Compliance and risk teams don't need another acronym-heavy regulatory summary — what's actually useful is understanding the direction these changes are pushing in, and what that direction means for how a KYB or AML program needs to be built, not just what box it needs to tick. This piece is organized around that: not a list of rules, but the shape of where the rules are heading.
The EU: AMLR and AMLD6 push toward continuous, not periodic
The EU's new Anti-Money Laundering Regulation (AMLR) and the sixth AML Directive (AMLD6) both move the regulatory expectation away from a single onboarding gate and toward demonstrable, ongoing awareness of counterparty risk. The direct implication for compliance programs is that a periodic review schedule — even a reasonably frequent one — is being asked to justify itself against a standard of continuous monitoring, not just "we review regularly." The practical question shifts from "how often do you check" to "how current is what you know, at any given moment."
What "continuous" actually requires, structurally
Meeting a continuous-monitoring expectation with a manual process means either a much larger analyst team or accepting real gaps in coverage — the two options most programs have historically had to choose between. This is precisely the gap that agentic, automated investigation is positioned to close: not by working faster at the same process, but by making genuinely continuous monitoring of a full portfolio operationally realistic rather than a resourcing fantasy.
FATF guidance: the beneficial ownership thread
FATF's ongoing guidance on beneficial ownership transparency continues to tighten expectations around UBO identification — not just capturing a UBO declaration at onboarding, but maintaining an accurate, current picture as ownership structures change. This connects directly to the network-visibility point made elsewhere in our writing: beneficial ownership is fundamentally a graph question (who ultimately controls this entity, through how many intermediate layers), and a compliance program that treats it as a one-time form field is structurally behind where guidance is heading.
CSDDD and the widening scope of "who you're responsible for"
The EU's Corporate Sustainability Due Diligence Directive (CSDDD) extends due-diligence obligations into supply chains and business relationships in a way that pushes counterparty risk management beyond its traditional financial-services core. Procurement, vendor management, and supply-chain functions are increasingly being asked to do a version of the same counterparty due diligence that's long been standard in financial services — which means the tooling gap (manual, point-in-time checks that don't scale) is showing up in functions that haven't historically had to deal with it.
UFLPA and sanctions-adjacent supply chain screening
The U.S. Uyghur Forced Labor Prevention Act (UFLPA) and similar supply-chain-focused enforcement push the same pattern into trade and procurement: due diligence obligations that used to apply narrowly to direct sanctions screening now extend into multi-tier supply chain relationships, where the entity you're directly contracting with may be several steps removed from the actual risk. Again, this is a network problem dressed up as a compliance requirement — you can't assess multi-tier supply chain risk by checking only your direct counterparty.
The common thread across all of this
Read individually, AMLR, AMLD6, FATF guidance, CSDDD, and UFLPA look like separate regulatory tracks affecting different teams. Read together, they're pointing in the same direction: from point-in-time to continuous, from single-entity to network-aware, and from narrowly-scoped (financial services only) to broadly-scoped (procurement, supply chain, and partnerships too). A compliance function built around periodic, single-entity, financial-services-only checks is going to find itself increasingly out of step with where enforcement and guidance are both heading — not because any single rule changed overnight, but because the cumulative direction is clear.
What this means in practice
None of this means every team needs to rebuild its program overnight in response to a specific new rule. It does mean that when evaluating or building compliance tooling going forward, "does this scale to continuous, network-aware monitoring across the relationships that actually matter to us" is a more useful question than "does this satisfy today's specific checklist" — because the checklist is visibly moving, and the direction it's moving in is consistent across every jurisdiction and regulation covered here.
This is a general summary of publicly available regulatory developments, not legal advice. Consult counsel for how these changes apply to your specific program.