EU Beneficial Ownership Reporting: New Format Under the AML Package
The European Commission has published an implementing regulation that standardises the format in which beneficial ownership information must be reported across EU member states. Issued under the new EU anti-money laundering legislative package, the regulation is directly relevant to crypto-asset service providers (CASPs), corporate service providers, and any obliged entity subject to EU AML rules. For firms operating in Malta and across the bloc, this is not a distant policy signal: it is a binding technical specification that will determine how KYC data must be structured, stored, and transmitted to central registers.
What the Implementing Regulation Does
The EU's AML package, adopted over the course of recent years, overhauled the bloc's approach to combating financial crime. A central pillar of that package is the reform of beneficial ownership (BO) registers, including strengthened interconnection between national registers through the Business Registers Interconnection System (BRIS). An implementing regulation is a Commission-level instrument that fills in the operational detail of a higher-level legislative act. In this case, it prescribes the specific data format that obliged entities and competent authorities must use when reporting or exchanging beneficial ownership information.
The MFSA, Malta's financial services regulator, flagged the publication of this regulation on 30 October 2026, indicating its relevance to supervised entities on the island. Malta has long positioned itself as a key EU jurisdiction for crypto licensing, so the practical reach of this format change is significant for the CASP community registered there.
Key technical dimensions of the new format
While the full technical annexes are set out in the Commission's published text, the regulation addresses several dimensions that compliance and finance teams need to understand:
- A standardised data schema for identifying and describing beneficial owners, covering fields such as name, date of birth, nationality, country of residence, and the nature and extent of the ownership or control interest held.
- Requirements for how information is structured to enable cross-border data exchange between national registers via BRIS, supporting the interconnection objective of the AML package.
- Specification of the format in which updates to beneficial ownership records must be submitted, which affects the frequency and technical method of reporting by obliged entities.
- Rules on the accuracy and verification obligations that sit alongside the data format, reinforcing that the format change is not merely cosmetic but ties directly to the substantive KYC standard.
How this fits into the broader AML legislative architecture
The implementing regulation sits beneath the AML Regulation and the Sixth Anti-Money Laundering Directive (AMLD6), which together form the centrepiece of the EU's updated financial crime framework. The AML Regulation introduced a directly applicable set of rules for obliged entities, removing the need for member states to transpose certain provisions. The implementing regulation adds the operational layer: without a common data format, the political ambition of a genuinely interconnected BO register ecosystem across 27 member states cannot be realised in practice.
CASPs are explicitly included in the scope of the AML Regulation, meaning they face the same beneficial ownership reporting obligations as banks, investment firms, and other traditional obliged entities. This is a departure from earlier directives, where crypto businesses sometimes fell into ambiguous or transitional categories.
Implications for Accounting Firms, Auditors, and CFOs
For professionals advising EU-regulated entities or managing compliance for a CASP, the new format has concrete downstream effects on data management, audit trails, and the systems used to support compliance work.
Data architecture and crypto bookkeeping software
One of the less-discussed consequences of a standardised BO reporting format is the pressure it places on the internal data architecture of obliged entities. Beneficial ownership information is typically collected at onboarding and updated on a trigger or periodic basis. If that data is held in formats or structures that do not map cleanly to the new EU schema, firms face a data migration and validation exercise before they can report compliantly.
This is where crypto bookkeeping software and digital asset accounting software choices become relevant beyond pure ledger functions. Firms that have integrated their KYC data pipelines with their accounting and compliance platforms need to verify that the BO data fields their systems capture align with the Commission's prescribed schema. Where there are gaps, whether a missing data point or a field that exists under a different name, those need to be resolved at the system level, not patched manually at reporting time.
Accounting firms serving CASP clients should include a data-field mapping exercise as part of their next compliance review cycle. The question is simple but often overlooked: does the client's current KYC data capture every field required by the new format, in the right structure, and with a documented verification basis?
Audit and assurance considerations
Auditors of regulated entities will need to understand the new format when assessing the adequacy of AML controls. An audit finding that a client's BO register submissions are technically non-compliant with the implementing regulation, even if the underlying data is broadly accurate, could trigger supervisory scrutiny. This is particularly relevant in Malta, where the MFSA has emphasised its supervisory expectations for the quality and accuracy of BO information held by licensed entities.
From an assurance perspective, the standardised format also makes comparative testing more tractable. Auditors can now assess whether a client's submitted data conforms to a specific, publicly available schema rather than relying on a more interpretive assessment of what information "should" be included.
CFO and treasury-level considerations
For CFOs of groups with complex ownership structures, the new format may require revisiting how beneficial ownership is determined and documented at group level. The nature and extent of ownership or control interests must be expressed in a way that the prescribed schema can accommodate. Where a group has layered holding structures or ownership interests that sit close to the relevant thresholds, the format effectively demands precision that informal or narrative BO records cannot provide.
Groups with EU-regulated crypto entities should also consider whether the same BO information needs to be reported in multiple member states and, if so, whether the standardised format reduces or potentially multiplies the compliance workload depending on how current processes are organised.
Malta-Specific Context
The MFSA's decision to publish a dedicated notice on this implementing regulation reflects the regulator's approach of keeping its supervised population informed of EU-level developments as they land. Malta hosts a significant number of CASPs that were licensed under the Virtual Financial Assets Act before MiCA's transitional provisions came into force, and many of these firms are now navigating the MiCA authorisation process alongside the broader AML package obligations.
Interaction with MiCA and the AML Regulation
MiCA and the AML Regulation operate on parallel tracks but with significant points of intersection. MiCA sets out the conditions for authorisation and ongoing conduct of business for CASPs, while the AML Regulation governs their financial crime prevention obligations. The implementing regulation on BO reporting format falls squarely in the AML Regulation lane, but CASPs preparing their MiCA authorisation applications will find that regulators including the MFSA expect their AML frameworks to already reflect the current state of EU requirements. A firm that cannot demonstrate a BO reporting process aligned with the new format is likely to face questions during the authorisation assessment.
For compliance teams managing the dual workload of MiCA transition and AML package implementation, the practical advice is to treat the BO format update as a discrete workstream with a clear owner, a gap analysis output, and a remediation timeline. Bundling it into a general "AML compliance" project risks it receiving insufficient attention.
Practical Next Steps for Compliance and Finance Teams
Given that the implementing regulation is now published, the clock on preparation has started. The following steps reflect the immediate priorities for obliged entities and their advisers.
Immediate actions
- Obtain and review the full text of the implementing regulation, including any technical annexes, to understand the precise data schema required.
- Conduct a field-by-field mapping of current KYC data capture against the required schema, identifying gaps or mismatches.
- Engage with the relevant national register authority (in Malta, this falls under the Malta Business Registry for BO register submissions) to understand the timeline for adopting the new format at the register level.
- Review vendor contracts and system specifications for any crypto accounting software or KYC platform in use, to confirm whether format updates are included in the vendor's roadmap and within what timeframe.
- Update AML policies and procedures to reference the new format requirements, ensuring that the documentation trail is in place ahead of any supervisory review.
Teams looking for context on how AML enforcement trends are shaping compliance expectations will find useful background in our coverage of AML signals for compliance teams using crypto accounting software and the wider analysis of how the EU AML framework intersects with crypto bookkeeping software obligations.
Frequently Asked Questions
Who does the EU beneficial ownership implementing regulation apply to?
The regulation applies to all obliged entities under the EU AML Regulation, which includes credit institutions, financial institutions, and crypto-asset service providers authorised or operating within the EU. It also applies to competent authorities responsible for maintaining and exchanging beneficial ownership information through national registers.
What is the difference between the AML Regulation and an implementing regulation?
The AML Regulation is a primary legislative act adopted by the European Parliament and Council. It sets out the substantive obligations for obliged entities. An implementing regulation is issued by the European Commission to specify the operational detail of how those obligations are fulfilled in practice, such as the data format for reporting. Both are legally binding across all EU member states without the need for national transposition.
Does this affect crypto-asset service providers specifically?
Yes. CASPs are explicitly within the scope of the AML Regulation, and the implementing regulation on BO reporting format therefore applies to them in the same way it applies to banks and investment firms. CASPs must collect, maintain, and report beneficial ownership information in the prescribed format, and their internal systems need to support that requirement.
How should a firm's crypto accounting software be updated to reflect the new format?
Firms should first identify whether their current systems capture all the data fields specified in the new schema. Where fields are missing or are captured in a different structure, they need to work with their compliance, IT, and vendor teams to close those gaps. The format update is a data architecture question as much as a policy one, and it should be treated as a project with defined deliverables rather than a routine policy refresh.
What is the role of the MFSA in implementing this regulation?
As an implementing regulation, this instrument is directly applicable across the EU without needing MFSA to issue separate rules. However, the MFSA supervises compliance by its licensed entities and has signalled its awareness of the regulation by publishing a dedicated notice. Firms supervised by the MFSA should expect this to form part of the AML supervisory framework against which they are assessed, and should engage with the MFSA's guidance as it is issued.