A 90-day AMLR action plan you can start this week

Ninety days will not finish the job, but it will tell you how big the job is. With the AMLR applying from 10 July 2027, starting now leaves roughly nine months of runway. This plan assumes a small to mid-size obliged entity with one compliance officer.

Days 1 to 30: find the gaps

• Confirm scope. Check Article 3 against what you really do (who must comply). Output: a one-page scope memo.
• Run the readiness checklist. Use the 12-point list. Output: red, amber, green by item.
• Sample 30 customer files, weighted to higher risk. Test each against Article 20 (CDD) and Articles 51 and 52 (beneficial owners). Output: a count of how many you could defend.
• Brief the board. The management body has to name a compliance manager under Article 11. Better they hear it from you in month one.

Days 31 to 60: fix the foundation

• Rewrite the business-wide risk assessment against Article 10, using the AMLA guidelines once final (see AMLA). The compliance officer drafts, management approves.
• Update policies and procedures to match Article 9, in particular outsourcing, reliance, record keeping and sanctions.
• Decide on remediation. From the file sample, estimate how many customers need fresh documents, and choose a method: ask at next contact, ask by campaign, or exit.
• Check systems. Can your tools store unredacted records (Article 77) and show beneficial ownership chains with the multiplication the Regulation requires?

Days 61 to 90: build evidence

• Train staff under Article 12, roles first, then everyone else. Keep attendance and content.
• Test the reporting path with a mock suspicion.
• Start remediation on the highest risk customers.
• Set a monitoring calendar: the transposition law in your country, AMLA final texts, supervisor guidance (in Malta, the FIAU).
• Report to the board on progress, budget and open risks.

A realistic note

The slippage always happens in the middle phase. Policies get rewritten, but nobody owns remediation. Give it a named owner and a weekly number: files remediated.

See also what is the AMLR if colleagues need the background first.

What this means for you

If you cannot spare the time internally, we can take on parts of this, usually the file sample and the remediation tracker. Describe your set-up in the enquiry form and we will say what we would scope.

General information, not legal advice.

Talk to an expert