Published 7 October 2026

AML glossary: the key terms, as EU law defines them

One or two sentences per term, the EU text that defines it today and what becomes of it on 10 July 2027: enough to speak the same language as your supervisor, wherever in the EU you practise.

This guide covers European Union law. What each Member State sets for itself (the authority that supervises you, the financial intelligence unit that receives your reports, how you file them) is set out country by country: Ireland, Malta and every other Member State.

Anti-money laundering and countering the financing of terrorism (AML/CFT) has a vocabulary of its own, and within the EU, its definitions come from EU legislation. This glossary gathers the ones an obliged entity uses day to day, each with the text that sets it out.

Each entry runs to one or two sentences, followed by two dated pointers: the text that defines the term today, usually Directive (EU) 2015/849 as your Member State has transposed it, and what the AMLR changes from 10 July 2027. Every article cited links to the text published on EUR-Lex, in its consolidated version where the text has been amended.

Which text applies, and when

The texts, and who applies them

AMLR

Regulation (EU) 2024/1624, applicable from 10 July 2027, which brings together in a single, directly applicable text the obligations of obliged entities: customer due diligence, beneficial ownership, suspicious transaction reporting, record keeping. The acronym stands for Anti-Money Laundering Regulation.

Today: AMLR, Article 90. Published in the Official Journal on 19 June 2024 and in force since 9 July 2024, it only applies from 10 July 2027. Until then, what applies is your Member State's law transposing Directive (EU) 2015/849.

From 10 July 2027: AMLR, Article 90; Directive (EU) 2024/1640, Article 77. The Regulation applies directly, with no transposition, and Directive (EU) 2015/849 is repealed the same day. Football agents and professional football clubs are covered only from 10 July 2029.

AMLR 2027: what changes for non-banking professions →

AMLA

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism, an EU body based in Frankfurt am Main. It will directly supervise selected credit and financial institutions, coordinates national supervisors and supports financial intelligence units; it does not directly supervise non-financial professions.

Today: Regulation (EU) 2024/1620, Articles 1, 4 and 108. The Regulation has applied since 1 July 2025; the articles establishing the Authority and setting its seat have applied since 26 June 2024.

From 10 July 2027: AMLR, Article 2(1)(45). Its definition does not change. The AMLR counts AMLA among supervisors when it carries out direct supervision.

AMLA won't be your supervisor. It is still shaping your rules. →

Obliged entity

Any natural or legal person that EU law subjects to anti-money laundering obligations: credit and financial institutions and, in the course of their professional activities, auditors, external accountants and tax advisors, notaries and other independent legal professionals for certain transactions, trust or company service providers, estate agents and gambling service providers, among others. Each Member State may add other exposed professions.

Today: Directive (EU) 2015/849, Article 2(1) and Article 4. Some categories only come in above a threshold: a monthly rent of EUR 10 000 or more for estate agents in lettings, transactions of EUR 10 000 or more for the art trade.

From 10 July 2027: AMLR, Article 3 and Article 90. The list grows, taking in among others traders in precious metals and stones or in high-value goods, crowdfunding service providers and intermediaries, credit intermediaries, football agents and professional football clubs, the last two only from 10 July 2029.

Trust or company service provider (TCSP)

Anyone who, by way of business, forms companies for third parties, provides them with a registered office or address, acts for them as director, trustee or nominee shareholder, or arranges for another person to do so. Providing a business address to companies falls within it.

Today: Directive (EU) 2015/849, Article 3(7) and Article 2(1)(3)(c). The Directive covers them only where they are not already caught as accountancy or legal professionals.

From 10 July 2027: AMLR, Article 2(1)(11) and Article 3(3)(c). The definition is substantively the same. It now names natural and legal persons expressly, and the listed-company exception for nominee shareholders goes.

Supervisor and supervisory authority

The body that checks whether obliged entities comply with their anti-money laundering obligations and takes the necessary measures when they do not. Each Member State designates its own, often profession by profession.

Today: Directive (EU) 2015/849, Article 48(1). The Directive speaks of “competent authorities”. Who supervises which profession, country by country: our Europe page.

From 10 July 2027: AMLR, Article 2(1)(45) and (46); Directive (EU) 2024/1640, Article 37. Two words, two notions: a “supervisor” is any body entrusted with that task, self-regulatory bodies included; a “supervisory authority” is a supervisor that is a public body, or the public authority overseeing a self-regulatory body in that role. Each Member State appoints one or more supervisors.

AMLA won't be your supervisor. It is still shaping your rules. →

Self-regulatory body

A body that represents the members of a profession, sets rules for them, performs certain supervisory or monitoring functions and ensures those rules are enforced. A bar association or a chamber of notaries is the typical example.

Today: Directive (EU) 2015/849, Article 3(5) and Article 34. A Member State may designate it to receive suspicious transaction reports from certain professions, which it must then pass on to the financial intelligence unit promptly and unfiltered.

From 10 July 2027: AMLR, Article 2(1)(46) and (47); Directive (EU) 2024/1640, Article 37(3). Same definition. Directive (EU) 2024/1640 allows Member States to entrust it with supervising accountancy and legal professions, and the AMLR calls the public authority overseeing it in that role a “supervisory authority”.

Senior management

An officer or employee who knows enough about the entity's exposure to money laundering and terrorist financing risk, and is senior enough, to take decisions affecting that exposure. Their approval is needed, for instance, before entering into a business relationship with a politically exposed person.

Today: Directive (EU) 2015/849, Article 3(12) and Article 20. They need not be a member of the board of directors.

From 10 July 2027: AMLR, Article 2(1)(40) and Article 42. Members of the management body in its management function are included as of right, alongside officers and employees who meet both conditions.

Knowing your customer

Business relationship

A business, professional or commercial relationship connected with the obliged entity's professional activities and expected, when contact is first made, to last. Establishing one is the first of the situations in which customer due diligence applies, whatever the amount at stake.

Today: Directive (EU) 2015/849, Article 3(13) and Article 11(a). The Directive's test is whether, at the time contact is established, it is expected “to have an element of duration”.

From 10 July 2027: AMLR, Article 2(1)(19). A relationship exists even without a written contract, and one that was not expected to last becomes a business relationship if it later acquires an element of repetition or duration.

Occasional transaction

A transaction carried out for a customer outside any business relationship. EU law does not define it as such: its amount, alone or added to that of linked transactions, is what triggers due diligence.

Today: Directive (EU) 2015/849, Article 11(b) and (c). Due diligence applies from EUR 15 000, in one operation or several that appear to be linked, and from EUR 10 000 in cash for persons trading in goods.

From 10 July 2027: AMLR, Article 2(1)(20) and Article 19(1)(b) and (4). The general threshold falls to EUR 10 000, linked transactions included, and the customer must be identified and verified from EUR 3 000 in cash, except, broadly, where the Member State already caps cash payments at EUR 3 000 or less. The AMLR defines “linked transactions”: two or more transactions with identical or similar origin, destination and purpose, or other relevant characteristics, over a specific period.

Customer due diligence (CDD)

The set of measures that tell an obliged entity who it is dealing with: identifying the customer and verifying their identity, identifying the beneficial owner, understanding the purpose and intended nature of the relationship, then monitoring it over time. Their extent follows the risk, but none of them can be dropped.

Today: Directive (EU) 2015/849, Articles 11 and 13. They apply when a business relationship begins, to occasional transactions above the thresholds, whenever there is a suspicion, and when previously obtained identification data is in doubt.

From 10 July 2027: AMLR, Articles 19 and 20. The list grows: checking whether the customer or its beneficial owners are subject to targeted financial sanctions, finding out about the nature of the customer's business, and determining whether the customer is a politically exposed person, a family member or a person known to be a close associate. Due diligence also applies when there is doubt whether the person you are dealing with is the customer or someone authorised to act for them.

Simplified due diligence

Lighter measures, allowed where the business relationship or transaction presents a lower risk that has been established beforehand. They lighten due diligence without removing it: monitoring must remain close enough to spot an unusual or suspicious transaction.

Today: Directive (EU) 2015/849, Article 15. The Directive leaves it to each Member State to allow them, and does not say what they consist of.

From 10 July 2027: AMLR, Article 33. The Regulation lists the permitted simplifications, such as verifying identity up to 60 days after the relationship starts or updating customer data less often, and the situations that rule them out, including suspicion and attempts to evade targeted financial sanctions.

Enhanced due diligence (EDD)

Additional measures required where the risk is higher: more information on the customer, their beneficial owners and the source of funds, senior management approval, closer monitoring of the relationship. Some situations call for them automatically, such as high-risk third countries and politically exposed persons.

Today: Directive (EU) 2015/849, Articles 18 to 24. Any transaction that is complex, unusually large, conducted in an unusual pattern or without an apparent economic or lawful purpose must be examined.

From 10 July 2027: AMLR, Article 34. The Regulation lists the measures available, including requiring the first payment to go through an account in the customer's name with a credit institution whose due diligence standards are at least as robust. It adds specific measures for customers holding at least EUR 50 million in assets, where a higher-risk relationship involves handling at least EUR 5 million: these apply to credit and financial institutions and to trust or company service providers.

Beneficial owner

The natural person or persons who ultimately own or control the customer, or on whose behalf a transaction or activity is carried out. Behind a company, a trust or a foundation, what you are looking for is always a human being.

Today: Directive (EU) 2015/849, Article 3(6). For a company, a shareholding of 25% plus one share, or an ownership interest of more than 25%, is an indication of ownership; each Member State may set a lower percentage. If no one can be identified and there are no grounds for suspicion, the senior managing official is recorded.

From 10 July 2027: AMLR, Article 2(1)(28) and Articles 51 and 52. The threshold becomes “25% or more” of the shares, voting rights or other ownership interest, counted at every level of ownership, and control via other means is looked for in parallel. The Commission may set a lower threshold for higher-risk categories of companies: 15% at most as a rule, and always below 25%.

Central beneficial ownership register

The register each Member State keeps of the beneficial owners of companies and other legal entities incorporated in its territory, and of the trusts and similar legal arrangements that fall under it. Obliged entities have access to it for their due diligence, but may not rely on it alone.

Today: Directive (EU) 2015/849, Articles 30 and 31; Directive (EU) 2024/1640, Articles 74 and 78. Access rules were rewritten by Directive (EU) 2024/1640, to be transposed on this point by 10 July 2025: competent authorities and financial intelligence units without restriction, obliged entities within their due diligence, and anyone who can demonstrate a legitimate interest. Access by any member of the general public had been struck down by the Court of Justice on 22 November 2022 (Joined Cases C-37/20 and C-601/20).

From 10 July 2027: Directive (EU) 2024/1640, Articles 10 to 13; AMLR, Articles 62 and 63. Directive (EU) 2024/1640 governs the registers and access to their contents, some of the access rules having to be transposed by 10 July 2026; the AMLR sets out what each legal entity must report to them.

Politically exposed persons

Politically exposed person (PEP)

A natural person who holds or has held a prominent public function: head of State or government, minister, member of parliament, supreme court judge, ambassador, board member of a State-owned enterprise, among others. Middle-ranking or more junior officials are never included.

Today: Directive (EU) 2015/849, Article 3(9) and Article 20. A relationship with a PEP calls for enhanced due diligence: senior management approval, establishing the source of wealth and funds, enhanced ongoing monitoring.

From 10 July 2027: AMLR, Article 2(1)(34) and Article 42. The list extends to heads of regional and local authorities with at least 50 000 inhabitants, to board members of medium-sized or large enterprises those authorities control, and to equivalent functions at Union level. For political parties, only those holding seats in national executive or legislative bodies, or in regional or local ones representing at least 50 000 inhabitants, still count.

Politically exposed persons in EU law: the common rules →

Family member

The relatives of a politically exposed person whom enhanced due diligence also covers: spouse or equivalent, children and their spouses or equivalents, parents.

Today: Directive (EU) 2015/849, Article 3(10) and Article 23. The measures required for the politically exposed person apply to them too.

From 10 July 2027: AMLR, Article 2(1)(35) and Article 46. The text names registered partnerships and civil unions, and adds the siblings of heads of State and government, ministers and deputy or assistant ministers.

Politically exposed persons in EU law: the common rules →

Person known to be a close associate

A natural person known to share beneficial ownership of a legal entity or arrangement with a politically exposed person, to have any other close business relations with them, or to be the sole beneficial owner of a structure set up for that person's de facto benefit.

Today: Directive (EU) 2015/849, Article 3(11) and Article 23. The measures required for the politically exposed person apply to them as well.

From 10 July 2027: AMLR, Article 2(1)(36) and Article 42(2). Unchanged definition. The Regulation requires AMLA to issue guidelines, by 10 July 2027, on the criteria for identifying such persons.

Politically exposed persons in EU law: the common rules →

Assessing risk

Risk-based approach

The principle that sets the intensity of due diligence by the risk: more measures where it is high, lighter ones where it is low and shown to be so. The texts do not define it; they apply it, from the entity's own risk assessment to the choice of measures for each customer.

Today: Directive (EU) 2015/849, Article 8 and Article 13(2) and (4). The entity must be able to show competent authorities or self-regulatory bodies that its measures are appropriate to the risks it has identified.

From 10 July 2027: AMLR, Article 10 and Article 20(2) to (4). The principle stays. The extent of measures is set on an individual analysis of each customer's risks, taking the business-wide risk assessment into account, and the Regulation requires AMLA to issue guidelines on risk variables and risk factors by 10 July 2026.

Business-wide risk assessment

The written analysis in which an obliged entity identifies and assesses the money laundering and terrorist financing risks it is exposed to: its customers, countries, products and services, transactions and delivery channels. It is documented, kept up to date and made available to the supervisory authorities.

Today: Directive (EU) 2015/849, Article 8(1) and (2). Competent authorities may waive individual documented assessments for a sector whose specific risks are clear and understood.

From 10 July 2027: AMLR, Article 10. The Regulation adds the risk of non-implementation and evasion of targeted financial sanctions. The assessment is drawn up by the compliance officer and approved by the management body in its management function, and AMLA sets out its minimum content in guidelines.

High-risk third country

A country outside the EU whose anti-money laundering regime has strategic deficiencies and which the Commission has identified as such in a delegated act. Any business relationship or transaction involving it calls for enhanced due diligence.

Today: Directive (EU) 2015/849, Articles 9 and 18a. The list is in the annex to Delegated Regulation (EU) 2016/1675, amended with each update.

From 10 July 2027: AMLR, Articles 29 to 31. The AMLR distinguishes three categories: countries with significant strategic deficiencies, which remain the “high-risk third countries”, countries with compliance weaknesses, and countries posing a specific and serious threat to the Union's financial system.

EU high-risk third countries: the list that counts, and its date →

Suspicion and reporting

Money laundering

Converting, transferring, concealing, acquiring, possessing or using property in the knowledge that it derives from criminal activity, in particular to disguise its origin, and taking part in any of those acts. Knowledge or intent may be inferred from objective factual circumstances.

Today: Directive (EU) 2015/849, Article 1(3) to (6). It is still money laundering where the activity that generated the property took place in another Member State or in a third country.

From 10 July 2027: AMLR, Article 2(1)(1). The AMLR refers to the criminal-law definition in Directive (EU) 2018/1673, including aiding and abetting, inciting and attempting, wherever the underlying activity took place.

Terrorist financing

Providing or collecting funds, by any means, directly or indirectly, with the intention that they be used, or in the knowledge that they will be used, to commit a terrorist offence. It must be reported like money laundering, whatever the amount.

Today: Directive (EU) 2015/849, Article 1(5) and Article 33. The Directive refers to the terrorist offences in Council Framework Decision 2002/475/JHA.

From 10 July 2027: AMLR, Article 2(1)(2). The AMLR refers to Article 11 of Directive (EU) 2017/541 on combating terrorism, including aiding and abetting, inciting and attempting.

Financial intelligence unit (FIU)

The central national unit, operationally independent and autonomous, that receives and analyses suspicious transaction reports from obliged entities and passes the results of its analyses on to the competent authorities. Each Member State has one, under a name of its own.

Today: Directive (EU) 2015/849, Article 32. It can suspend or withhold consent to a suspicious transaction while it analyses it. Each country's unit is named on our Europe page.

From 10 July 2027: Directive (EU) 2024/1640, Article 19. Directive (EU) 2024/1640 makes it the “single central national unit” receiving the reports required by the AMLR, and sets out its analytical functions in detail.

Suspicious transaction report (STR)

The report an obliged entity sends, on its own initiative, to the financial intelligence unit when it knows, suspects or has reasonable grounds to suspect that funds are the proceeds of criminal activity or are related to terrorist financing, whatever the amount. Attempted transactions are reported too.

Today: Directive (EU) 2015/849, Articles 33 and 39. Neither the customer nor any third party may be told that a report has been made.

From 10 July 2027: AMLR, Articles 69 and 73. A suspicion may concern funds or activities, and one arising from the inability to carry out due diligence must be reported too. The entity answers the unit's requests within 5 working days, which the unit may shorten in urgent cases.

Financial sanctions

Targeted financial sanctions

The freezing of the assets of designated persons and entities, together with the prohibition on making funds or other assets available to them, directly or indirectly. In the EU, they result from Council decisions and Council regulations.

Today: Directive (EU) 2024/1226, Article 2, points (1) and (2); Regulation (EU) No 269/2014, Article 2. Directive (EU) 2015/849 does not define the notion: each sanctions regime has its own Council regulation, which lists the designated persons in an annex, as Regulation No 269/2014 does for one of them.

From 10 July 2027: AMLR, Article 2(1)(49) to (51) and Article 20(1)(d). The Regulation defines the notion and builds it into due diligence: checking whether the customer or its beneficial owners are designated and, for a customer that is a legal entity, whether designated persons control it or hold more than 50% of it.

EU financial sanctions: what applies the moment a name is on the list →

Freezing of funds and economic resources (asset freeze)

Freezing funds means preventing any move, transfer, alteration, use of, access to or dealing with them that would change their volume, amount, location, ownership, character or destination. Freezing economic resources means preventing their use to obtain funds, goods or services, including by selling, hiring or mortgaging them.

Today: Directive (EU) 2024/1226, Article 2, points (5) and (6); Regulation (EU) No 269/2014, Article 1(e) and (f) and Article 2. Each sanctions regulation carries these definitions; Directive (EU) 2024/1226 repeats them for all regimes and makes intentional failure to freeze a criminal offence.

From 10 July 2027: AMLR, Article 2(1)(49). The definition does not change: it remains the one in the sanctions regulations. The AMLR ties the freeze to targeted financial sanctions, which due diligence must now check.

EU financial sanctions: what applies the moment a name is on the list →

Funds

In sanctions law, financial assets and benefits of every kind: cash, cheques, deposits and account balances, securities, interest and dividends, letters of credit and, under Directive (EU) 2024/1226, crypto-assets.

Today: Directive (EU) 2024/1226, Article 2, point (3); Regulation (EU) No 269/2014, Article 1(g); Directive (EU) 2015/849, Article 3(3). Anti-money laundering law reasons in terms of “property”: Directive (EU) 2015/849 covers assets of any kind, corporeal or incorporeal, and the documents evidencing title to them.

From 10 July 2027: AMLR, Article 2(1)(4) and (48). The AMLR uses two notions: “funds” or “property” in the criminal-law sense of money laundering, and “funds or other assets”, of every kind, targeted by financial sanctions. Sanctions regulations keep their own definition.

Economic resources

Assets of every kind, tangible or intangible, movable or immovable, which are not funds but can be used to obtain funds, goods or services: a building, a yacht or a work of art, for instance. They are frozen just as funds are.

Today: Directive (EU) 2024/1226, Article 2, point (4); Regulation (EU) No 269/2014, Article 1(d) and Article 2(2). Making an economic resource available to a designated person is prohibited, just like paying them funds.

From 10 July 2027: AMLR, Article 2(1)(48). The AMLR expressly includes them among the “funds or other assets” targeted by financial sanctions; the definition in the sanctions regulations does not change.

Informative article, current as of 7 October 2026, not constituting legal advice. Each definition was checked against the EU text as published on EUR-Lex; anything your Member State added when transposing the Directive should be checked with your supervisor.

Frequently asked questions