8 months before the AMLR, 1 in 3 companies still quote rules that no longer exist

Who the AMLR covers, and what we read

The AMLR reaches far beyond banks. It covers anyone who moves, holds or advises on other people’s money or high-value assets: payment companies, fund managers, insurers, accountants, lawyers and notaries, company formation agents, crypto and crowdfunding platforms, gambling operators, estate agents, gold, art and luxury goods dealers, and from July 2029 football clubs and agents. Our 240 companies span most of these groups.

We only read what anyone can read: privacy notices, terms, complaint pages and client guides. Internal AML work such as risk assessments stays behind closed doors, so we left it out.

What the AMLR changes in your public documents

Today every EU country has its own AML law. On 10 July 2027 that changes, when a single regulation takes over in all of them at once. Any public text that quotes the national rules will be out of date from that day. Six of the changes will be visible to customers, and in each case we already found texts that fall short today.

What changes	What we found today	What to update
The AMLR replaces the national AML law.	What we found today 20 of 43 privacy notices that describe AML checks give the wrong legal reason or quote the wrong law.	What to update Every mention of the national AML law in privacy notices, terms and onboarding guides.
Anyone with 25% or more of the shares or votes, or who controls the company in another way, counts as an owner.	What we found today One client guide still says only “more than 25% of the shares”.	What to update Onboarding guides and forms.
AML records are kept for 5 years after the customer relationship ends, everywhere in the EU.	What we found today 14 of 49 notices give no clear time for AML records, or two different ones.	What to update The retention section of the privacy notice.
More people count as politically exposed, including heads of regions and cities with 50,000 or more inhabitants.	What we found today 9 companies describe their PEP checks unclearly or too narrowly.	What to update The PEP section of the privacy notice and the KYC form.
No cash payments of €10,000 or more for goods and services.	What we found today One precious-metals dealer still describes cash checks under the old national rules.	What to update Terms of sale.
Crypto providers are fully covered. Football clubs and agents follow from July 2029.	What we found today Two crypto providers still call themselves “registered” after getting a MiCA licence.	What to update Licence text and imprint.

What we found

Each figure is based only on the companies where we could check that particular point, so the totals differ.

35%

35% Still quote rules that no longer exist

This was the finding that surprised us most. Seventeen companies name a data protection authority by a title it no longer uses. Fifteen rely on a data transfer agreement struck down in 2020. Eleven still send customers to an EU complaints platform that shut in July 2025.

49%

49% Never say which data the law requires

Many of the privacy notices we read list the documents a customer has to hand over: passport, proof of ownership, source of funds. Half of them never say that the law requires it, or that the company cannot take the customer on without it. In 39 cases this sits right next to a description of the company’s own identity checks.

47%

47% Give the wrong legal basis for their AML checks

Where a privacy notice explains the AML checks, nearly half get the legal basis wrong. Some say the checks rest on consent or on the company’s own interest. Others quote the wrong law, with the wrong date or a chapter number that belongs to a different act.

Smaller companies are hit harder

A wealth manager with 20 staff, an accounting firm or an estate agent also has to prepare for the AMLR. The deadline is the same as for a bank, but the resources are very different.

A bank has a compliance department and a budget for the work. A small firm may have one person who also runs the business, working with documents inherited from templates or a law firm years ago. Reviewing them takes time away from clients, so it is easy to put off until a client or supervisor asks a question.

Three cases

These three cases from our review show the gaps we found and how the wording could be changed to address them.

Cause	Gap found	Proposed fix
The AML text and the accounting text were written separately and pasted together.	Gap found A Luxembourg accounting firm’s notice keeps AML identification data for at most five years after the relationship ends, then says the same data is kept ten years to match accounting rules.	Proposed fix “We keep identification and due-diligence records for five years after the business relationship ends, as the AML law requires, and then delete them. Accounting records are kept for ten years.” RuleGDPR Art. 13(2)(a) · Law of 12 November 2004, Art. 3(6)
A generic “data is optional” clause survived into a KYC notice.	Gap found A Nordic payment institution’s notice says giving personal data is always voluntary. An earlier clause says the AML law may require it, which it does for every merchant it onboards.	Proposed fix “To open a merchant account you must give us the identity and ownership information the anti-money laundering law requires. Without it we cannot onboard you. Marketing preferences are optional.” RuleGDPR Art. 13(2)(e)
The licence changed and the privacy policy did not.	Gap found An Austrian crypto-asset provider’s policy, dated this autumn, calls it a registered provider. It has held a MiCA authorisation since late 2025, and its own terms already say licensed.	Proposed fix “[Company] is authorised as a crypto-asset service provider under Regulation (EU) 2023/1114 (MiCA) by the Austrian Financial Market Authority (FMA).” RuleMiCA Art. 66(2)

How Hybridity helps

Hybridity helps you keep public documents aligned with the rules that apply to your business. It links policy requirements to their legal sources, flags gaps and turns them into tasks with owners, due dates and drafted fixes. Your team reviews the wording and records evidence when the updated documents are published.

See the update in action

1. 01Snapshot

   Every public document is checked against the new rules, and each place that cites the old act, the old record-keeping period or the old beneficial-ownership test is flagged.

   Documents that still cite the old AML act are flagged.

2. 02Rulebook

   Each policy is broken into rules traced to the legal source. The customer due diligence rule is linked to the privacy notice, the client onboarding guide and the terms.

   The customer due diligence rule is linked to each affected document.

3. 03Tasks

   Each flagged document gets an owner, a due date and a drafted fix. The owner approves the wording and uploads the published version as evidence.

   An owner reviews the new wording and records evidence after publication.

4. 04Monitoring

   When the EU Anti-Money Laundering Authority (AMLA) publishes new technical standards or a national rule changes, the documents affected are flagged again.

   New technical standards flag affected documents for review.