AML Regulation 10.7.2027 | How the New EU Regulation Changes Corporate Obligations

Key Highlights

Government Proposal HE 105/2026 vp was submitted to Parliament on June 4, 2026, and is currently under committee review. The acts have not been enacted, and their content may still change. However, the EU Anti-Money Laundering Regulation is already in force.

What is Changing and When?

In the background is a legislative package replacing the entirety of EU AML regulation: the Anti-Money Laundering Regulation (AMLR), the Sixth Anti-Money Laundering Directive (AMLD6), the AMLA Regulation establishing a new supervisory authority, and amendments to the Financial Information Directive.

In Finland, the reform is executed by enacting an entirely new Anti-Money Laundering Act that repeals the existing one. Concurrently, over 30 other acts will be amended. National discretion has been used sparingly, as the primary obligations stem directly from the EU Regulation.

The implementation schedule proceeds in four main phases:

Why the Act is Being Replaced by a Regulation – and What It Means in Practice

Until now, AML regulation relied on directives transposed into national legislation. Going forward, substantive requirements—customer due diligence, internal policies, risk assessments, and reporting obligations—will be set out in a directly applicable EU Regulation.

The new national Anti-Money Laundering Act will remain to govern areas left to national discretion: the national risk assessment, beneficial ownership registers, supervisory powers, and administrative sanctions. Several familiar provisions in sectoral laws will be repealed—such as customer due diligence provisions in the Payment Institutions Act, Investment Services Act, and Act on the Book-Entry System.

The practical consequence is clear: references to national AML legislation in internal company policies will mostly point to repealed provisions after July 10, 2027. Furthermore, the Regulation will be interpreted through EU law rather than national legislative history, with significant technical detail determined by AMLA’s technical standards and guidelines throughout 2026–2027—some arriving after application has already begun. Compliance frameworks must therefore be designed as continuously evolving processes rather than one-off projects.

Who Will Be an Obliged Entity Going Forward?

The scope of obliged entities will be governed directly by the EU AML Regulation, bringing changes in both directions.

Brought into scope: Crowdfunding service providers and intermediaries, certain mortgage and consumer credit intermediaries, traders in high-value goods, precious metals, gems, and cultural goods, non-financial mixed holding companies, intermediaries involved in investor residence schemes, and additional real estate professionals—including rental transactions where monthly rent equals or exceeds 10,000 euros.

Removed from scope: General traders in goods due to the new general cash threshold, as well as non-life insurance companies (34 entities in Finland) and employment pension insurance companies (4 entities). In the insurance sector, scope will be restricted strictly to life insurance and investment-related activities. While administrative burdens for non-life insurers are estimated to decrease by approximately 0.7 million euros annually, customer identification and sanctions compliance will remain largely unchanged in practice.

Group structures should review these boundaries carefully, as a single corporate group may contain entities both added to and removed from the scope.

Beneficial Owners: The 25% Threshold Lowers

This change impacts ordinary Finnish companies most broadly, including those that are not obliged entities themselves.

Under the 4th AML Directive, ownership-based beneficial ownership required an interest of more than 25%. Under Article 52 of the AML Regulation, the threshold shifts to at least 25% of shares, voting rights, or other ownership interests, including rights to profits or liquidation proceeds. An exact 25% stake will therefore constitute beneficial ownership. In indirect structures, ownership percentages are calculated by multiplying chain interests and aggregating distinct chains.

Additionally, the European Commission may establish a lower threshold of up to 15% for high-risk sectors via delegated acts, introducing the possibility of parallel threshold standards.

The required registration data is also expanding: entities must collect full names, date and place of birth, residential address, country of residence, citizenship, identity document number, personal identification number (if applicable), and descriptions of the source of information for all beneficial owners.

Finland will establish a dedicated beneficial ownership register maintained by the Patent and Registration Office (PRH). Access will be granted to authorities, obliged entities for customer due diligence, and parties demonstrating a legitimate interest (such as journalists and non-governmental organizations). Statutory assumptions aimed at reducing administrative burden will remain for associations, foundations, religious communities, and housing companies.

Obliged entities will be legally required to report discrepancies between registered information and their own due diligence findings. Inaccurate beneficial ownership records will not remain mere administrative oversights—they will trigger inquiries and delay banking relationships or financing transactions. Shareholder agreements, option arrangements, voting rights differentials, and holding structures should be reviewed against the new threshold well before registration changes and the Regulation take effect.

Cash Payments Exceeding 10,000 Euros Prohibited for All Businesses

Article 80 of the AML Regulation prohibits cash payments exceeding 10,000 euros for goods and services. The restriction applies universally to all commercial sellers and service providers—not just obliged entities—and operates in both directions: businesses may neither accept nor make cash payments exceeding this amount. Linked transactions are aggregated, preventing circumvention through installment splitting.

Transactions between private individuals acting in a non-professional capacity remain exempt, as do certain payments and deposits made at credit institution premises. Member States were permitted to introduce lower national limits, but Finland has not proposed a lower cap.

This is the single provision directly affecting virtually every business regardless of sector. Cash handling procedures, commercial terms, and point-of-sale configurations should be reviewed immediately—particularly in automotive sales, machinery, construction, and luxury goods trade.

Who Holds Responsibility? Designation of a Compliance Executive

The AML Regulation explicitly elevates compliance responsibility to senior management level.

Obliged entities must designate a member of the management body responsible for ensuring compliance. In Finland, the Government Proposal clarifies that this refers to executive management—the Managing Director and executives directly reporting to senior leadership (a definition the proposal acknowledges as open to interpretation).

The compliance officer prepares the entity-wide risk assessment, but senior management must formally approve it. The risk assessment must be kept up to date and provided to supervisory authorities upon request. Introducing new products, distribution channels, technologies, or customer categories requires a dedicated risk assessment prior to launch.

Outsourcing functions remains permissible provided advance notification is given to supervisors, though full regulatory responsibility stays with the obliged entity. However, outsourcing is strictly prohibited for approving risk assessments, adopting internal policies, confirming customer risk profiles, deciding on business relationship onboardings, and submitting suspicious activity reports to the Financial Intelligence Unit (FIU).

Boards and executive management must be capable of demonstrating formal review and approval of the organization's risk profile. This is primarily a documentation challenge: formal board minutes, decision templates, and regular monitoring reports should be prepared well in advance.

What Are the Costs of Non-Compliance?

Administrative sanctions will continue to include administrative fines, penalty fees, periodic penalty payments, and public warnings, but maximum fine caps are increasing significantly.

• Financial sanctions must equal at least twice the economic benefit derived from the breach or at least 1,000,000 euros, whichever is higher.
• For credit and financial institutions, maximum penalties for legal persons reach at least 10,000,000 euros or 10% of annual global turnover—doubling the previous statutory euro-denominated ceiling. For natural persons, sanctions can reach up to 5,000,000 euros.
• The limitation period for continuing breaches extends from 5 years to 10 years. FATF had repeatedly identified Finland’s 5-year limit as a regulatory weakness.

A longer limitation period combined with higher financial penalties fundamentally shifts liability risks in M&A transactions: regulatory due diligence will now need to review AML compliance histories extending back ten years, impacting representations, warranties, and indemnity structures.

Actionable Steps for Businesses

Although the national Government Proposal remains under parliamentary review, the text of the EU Regulation is finalized. Preparations should not be delayed.

• Determine whether your company or group entities fall within the scope of obliged entities under the new definitions.
• Re-run beneficial ownership calculations using the "at least 25%" threshold, incorporating indirect chains.
• Ensure current Trade Register records reflect accurate beneficial ownership ahead of the July 10, 2026 deadline.
• Designate a compliance officer within executive management and formalize roles within governance frameworks.
• Update corporate risk assessments and submit them to executive management for formal approval.
• Review existing outsourcing agreements against new statutory restrictions.
• Adjust cash intake policies and commercial contract terms to comply with the 10,000 euro limit.
• Update internal policies, replacing references to national acts with the corresponding EU Regulation provisions.

Frequently Asked Questions

Is the new Anti-Money Laundering Act already in force? No. Government Proposal HE 105/2026 vp was submitted to Parliament on June 4, 2026, and is undergoing committee review. The national acts are not yet passed. However, the EU Anti-Money Laundering Regulation is already enacted and will apply directly from July 10, 2027, regardless of national legislative timelines.

When does the new AML framework take effect? The majority of provisions and the direct application of the EU AML Regulation begin on July 10, 2027. National provisions concerning beneficial ownership registers take effect earlier, on July 10, 2026. Rules targeting football agents and professional football clubs will apply from July 10, 2029.

Our business is not an obliged entity. Are we affected? Yes, in two main ways. The ban on cash payments exceeding 10,000 euros applies to all commercial sellers of goods and services. Furthermore, general corporate obligations regarding beneficial ownership transparency affect corporate entities broadly, and banks or obliged counterparties will require this data under stricter rules.

Is the 25% beneficial ownership threshold changing? Yes. The previous threshold required owning more than 25%, whereas the new threshold is set at at least 25%. An exact 25% holding will now trigger beneficial ownership status. Additionally, the European Commission may lower this to 15% in high-risk sectors.

Can a business accept a cash payment exceeding 10,000 euros? No. The prohibition covers both accepting and making cash payments exceeding 10,000 euros for commercial goods and services, including linked payments. Transactions between private individuals acting outside a business context are excluded.

Can AML compliance functions be outsourced? Most operational tasks can be outsourced following prior notice to supervisory authorities, though legal responsibility remains entirely with the obliged entity. However, key governance duties—such as approving risk assessments, adopting internal policies, approving customer risk profiles, onboarding decisions, and submitting suspicious activity reports—cannot be outsourced.

Are non-life insurers excluded from AML scope? Under the proposed national draft, non-life insurance companies are removed from the scope of obliged entities under the national act because mandatory EU scope is limited to life and investment-related insurance. However, general customer identification and sanctions compliance standards continue to apply in practice.

What happens if our registered beneficial ownership data is inaccurate? Obliged entities are legally required to report discrepancies between register records and their own findings to the authorities. Incorrect records can result in administrative sanctions and practical disruptions, such as delayed banking onboarding or blocked financial transactions.

How LKOS Law Office Can Assist

We assist corporations with regulatory scope assessments, beneficial ownership reviews, drafting risk assessments and compliance policies, and managing communications with supervisory authorities—ranging from corporate structure reviews to governance documentation and outsourcing terms.

Learn more about our practice and legal services at Corporate Law & Business Counsel and Our Services.

This article was prepared based on information available as of August 21, 2026. It provides a general legal overview of pending regulatory changes and does not constitute formal legal advice for specific matters.