I joined a webinar last week for a discussion on evidencing AMLR implementation. A lot of the conversation came back to an issue that I think will become increasingly important as firms move from interpretation and gap analysis into delivery.
How do you demonstrate, not just that you have made changes, but that those changes address the original requirement and work in practice?
It is a theme we have been discussing with clients for some time: the need for a “golden thread” running through the programme, connecting the requirements to the gaps identified, the changes made and ultimately the evidence that those changes are working.
July 2027 isn't really the finish line
There is understandably a lot of attention on 10 July 2027. Firms have a significant amount to do before then, across CDD, governance, data, technology, risk assessment and other parts of the financial crime framework.
But I don't think firms should think of July 2027 as the point at which the work is finished.
To use a Formula 1 analogy, July 2027 is closer to the start of the race than the chequered flag. By that point, the organisation has to have implemented its position and be able to stand behind it. Evidence of how well those controls operate will continue to develop afterwards.
So the real AMLR deliverable isn't simply a completed project plan or a series of closed gaps. It is a defensible position.
A firm should be able to explain what it understood the requirement to mean, what it found when it assessed its existing environment, what it decided to change, why it made that decision and how it knows the resulting control works.
Requirement → interpretation → control design → implementation → outcome → evidence
The lineage needs to be clear enough for someone to retrace the decisions and evidence several years later.
Keeping the chain intact
Most large firms know how to run a regulatory gap assessment, but implementation becomes harder because ownership is spread across different teams.
One team may interpret the requirement. Another owns the policy. A business team owns the control. Technology implements a system change. Operations writes the procedures. The data needed to operate or evidence the control may sit somewhere else again.
Multiply that across business lines, products, jurisdictions and legal entities, and every team could complete its allocated activity while the organisation still struggles to demonstrate a coherent line from the regulation to the eventual outcome.
The quality of the interpretation record therefore matters.
AMLR retains a risk-based approach, while introducing a more harmonised and, in a number of areas, more prescriptive framework with a higher “floor” than before. Firms will still exercise judgement, and those judgements need to be explicit.
What did we interpret the requirement to mean? What assumptions did we make? What uncertainty remained? Who challenged and approved the position? If an assumption changes as further regulatory material is finalised, what needs to change as a result?
At the Nordic conference, one of our recommendations was simple: write the assumptions down. Treat changes to them as genuine change control and, where necessary, approve a position conditionally rather than pretending certainty exists where it doesn't.
That provides a much stronger record than a spreadsheet cell moving from amber to green.
Define what “done” means before you start delivery
Before implementing a change, firms need to be clear about what they are actually trying to achieve.
There is an important distinction between a delivery plan and a definition of done. The delivery plan tells you the activities you intend to complete. The definition of done describes the outcome those activities need to produce, the scope across which that outcome needs to hold, and the evidence that will demonstrate you have got there.
Updating policy, changing systems, updating the customer risk model or delivering training may all appear on an AMLR plan. Completing those activities tells you that the work has been carried out. It doesn't, on its own, tell you that the underlying requirement has been met.
The better approach is to work backwards from the required outcome. For each material obligation or work package, define what needs to be true when the work is complete and how you will know. Crucially, agree that definition before delivery starts rather than creating it retrospectively to fit what has been delivered.
Without a clear definition of done, programmes can report that activities are complete while still struggling with the more fundamental question: have we actually achieved the outcome we set out to achieve, and can we prove it?
That discipline strengthens the evidence chain. The obligation defines what needs to change; the firm's interpretation establishes the outcome and scope; implementation delivers the change; and the definition of done provides the basis for demonstrating that it is genuinely complete.
Governance should record judgement, not just progress
There is a related implication for governance.
On a programme of this scale, governance cannot simply be a series of steering committees receiving progress updates. They need to include the right people who can make decisions, challenge designs, accept risk and push back where necessary.
A proposed control design may involve judgement about scope, residual risk or how a requirement has been interpreted. Those decisions need effective challenge and, where appropriate, formal approval by people with the authority to make them.
The reasoning matters as much as the decision. If a firm accepts a particular interpretation, approves a design conditionally or accepts a known residual risk, the record should explain what was considered, why the decision was reached and who approved it.
That becomes another part of the evidence chain, allowing someone looking back later to understand not just what was implemented, but the decisions and judgements that shaped it.
Spreadsheets have their limits
Many firms still manage regulatory mapping through large spreadsheets. They can be useful for analysis and tracking. The problem comes when the spreadsheet becomes the institutional memory of the programme.
Will somebody looking at a cell three years later understand the interpretation behind it, the assumptions made, what challenge took place and which evidence justified closure?
More importantly, can they trace that requirement into the policies, procedures, systems, data and operational controls that now depend upon it?
Firms need to retain that lineage alongside the project artefacts. It also creates a better starting point for subsequent changes to products, customer journeys, operating models or technology because the organisation can understand why the existing control environment looks the way it does.
Delivery pressure is becoming the immediate issue
Many firms have undertaken substantial interpretation and gap-analysis work, while fewer appear to have moved decisively into detailed planning and implementation.
That matters because AMLR is not delivered by Compliance alone. Material changes may depend on technology release cycles, data, Operations, governance, customer processes and teams across multiple entities. Delivery capacity therefore matters just as much as regulatory interpretation.
The six-month window associated with some CDD requirements shouldn't become a new implementation deadline. I would treat it as contingency and plan delivery accordingly.
That requires clear ownership, dedicated capacity, a view of interdependencies and an honest understanding of what remains outstanding. Throughout delivery, the evidence chain needs to remain intact.
The question I would be asking AMLR programme teams now is whether, for one of the organisation's most material requirements, somebody could follow the trail from the regulation, through its interpretation and approval, into the control design, implementation and evidence that the control is operating as intended.
And could they do the same across the rest of the material obligations, including explaining what remains open, why, and who owns it?
That is the standard I think firms should be working towards.
Because when those decisions are challenged in future, the quality of that record will matter.
