But as a regulatory milestone that felt permanently future-tense. It isn't any more.
The EU Anti-Money Laundering Regulation framework is now entering operational implementation across member states. And the question that matters now isn't whether firms are aware of these developments (most are) but whether their KYC programmes are actually built for what's being asked of them.
The honest answer, for most organisations, is: partially. The structures are there, the policies have been updated, the training has been run. But the underlying operational model (how KYC cases are reviewed, how quality is measured, how oversight is documented) was often designed for a lighter-touch regulatory environment than the one that now exists.
What AMLA actually changes
It's worth being precise about what AMLA is and isn't, because there's a tendency in the market to treat it as either a technical EU compliance matter (not relevant to non-EU firms) or as the beginning of a completely new era (panic warranted). Neither is quite right.
AMLA is a supervisory authority, not a rule-writer. The rules - the EU Anti-Money Laundering Regulation - have been established separately and are now in force.
AMLA's role is to ensure those rules are applied consistently across EU member states, and to directly supervise the highest-risk obliged entities operating across borders. In 2026, supervisory work begins at the institutional level. In 2027, direct supervision of large institutions across EU member states becomes a formal function.
What changes in practice is the quality of scrutiny and its consistency. Before AMLA, AML supervision in the EU was fragmented across national competent authorities with different approaches, different risk tolerances, and different enforcement records.
A firm operating in five EU jurisdictions could face five meaningfully different regulatory conversations. AMLA doesn't eliminate that variation immediately, but it introduces a central supervisory layer that will over time compress it. And that layer starts with the largest, most complex, most cross-border institutions.
For firms in scope, this means the oversight of their KYC programme is no longer primarily a national conversation. The documentation standards, the quality governance, and the evidence of controls will be assessed against a harmonised framework - one that AMLA is actively building out this year.
The governance question your regulator will ask
The most useful way to think about AMLA's operational start is through the lens of a specific question: if your KYC programme were reviewed tomorrow, could you demonstrate not just that you have a quality process, but that the process works?
This is a meaningful distinction. Most compliance functions can produce policy documentation. Most can describe their QA methodology in a meeting. The harder test (and the one that regulators increasingly apply) is whether the documentation reflects the operational reality.
Sampling records that show error rates. Root cause analyses that are actually completed. Rework that's tracked and closed within a defined timeline. Evidence that control failures were identified internally, not by the regulator.
The shift AMLA represents is one of expectations, not just rules. Supervisory authorities that have observed years of compliance failures (in some cases at the largest institutions in the world) are not reassured by process documentation alone.
They want to see that the governance structure produces consistent, auditable outcomes. This includes evidence that governance controls are functioning proactively in identifying, escalating, and remediating issues internally before they become regulatory findings. That's a higher bar than it sounds like in the day-to-day reality of running a compliance function under volume and cost pressure.
What the next 18 months look like
Three milestones are worth marking on any KYC programme's planning horizon:
AMLA's supervisory work is underway now, focused initially on the most complex cross-border entities. Firms in scope should expect to be contacted, and should treat the initial supervisory engagements as diagnostic - the authority is building its view of the landscape, and the information firms provide in these early interactions shapes how they're perceived.
In 2027, FATF introduces perpetual KYC as a global standard. Perpetual KYC (the shift from periodic review cycles to continuous, event-triggered monitoring) is not just a technology question.
It requires a fundamentally different operational model: one where customer risk profiles are updated in near-real time, where data feeds from multiple sources are continuously assessed, and where the compliance team's role shifts from executing reviews to monitoring exceptions and handling escalations.
Most KYC operations today are not designed for this. Getting from periodic to perpetual requires rethinking the workflow, the tooling, and the skills mix. And 18 months is a short runway for that kind of change.
Also in 2027, AMLA begins direct supervision of large institutions across member states. Firms that have spent 2026 assuming AMLA is primarily a theoretical development will find 2027 a sharp correction. The supervisory relationships being built this year will determine how those engagements are structured.
Three things to do now
First: test your documentation against the supervisory standard, not just the internal standard.
Ask whether your QA records would satisfy a regulator who has no prior context on your programme, i.e. someone reading the documentation cold. If the answer requires extensive explanation, the documentation isn't robust enough.
Second: assess your readiness for perpetual KYC as an operational model, not just as a technology purchase.
The technology for continuous monitoring exists and is maturing fast. The harder question is whether your operating model (team structure, escalation paths, case management workflow) can support the shift from periodic batch reviews to real-time exception handling.
Most organisations need 12–18 months of operational redesign before the technology investment is fully productive.
Third: review your outsourced KYC arrangements specifically.
AMLA's guidance on outsourcing governance makes clear that responsibility for oversight does not transfer with the work. If your KYC is delivered by an external partner, the quality governance and oversight documentation sits with you.
That means visibility into your partner's error rates, their root cause analysis processes, and their escalation practices - not just their SLA headline numbers. If you don't have that visibility, AMLA's supervisory focus makes now the right time to build it.
The bottom line
AMLA's operational start isn't a cliff edge. There’s no single deadline where everything changes at once. It's the beginning of a period during which the quality of scrutiny across the EU's AML and KYC landscape will gradually, consistently increase.
Firms that use 2026 to build documentation robustness, operational readiness for perpetual KYC, and proper oversight of their outsourced arrangements will be better positioned for every supervisory interaction ahead.
Those that wait for a specific enforcement signal may find the signal arrives later than expected - and with less lead time than they'd assumed.