The new EU Anti‑Money‑Laundering (AML) Framework represents a significant reform of AML obligations for law firms. From 10 July 2027, law firms across the EU will face significantly stricter governance, risk management and client due diligence requirements.
These developments will also directly affect UK law firms with EU offices, clients or cross-border mandates. Firms advising on EU transactions will increasingly need to navigate regulatory divergence between the UK and EU AML regimes and may face parallel compliance frameworks.
Affected law firms will be required to designate new internal compliance roles. They are also obliged to install stricter risk‑management systems and enhanced client‑due‑diligence processes including expanded documentation duties. The new EU AML-Framework will fundamentally reshape compliance expectations, internal governance, and daily legal practice.
Impact of EU AML regulations on Law Firms
Law firms subject to AML rules should start preparing now, as the new structures and processes must be in place by July 2027. This will also apply to UK law firms with EU operations and offices in EU member states as the EU-AML Package creates critical regulatory divergence between the UK and the EU.
For UK solicitors, especially those advising on cross‑border transactions and matters, AML is no longer merely a background compliance issue, but increasingly a central strategic risk area.
The EU AML Package: New Rules for Law Firms
The EU’s new AML Package, in force since 9 July 2024, introduces a comprehensive reform consisting of:
- The EU AML Regulation (EU 2024/1624), which creates a directly applicable single rulebook for all.
- The 6th AML Directive (EU 2024/1640) which regulates the national mechanisms EU Member States must put in place to prevent money laundering and terrorist financing.
- The AMLA Regulation (EU 2024/1620), which sets the rules for the EU Anti-Money- Laundering Authority (AMLA).
This new framework aims to eliminate fragmented national approaches and impose a uniform compliance baseline, centralised enforcement and harmonised standards across the EU.
AMLA Supervision and What It Means for Law Firms
The EU Anti‑Money‑Laundering Authority (AMLA), created under the rules of the AMLA Regulation, officially began operations on 1 July 2025. AMLA will issue technical standards, guidelines, and recommendations to coordinate national supervisory authorities, with the objective of further harmonising anti-money laundering practices across the EU and providing greater clarity for obliged entities, including law firms.
When are Lawyers “Obliged Entities”?
Not all lawyers automatically fall under the AML-regime. Only lawyers and law firms that conduct activities considered particularly at risk for money laundering are classified as “obliged entities” and fall under the scope of the AML-Rules. These activities are set out in a defined list and include:
- Real‑estate transactions
- Financial transactions
- Mergers, acquisitions, and corporate restructurings
- Tax advice that forms a substantial element of the engagement.
The new single rulebook expands the current category of obliged entities and includes parent and holding companies. Individual lawyers are not personally obliged when, and to the extent that, they handle mandates on behalf of the legal practice entity, regardless of whether they are employees, freelancers, partners, or managing directors.
However, individual lawyers remain obliged if they carry out AML-relevant activities in their own names.
This has immediate cross border effects. UK law firms with any form of EU practice must check whether their activities make them subject to EU AML rules even when the equivalent activity would fall outside the scope of the UK Money Laundering Regulations. The discrepancy creates asymmetric compliance burdens.
A Stricter Compliance Regime
The new EU AML Regulation introduces a suite of obligations that are significantly more detailed and demanding than previous rules. Law firms must build robust internal systems capable of identifying, assessing, and mitigating AML risks.
Mandatory elements include a documented firm‑wide risk assessment, as well as greater documentation and reporting duties. It also assigns clear responsibility to senior leadership for AML governance, introducing the “three lines of defence” model.
New Governance Roles
The three lines of defence model requires firms to designate:
- A Compliance Manager, who is responsible for AML governance.
- A Money Laundering Reporting Officer, who is responsible for ongoing oversight.
- An independent Audit Function to test AML systems and controls.
To reduce the significant challenge for smaller law firms, the Compliance Manager and the Money Laundering Officer can be performed by one person as is the case in many UK firms.
Tightened Client‑Due‑Diligence (CDD) Requirements
The AML Regulation expands client‑verification requirements considerably. Lawyers will need to perform more detailed identity and beneficial‑ownership checks, mandatory, documented risk assessments for each client relationship and transactions and group‑wide AML procedures for multi‑office firms.
Regarding branches or subsidiaries of obliged entities located in third countries where the minimum AML/CFT requirements are less strict, the Regulation states clearly that the parent undertaking must ensure that those branches or subsidiaries comply with EU requirements, including requirements concerning data protection, or equivalent.
Greater Documentation and Reporting Duties
The Regulation also increases documentation and reporting obligations. Firms must maintain extensive written records of risk assessments, CDD activities, and decision‑making processes. The new rules also introduce the obligation to report inconsistencies detected during CDD checks, in addition to suspicious activity reports.
Preparing for EU-AML Reform: What Firms Should Do Now
The EU-AML Package creates critical regulatory divergence between the UK and the EU. As a result, UK firms with EU operations and EU offices will be applying substantively different standards between the UK and EU operations for the first time.
UK law firms cannot afford to wait. They need to be prepared when the new rules come into force in July 2027.
The changes will affect case‑intake procedures, data‑management systems, internal reporting lines, staff training, and overarching governance structures. Implementing these systems will require substantial investment and internal coordination. Early preparation is essential for firms to be able to transition smoothly to the new rules.
Law firms should begin preparing now by:
- Reviewing whether EU activities bring the firm within scope of the EU-AML Regulation
- Assessing governance structures and AML roles
- Strengthening client due diligence procedures
- Reviewing cross-border AML compliance frameworks
- Preparing internal systems and training programmes
Implementing these systems may require substantial investment and internal coordination, and early preparation is essential for firms to transition smoothly with the new rules.
If you would like to explore what impact the new EU rules have on your firm and how we can assist you with undertaking a gap analyses, designing and implementing the appropriate processes and systems, please get in touch with Heike Loercher at heike.loercher@hooktangaza or brussels@hooktangaza.com.
