EU AML Package · AMLR · AMLD6 · AMLA

AML/CFT Programme Starter Kits

From 10 July 2027 the EU single rulebook applies directly in every Member State — and to a much wider circle of businesses than before. These starter kits give smaller obliged entities a documented, proportionate starting point instead of a blank page.

Choose your starter kit Is a kit right for you?

Last reviewed: 26 August 2026

Read this first

These starter kits are an editorial resource of FinancialCrime.lu. They are not official guidance, they are not endorsed, approved or validated by AMLA, the CSSF, the AED, the CAA, the CRF or any other competent authority, and they do not create a safe harbour.

Using a starter kit does not discharge you from your own obligations. Under Article 9 of Regulation (EU) 2024/1624 (AMLR) it is your internal control framework, approved by your management body, that must be commensurate to your nature, size, complexity and risk profile. The interpretation of the AMLR is ultimately a matter for the competent authorities and the Court of Justice of the European Union.

What a starter kit is

A starter kit is a complete, pre-drafted set of documents for one sector: a business-wide risk assessment, a set of AML/CFT policies and procedures, and the forms you need to run them day to day. You work through the kit once, replace every placeholder with facts about your own business, have the result approved by your management body, and from that moment the documents are your AML/CFT programme — no longer ours.

A kit does

give you a defensible structure that maps to the AMLR article by article;
set out the decisions you have to take, and the order to take them in;
provide worked sector examples of risk factors, red flags and escalation triggers;
keep the paperwork proportionate to a small, low-complexity business;
tell you what has changed when the law or supervisory expectations move.

A kit does not

constitute legal advice, or advice on your specific situation;
carry any supervisory approval, or shift responsibility away from you;
replace the judgement of your compliance officer and management body;
work if you adopt it unchanged — an untailored programme is a finding waiting to happen;
cover screening tools, identity verification providers, training delivery or monitoring software.

Why now

The AMLR is a regulation, not a directive: from 10 July 2027 it binds you directly, without national transposition, and it must already be implemented on the first day you provide a service in scope. It also widens the perimeter substantially — letting agents, dealers in high-value goods, crowdfunding platforms, non-bank credit intermediaries, non-financial mixed activity holding companies, investment migration operators and, later, professional football all become obliged entities ( ⚖ Article 3 ).

9 July 2024 — AML package in force AMLR, AMLD6 and the AMLA Regulation entered into force. Most obligations are deferred.
1 July 2025 — AMLA takes up its work The Authority for Anti-Money Laundering and Countering the Financing of Terrorism starts operating in Frankfurt.
10 July 2026 — AMLA guidelines due Deadline for AMLA guidelines on the minimum content of the business-wide risk assessment and on additional information sources.
10 July 2027 — AMLR applies The single rulebook becomes directly applicable and AMLD6 must be transposed. Your programme must be in place before you provide services in scope.
2028 — AMLA direct supervision AMLA is expected to begin direct supervision of a first group of selected obliged entities.
10 July 2029 — Football and deferred provisions Professional football clubs and football agents come into scope, together with certain deferred AMLD6 provisions.

If you are already an obliged entity — a bank, a fund manager, a notary, a domiciliation agent — you do not start from zero. Use a kit as a gap-analysis grid against your existing framework rather than as a replacement for it.

Is a starter kit right for you?

⚖ Article 9(1) requires an internal control framework that is commensurate to the nature and size of your business. That cuts both ways: a template can be adequate for a genuinely simple business, and plainly inadequate for a complex one. The kits are drafted for the first case only.

A kit is likely to fit if

you provide services in one sector only, and only in Luxembourg or one other Member State;
you have roughly 15 or fewer people involved in the business;
your clients are mostly natural persons or straightforward local entities;
you do not routinely deal with politically exposed persons, high-risk third countries or complex multi-layer ownership structures;
you are not part of a group subject to group-wide requirements ( ⚖ Article 16 ).

Take tailored advice instead if

you operate cross-border, through branches, or as part of a group;
trusts, fiducies, foundations or nominee arrangements are a normal part of your work;
you have material exposure to high-risk third countries or to sanctioned jurisdictions;
you rely on third parties or outsourcing for CDD ( ⚖ Article 18 );
you are, or expect to become, subject to AMLA direct supervision.

Each kit repeats these criteria in a binding form on its own Getting started page. If you do not meet them, the kit is not suitable and should not be used as a package.

Choose your starter kit

The register below follows the categories of obliged entity in ⚖ Article 3 , so you can check it against the Regulation itself. One kit per category, released in waves: kits marked in preparation are being drafted now, kits marked planned follow once the relevant AMLA guidelines and national supervisory designations are settled.