How to prepare effectively for AMLR while the detail is still moving

Regulation waits for no one – AMLA is already pushing forward with testing its risk assessment data requirements. This work is currently directed at national supervisors (such as BaFin), which are already consulting with firms in their jurisdictions to support their obligations to AMLA.

Much of the operational detail will arrive through AMLA’s future work, with eighteen final texts due to be published in Q3 and Q4 2026 and two more in Q1 2027. That timeline is not a reason to pause. AMLR was designed as a structural change in rulemaking and supervision, with some interpretive detail around practical implementation intentionally deferred rather than omitted.

For senior leaders, the practical question is simple. Can you explain, today, how AMLR will affect your footprint, where the likely pressure points are, and what your plan is between now and July 2027? If the answer is no, the issue sits with governance rather than legal interpretation.

Several parts of AMLR are already explicit enough to assess without waiting for further technical standards. For example, there are mandatory review cycle maxima, business--day timelines, required content for business-wide risk assessments, defined internal roles and responsibilities, and minimum policy requirements already clear in the text.

That gives firms a sensible starting point. You do not need to predict every future expectation to identify obvious misalignment. If your current review cycles are longer than the AMLR text allows, that is a real issue now. If your policy set or governance model does not meet the minimum expectations already stated, that is already visible. Firms should not assume later guidance will dilute points that are already set out plainly in the regulation.

Based on our experience, the sentiment of guidance does not usually change between consultation and final text. Therefore, it would be prudent to get familiar with the twenty-two consultations being launched in 2026/7 as they are released, putting in place a plan to assess and respond as consultations are finalised, rather than waiting for final texts.

Not every firm needs the same level of activity at this stage. Firms likely to fall within AMLA’s directly supervised population should already be mobilising in a meaningful way. For them, waiting for full clarity won’t be an option. They are visible, easier to identify, and likely to feel the pressure earliest.

While final confirmation of the directly supervised population will come later, most firms can already form a working view based on footprint, cross-border activity and scale.

For firms more likely to sit outside that group, a proactive but proportionate approach still makes sense. This means active assessment, clear ownership and documented decisions. It means understanding the regulation, testing the requirements that are already clear and assessing how EU exposure affects the wider group. A good example is the risk assessment data AMLA requires. All firms in the relevant EU member state will need to produce the data to determine whether they fall inside or outside AMLA’s supervisory risk-based approach. Any changes needed to find and report this data will sit with the firm, even if it is obvious from size and scale that they would not be among the top 40.

Even where the impact is limited, every MLRO or compliance leader should reach a considered position within a timeframe that makes sense for their organisation.

Boards do not need a dramatic message. They need to know whether this is a horizon-scanning item, a readiness exercise or a more active programme, and why.

While firms may not yet need a formal strategy deck, they should already have a working position that demonstrates understanding and ownership. A short internal paper is a practical way to capture this.

For firms that are close to the threshold for AMLA direct supervision (i.e. operates across 6 EU member states; total of ≥ 20,000 customers), this should go further. They should be running a structured, iterative gap analysis with clear governance, with outputs reported through Risk Co or an equivalent forum.

For all other firms, the initial internal paper should cover four areas.

• First, your scope and footprint. Which legal entities, business lines and jurisdictions are affected, directly or indirectly, and on what basis this has been determined.
• Second, the points already clear enough to assess now, along with any material gaps identified and a clear plan for how and when testing will be carried out as further detail is finalised.
• Third, the areas where decisions are being deferred pending RTS or guidance, with named ownership and a trigger for revisiting them to enable active monitoring so they do not inadvertently slip off the radar.
• Fourth, the governance route for oversight and escalation, including how updates reach senior committees or the board and where overall responsibility and accountability sit.

This exercise is most effective when led by operations or a 1LOD advisory team, with a combined 1LOD and 2LOD structure providing oversight and challenge.

The structure of this paper might sound basic, but it gives leaders something many firms still lack on AMLR: a defensible narrative. If challenged, you can show that you have separated known requirements from open questions, assigned accountability and avoided both complacency and overreaction. That is a much stronger place to be.