If you’re managing AML compliance in a UK-regulated business, the 5th AMLD changed the job in some very tangible ways – even after Brexit. The UK chose to align much of its AML regime with EU standards, meaning the ripple effects of the directive still impacted risk registers and onboarding processes.

One of the most immediate operational shifts came from the expansion of the regulated sector. If your business deals in virtual assets or offers digital wallets, you became subject to the same AML controls as traditional banks. That means customer due diligence (CDD), reporting obligations, training, and record-keeping – all with regulators watching closely.

You also had to review how you collect and verify beneficial ownership information. The directive gave a nudge (or more of a shove) toward checking corporate structures thoroughly and comparing customer-provided data against national registers. It became increasingly important to be able to show you’ve used information to assess risk and spot red flags early.

Beneficial ownership registers going public added another dimension to due diligence. It made information easier to access, but it also raised expectations. If data is available and you miss it, that’s no longer just a systems issue, it becomes a supervisory concern. Regulators expect you to make use of the tools now at your fingertips.

The increased focus on high-risk countries also shifted how enhanced due diligence (EDD) is applied. You need to be able to show more than just a policy template. What steps do you take when onboarding someone linked to a flagged jurisdiction? Is there an audit trail that shows a clear rationale for accepting or rejecting that business? And when FATF updates its list, is someone in your business responsible for updating internal controls and screening systems accordingly?

Then there’s the growing need for cross-border cooperation. The 5th AMLD encouraged more intelligence sharing across borders, which trickles down into your own expectations for compliance. When information requests come in from other jurisdictions, or when you need to make one yourself, the processes need to be in place and up to speed.

Finally, the directive’s broader scope also sharpened the focus on risk assessments. If your existing methodology was static or generic, you probably found that it no longer held up under scrutiny. Risk needs to be reviewed regularly, documented clearly, and based on evidence, not assumptions.