New EU AML rules: What changes for investor onboarding and monitoring?

Key takeaways

• From 10 July 2027, a single anti-money laundering (AML) rulebook applies across the EU, largely replacing rules that currently differ country to country.
• The main changes are more consistent investor information requirements, set ways to check identity, a wider net for beneficial owners and fixed deadlines for refreshing checks.
• If you manage or administer EU private funds, the new rules will shape how you onboard and monitor investors.
• The detailed standard on applying these rules is in final draft, so now is a good time to start preparing.

The new European Union (EU) anti-money laundering (AML) rules apply from 10 July 2027. For private fund onboarding, they largely replace country-by-country requirements with one EU rulebook. That rulebook sets out what you collect from investors, how you confirm who they are and who owns them, and how often you check again.

This guide explains what is changing, what it means for your investor onboarding process and the practical steps you can take now to prepare. Some of the detail may still change before the rules are finalised, so be sure to follow the advice of your legal and compliance team.

Why is the EU changing its AML rules?

AML rules exist to stop criminals using the financial system to hide or move illegal money. For fund managers, that means checking every investor before accepting their money and keeping those checks up to date.

Until now, EU AML rules have mostly come from directives, which set goals that each EU country writes into its own national law. This means that details vary between countries. A firm onboarding investors into Luxembourg, Irish and Maltese funds, for example, can face three slightly different sets of requirements.

The new package replaces much of this with a regulation that applies in the same way in every EU country. It also creates a new EU AML authority to help make sure the rules are applied consistently.

What’s in the new EU AML package?

The new EU AML package has three key parts. The first two matter most for investor onboarding.

1. The Anti-Money Laundering Regulation (AMLR) is the new rulebook

The AMLR sets out the anti-money laundering checks firms must carry out. This article focuses on the checks a fund must carry out on its investors. The AMLR applies directly in every EU country from 10 July 2027.

2. The Anti-Money Laundering Authority (AMLA) is the new EU supervisor

AMLA is a new EU agency, based in Frankfurt, that started work in summer 2025. It has two jobs that matter for fund managers:

• writing the detailed technical standards that explain how firms should apply the AMLR in practice
• coordinating national regulators, such as the Commission de Surveillance du Secteur Financier (CSSF) in Luxembourg and the Central Bank of Ireland, so the rules are applied the same way across the EU

The regulatory technical standards (RTS) fill in the practical detail, such as which pieces of information to collect from an investor. AMLA drafts them, and they become legally binding once the European Commission (EC) adopts and publishes them.

From 2028, AMLA will also directly supervise at least 40 high-risk financial firms that operate across borders. Most firms will continue to be supervised by their national regulator.

3. The sixth Anti-Money Laundering Directive (AMLD6) sets rules for governments

AMLD6 tells EU countries what they must put in place, such as national supervisors and registers of who owns companies. This has less direct impact on your day-to-day operations, although you may use those registers when checking corporate investors.

Do the new rules apply to your firm?

If you manage an EU fund, they are likely to apply. The AMLR lists alternative investment funds and their managers (AIFMs) and UCITS funds and their management companies among the financial firms that must carry out AML checks.

If you’re a fund administrator or transfer agent, you probably carry out investor checks on behalf of a fund or its manager. Depending on your licence, you may also have AML obligations of your own. Outsourcing the work doesn’t transfer the legal responsibility, which stays with the fund or manager. In practice, expect your asset manager clients to ask how your processes meet the new standards.

If you’re a UK firm, you follow the UK’s own rules, the Money Laundering Regulations 2017, which the AMLR doesn’t replace. The AMLR will apply to EU entities in your group that fall within its scope, such as EU funds and their management companies.

If you’re not sure whether the rules apply to an entity, check with your legal and compliance team.

How will the new EU AML rules impact investor onboarding?

Most of the changes affect customer due diligence (CDD). These are the checks you carry out to confirm who an investor is, who owns or controls them, their investment goals and where their money comes from. Many firms simply call this KYC (know your customer).

The AMLR sets the requirements, and AMLA’s final draft technical standards on CDD fill in the detail. The standards could still change before they are adopted and published, so treat what follows as an overview of the direction of travel. Based on the draft technical standards, these are the five changes most likely to affect your onboarding process.

1. A standard list of what to collect from investors

The draft standards set out in detail the information to collect about individual and corporate investors. You will also need to continue to record why the investor is investing and understand where their money comes from, in more depth for higher-risk investors. You will need this information for ongoing monitoring later.

In practice, your investor forms and document requests may need updating, especially if they were built around one country’s standards.

2. Clear options for checking an investor’s identity

The AMLR sets out accepted ways to confirm that an investor is who they say they are. These include identity documents, electronic identification methods and qualified trust services that meet EU standards.

Qualified electronic signatures (QES) can help here. Before issuing the qualified certificate behind a QES, the provider must check who the signer is. This can bring identity verification and signing together in one step. A QES may not include every detail you need, such as date or place of birth, so you’ll still need to verify any missing information and complete your other due diligence checks.

In practice, work with your compliance team to decide which methods you’ll offer investors, and record your reasoning.

3. A wider net for beneficial owners

A beneficial owner is a real person who ultimately owns or controls a company or other entity investing in your fund. Under today’s rules, owning more than 25% is treated as an indication of beneficial ownership. For companies, the AMLR sets the threshold at 25% or more, and ownership held through other companies is calculated through each layer.

For investors with several layers of ownership, the draft standards also set out what to collect about each company in the chain.

Investors that are themselves funds, such as feeder funds or funds of funds, have their own beneficial ownership test under the AMLR. As well as anyone holding 25% or more of the fund’s units, it can include people who define or influence the fund’s investment policy or who have other control rights.

In practice, some corporate investors already on your books may have beneficial owners you haven’t yet identified. Watch our short video to see how related people and companies can be mapped digitally, with supervised AI speeding up the process.

4. Conditions for funds sold through intermediaries

Some funds are distributed through banks or other financial institutions that hold units in their own name, on behalf of their clients. The draft standards set conditions for how a fund meets its duty to identify the end investors in this situation.

You will need to be able to show your regulator, on request, how those conditions are met, so it’s worth reviewing your distribution agreements with your compliance team now.

5. Fixed deadlines for refreshing investor checks

Investor checks don’t stay valid forever. The AMLR sets maximum periods between updates: one year for higher-risk investors and five years for everyone else. Under the draft standards, existing investors must also be brought up to the new standard within those periods.

You will also need to recheck an investor promptly if they may have become a politically exposed person (PEP). A PEP is someone in a prominent public role, and the checks extend to their family members and close associates.

In practice, refreshing investor files becomes a regular, scheduled workload that grows with every investor you add.

When do the new EU AML rules apply?

There are two timeframes to plan around:

• The AMLR applies across the EU from 10 July 2027.
• AMLA sent its final draft of the technical standards to the EC on 1 October 2026. Once the EC adopts and publishes them, they will become the law, and six months later they start to apply, so the exact date is not fixed yet.

Depending on when the standards are adopted, they could apply before or after 10 July 2027. Either way, the final draft gives a clear picture of what is coming, so it makes sense to plan against it now.

Seven steps to get investor onboarding and ongoing monitoring ready for the new EU AML rules

1. Take stock of your investors. Group them by type (such as individual, company or trust), country and risk level.
2. Compare your forms with the new list. Check the information you collect against the draft standards and fill any gaps.
3. Choose how you will check identity. Decide with your compliance team which methods you will offer, and record your reasoning.
4. Recheck beneficial ownership. Recalculate it for corporate investors with layered ownership, using the 25%-or-more threshold.
5. Plan your refreshes. Schedule updates for existing investors, starting with those rated higher risk.
6. Review distributor arrangements. Make sure you can evidence how funds sold through intermediaries meet the conditions in the draft standards.
7. Make your records easy to show. Check that every request, document and decision is stored where your regulator can see it.

Throughout, involve your legal and compliance advisers, and check the final texts once they are published.

How Goji helps you meet the new standards

The Goji platform is a white-label platform that asset managers and fund administrators use to digitise and automate the investment process, from onboarding to reporting. It helps your team meet the new standards efficiently. Your firm stays responsible for its AML decisions, and your team reviews and approves each one.

Investor profiles on the Goji platform are given a risk rating and review schedule, and transactions for high-risk investors are held until the MLRO signs off.

How the Goji platform helps

Risk-based checks for every investor

Configurable rules apply your policies to each investor, setting their risk profile and the checklist of information and documents to collect, based on factors such as jurisdiction and entity type. Investors are screened and rated low, medium or high risk, and checked according to their entity type and risk level. High-risk investors can go to your money laundering reporting officer (MLRO) for sign-off, and no transactions happen until checks are complete.

Confirming identity

ID document checks for more than 200 countries. Selfie-to-ID facial matching and liveness checks confirm the investor is the person on the document, and you can apply them in line with your policies, for example to all remote onboarding or to higher-risk investors only. The evidence comes straight back to the platform.

Identifying beneficial owners

Company checks in more than 200 countries, covering incorporation details, group structure, beneficial owners and directors. Directors, shareholders and other related people sit on the investor’s profile. Authorised signatories are captured against the company and sent requests automatically, and information about associated companies is requested automatically.

The entity map shows who owns and controls a corporate investor, with ownership percentages traced through each layer of the structure.

Screening for PEPs and sanctions

Screening against LSEG World-Check at onboarding.

Keeping checks up to date

Reviews as often as every six months for high-risk investors, plus reviews triggered by watchlist hits, company register changes and country risk updates (at least quarterly).

Ongoing monitoring puts schedules reviews and triggered reviews, such as screening hits and company register changes, in one queue, sorted by risk level.

Reviewing and approving evidence

Your reviewers see all the identity checks and evidence on the platform and approve it there. That means no certified copies to chase, one step per signatory and all the evidence in one place.

Each related person has their own checklist, so reviewers can approve documents and chase any outstanding information from one screen.

Showing your regulator your work

Every request, document, message, note and decision is logged on the investor’s profile, so you can show your work without manual sample testing.

Every request, email, document, note and decision is time-stamped and logged against the investor's profile, ready to show your regulator.

Using AI to speed up onboarding while still meeting the new standards

AI can now take on the repetitive groundwork of onboarding, such as reading documents, pulling out data and mapping ownership structures. That frees your team to focus on higher-value tasks. The new rules allow this, but it’s important to ensure that people stay in control of the decisions that matter.

What the new rules say about AI

The AMLR lets firms use automated processes and AI systems in their AML checks, with conditions. The most important for onboarding is that key decisions, such as whether to accept an investor, must involve meaningful human intervention. Investors may also ask for an explanation of a decision and challenge it.

In practice, AI can prepare the work, but a person needs to review it and make the judgement call. You also need to maintain records showing how each decision was reached.

AI capabilities on the Goji platform

The Goji platform uses supervised AI, purpose-built for private fund operations, to take repetitive work off your team. This includes:

• Reading investor documents. When an investor uploads a document, AI can identify what it is, such as a passport or driving licence. It then extracts and validates the KYC data, ready for your team to review. Once approved, it can populate that data directly into the platform. That helps you collect the full set of information the new standards ask for, with fewer gaps to chase and less manual data entry.
• Mapping complex ownership structures. The AI processes KYC document packs, including ownership structure charts, and cross-references against public registries. It produces an entity map for your team to sign off, which helps when you need to trace beneficial owners through several layers.

The in-platform AI assistant helps your team start onboarding a new investor by uploading KYC documents or searching by company number, LEI code or company name.

Where your team stays in control

Every AI output goes to your team for review and approval before anything is committed to the investor’s record. High-risk investors still go to your MLRO for sign-off. Every review and decision is logged, so you can explain to an investor or your regulator how a decision was reached.

This human-in-the-loop approach is designed to support the AMLR’s requirement for meaningful human intervention. AI does the groundwork, and your team makes every decision.

Learn about our in-platform AI assistant by watching our short video.

Where to find the official texts

• The Anti-Money Laundering Regulation (AMLR), on EUR-Lex
• AMLA's final draft technical standards on customer due diligence
• AMLA's announcement of the final draft standards

Get your onboarding ready for 2027

Book a demo to see risk-based onboarding, ongoing monitoring and audit-ready records on the Goji platform.

This article is for general information only and isn't legal advice. The technical standards described are in draft and may change. Speak to your legal and compliance advisers about how the rules apply to your firm.