Countdown to the AMLR: Time to act!

The Anti-Money Laundering Authority (AMLA) has edged closer from consultation to delivery. The AMLR (Regulation (EU) 2024/1624) sets the obligations, while regulatory technical standards (RTSs) and implementing technical standards (ITSs) explain how to meet them. On 30 September 2026, AMLA published final draft RTSs on customer due diligence (CDD), criteria for identifying business relationships and occasional or linked transactions, and group-wide requirements, for adoption by the European Commission. Alongside other RTS, ITSs and guidelines, which are expected to be published in the coming months, these measures will shape how obliged entities operate and evidence compliance.

Obliged entities should now shift from understanding the changes to planning their implementation.

Gap Analysis: The Foundation of Readiness

AMLR readiness starts with a gap analysis: comparing existing AML/CFT frameworks, systems and controls with the new requirements to identify shortcomings and plan remediation. Although some RTSs, ITSs and guidelines remain unpublished, enough material is available to start this assessment now.

The findings of the gap analysis should be translated into action through:

• Organisation. Determining the manner in which the firm intends to remediate any shortcomings – whether remediating based on distinct processes, on the publication of final published RTSs, by risk priority, or through a single integrated programme.
• Accountability. Having a named owner and deadline for each gap identified.
• Reporting to the management body. Regular progress and residual-risk reporting thereby being able to demonstrates effective oversight.

With approximately 8 months until the AMLR becomes applicable, some obliged entities may not have all the necessary frameworks, systems and controls in place in time. This creates regulatory risk, which obliged entities should manage and mitigate as effectively as possible. Documenting the steps taken to align the obliged entity’s framework with the new rules will enable a firm that is not fully aligned by the deadline to evidence its best efforts to comply.

By completing the initial gap analysis at this stage obliged entities would be able to prioritise resources, address implementation risks, transition smoothly and reduce regulatory risk.

Data Readiness: Reporting and Supervisory Risk Assessment

The AMLR and RTSs require obliged entities to collect, maintain and report specified information for suspicious transaction reporting, customer due diligence and beneficial ownership, supervisory risk assessments and other notifications. More data does not necessarily mean better customer due diligence. Such data needs to be used in a manner which informs the customers profile and behaviour. Supervisors will increasingly assess AML/CFT risk using standardised data on customers, products and services, geographies, distribution channels and control effectiveness. Obliged entities should therefore be able to produce accurate, consistent information on demand whilst showing that such information is being used in an effective manner to profile customers and monitor their activities.

Obliged entities should therefore consider:

• Mapping data. Identify required data points (including gaps), their location and responsible owners.
• Adopting a proportionate approach. Identifying mandatory data and ensuring that such data is collected, retained and analysed (as need be), whilst creating a risk-based framework on how and when additional data is required to be obtained.
• Ensuring consistency. Align supervisory, risk and management reporting through common definitions and ownership.
• Evidencing effectiveness. Retain reliable records and metrics showing how data is used, and how controls perform in practice.
• Integrating systems. Where possible, connect relevant systems and sources to support dependable reporting.

Customer Due Diligence, Business Relationships and Occasional Transactions: Getting Day One Right

Two final draft RTSs will shape how obliged entities conduct customer due diligence, from initial onboarding through to ongoing monitoring. The first, the CDD RTS under Article 28(1), specifies the information required for standard, simplified and enhanced due diligence. The second, the RTS under Article 19(9), sets criteria for distinguishing business relationships from occasional transactions and identifying linked transactions. In this respect, obliged entities should:

• Document classification decisions. Define how business relationships, occasional transactions and linked transactions are identified.
• Analyse CDD data gaps. Compare current onboarding data, documents and on-boarding processes with the CDD RTS.
• Strengthen beneficial ownership assessments. Review how ownership and control are identified and verified, especially in complex structures.
• Review refresh triggers. Ensure trigger events prompt timely review or updating of customer information.
• Embed requirements through organisational changes. Update policies, procedures, systems, on-boarding forms and ensure that training is provided to align staff knowledge and understanding with new requirements.

Technological Impact of E-Identification Requirements

The CDD RTS makes identity documents, and eIDAS electronic identification or qualified trust services the default verification methods. Other remote methods remain possible only as justified fallbacks with appropriate safeguards. Onboarding platforms and providers may need to receive, validate and securely store eID data and demonstrate that remote solutions work. Within this context, obliged entities should:

• Engage with vendors. Vendors should be able to support new on-boarding methods as required by the AMLR. Any shortcomings in the on-boarding process remain the responsibility of the obliged entity.
• Review current methods. Test document upload, biometric matching and video identification against the final draft RTS safeguards.
• Set a risk-based fallback. Define when alternatives may be used, required safeguards, escalation and recordkeeping.
• Test before go-live. Test eID, document and fallback routes, including failures and manual referrals, and retain evidence of such testing.

Compliance with the Group-Wide RTS

Group-wide controls extend beyond formally consolidated groups. Under Articles 16 and 17 of the AMLR and the draft RTS on group-wide requirements and third-country branches and subsidiaries, they may also cover networks, partnerships and franchises sharing ownership, management or compliance control. Entities should:

• Confirm scope. Map the group and any controlled network, partnership or franchise, including branches and third-country entities. Referral, branding or tool-sharing alone is out of scope.
• Identify the parent undertaking responsible for group-wide policies. Such assessment is required both for EU and non-EU headquartered groups, although the requirements and criteria differ.
• Build the framework. Where applicable, establish a group-wide risk assessment, approved policies and procedures, and clear reporting lines.
• Enable information sharing. Define need-to-know exchanges, secure channels, records and data-protection safeguards.
• Manage third-country impediments. If local law prevents compliance, notify the supervisor within 28 calendar days, seek consent where possible and apply proportionate additional measures.

Not Just Rules: The AMLR is also an opportunity

Treating the AMLR purely as a compliance exercise risks missing its wider strategic value. Obliged entities that approach this as a chance to redesign, rather than merely patch, can build onboarding journeys that are faster, more consistent and less dependent on manual intervention, particularly where eID-based verification and integrated systems replace fragmented processes. Better-structured data also supports sharper customer insight, more meaningful risk-based decisions, better monitoring and more credible engagement with supervisors. Group-wide frameworks can reduce duplication across jurisdictions, while clear ownership and management reporting strengthen governance, accountability and board-level oversight. These improvements carry commercial benefits: fewer onboarding delays, lower remediation costs, and stronger reputational standing with clients, banks and regulators who increasingly expect demonstrable AML/CFT maturity.

Entities that embed these requirements into their operating model, rather than layering them on top, will be better placed to win and retain business in a more demanding market. The AMLR therefore ultimately invites a choice: comply at the minimum level required or use the change to do business in a more efficient, transparent and resilient manner.

The Road to Implementation

While some details are still being finalised, the overall direction is clear. Starting early gives organisations the breathing room to identify gaps, make the right changes and test what works well ahead of 10 July 2027. The coming months will test the obliged entity’s culture and will clearly distinguish between those obliged entities which treat AML/CFT compliance as a policy update, and those which treat AML/CFT compliance as an integral part of how they do business.

For further information on the AMLR requirements or how such measures will impact subject persons, kindly contact Mario Zerafa (mzerafa@ganado.com) or Ruth Esposito (resposito@ganado.com)