AMLR, the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624), applies from 10 July 2027. Our earlier articles cover what it is and the eight big changes it introduces. This one is narrower. It asks what changes in the week of a compliance team: the reviews that come due, the questions asked at onboarding, the ownership work, the screening runs, the monitoring alerts, the sign-offs, and the identity checks.
For each routine we describe how it works today in a typical obliged entity, what AMLR requires instead, what AMLA’s final draft technical standards propose in addition, and which details remain subject to adoption. Throughout, we try to keep two things apart: what is fixed in the regulation text, which applies from July 2027 regardless, and what sits in standards and guidelines that are final drafts or not yet published. The second group shapes how you implement the first. It does not suspend it.
Key takeaways
Customer information updates get a legal deadline: customer information must be updated at least once a year for customers subject to enhanced due diligence measures, and at least every five years for all other customers. Risk-based policies and event-driven triggers may require earlier updates. The transitional timetable for existing customers depends on when AMLA’s adopted customer due diligence standard enters into force.
Onboarding becomes more structured: understanding the purpose and intended nature of the relationship is a standard due diligence requirement. Expected activity and information on the source and destination of funds are collected where necessary, at a level appropriate to the customer’s circumstances and risk.
Ownership checks go deeper: beneficial ownership is assessed through the ownership chain, using an ownership threshold of 25 percent or more and the accumulation rules, while control is assessed separately and in parallel. The central register remains a source of information, not the sole basis for establishing beneficial ownership.
Targeted financial sanctions screening gets explicit triggers: the final draft customer due diligence standard specifies screening at onboarding, after relevant changes, and at regular intervals. Those detailed provisions remain subject to adoption by the European Commission.
Governance becomes explicit: AMLR establishes compliance officer and compliance manager responsibilities, management body approval of policies and the business-wide risk assessment, and employee training and integrity requirements.
Preparation can start now: implement what AMLR itself establishes and prepare for the final standards and guidelines. Pending guidance may shape implementation, but it does not postpone obligations the regulation already sets.
Note: This article reflects AMLR as enacted and the regulatory technical standards AMLA finalised on 1 October 2026. Those standards are final drafts until the European Commission adopts them and they are published in the Official Journal. Under AMLA’s draft, the standards would generally apply six months after entry into force (Art. 29 RTS); the final commencement and transitional provisions depend on the adopted text. AMLA’s guidelines on ongoing monitoring and on the business-wide risk assessment were still pending when this article was written; check their status before relying on any detail that depends on them. This is a practical overview, not legal advice.
1. Customer information updates: the calendar gets a legal deadline
Today: most firms run periodic reviews on a risk-based cycle written into their own policy, commonly yearly for high risk and every three to five years otherwise, and the backlog is managed as capacity allows.
Under AMLR: customer information must be updated at least once a year for customers subject to enhanced due diligence measures under Section 4 of the regulation, and at least every five years for all other customers (Art. 26(2) AMLR). These are maximum intervals; a risk-based policy can set shorter ones, and your own risk rating does not by itself move a customer into the one-year band unless enhanced measures apply. Reviews are also triggered by events, for example a change in the customer’s circumstances or a relevant fact the firm becomes aware of (Art. 26(3)). For customers you already have, AMLA’s final draft customer due diligence standard requires existing customer information to be brought into line on a risk-sensitive basis within the Article 26(2) periods, calculated by reference to the standard's entry into force (Art. 28 RTS).
What changes in the week: the timetable for updating customer information is no longer just a matter of internal policy. Firms need to know which customers are approaching their applicable deadline, what information needs updating, and which events should trigger an earlier review.
Start now: calculate how many customers fall into each window and how much updating work that implies each year. For most firms the five-year interval is manageable and the one-year interval for customers under enhanced due diligence is the capacity problem. The exact transitional dates follow the adopted standard; the capacity you will need does not.
2. Onboarding questions: purpose and intended nature for everyone, funds where necessary
Today: source of funds is asked when the customer is high risk, and expected activity is often a free-text field or not asked at all.
Under AMLR: before entering a business relationship, the obliged entity must assure itself that it understands the relationship’s purpose and intended nature (Art. 25(1) AMLR). That part is standard due diligence for every customer. To get there, the regulation lists information to obtain where necessary: the purpose and economic rationale, the estimated amount of the envisaged activity, the source of funds, the destination of funds, and the customer’s business activity or occupation. How much of that you collect, and in what depth, follows the customer’s risk. AMLA’s final draft standard says the same in practice: the information is not a checklist, and in low-risk cases purpose and intended nature may be inferred from the customer profile, the product, or previous transactions (Art. 16 RTS). Simplified due diligence is reserved for genuinely low-risk cases and can no longer be applied by default (Art. 33 AMLR).
What changes in the week: onboarding questionnaires need to be able to ask about expected activity and funds for any customer, with the depth driven by risk rather than by a fixed high-risk flag. The answers become inputs to monitoring rather than a form filed and forgotten, because the expected activity you record is what the customer’s actual transactions are later compared against.
Start now: redesign the questionnaire so that purpose, expected activity, and funds are structured fields with risk-dependent depth, and make sure those fields are readable by whoever builds monitoring rules.
3. Ownership work: more people per company, and more proof
Today: beneficial ownership is often read from the first layer of owners and confirmed against the national beneficial owner register.
Under AMLR: beneficial ownership is assessed through two routes, ownership and control. On the ownership route, interests are calculated through the chain using the accumulation method, with a threshold of 25 percent or more (Art. 52 AMLR). Control is assessed separately and in parallel, so a person can be a beneficial owner through control while holding less than the threshold (Art. 51 to 54). If no natural person can be identified as a beneficial owner after all possible means have been exhausted, or there are doubts that the identified persons are the beneficial owners, the obliged entity must record this and identify the senior managing officials, verifying their identities subject to the regulation's conditions. Identifying them as a fallback does not make them beneficial owners (Art. 22, 63 AMLR; recital 125). The central register must still be consulted, but it is a source of information rather than the sole basis for establishing beneficial ownership (Art. 22(7)). AMLA’s final draft standard adds that for each company between your customer and its beneficial owners, you record the legal form, the country of registration, any nominee shareholders or directors, and the share of ownership and voting rights (Art. 11 RTS).
What changes in the week: every KYB onboarding and review has more named individuals to identify, verify, screen, and monitor, and more data to keep per layer of the structure. Our UBO article covers the mechanics in detail.
Start now: the ownership and control rules are set by the regulation, not by pending standards. Audit how your current process establishes ownership and where it stops at the register.
4. Targeted financial sanctions screening: from a batch job to a schedule with triggers
Today: customers are screened at onboarding and then rescreened on a batch cycle, often nightly or weekly, with beneficial owners sometimes included and sometimes not.
Under AMLR: customer due diligence includes checking whether the customer or its beneficial owners are subject to targeted financial sanctions. For a customer that is a legal entity, it also requires checking whether designated persons or entities control it or hold more than 50 percent of its proprietary rights, or a majority interest, individually or collectively (Art. 20(1)(d) AMLR). AMLA's final draft standard sets out proposed screening triggers and further detail on the identifiers to consider: at onboarding, when a relevant new designation or sanctions-list change requires screening under the applicable rules, when significant changes in due diligence information may affect whether a person or entity is listed, for example a change of name, residence, nationality, business operations, or beneficial owner, and on a regular basis at a frequency that reflects the firm’s exposure to sanctions risk (Art. 25 RTS). It also proposes that screening and verification be performed without undue delay from the moment UN financial sanctions are made public, and from the moment updated targeted financial sanctions become applicable (Art. 25(2)(e) and (f) RTS). Separately, Article 27 AMLR requires temporary record-keeping for customers subject to UN financial sanctions, or controlled or majority-owned by such persons, covering the period between publication of those sanctions and the date the corresponding EU sanctions apply. The standard also clarifies that known aliases, trade names, and similar identifiers are relevant to the screening. These triggers are in the standard rather than the regulation, so their exact wording depends on adoption.
What changes in the week: a change to a customer record becomes a screening event, not just a data update, and the beneficial owners identified under point 3 join the screening population automatically. Screening sits inside the customer record rather than next to it.
Start now: confirm that every beneficial owner you identify is actually in the screening population, and that a change of details triggers a rescreen. Both are sensible preparations and align with the draft standard’s proposed requirements; the final wording remains subject to adoption.
5. Monitoring: a legal obligation, with onboarding data behind it
Today: transaction monitoring is run as a set of rules on the payment stream, usually in a separate system from onboarding, and an alert is investigated with whatever context the analyst can pull together.
Under AMLR: ongoing monitoring of the business relationship, including scrutiny of transactions to check that they are consistent with the firm’s knowledge of the customer, their business, and their risk profile, is an explicit obligation (Art. 26(1) AMLR). The regulation does not prescribe how an alert review must be organised. In practice, though, checking a transaction against what you know about the customer means the reviewer needs the onboarding record at hand: risk classification, expected activity, and any declared source and destination of funds. That is an operational consequence of the obligation, not a separate statutory requirement, and it is the part most firms have to build.
What changes in the week: alert investigation starts from the customer’s expected activity rather than from the transaction alone, and the monitoring team needs the onboarding record available. AMLA’s guidelines on ongoing monitoring are still to come and will clarify implementation; they do not postpone the obligation.
Start now: make customer risk classification, expected activity, and relevant funds information available to your monitoring process, and make sure the monitoring you run today is effective against your own risk assessment. Keep under review: refine the monitoring methodology and controls as AMLA publishes its final guidelines.
6. Sign-offs: named roles and a management body that approves
Today: the compliance function is organised as the firm sees fit, and policies are approved wherever the firm’s governance puts them.
Under AMLR: obliged entities appoint a compliance officer, responsible for day-to-day AML/CFT compliance and sanctions, the contact point for authorities, and the person who files suspicious transaction reports (Art. 11(2), 69(6) AMLR), and a compliance manager, a member of the management body who owns compliance at senior level (Art. 11(1)). The management body approves internal policies and the business-wide risk assessment (Art. 9, 10). Training and employee integrity checks become explicit obligations (Art. 12, 13). One person may hold both roles where the conditions in Article 11 are met, taking account of the nature and size of the obliged entity.
What changes in the week: policy changes, the risk assessment, and the escalation path for reports get a defined owner and a defined approver. Training stops being ad hoc and becomes something you have to be able to evidence.
Start now: name the two roles, put the risk assessment on the management body’s agenda, and start a training record. AMLA’s guidelines on the business-wide risk assessment will shape its format, not whether it is required.
7. Identity verification: tighter rules for remote checks
Today: identity is verified with whichever method the firm’s policy allows, with video and document-upload flows common for remote customers.
Under AMLR: identity verification must use one of the routes set out in Article 22(6): an identity document, passport or equivalent, with information from reliable and independent sources where relevant; or electronic identification means meeting the substantial or high assurance requirements under eIDAS and relevant qualified trust services. AMLA's final draft standard adds detail for remote checks. It proposes using qualifying electronic identification means or relevant qualified trust services, with remote document-based verification available when that route is unavailable or cannot reasonably be expected. Alternative methods are subject to defined conditions and safeguards, including requirements for quality, security and confidentiality, and the firm must be able to justify their use (Art. 6, 7 and 27 RTS). The detailed requirements remain subject to adoption.
What changes in the week: for domestic customers in Nordic markets, existing eID infrastructure is a strong starting point, provided the scheme meets the required assurance level and identity-data requirements. For customers in markets without a widespread eID, the fallback methods and their documentation become part of the routine, and the firm needs to be able to explain to its supervisor why a fallback was used.
Start now: map which of your markets have an eID scheme at the required assurance level, and what the fallback and its justification will be elsewhere. The details of the fallback conditions follow the adopted standard.
Start now, or wait for the standards?
Start now, because it is fixed in the regulation:
Update intervals of at most one year for customers under enhanced due diligence and five years for all others, and the updating work they imply.
Beneficial ownership through the chain with the 25 percent threshold and accumulation rules, control assessed in parallel, and the senior-managing-official fallback.
The compliance officer and compliance manager roles, and management body approval of policies and the business-wide risk assessment.
Ongoing monitoring as an explicit obligation, with customer risk classification, expected activity, and relevant funds information available to the monitoring process.
Purpose and intended nature of the relationship for every customer, and the ability to collect expected activity and funds information at a depth that follows risk.
Depends on adoption or on AMLA’s guidelines, but prepare the data for it now:
The transitional start date of update periods for existing customers, which follows the adopted customer due diligence standard and its six-month application period.
The exact targeted financial sanctions screening triggers and the conditions for fallback identity verification, which sit in the standard.
Monitoring methodology and controls, which AMLA’s ongoing monitoring guidelines will refine. The guidance clarifies implementation; it does not postpone the obligation.
The format of the business-wide risk assessment, pending AMLA’s guidelines.
FAQ
Does the one-year update period for customers subject to enhanced due diligence start in July 2027?
AMLR, including its maximum update intervals, applies from 10 July 2027. For customers you already have, AMLA’s final draft customer due diligence standard provides a transitional timetable tied to the date the standard enters into force, which in turn depends on adoption by the European Commission and publication in the Official Journal, with application proposed six months after entry into force. Plan for the transitional timetable in the adopted standard, and build the capacity to update customer information ahead of AMLR's application date rather than after it.
Do we have to ask every customer about source of funds?
You must understand the purpose and intended nature of every business relationship. You collect information on the source and destination of funds where necessary to achieve that understanding, with the depth of inquiry proportionate to the customer's circumstances and risk. This means funds questions should not be categorically excluded for lower-risk customers, although they will not be necessary in every case. Simplified due diligence is also no longer a default (Art. 33 AMLR).
Can one person be both compliance officer and compliance manager?
Yes, where the conditions in Article 11 AMLR are met, taking account of the nature and size of the obliged entity. The management body still has to approve policies and the business-wide risk assessment.
What should a compliance lead do this quarter?
Count the customers in each update window, redesign the onboarding questionnaire for purpose, expected activity, and funds, audit how ownership and control are established today, confirm beneficial owners are in the screening population, and put the roles and the risk assessment on the management body’s agenda. The rest can follow the standards.
If you want to go through what this means for your own processes, get in touch.
—
More in the AMLR 2027 series
AMLA’s October release on AMLR standards (RTS): What changes for compliance teams
AMLR and UBO mapping: how beneficial ownership identification changes in 2027
—
Published: 26 October, 2026
This article is published by Bits Technology, a compliance platform for regulated financial companies in Europe.
