AMLR 2027

AMLR 2027 readiness checklist

Twelve checks, tied to the articles of the Regulation, to run before 10 July 2027.

Talk to an expert
AMLR 2027 readiness checklist

Use this as a gap analysis. For each line, answer “yes, and I can show the evidence” or “no”. A supervisor will ask for the evidence, not your confidence. The article references are to Regulation (EU) 2024/1624.

Governance

  1. Compliance manager named. A member of the management body must be responsible for compliance, and you must also have a compliance officer with enough standing to do the job (Article 11). In a small firm one person can hold both roles where size and risk justify it (Article 11(7)).
  2. Policies, procedures and controls cover the AMLR scope. Article 9 lists what they must include: the risk assessment, CDD, suspicious transaction reporting, outsourcing and reliance, record keeping and data protection, among others.
  3. Reporting line works. The compliance officer must be able to report to the management body directly and independently (Article 11(5)). Check the board minutes show that actually happening.
  4. Staff awareness and training. Ongoing programmes appropriate to each role, including agents and distributors where they do the work (Article 12).

Risk assessment

  1. Business-wide risk assessment is documented and current. It has to be drawn up by the compliance officer, approved by management and kept up to date (Article 10). New products, channels and customer segments need a risk look before launch.
  2. You have read the AMLA guidelines on its content. Article 10(4) required AMLA to issue them by 10 July 2026; AMLA opened a consultation on the draft in April 2026, and it ran until 15 July 2026, after the statutory date (see the FIAU’s summary). Check the AMLA website to see whether a final text has been published.

Customer due diligence

  1. CDD triggers match Article 19. Business relationship, occasional transaction of at least EUR 10,000, suspicion, doubts about earlier data. Know the special thresholds: EUR 1,000 for crypto-asset service providers, EUR 2,000 for gambling providers, and the EUR 3,000 cash rule in Article 19(4).
  2. Beneficial ownership method is written down. The 25% ownership test and the separate control test sit in Articles 51 and 52. Indirect holdings are multiplied through the chain. Check your onboarding form actually asks the questions.
  3. Ongoing monitoring is evidenced. Article 20(1)(f) requires it and Article 26 sets the detail. Article 26(2) caps the gap between updates of customer information at 1 year for higher-risk customers and 5 years for everyone else. Plan how you will refresh older customer files, because that is where the workload sits.

Records and reporting

  1. Record retention. Copies of CDD material, suspicion assessments and supporting evidence, not redacted (Article 77).
  2. Suspicion reporting route is tested. The compliance officer reports to the FIU (Article 11(2) and Article 69). Run a mock case through the process.
  3. Cash and high-value goods. Dealers check the EUR 10,000 cash limit (Article 80) and any lower national limit. Motor vehicle dealers note the reporting threshold of EUR 250,000 in Article 74.

Practitioner note

Items 8 and 9 are where firms get stuck. A policy can be rewritten in a fortnight; 2,000 customer files cannot. If you only have time to do one thing in the next quarter, sample 30 files and see how many you could defend under the new rules.

Continue with the 90-day action plan or check who must comply.

What this means for you

If the sample shows more gaps than you expected, that is common and it can be fixed. Send us the numbers through the enquiry form and we will tell you where we would start.

General information, not legal advice.

Talk to an expert