, EU Regulation 2023/1113) above €1,000, and full alignment with standard anti-money-laundering obligations. As of late 2025, ESMA (the European Securities and Markets Authority) reported 140 CASPs authorized in the EU, of which only a handful in France versus 43 in Germany and 22 in the Netherlands. Market consolidation is severe.

The real estate sector is explicitly targeted by AMLD6 as a high-risk vector. Real estate agencies, notaries, and dealers must implement documented due diligence on every transaction, with systematic reporting above the €10,000 cash threshold. The trade in luxury goods (watches, jewelry, precious metals) is explicitly brought into scope.

The art trade fully enters the anti-money-laundering perimeter above the €10,000 threshold per transaction or series of linked transactions. Due diligence covers the origin of the work, the final seller, and the effective recipient. Art dealers, antique dealers, and gallery owners must designate an anti-money-laundering compliance officer and report any suspicion to Tracfin.

The accounting and legal professions (notaries, lawyers, certified accountants, tax advisors) are confirmed as obliged professionals. Professional secrecy is preserved only for operations strictly within courtroom defense or preliminary legal counsel.

::: callout-info Key AMLD6/AMLR figures to remember

• 40 entities as priority under AMLA direct supervision from 2028
• 22 predicate offenses harmonized under European criminal law
• €10,000: single cash threshold across the whole EU
• 25%: single threshold for the beneficial ownership register
• 10% of turnover: sanction ceiling for serious breach

:::

An operational roadmap to navigate the next 12 months without surprises.

Map existing due diligence processes against AMLR requirements. Identify gaps regarding beneficial ownership, thresholds, documentation, and scoring. Audit the due diligence policy by client segment. Assess the maturity of automated detection tools.

Revise the standard, simplified, and enhanced KYC procedures. Update the processing register under GDPR (the EU's personal data law) to include the new data collected under AMLR. Adapt the suspicious activity reporting templates to the harmonized format provided by AMLA.

Launch end-to-end tests on the new KYC journeys, from customer onboarding through prudential reporting (the regular submissions to the supervisory authority). Train all sales and compliance teams on the 22 harmonized predicate offenses and the new reporting thresholds.

Activate the new configurations on July 10, 2027. Incorporate lessons learned from ACPR/Tracfin controls during the first weeks of application. Document residual gaps with a 6-month remediation plan.

Our eIDV (electronic Identity Verification) approach anticipates AMLD6/AMLR along three structuring axes. We are operationally ready today:

• Multi-source electronic identity verification: we cross-reference transactional, government, and telecom data across 197 countries, with a substantial eIDAS (the European electronic identity) assurance level by default and a high level on demand for enhanced-risk operations.
• International coverage: 4,000 worldwide sources, 1.5 billion individuals identified, 250 million professionals identified. The beneficial owner of a Luxembourg holding is identifiable just as a French client would be.
• Compliance by design: no centralized storage, no biometric library, strict alignment with GDPR article 5.1.c requirements and ACPR expectations.

This approach, validated by 5 million monthly verifications, takes on its full meaning under AMLD6: only real-existence data resists document fraud and deepfakes.

You can also benefit from a free audit of your existing data, to measure your current data assets and the optimum reachable against your goals.

::: cta Get your KYC framework ready for AMLD6/AMLR: free audit in 10 days. Discuss your project :::

What is the deadline for AMLD6 transposition in France? July 10, 2027, in accordance with article 85 of Directive (EU) 2024/1640. The French ordinance is expected in the second half of 2026.

Does the AMLR completely replace earlier directives? Regulation (EU) 2024/1624 (AMLR) replaces the due diligence obligations previously set by AMLD4 and AMLD5. Directive AMLD6 adds the criminal and procedural layer.

Which entities will be directly supervised by AMLA? Around 40 priority entities from January 1, 2028: large cross-border banks, leading European CASPs, certain systemic fintechs. Indirect supervision (through national authorities) covers all others.

Does the €10,000 threshold apply to professional payments? Yes, as long as at least one party is an AML/CFT obliged entity. The rule applies to cash payments, regardless of the nature of the transaction.

Do KYC subcontractor contracts need to be amended? Yes. Subcontracting agreements must include the new due diligence, retention, and reporting obligations, in line with GDPR article 28 and ACPR/AMLA prudential expectations.

Anticipating AMLD6/AMLR is not optional — it is a continuity-of-business condition for any professional subject to anti-money-laundering rules in France. The 18 months you have left must be devoted to mapping, redesigning, testing, and training. The first ACPR/AMLA controls in 2028 will focus as a priority on the quality of documentation and the traceability of due diligence decisions. Competitive advantage is at stake, as much as conversion rates.

To go further, consult our KYC/eIDV compliance pillar for France, our KYC pillar, our article how to implement a KYC framework, our article who is KYC mandatory for, and our dedicated article on crypto KYC regulation 2026. For a direct conversation, contact our experts.