Clocks that run against you
Deadlines you have to meet. Where a period runs from an event you discover rather than a date in a calendar, the trigger is the part to engineer a process around.
Re-determine whether an existing customer, a beneficial owner or a person on whose behalf a transaction is carried out has become a politically exposed person
Without delay- Starts
- New or changed due diligence information bearing on the status, or an update to the single list of prominent public functions published under Article 43(5) AMLR
- Basis
- Article 17(2) of the final draft RTS under Article 28(1) AMLR
- Status
- Final AMLA text
Also at a risk-sensitive frequency in the ordinary course. The list trigger is external and unannounced. The Commission assembles the national lists into a single list and publishes it in the Official Journal, so somebody has to watch for updates to it. Under Article 17(3), the screening may use automated screening tools, manual checks or a combination of both.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Report a discrepancy between a central beneficial ownership register and the information you have collected
14 calendar days- Starts
- Detection of the discrepancy
- Basis
- Article 24(1) AMLR
- Status
- Level 1
Without undue delay and in any case within 14 days. The report must be accompanied by the information indicating the discrepancy and by who you consider the beneficial owners, nominee shareholders and nominee directors to be, and why. You may ask the customer for more information instead of reporting in two cases. The first is where the discrepancy is limited to typographical errors, different transliterations or minor inaccuracies that do not affect the identification of the beneficial owners or their position. The second is where it results from outdated data, the beneficial owners are known to you from another reliable source, and there are no grounds to suspect an intention to conceal. Neither route is available in higher-risk cases under Section 4. Article 24(4) carves out notaries, lawyers, other independent legal professionals, auditors, external accountants and tax advisors. The duty does not apply to information they obtain in ascertaining a client’s legal position or in judicial proceedings. It does apply when they give legal advice in the situations covered by Article 21(2), second subparagraph. Two points about the register itself, which this duty assumes you can reach. Your access does not depend on the legitimate interest regime that Article 12 of Directive (EU) 2024/1640 applies to journalists, researchers and others. Article 11(3) gives obliged entities taking customer due diligence measures timely access to the interconnected registers. There is nothing to apply for and no interest to demonstrate. Member States had to transpose Article 11 by 10 July 2026. The Commission’s transposition page, last updated on 26 October 2026, shows that nine Member States have notified full transposition of Articles 11, 12, 13 and 15. It records infringement proceedings for non-communication pending against eighteen. Where a Member State has not notified full transposition, access for obliged entities rests on its existing national rules implementing Articles 30(5)(b) and 31(4)(b) of Directive (EU) 2015/849. Those provisions give access within the framework of customer due diligence, and they remain in force until that Directive is repealed on 10 July 2027. Under Article 10 of the Directive, you see the statement the legal entity or arrangement itself submitted only if you report a discrepancy under this Article or provide proof of the steps you have taken to determine the beneficial owners. In either case you can also see the justification. Under Article 10(10), the register then has 30 working days to take appropriate action on a reported discrepancy.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Invite the customer to submit correct information to the central register
14 calendar days- Starts
- Concluding that the register information is incorrect
- Basis
- Article 24(2) AMLR
- Status
- Level 1
If the customer does not do so within that period, the discrepancy must then be reported to the register.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Reply to a request for information from your FIU
5 working days- Starts
- The FIU’s request
- Basis
- Article 69(1) AMLR
- Status
- Level 1
The FIU may shorten this in justified and urgent cases, expressly including to less than 24 hours, and may extend it where justified and where the extension would not undermine its analysis. A five working day turnaround that can collapse to a day is a resourcing question before it is a compliance one, and it applies to every obliged entity, not only to banks. Requests may cover transaction records, and the format for providing those is the instrument in this item.
Context: Item 45, AMLA ITS on the format for reporting suspicions and providing transaction records (Article 69(3) AMLR)
Hold a transaction you have reported, and when you may release it
3 working days- Starts
- Submission of the report
- Basis
- Article 71(1) AMLR
- Status
- Level 1
Where you know or suspect that a transaction is related to the proceeds of criminal activity or to terrorist financing, you must refrain from carrying it out until you have reported it and complied with any further specific instructions from the FIU or other competent authority under the applicable law. If no instruction to the contrary arrives from the FIU within 3 working days of submitting the report, you may carry out the transaction. You may do so only after assessing the risks of proceeding. The Regulation gives permission, not clearance, so the decision and the record of it are yours. Where refraining is impossible, or would be likely to frustrate efforts to pursue the beneficiaries of the transaction, you must inform the FIU immediately after carrying it out. Two things follow for anyone designing the process. The clock runs from submission, not from detection, so a report sitting unsent in a review queue holds the payment without starting the count. And silence from the FIU is not approval; it is the point at which your own risk assessment takes over.
Context: Item 19, FIU pillar: staffing, FIU.net transfer and joint analyses
How long your FIU can stop a transaction or the use of an account
At most 10 or 5 working days- Starts
- The FIU’s decision to suspend
- Basis
- Articles 24 and 25 of Directive (EU) 2024/1640
- Status
- Level 1
Your FIU may suspend or withhold consent to a transaction for up to 10 working days for its analytical work, and may suspend the use of a bank, payment or crypto-asset account, or a whole business relationship, for up to 5 working days. Where the suspension follows a report you made, it is to be imposed within the 3 working days above, which is how the two clocks connect. A Member State may set longer periods only where its FIU also traces, seizes, freezes or confiscates criminal assets under national law. Even then, appropriate national safeguards must apply, such as the possibility for the person affected to challenge the suspension before a court. The FIU may lift a suspension at any time, and may suspend at the request of an FIU in another Member State, so a hold can originate abroad. Separately, it may instruct you to monitor named accounts or business relationships for a period it specifies and to report the results. These are ceilings set by a Directive: the periods that bind you are the ones your Member State transposes, by 10 July 2027.
Context: Item 19, FIU pillar: staffing, FIU.net transfer and joint analyses
Notify the home supervisor that a third country’s law prevents or restricts group-wide AML/CFT policies
28 calendar days- Starts
- Identification of the legal impediment
- Basis
- Article 7(1)(a) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
Not a new deadline: the same 28 days has applied since 2019 under Commission Delegated Regulation (EU) 2019/758, so a firm with a working 2019/758 process already has the machinery. In a group the parent undertaking notifies. Where a single notification is inappropriate, it may let individual obliged entities notify their own supervisors. Several impediments may go in one notification. Industry asked for a two-step notification on the DORA model, with 90 days for the substantiated part. AMLA did not adopt it, noting that supervisors may request follow-up information as part of ongoing supervision. Notify on what you know within the 28 days, and expect the detail to be asked for afterwards. Where additional measures are taken, a second notification follows. Under Article 7(4), the supervisor is to be told without undue delay of the measures taken, with an assessment of their appropriateness.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Notify the supervisor of the obliged entity identified as parent undertaking in the Union
28 calendar days- Starts
- After the day on which two or more obliged entities of the same non-EU head office are established in the Union without being in a parent and subsidiary relationship
- Basis
- Article 13(1) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
An entity already in that position on the day the standard applies notifies on that date. The notification must carry six specified items, including a detailed group chart and reasons against each of the three tests. The assessment therefore has to be finished within the 28 days, and it is easier to have it largely in place beforehand.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Notify a change in which entity is designated parent undertaking in the Union
28 calendar days- Starts
- Counted back from the date the change takes effect: the notification must reach the supervisor at least 28 calendar days before it
- Basis
- Article 13(6) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
Where objective and extraordinary circumstances make advance notice impossible, as soon as possible and in any event within 28 calendar days after the change.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Notify a request for permission not to identify a head of the structure
28 calendar days- Starts
- After forming the intention to request it
- Basis
- Article 17(2) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
For networks, partnerships and franchises with no entity holding sufficient responsibility and powers. A coordinating obliged entity makes the request and becomes the main point of contact. This route did not exist in the consulted draft.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
First notification to supervisors by structures other than groups
6 months- Starts
- Application of the standard
- Basis
- Final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
Applies to the identification of the head of the structure and to a permission not to identify one.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Make written submissions before a periodic penalty payment decision
Up to four weeks- Starts
- The supervisor’s statement of findings
- Basis
- Article 7(2) and (3) of the final draft RTS under Article 53(10) AMLD
- Status
- Final AMLA text
The procedure applies before a decision imposing a periodic penalty payment. The supervisor sets the period in its statement of findings, up to a maximum of four weeks, and need not take into account submissions received late. Up to four weeks may be little time where the breach spans years or several Member States. The base amounts for pecuniary sanctions are for the separate Guidelines in Item 48, on which no consultation has appeared.
Context: Item 40, AMLA RTS on enforcement: pecuniary sanctions, administrative measures and periodic penalty payments (Article 53(10) AMLD)
How long you stay a selected obliged entity once you are on the list
Until the next cycle begins to bite- Starts
- Not the publication of a later list that leaves you out. Direct supervision continues until AMLA commences direct supervision of the entities on that later list, which is six months after it is published.
- Basis
- Articles 13(4) and 13(6) AMLAR
- Status
- Level 1
So coming off the list and coming out of direct supervision are six months apart, and the obligations of a directly supervised entity run through that gap. The selection process repeats every three years from the commencement of the first selection.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
Update the documents, data and information of a higher-risk customer
At most 1 year- Starts
- Time since the last update
- Basis
- Article 26(2)(a) AMLR
- Status
- Level 1
Applies to customers to whom the enhanced due diligence measures in Section 4 of Chapter III apply. The frequency within the cap is yours to set on risk; the cap is not.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
Update the documents, data and information of any other customer
At most 5 years- Starts
- Time since the last update
- Basis
- Article 26(2)(b) AMLR
- Status
- Level 1
The practical constraint is evidential rather than temporal: you cannot show a file is inside five years unless the date of its last review is recorded and retrievable.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
Review and, where relevant, update customer information regardless of the cycle
On the event- Starts
- A change in the customer’s relevant circumstances; a legal obligation during the calendar year to contact the customer to review beneficial ownership information or to comply with Directive 2011/16/EU; or becoming aware of a relevant fact about the customer
- Basis
- Article 26(3) AMLR
- Status
- Level 1
The middle trigger is an efficiency instruction in disguise: where another legal duty already requires you to contact the customer that year, that contact is the occasion for the review. Running tax reporting and the anti-money laundering refresh as unconnected exercises pays twice for the same letter.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
Verify whether a customer or beneficial owner is subject to targeted financial sanctions
Risk-based- Starts
- Ongoing, at a frequency commensurate with your exposure to the risk of non-implementation and evasion of targeted financial sanctions. Credit and financial institutions must also verify upon any new designation
- Basis
- Article 26(4) AMLR
- Status
- Level 1
A separate cadence from the customer information cycle and not satisfied by it. It does not replace the duty to apply the sanctions themselves or any stricter national or Union screening requirement.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
Bring the documents, data and information of customers onboarded before the standard enters into force into line with it
Risk-based- Starts
- Entry into force of the standard, which is twenty days after its publication in the Official Journal
- Basis
- Article 28 of the final draft RTS under Article 28(1) AMLR
- Status
- Final AMLA text
No remediation deadline of its own: the legacy book comes up in risk order within the one-year and five-year periods in Article 26(2) AMLR. The reference point is now settled. Recital 26 provides that those periods start only at the date of entry into force for relationships existing before that date, and AMLA says it amended the provision specifically so the periods run from entry into force rather than the publication date. The standard applies six months after it enters into force. The legacy clocks therefore start about six months before the obligation itself applies. A low-risk legacy file has roughly four and a half years from the day the standard applies. AMLA refused to extend the one-year and five-year periods, which are fixed by the AMLR and not by this standard.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Clocks that run against an authority
Not your obligations, but they determine when you get an answer, when a position becomes known, and how long exposure stays open. Worth planning around.
AMLA tells you that it has passed information you gave it to another authority
Without undue delay- Starts
- The exchange of the information. For recurring or periodic exchanges, you are told only once.
- Basis
- Article 92a(4) AMLAR, inserted by Regulation (EU) 2025/2088
- Status
- Level 1
Three carve-outs remove the notification entirely: anonymised information, under paragraph 5(a); information modified, aggregated or put through another method of disclosure control, under paragraph 5(b); and, under paragraph 6, where AMLA determines or is told that telling you could compromise supervisory or resolution proceedings, actions or investigations. Paragraph 7 extends the scheme to information AMLA has since quality-checked or otherwise processed. The companion provision is Article 92a(2), which requires AMLA to ask an authority that already holds information rather than asking you, unless that authority cannot share it, action is urgent, or asking you directly is necessary.
Context: Item 43, Amendment of the AMLA Regulation: simplification and reporting-burden mandate (Regulation (EU) 2025/2088)
Supervisor approves the identification of the parent undertaking in the Union
60 calendar days- Starts
- Receipt of the complete notification
- Basis
- Article 13 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The clock runs from a complete notification, so an incomplete one does not start it. Plan on up to about three months from first assessment to approval.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Your supervisor reviews your inherent and residual risk profile
1 year- Starts
- Ongoing cycle. Once every three years instead, where the entity is very small or carries out activities of very low ML/TF risk. Ad hoc where risks crystallise or material new information emerges
- Basis
- Final draft RTS under Article 40(2) AMLD (financial sector)
- Status
- Final AMLA text
Not your deadline, but it sets how often you are scored and therefore how often you are asked for the data. AMLA’s examples of an ad hoc trigger are a change of ownership or business model, or control failures suggesting inherent risk has increased, so a reorganisation has a supervisory consequence as well as an internal one. The instrument applies from 31 December 2027.
Context: Item 47, AMLA RTS on the methodology for assessing the risk profile of obliged entities (Article 40(2) AMLD): the financial-sector phase
Supervisors exchange information essential or relevant to the assessment
28 calendar days- Starts
- Receipt of the complete notification
- Basis
- Article 13 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
Runs inside the supervisor’s 60 days.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Your supervisor confirms whether it complies, or intends to comply, with AMLA Guidelines
2 months- Starts
- Issuance of the Guidelines
- Basis
- Article 54(3) AMLAR
- Status
- Level 1
Worth watching rather than acting on: this is when you learn whether the authority that supervises you complies, or intends to comply, with a set of Guidelines. AMLA publishes the fact of non-compliance and may publish the reasons.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
Limitation period for collecting periodic penalty payments
Five years- Starts
- The day after notification of the decision setting the final accrued amount
- Basis
- Article 10 of the final draft RTS under Article 53(10) AMLD
- Status
- Final AMLA text
This is the only limitation period in the standard, and it concerns collection. The standard sets none for imposing a pecuniary sanction. Under Article 10(2), the law of the Member State where the payment is collected may interrupt or suspend the period.
Context: Item 40, AMLA RTS on enforcement: pecuniary sanctions, administrative measures and periodic penalty payments (Article 53(10) AMLD)
Periodic penalty payments accrue
Daily, weekly or monthly- Starts
- Continuing breach
- Basis
- Article 9(1) of the final draft RTS under Article 53(10) AMLD
- Status
- Final AMLA text
The unit matters: a monthly accrual on a breach that takes a quarter to fix is a different number from a daily one.
Context: Item 40, AMLA RTS on enforcement: pecuniary sanctions, administrative measures and periodic penalty payments (Article 53(10) AMLD)
About your customers
Fields and judgements you must be able to produce for an individual customer or relationship.
The date on which each customer file was last reviewed or updated
- Specification
- Per customer, retrievable
- What it is for
- You cannot demonstrate that a file sits inside the one-year or five-year cap without it
- Basis
- Implied by Article 26(2) AMLR
- Status
- Practical implication
Not a listed data point anywhere in the framework. It is the field the cadence rule assumes you already hold. Where it is missing, inaccurate or held inconsistently across systems, compliance with the cap cannot be shown. With the current risk classification it is the minimum pair needed to evidence Article 26 compliance, and no version of the technical standards will make it unnecessary.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
The current risk classification of each customer, and whether enhanced due diligence applies
- Specification
- Per customer, retrievable, and auditable to a date
- What it is for
- The cap is one year for customers under enhanced due diligence and five for everyone else, so the classification selects the deadline
- Basis
- Implied by Article 26(2)(a) AMLR
- Status
- Practical implication
A classification that lives in a relationship manager’s judgement rather than in the system cannot be evidenced. Note also that the classification drives the order in which the legacy book is remediated under Article 28 of the customer due diligence standard, so it decides both the deadline and the queue.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
The purpose and intended nature of each business relationship or occasional transaction
- Specification
- Purpose and economic rationale; estimated amount of the envisaged activities; source of funds; destination of funds; business activity or occupation of the customer
- What it is for
- Required before entering the relationship or carrying out the transaction
- Basis
- Article 25 AMLR
- Status
- Level 1
Obtained “where necessary”, so the five heads are a menu read against risk rather than a mandatory form. Traders in high-value goods under Article 74 AMLR must additionally determine whether the intended use of the goods is commercial or non-commercial. Article 16 of the customer due diligence standard specifies what the estimated amount of the envisaged activities covers, including the estimated amount or range of funds and the anticipated type, frequency and volume of activities and transactions.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Your own view of who the beneficial owners, nominee shareholders and nominee directors are, and why
- Specification
- In writing, accompanying any report of a register discrepancy
- What it is for
- A discrepancy report is not a flag; it must carry your analysis and your conclusion
- Basis
- Article 24(1) AMLR
- Status
- Level 1
This turns a register check into a documented position. Where senior managing officials are reported in place of beneficial owners under Article 22(2) AMLR, they are not beneficial owners and must not be counted as such.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Identification attributes in the form electronic identification means actually use
- Specification
- Mapped from Article 22(1) AMLR onto attribute names such as family_name, given_name, birth_date, birth_place, nationality and personal_administrative_number
- What it is for
- It is the bridge between the Regulation’s list and a digital identity wallet
- Basis
- Annex I to the final draft RTS under Article 28(1) AMLR
- Status
- Final AMLA text
Worth reading before procuring or configuring an electronic identification solution, because it tells you which attributes a provider has to be able to deliver. One caution comes from the consultation responses. The Annex is anchored to Commission Implementing Regulation (EU) 2024/2977, the EU Digital Identity Wallet specification. That specification is itself in early implementation. Respondents warned that the attributes the standard requires and those the rollout delivers may not match for some years. They also said that only payment service providers were obliged to accept the wallet. AMLA has confirmed that existing remote onboarding tools may continue to be used where they meet the quality, security and confidentiality requirements of Article 7, and that where verification is done through the means in Article 22(6), point (b) AMLR no additional data points need to be obtained.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
The specific simplified verification measures that apply to each type of lower-risk customer
- Specification
- A mapping, held inside the internal procedures required by Article 9 AMLR, from each type of customer the firm treats as presenting a lower risk to the specific measures of simplified verification taken for that type. Not a policy statement that simplified due diligence is available, but the measures themselves, by customer type.
- What it is for
- Article 33(2) AMLR requires it in terms. It is also the first thing a supervisor can ask for without notice, because unlike a risk judgement it either exists or it does not.
- Basis
- Article 33(2) AMLR, read with Article 9
- Status
- Level 1
Four of the five measures in Article 33(1) depend on no Level 2 instrument and will be available when the AMLR applies on 10 July 2027. A firm that has deferred this mapping until the Guidelines arrive is waiting for something that will not change what Article 33(2) already requires.
Context: Item 8, AMLA sectoral roundtables and draft Guidelines on simplified customer due diligence
Whether a customer forms part of a complex structure, on a defined test
- Specification
- Three or more layers between the customer and the beneficial owner, together with more than one of: a legal arrangement or similar entity such as a foundation in any layer; the customer and the layer entities registered outside the Union; nominee shareholders or nominee directors; or a structure that obfuscates ownership with no legitimate economic rationale
- What it is for
- A quantified definition of a complex structure
- Basis
- Annex 2 to the interpretative note for the 2026 testing and calibration exercise
- Status
- Draft only
Stated for the purposes of that data collection, so it does not bind generally. It is nonetheless the clearest indication of where AMLA draws the line, and a firm with no layer count in its systems cannot apply it.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
About your firm or your group
Figures about the entities themselves. Most of these exist to answer a single question: which EU entity carries the group obligation.
One account of your governance and internal controls that holds good for two supervisors at once
- Specification
- A single, reconciled description of the governance arrangements, internal controls and control framework, consistent with what is reported prudentially and what is reported for AML/CFT purposes. Where the two accounts differ, the reason for the difference, written down.
- What it is for
- Because two authorities read the same control framework from two files, and in one respect the Regulation requires it. Article 13(5) AMLAR provides that, prior to the publication of the list of selected obliged entities, the Authority shall inform the relevant non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk. That is a Level 1 duty, and it runs to every relevant non-AML/CFT authority as defined in Article 2(4), not only to the ECB. The AMLA–ECB memorandum then adds a standing exchange that needs no request. From the ECB to AMLA go the SREP outcomes on business model, operational risk and internal governance and risk management, the Supervisory Examination Programme planning, SSM decisions on governance or institution-wide control shortcomings, and fit and proper decisions that carry an anti-money laundering assessment. From AMLA to the ECB go your money laundering and terrorist financing risk assessments, requests for changes to your governance structure, and decisions restricting your business or requiring divestment. Whistleblowing reports relevant to the other side cross in both directions.
- Basis
- Articles 2(4) and 13(5) AMLAR; Annex to and Paragraph 7.2 of the AMLA–ECB Memorandum of Understanding under Article 92(3) AMLAR
- Status
- Practical implication
Note where the duty actually sits, because it is wider than the memorandum. The pre-publication disclosure of your risk classification is Article 13(5) AMLAR, a Level 1 obligation, and it runs to every relevant non-AML/CFT authority in the Article 2(4) family: prudential authorities, the ECB in its Single Supervisory Mechanism tasks, resolution authorities, deposit guarantee scheme designated authorities and the rest. The AMLA–ECB memorandum supplies the practical modalities for one of them and creates no enforceable rights. Article 13(5) is not optional.
Context: Item 51, Transfer of the EBA’s AML/CFT mandates and functions to AMLA
A clear and detailed statement of whether you comply with an AMLA guideline, where that guideline requires one
- Specification
- A written statement, per guideline that calls for it, saying whether the firm complies, “in a clear and detailed way”. The Regulation sets no format and no deadline for the firm’s statement, so the guideline itself will say what and when.
- What it is for
- Article 54(3) AMLAR. Its fourth subparagraph puts this on obliged entities and nobody else: “If required by that guideline or recommendation, obliged entities shall report, in a clear and detailed way, whether they comply with that guideline or recommendation.” It is separate from, and additional to, the two-month comply-or-explain confirmation that the same article puts on supervisory authorities, supervisors and FIUs.
- Basis
- Article 54(3) AMLAR, fourth subparagraph
- Status
- Level 1
The first subparagraph also puts obliged entities under a duty to “make every effort to comply” with AMLA guidelines. Only authorities have the two-month clock and only authorities get published for non-compliance; a firm’s position surfaces instead through whatever reporting the guideline itself imposes. Each guideline has to be checked for any such requirement.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
The average number of customers of each EU obliged entity in the group, and how many are high risk
- Specification
- Average at 31 December of the two calendar years immediately preceding the current year
- What it is for
- One of the factors determining which entity is the parent undertaking in the Union
- Basis
- Article 10(1)(c) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The consulted draft asked for three years; the final text asks for two, which removes a year of assembly. The high-risk qualifier is new in the final text, so a plain customer count is no longer enough.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
The average value of incoming and outgoing transactions of each EU obliged entity
- Specification
- Average over the two calendar years immediately preceding the current year, in euro or converted at the official rate available on 31 December of the reference year
- What it is for
- A second factor in the same determination
- Basis
- Article 10(1)(d) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The standard does not itself define “incoming and outgoing”. AMLA’s interpretative note for the 2026 calibration exercise uses the term for transactions into and out of the entity, not across a border. That note was written for a different data collection, so read it as an indication rather than a definition.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
The number of cross-border establishments of each EU obliged entity
- Specification
- Including agents and distributors, activity under the freedom to provide services through agents or distributors, and other types of infrastructure located in other Member States
- What it is for
- A factor in the parent undertaking determination, and new in the final text
- Basis
- Article 10(1)(b) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
Agent and distributor networks count. A firm that thinks of its establishments as its offices will undercount.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Turnover, balance sheet size and average employee numbers of each EU obliged entity
- Specification
- Total annual turnover per the latest accounts approved by the management body; balance sheet size per the latest audited consolidated statements, or individual statements where consolidation is not required; average number of employees during the financial year
- What it is for
- The tie-breakers where the primary factors do not settle which entity is the parent undertaking
- Basis
- Article 10(2) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The draft had turnover alone; the final text offers three, which gives a group room to argue but also means three figures have to be available for every candidate entity.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
The number of full-time equivalent staff in the compliance function of each EU obliged entity
- Specification
- Full-time equivalents in the compliance functions referred to in Article 11 AMLR
- What it is for
- The secondary test of which entity has sufficient understanding of the group’s EU operations
- Basis
- Article 11(2) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
Compliance staff numbers are the fallback within the test of sufficient understanding of operations, used where the circumstances in Article 11(1) are not conclusive. A group that has consolidated compliance into one European hub should note that the hub’s staff numbers can then weigh in deciding which entity carries the group obligation.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
A detailed chart of the group, and an account of what every EU entity does
- Specification
- Shareholdings in capital or voting rights; a summary overview and explanation of the organisation, roles and responsibilities of the identified entity and of every other EU obliged entity; and detailed reasons for each of the three determinations
- What it is for
- The six items that make up a complete notification of the parent undertaking
- Basis
- Articles 12 and 13 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The supervisor’s sixty days to approve run only from a complete notification. This material therefore has to be ready within the twenty-eight days, and it is easier to have it largely in place beforehand.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
A group-wide risk assessment taken from a group-wide perspective
- Specification
- Risks arising across the group or structure, focusing on those with a significant impact on overall risk exposure
- What it is for
- One of the minimum group-wide requirements, and the hinge between this instrument and the business-wide risk assessment Guidelines
- Basis
- Article 3 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
This is where the consultation did most good. Respondents read the draft as requiring the individual risk profile of every entity to be assessed and consolidated whatever its relevance; the final text is holistic and materiality-based. The exercise now scales with the number of material risks rather than the number of entities.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
The supervisory risk assessment data set for your entity type
- Specification
- Up to 150 data points for the most complex and risky financial institutions; 33 for the insurance sector; fewer again for insurance intermediaries
- What it is for
- National supervisors use the resulting model to plan the frequency and intensity of their supervision of you
- Basis
- AMLA Chair, BIPAR keynote, 22 January 2026
- Status
- Draft only
A quantified statement of burden, and the figure that makes the proportionality claim checkable against your own template. Reported in a speech rather than in the instrument, so treat the numbers as indicative of the design rather than as the specification.
Context: Item 47, AMLA RTS on the methodology for assessing the risk profile of obliged entities (Article 40(2) AMLD): the financial-sector phase
For submission in a prescribed format
Where the framework specifies not only what you report but the template, the grade of each field and what a blank cell means.
The entity-level risk assessment datapoints for your sector
- Specification
- A core set applying to all entities plus sector-specific datapoints; most entities will not exceed 100 to 150 datapoints in total
- What it is for
- They produce the inherent risk score your supervisor uses to set the frequency and intensity of your supervision
- Basis
- Final draft RTS under Article 40(2) AMLD (financial sector)
- Status
- Final AMLA text
AMLA states this is “significantly below the number most supervisors request currently”, so for a typical firm the direction is a reduction. There are two caveats. The limit applies to risk assessment data only, and does not restrict what a supervisor may ask for in on-site or off-site supervision. The standard does not specify sources, so a supervisor may draw on data it already holds, including from the FIU or from external auditors, which can reduce what you are asked for. The scoring thresholds and weights are not in the instrument: AMLA sets them for each review cycle, so the datapoints are public and the numbers that convert them into a score are not.
Context: Item 47, AMLA RTS on the methodology for assessing the risk profile of obliged entities (Article 40(2) AMLD): the financial-sector phase
The calibration and selection workbook, at solo level for each establishment
- Specification
- 35 sheets: a data quality dashboard, 32 reporting templates, an admissible-values list and 578 validation rules. 254 datapoints across all templates; about 116 in the templates applicable to every entity. Each datapoint marked stock, the position at 31 December, or flow, cumulative activity over the year; one reporting currency declared once from a list of seven; financial assets at market value at 31 December
- What it is for
- The instrument through which eligibility and risk data reach AMLA, repeating for the 2027 selection cycle
- Basis
- Interpretative note for the 2026 testing and calibration exercise
- Status
- Draft only
Reporting is solo by establishment and never consolidated: a bank in one Member State with a branch in a second and a subsidiary in a third files three times, to three supervisors, with the head office excluding both. That is the opposite of the eligibility collection, where a group reports once through its parent or a designated entity. The package AMLA has promised for 2027 is expected in a CSV OIM XBRL-based format rather than Excel. A datapoint is a column, so the figures understate the volume: the geographies sheet repeats its 17 columns for every country the entity is active in, with room for about 260 rows, which for a cross-border firm is the largest part of the submission. The country list runs to 250 jurisdictions and the entity type list to 11 categories.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
Customer counts on the exercise’s own definitions, which are not your definitions
- Specification
- Total customers, natural persons, legal entities, PEP-related natural and legal persons, active customers and new customers, each at the end of the reference year
- What it is for
- The part of the submission where the exercise’s definitions differ most from a firm’s own
- Basis
- Template AML.02.01 and Annex 2 to the interpretative note
- Status
- Draft only
Walk-in customers are excluded from the counts and reported separately. Each joint account holder counts once. A customer with several products counts once per obliged entity. Dormant accounts count. For life insurance the customer is the policy holder; for asset managers it is the person in the shares or units register, counted once per collective investment undertaking. Legal entities in the same corporate group count separately. An instruction that was never executed still makes a customer active, even though a non-executed transaction is not a transaction.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
A written account of the data you cannot produce
- Specification
- For every blank cell where the data exists but cannot be reported, a comment naming the template, column and country and beginning “Unable to report:” followed by the specific reason
- What it is for
- A zero and a blank mean different things, and an unexplained blank is treated as not applicable
- Basis
- Template AML.01.02 and the interpretative note
- Status
- Draft only
Worth careful attention. The comments amount to an inventory of the firm’s own data gaps, and the reasons given may be read closely.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
Suspicion reports and transaction records in the common EU format
- Specification
- 167 numbered data points up to DP0903 and 42 link types across ten report categories. The interpretative note describes four transaction-record templates, for banking, money remittance, crypto-assets and correspondent relationships, but the consulted annexes contain three: there is no crypto-asset table
- What it is for
- The format in which every suspicion will reach an FIU
- Basis
- Draft ITS under Article 69(3) AMLR and its interpretative note
- Status
- Draft only
Data points come in five grades: mandatory, with a technically required subset that blocks submission if absent; mandatory if available; optional; dependent on another field; and required by the individual FIU. The phase-in is about two years for the first phase and roughly five overall. Future revisions of the interpretative note are to be decided by AMLA’s General Board or a body it chooses, with no public consultation, so this is a specification that can move without a consultation to respond to.
Context: Item 45, AMLA ITS on the format for reporting suspicions and providing transaction records (Article 69(3) AMLR)
Transaction records in eight transaction states, not just completed payments
- Specification
- Operations over a period through a payment account, an IBAN-identified bank account, transfers of crypto-assets, or a money or value transfer service. At the FIU’s request or voluntarily these may relate to completed, scheduled, attempted, rejected, cancelled, suspended, refrained or frozen transactions
- What it is for
- An FIU request under Article 69(1)(b) AMLR must be answered within five working days, and may ask for any of these states
- Basis
- Article 2(2) of the draft ITS under Article 69(3) AMLR
- Status
- Draft only
The scoping point is the eight states. A transaction history that retains only what settled cannot answer the request. Attempted, rejected, refrained and frozen operations may sit in systems separate from the payment ledger, or may not be retained at all, and the scoping has to find them. This half of the instrument applies to credit and financial institutions; the suspicion report half applies across all nine sectors in Annex I.
Context: Item 45, AMLA ITS on the format for reporting suspicions and providing transaction records (Article 69(3) AMLR)
About what your organisation is
Who carries the group obligation, whether your network counts as a structure at all, and what sits inside the group-wide assessment.
Which of your EU entities is the parent undertaking for group-wide purposes
- What you are given
- Four factors, any of which may determine sufficient prominence: holding company status at the highest level of consolidation where the third-country head office established it for most of the group’s EU obliged entities; number of cross-border establishments including agents and distributors; average customers over the two preceding calendar years, in particular high-risk ones; average incoming and outgoing transactions over the same two years. Where those do not settle it: turnover, balance sheet size or average employees. Then a qualitative test of sufficient understanding of EU operations, with full-time equivalents in the compliance function as the fallback. Then whether the entity has responsibility for implementing the requirements.
- What must be on file
- A notification carrying six items, including a detailed group chart with shareholdings in capital or voting rights, an account of what every EU obliged entity in the group does, and detailed reasons for each of the three determinations
- Basis
- Articles 10 to 13 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The consulted draft ran this as a waterfall and provided that prominence prevailed over understanding. Both were removed after consultation. The result is that there is no longer a calculation producing the answer: you weigh factors that sit at the same level and record why you weighed them as you did. The twenty-eight day clock starts when the entities are established. The supervisor’s sixty days to approve run only from a complete notification. The reasoning therefore has to be finished within the twenty-eight days, and it is easier to have it largely in place beforehand.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Whether your network, partnership or franchise is a structure within the group-wide requirements
- What you are given
- At least two obliged entities sharing common ownership, common management or common compliance control. The three are alternatives, so any one of them suffices, and common compliance control is expressly not limited to AML/CFT compliance but extends to prudential, product and service compliance.
- What must be on file
- Your reasoning on each of the three limbs, and on what is shared across the structure in practice as against what is merely branded in common
- Basis
- Article 14 of the final draft RTS under Articles 16(4) and 17(3) AMLR; Article 50(1) AMLD
- Status
- Final AMLA text
Firms that do not think of themselves as a group should check this point carefully. A professional network or franchise sharing a quality-assurance function is within the definition even if nothing about its anti-money laundering arrangements is shared. The same concept also decides whether a supervisory college can be convened over the structure, once establishments exist in three Member States.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Whether to ask your supervisor for permission not to identify a head of the structure
- What you are given
- Available where no entity in the structure has sufficient responsibility and powers to impose AML/CFT requirements across it, or where there are proven legal impediments under Union or national law. If granted, group-wide requirements reduce to certain minimum requirements that the obliged entities comply with mutually, without any one of them steering the others, and a coordinating obliged entity becomes the point of contact.
- What must be on file
- A request within twenty-eight calendar days of forming the intention, with reasons, and a summary overview and explanation of the permission sought
- Basis
- Article 17 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
This route did not exist in the consulted draft and was created in response to the professions. It is the difference between appointing a head office a network does not have and operating a mutual compliance floor, and it has to be asked for rather than assumed.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Which risks are material enough to appear in the group-wide risk assessment
- What you are given
- A holistic group-wide perspective taking account of risks across the group or structure and focusing on those with a significant impact on overall risk exposure
- What must be on file
- What you included, what you left out, and the basis on which you judged the excluded entities or risks immaterial
- Basis
- Article 3 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The draft was read as requiring every entity’s individual profile to be assessed and consolidated whatever its relevance, and the industry succeeded in changing it. The exercise now scales with the number of material risks rather than the number of entities, which is less work and harder work: materiality is a judgement, so a group excluding twenty-eight of its forty entities has to be able to say why.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
About your customers
Classification, cadence and sequence. None of these has a right answer that can be computed from outside the firm.
Whether a business relationship or transaction presents a low enough degree of risk to apply simplified due diligence, and which simplified measures to apply
- What you are given
- Article 33(1) AMLR gives a closed list of four measures and a fifth point for measures identified by AMLA. First, verify the customer and beneficial owner after the relationship is established, where the specific lower risk justifies the postponement, and in any case within 60 days. Second, reduce the frequency of identification updates. Third, reduce the information collected on purpose and intended nature, or infer it from the type of transaction or relationship. Fourth, reduce the frequency or degree of scrutiny of transactions. All of them must be proportionate to the nature and size of the business and to the specific elements of lower risk identified. Monitoring must still be sufficient to detect unusual or suspicious transactions. Point (e) admits any other measure identified by AMLA under Article 28. Section 5 of the final standard sets minimum identification information, sources and inferred purpose for low-risk situations. Whether any of that counts as a measure for the purposes of point (e) is not stated. Annexes II and III supply the lower-risk factors. No instrument grants a category automatic treatment: AMLA declined to, and the Guidelines now being prepared are own-initiative and cannot create exemptions from the AMLR.
- What must be on file
- The individual analysis under Article 20(2) AMLR, because lower risk has to be identified before the menu opens at all. The specific measures of simplified verification for each type of lower-risk customer, written into the internal procedures required by Article 9, which Article 33(2) requires in terms. A documented decision wherever additional factors of lower risk are relied on, also express in Article 33(2). Where verification is postponed, the risk management procedures under Article 33(3) limiting the amount, number or types of transactions permitted before verification takes place. The record of the regular verification under Article 33(4) that the conditions for simplified treatment still exist, at a frequency commensurate with the business and the relationship. And throughout, whatever Article 20(4) requires: the firm must at all times be able to demonstrate to its supervisor that the measures taken are appropriate to the risks identified.
- Basis
- Articles 9, 20(2), 20(4) and 33 AMLR, with Section 5 of the final RTS under Article 28(1) AMLR
- Status
- Level 1
Article 33(5) closes the door again in five situations: doubts about the veracity of the information or inconsistencies in it, the lower-risk factors no longer being present, monitoring that excludes a lower-risk scenario, a suspicion of money laundering or terrorist financing, and a suspicion that targeted financial sanctions are being circumvented. Simplified treatment is therefore a state to be maintained and evidenced, not a classification made once at onboarding.
Context: Item 8, AMLA sectoral roundtables and draft Guidelines on simplified customer due diligence
Whether a given customer is in a business relationship or carrying out an occasional transaction
- What you are given
- The AMLR definition is the primary reference: a relationship expected at the outset, or subsequently acquiring, an element of repetition or duration. The standard adds criteria to take into account. For all obliged entities, ongoing access to services within the anti-money laundering framework indicates duration. For the professions listed in Article 3(3)(a) to (d) and (l), services provided at different intervals, or different services, indicate repetition. For currency exchange, remittance and certain crypto services, three or more transactions in a rolling twelve months indicate a relationship. For land-based gambling, membership does. For football clubs, conditions attaching to a transfer do.
- What must be on file
- Your classification policy and the reasoning behind it, including why relationships that meet none of the listed criteria were nonetheless treated as relationships where the facts warranted it
- Basis
- Articles 1 to 3 of the final draft RTS under Article 19(9) AMLR; Article 2(1)(19) AMLR
- Status
- Final AMLA text
The point AMLA was pressed on and confirmed: the criteria in Articles 2 and 3 “are therefore not exhaustive and should not be interpreted as limiting the scope of the Level 1 definitions”. The absence of a criterion does not preclude a business relationship where the AMLR conditions are otherwise met on the facts. A rules engine configured to treat these criteria as the test will be wrong. This is a judgement the standard deliberately leaves open.
Context: Item 5, AMLA RTS on business relationships and transaction classification (Article 19(9) AMLR)
How often you review each customer within the statutory caps
- What you are given
- The period between updates depends on the risk posed by the business relationship and may not exceed one year for customers subject to enhanced due diligence and five years for all others
- What must be on file
- The cadence you set, the risk basis for it, and for each customer the date of the last review and the current classification
- Basis
- Article 26(2) AMLR
- Status
- Level 1
The caps are fixed and the frequency inside them is yours. The evidential point matters more than the policy one. A cadence cannot be demonstrated without the date of last review and the current classification, held consistently and retrievable per customer.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
Whether a low-risk relationship justifies reduced update frequency
- What you are given
- Permitted where the relationship presents a low degree of risk (Article 33(1)(b) AMLR). Monitoring must still be sufficient to detect unusual or suspicious transactions (Article 33(1), second subparagraph). The conditions for simplified treatment must be verified regularly (Article 33(4)). The consulted draft of the customer due diligence standard added three further conditions in its Article 23; no equivalent article appears in the final text
- What must be on file
- The monitoring that supports the low-risk conclusion, and the regular verification under Article 33(4), not merely the conclusion that risk is low
- Basis
- Article 33(1) and (4) AMLR
- Status
- Level 1
The five-year limit in Article 26(2)(b) AMLR continues to apply regardless. Reducing frequency is therefore a decision to do more monitoring, not less work.
Context: Item 44, AMLA Guidelines on ongoing monitoring of a business relationship (Article 26(5) AMLR)
The order in which you bring the existing customer book into line
- What you are given
- On a risk-sensitive basis, within the periods set out in Article 26(2) AMLR, for relationships existing before the standard enters into force
- What must be on file
- The sequence you worked in and the risk reasoning that produced it
- Basis
- Article 28 of the final draft RTS under Article 28(1) AMLR
- Status
- Final AMLA text
There is no remediation deadline of its own and no cliff, which is the good news. The price of risk order is that the order is a decision: a supervisor asking why a particular segment was left until year four is asking about your reasoning, not your timetable.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Whether to screen for politically exposed persons by automated tools, manual checks, or a combination
- What you are given
- Automated screening tools, manual checks or a combination of both. The final text does not prescribe one of these. The firm chooses, and has to be able to explain its choice
- What must be on file
- The means chosen, and why they suit your business and its risks
- Basis
- Article 17(3) of the final draft RTS under Article 28(1) AMLR
- Status
- Final AMLA text
The consulted draft expected automated screening unless size, business model, complexity or nature of business justified otherwise. The final text removes that presumption. Note the trigger it comes with: re-determination is required without delay when the single list of prominent public functions published under Article 43(5) AMLR is updated. That means watching the Official Journal for updates to the list.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
Taken under constraint
Where a third country’s law, or a customer’s behaviour, forces a choice and the instrument gives you a range rather than an instruction.
Which additional measures to apply where a third country’s law blocks group-wide policies
- What you are given
- A common set of minimum actions, complemented by tailored additional measures where necessary, applied as a graduated escalation in which the most severe measures are reached only where the impediment has been identified and the available mitigating actions are insufficient
- What must be on file
- The measures chosen, the alternatives considered, and why the chosen ones address the risk. Also the notification to the supervisor, made without undue delay under Article 7(4), of the additional measures taken and an assessment of their appropriateness
- Basis
- Articles 7 and 8 of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
The consulted draft set out five named scenarios each with its own prescribed measures, so a firm matched its facts to a scenario and took what was listed. Both the scenarios and the per-scenario prescription were removed. The twelve measures in the final text end in termination of the relationship and closing down or ensuring divestment of the operation, so the escalation has a real end point and the decision not to reach it is also a decision to record.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Requiring customer consent to overcome a third-country restriction
- What you are given
- Require customers and, where applicable, beneficial owners to give consent that overcomes the restriction, to the extent this is compatible with the third country’s law. Where consent is not feasible, the additional measures in Article 8 apply
- What must be on file
- That consent was required where local law allowed it, and why it was not feasible where it was not
- Basis
- Article 7(1)(b) and (2) of the final draft RTS under Articles 16(4) and 17(3) AMLR
- Status
- Final AMLA text
AMLA accepted during the consultation that consent may be neither feasible nor sufficient, and widened the alternatives accordingly. Where risks still cannot be managed effectively, Article 7(3) calls for further measures that are necessary, appropriate and proportionate. Recording that consent was not pursued because it was thought pointless is not the same as recording that it was not feasible.
Context: Item 6, AMLA RTS on group-wide AML/CFT arrangements (Articles 16(4) and 17(3) AMLR)
Whether an activity is suspicious, and which assessments to carry out first
- What you are given
- A suspicion rests on the characteristics of the customer and their counterparts, the size and nature of the transaction or activity or its methods and patterns, the link between several transactions, the origin, destination or use of funds, or any other circumstance known to you, including the consistency of the activity with the information obtained under Chapter III and the customer’s risk profile. Where necessary you must prioritise assessment by reference to the urgency of the transaction and the risks affecting the Member State in which you are established.
- What must be on file
- The basis for the suspicion, and, where prioritisation was applied, why some assessments were taken before others
- Basis
- Article 69(1) and (2) AMLR
- Status
- Level 1
Two points in Article 69 are easy to miss. Attempted transactions are reportable, and so are suspicions arising from the inability to complete customer due diligence, so a failed onboarding can itself be a report. And prioritisation is expressly permitted, which means the decision to defer an assessment is a decision within the rule rather than a departure from it.
Context: Item 45, AMLA ITS on the format for reporting suspicions and providing transaction records (Article 69(3) AMLR)
2027
Commission decision due on the three standards submitted on 1 October 2026: customer due diligence, business relationships and transaction classification, and group-wide arrangements
About 1 January 2027- Who it reaches
- All obliged entities. Nothing in these three standards can be relied on as final until the Commission has adopted them.
- Basis
- Article 49(1) AMLAR, three months from receipt of the draft
- Status
- Practical implication
The Commission must inform the Parliament and the Council in due time if it cannot decide within the three months, so the date can slip without anything being wrong. Article 49(1) also covers the case where the Commission does not simply adopt. It may adopt in part or with amendments where the Union’s interests so require. It must then send the draft back to AMLA with its reasons. AMLA has six weeks to amend the draft and resubmit it as a formal opinion. If AMLA does not, or does not amend consistently with what was proposed, the Commission may adopt with its own amendments or reject outright. Objection periods for the Parliament and the Council run after adoption, so a standard can still fail to enter into force.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
National authorities collect, from the entities in the provisional eligibility pool, the data points in the annex to the Article 12(7) RTS and the eligibility data
31 March 2027- Who it reaches
- Credit institutions, financial institutions and crypto-asset service providers that made it into the provisional pool, which is drawn from the eligibility template returned in 2026. Returning the template does not by itself put a firm in the pool.
- Basis
- AMLA FAQ on provisionally eligible obliged entities, and the annex to the Article 12(7) RTS
- Status
- Final AMLA text
The earlier round, the eligibility collection on 2025 data, reached AMLA through national supervisors by 15 August 2026. This round is the one that decides the list.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
Latest date for AMLA to commence the first selection process for direct supervision
By 1 July 2027- Who it reaches
- The entities in the eligible pool. Selection is on the published methodology, not on an invitation.
- Basis
- Article 13(4) AMLAR
- Status
- Level 1
At the latest, nine days before the AMLR itself applies. A selected entity is therefore chosen on 2026 and early-2027 data, against a framework that is not yet in force.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
The Anti-Money Laundering Regulation applies directly in every Member State, and most of the sixth Anti-Money Laundering Directive must be in national law
10 July 2027- Who it reaches
- Every obliged entity except professional football clubs and football agents, to which the Regulation applies from 10 July 2029. The Regulation needs no national law in between. The Directive does, and a Member State that transposes late leaves its own firms reading two regimes at once.
- Basis
- Regulation (EU) 2024/1624, date of application; Directive (EU) 2024/1640, transposition deadline
- Status
- Level 1
This date is fixed and certain for every sector except football, which follows on 10 July 2029. Some provisions of the Directive have their own transposition dates: Article 74 by 10 July 2025, Articles 11, 12, 13 and 15 by 10 July 2026, and Article 18 by 10 July 2029. Most of the Level 2 standards below do not apply on this date.
Context: Item 35, What happens to the AMLD4 Level 2 measures when Directive (EU) 2015/849 is repealed
The three standards submitted on 1 October 2026 begin to apply, six months after their entry into force
About September 2027 to February 2028- Who it reaches
- All obliged entities, except football clubs and agents.
- Basis
- Entry into force twenty days after publication; application six months later
- Status
- Practical implication
An estimate, built from an assumed Official Journal publication between February and July 2027. The six-month deferral was granted deliberately, to give firms time to adapt systems, policies and training: the consulted drafts did not provide for it.
Context: Item 5, AMLA RTS on business relationships and transaction classification (Article 19(9) AMLR)
The methodology for assessing the inherent and residual risk profile of obliged entities applies, financial sector
31 December 2027- Who it reaches
- Every financial-sector obliged entity, through its own national supervisor. Not a reporting duty you discharge; a scoring method applied to you.
- Basis
- Article 40(2) AMLD, final RTS, financial-sector phase
- Status
- Final AMLA text
A fixed calendar date rather than a period after entry into force, and it falls after the AMLR applies. The thresholds and weights AMLA sets for each review cycle are what determine the score, and they are not in the instrument.
Context: Item 47, AMLA RTS on the methodology for assessing the risk profile of obliged entities (Article 40(2) AMLD): the financial-sector phase
Operators of trading platforms must have a white paper drawn up, notified, published and updated for crypto-assets other than asset-referenced and e-money tokens admitted to trading before 30 December 2024
31 December 2027- Who it reaches
- Operators of crypto-asset trading platforms.
- Basis
- Article 143(2)(b) MiCA
- Status
- In force now
A MiCA disclosure obligation, not an anti-money laundering one. It is on this calendar because it lands on the same small teams in the same quarter as the AML/CFT standards.
Context: Item 36, Markets in Crypto-Assets Regulation (MiCA), the instrument that defines the AML perimeter for crypto
AMLA reports to the Commission on all legal obstacles in sectoral legislation that prevent information exchange between authorities and with other entities
11 November 2027- Who it reaches
- Nobody directly. It matters because the same report may address non-material, obsolete, duplicative or otherwise irrelevant reporting requirements, and the Commission is then to put a legislative proposal where appropriate. It is the dated route to getting a reporting requirement removed.
- Basis
- Article 92a(11) AMLAR, inserted by Regulation (EU) 2025/2088
- Status
- Level 1
To be produced in close cooperation with the financial supervisors and updated regularly thereafter. The undated companion route is Article 55(1), under which AMLA’s opinions may address whether redundant or obsolete reporting requirements ought to be removed, after consulting stakeholders.
Context: Item 43, Amendment of the AMLA Regulation: simplification and reporting-burden mandate (Regulation (EU) 2025/2088)
2028
The first selection process concludes and the list of selected obliged entities is published
About 1 January 2028- Who it reaches
- Selected entities, who learn their status on publication.
- Basis
- Article 13(4) AMLAR: within six months of commencement, published without undue delay
- Status
- Practical implication
This is the latest permitted date, not an announced one. AMLA has given no undertaking to publish the provisional pool beforehand, so for most firms the first confirmation is the final list.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
Direct supervision by AMLA commences for the selected entities
About mid-2028- Who it reaches
- Selected entities only. Everyone else stays with a national supervisor, scored on the Article 40(2) methodology below.
- Basis
- Article 13(4) AMLAR: six months after publication of the list
- Status
- Practical implication
Six months between learning you are selected and being supervised directly. The process then repeats every three years from the commencement of the first selection.
Context: Item 11, AMLA direct-supervision selection methodology (“models for selection”)
Transposition deadline for most provisions of the Anti-corruption Directive
1 June 2028- Who it reaches
- Member States, not firms directly. It reaches firms through national law and through what their supervisors are then expected to look for.
- Basis
- Directive (EU) 2026/1021, in force since 1 June 2026
- Status
- Level 1
Context: Item 1, Anti-corruption Directive
Machine-readable transmission under Article 3(2) of both EPPO reporting standards begins to apply, as do Article 3(4) on interoperability and Article 11 on supplementary exchanges of the Article 31(2) implementing standard
10 July 2028- Who it reaches
- Entities and authorities inside the FIU and EPPO reporting chain.
- Basis
- Article 3(2) of each EPPO reporting ITS; Articles 3(4) and 11 of the Article 31(2) ITS
- Status
- Final AMLA text
The rest of each instrument applies earlier: the EPPO standards from 10 July 2027, and the bulk of the Article 31(2) standard on entry into force, the twentieth day after publication. A respondent asked for the whole instrument to be aligned to 2028 with a roadmap of intermediate milestones. That was not granted.
Context: Item 42, AMLA implementing standards on FIU exchange formats and EPPO reporting (Article 31(2) AMLD, Article 81(1) AMLR, Article 41(2) AMLAR)
AMLA is to issue guidelines to supervisors on the characteristics of a risk-based approach to supervision and the measures to be put in place within supervisory authorities
10 July 2028- Who it reaches
- Supervisors. It reaches firms as the standard their supervisor is judged against.
- Basis
- Article 40(3) AMLD
- Status
- Level 1
Context: Item 20, Common supervisory methodology and handbook (convergence toolkit)
FIUs are to have implemented Ma³tch cross-matching in FIU.net
10 July 2028- Who it reaches
- FIUs. A full positive hit in Ma³tch triggers a dissemination, so it changes what happens to a report after it leaves you.
- Basis
- Draft RTS under Article 31(3) AMLD, as consulted
- Status
- Draft only
Context: Item 41, AMLA RTS on when a suspicious transaction report concerns another Member State (Article 31(3) AMLD)
2029 and beyond
Professional football clubs and football agents: the Anti-Money Laundering Regulation applies to them, and so do the customer due diligence, transaction-classification, group-wide and enforcement standards
10 July 2029- Who it reaches
- Professional football clubs and football agents, the obliged entities in Article 3, points (3)(n) and (o) AMLR. No deferral for anyone else.
- Basis
- Article 90 AMLR for the obliged entities in Article 3, points (3)(n) and (o), carried into each standard
- Status
- Final AMLA text
In the enforcement standards the general application date is still to be confirmed on adoption, while this date is not. The football deferral is therefore the firmer of the two.
Context: Item 4, AMLA RTS on customer due diligence (Article 28(1) AMLR)
The Commission’s assessment of national reporting systems
10 July 2032- Who it reaches
- Nobody directly. It is the date by which the present arrangement is reviewed, which is the context for anything built to a national format in the meantime.
- Basis
- Article 87, point (a) AMLR, first review
- Status
- Level 1
The draft implementing standard on reporting formats separately provides that it may be reviewed every four years once technical implementation is achieved. Until the reporting format converges, the practical answer stays whatever your own FIU accepts.
Context: Item 45, AMLA ITS on the format for reporting suspicions and providing transaction records (Article 69(3) AMLR)