AMLR Compass
Navigating tomorrow. Understanding the new regulation. Structuring implementation.
Overview
Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR) is a central component of the EU anti-money laundering package adopted in 2024. Through the AMLR, the EU introduces a single rulebook: uniform, directly applicable regulation are intended to close gaps and reduce divergences between national regulation and to further harmonise the prevention of money laundering and terrorist financing. The AMLR also addresses the risks of non-implementation and evasion of targeted financial sanctions.
The AMLR applies in the EU Member States from 10 July 2027. Its application in the EEA States, including Liechtenstein, will depend on the timing and terms of its incorporation into the EEA Agreement.
The AMLR may also be relevant to Swiss financial intermediaries, for example through a branch or subsidiary in the EU/EEA, or as part of a group with obliged entities in the EU/EEA.
Unlike Directive (EU) 2024/1640 (AMLD6), which also forms part of the EU anti-money laundering package, the AMLR does not need to be transposed into national law of the EU Member States, as it is directly applicable. Therefore, the due diligence requirements applicable to obliged entities will in future derive predominantly from the AMLR itself.
With the AMLR Compass, reeeg helps you navigate this paradigm shift. The AMLR Compass focuses exclusively on the requirements of the AMLR.
Navigating tomorrow: The AMLR Compass maps the new articles of the AMLR to familiar subject areas, making it easier to locate the relevant provisions.
Understanding the new regulation: The AMLR Compass explains the new provisions of the AMLR and makes the resulting obligations easier to understand.
Structuring implementation: To support a structured implementation, reeeg has supplemented the AMLR Compass with potential areas for action. These serve as a first set of guidance for practical implementation. reeeg will be pleased to provide you with the AMLR Compass including the areas for action, free of charge upon request.
Disclaimer
The content is provided for general information and guidance. It does not constitute legal advice or a binding legal interpretation. It is not a substitute for consulting the binding legal sources or assessing the circumstances of an individual case. The AMLR Compass makes no claim to be complete or up to date.
The AMLR
The AMLR: Regulation (EU) 2024/1624
As Union law, the AMLR must be interpreted autonomously. National concepts and methods of interpretation are not determinative; a uniform understanding across the EU is essential. Interpretation takes account not only of the wording but also of the context and objectives of the provision. Recitals may provide supplementary guidance, provided that they do not contradict the operative provisions. The different language versions may also provide guidance. In addition, provisions must be interpreted in a manner that ensures their practical effectiveness (effet utile). The FATF Recommendations may also be taken into account as a supplementary aid to interpretation.
With the AMLR, the EU legislature expressly retains the risk-based approach and specifies its application within the single rulebook. The risk-based approach therefore shapes the implementation of obligations within the limits laid down by the AMLR. As before, however, it does not apply to the non-implementation or evasion of targeted financial sanctions.
The AMLR is supplemented by Level 2 and 3 measures.
Regulatory technical standards (RTS): These specify particular requirements of the AMLR.
Implementing technical standards (ITS): These lay down uniform technical or procedural details to ensure that particular requirements are applied consistently.
Guidelines (GL) and recommendations (REC): These instruments are published by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). They clarify requirements and support consistent supervision and application.
AMLA provides an overview of its regulatory mandates and their current status on its website. AMLA: regulatory instruments and current status
Certain guidelines issued by the European Banking Authority (EBA) continue to apply until new AMLA regulatory instruments on the same subjects enter into force (Article 54(5) of Regulation (EU) 2024/1620, AMLAR). AMLA also lists on its website the applicable technical standards that remain in force (AMLA: applicable EBA / EC instruments).
Definitions
AMLR Article 2 | Definitions
This Article defines key terms used in the AMLR and establishes a uniform conceptual framework throughout the Union. It defines, for example, “criminal activity” (point (3)), “politically exposed person” (point (34)) and “management body” (point (37)). The definitions apply across the EU anti-money laundering package.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Scope
AMLR Articles 3–8 | Obliged entities, exemptions and cross-border activities
These Articles determine which natural and legal persons are covered as obliged entities. The AMLR harmonises the categories of obliged entities and regulates certain exemptions and cross-border activities directly at European level.
For example, investment migration operators, football agents and professional football clubs are newly included among obliged entities.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Internal organisation
AMLR Article 9 | Internal policies, procedures and controls
AMLA guidelines under Article 9(4)
This Article requires internal policies, procedures and controls to ensure compliance with legal requirements and to manage and mitigate the risks of money laundering, terrorist financing and the non-implementation and evasion of targeted financial sanctions.
They shall cover, in particular:
- business-wide risk assessment and risk management;
- customer due diligence and reporting of suspicions;
- outsourcing and reliance on other obliged entities;
- record retention and the processing of personal data;
- monitoring compliance with internal requirements and remedying deficiencies;
- assessment of the integrity of employees, internal communication and training for employees and, where applicable, other persons involved;
- internal controls and an independent audit function to test those policies, procedures and controls.
Policies, procedures and controls must be recorded in writing, kept up to date and improved where weaknesses are identified. Internal policies require approval by the management body in its management function; procedures and controls must be approved at least at the level of the compliance manager.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Business-wide risk assessment
AMLR Article 10 | Business-wide risk assessment
AMLA guidelines under Article 10(4)
AMLA guidelines under Article 32
This Article lays down the requirements for the business-wide risk assessment (BRA). It must take account of the risk variables in Annex I and the risk factors in Annexes II and III, the findings of the risk assessment at Union level, national risk assessments relevant to the obliged entity and other information made available internationally and nationally. This includes publications on risks, trends and methods, including those issued by AMLA under Article 32, and FIU alerts. The business-wide risk assessment must cover risks relating to customers, countries or geographical areas, products, services, transactions and delivery channels.
In addition to money laundering and terrorist financing, the business-wide risk assessment must address risks associated with the non-implementation or evasion of targeted financial sanctions.
The business-wide risk assessment must be kept up to date and reviewed regularly.
The business-wide risk assessment is drawn up by the compliance officer and must be approved by the management body in its management function.
Interaction between the BRA and the CRA
The business-wide risk assessment (BRA) and the individual customer risk assessment (CRA) are interlinked. The BRA provides the framework for understanding risks. For example, it identifies products, countries, delivery channels or customer structures that expose the obliged entity to higher risks. The CRA builds on this framework to assess which risks are actually present for a particular customer and which due diligence measures are required as a result.
Findings from customer due diligence and ongoing monitoring feed back into the review and updating of the BRA. For example, where similar unusual transaction patterns are identified across several customers, consideration must be given to whether a risk has previously been underestimated and whether the assessment methodology or controls need to be adjusted. Conversely, changes to the BRA call for a review of the customer risk assessments and measures affected.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Compliance functions and AML Officer
AMLR Article 11 | Compliance functions
This Article sets out responsibilities at management and compliance level. One member of the management body in its management function must be appointed as the “compliance manager”. Obliged entities must also have an AML officer. The Article lays down the requirements, tasks and responsibilities of these functions and establishes internal organisational measures.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Training, awareness and integrity
AMLR Articles 12–14 | Awareness of requirements, integrity of employees and reporting of breaches
These Articles govern training and awareness, integrity requirements for certain employees, internal reporting of breaches and special safeguards for employees exposed to risks.
The training obligation also extends to obliged entities’ agents and distributors.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Group-wide requirements
AMLR Articles 16–17 | Group-wide requirements
RTS under Article 16(4) and Article 17(3)
Article 16 requires a parent undertaking to ensure compliance throughout the group with the requirements relating to internal procedures, risk assessment and employees. For groups whose head office is located in the Union, this obligation also extends to the group's branches and subsidiaries in third countries. The term "parent undertaking" is defined in Article 2(1), point (42). It covers, on the one hand, groups whose head office is located in the Union and, on the other hand, subject to further conditions, an obliged entity established in the Union that belongs to a group whose head office is located outside the Union, where the group includes at least two subsidiaries that are obliged entities established in the Union.
The group-wide requirements include, among other things, the preparation of a group-wide risk assessment and the exchange of information within the group. The exchange of information must be ensured both horizontally and vertically between group entities. It covers, in particular, the identity and characteristics of the customer and the customer's beneficial owners, the nature and purpose of the business relationship, and suspicious transaction reports, including the underlying analyses. The RTS set out a detailed list of the information to be shared.
Article 16 also provides for the establishment of compliance functions at group level and, where justified by the group's activities, of an AML officer, and sets out their reporting obligations.
Article 17 governs the group-wide requirements in relation to branches and subsidiaries in third countries.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Outsourcing
AMLR Article 18 | Outsourcing
AMLA guidelines under Article 18(8)
This Article sets out the framework for outsourcing tasks to service providers. The obliged entity remains fully liable for compliance with its obligations. Certain tasks may not be outsourced. The obliged entity must retain control over the outsourced tasks and ensure that supervisors have access to the relevant information.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Application of customer due diligence
AMLR Article 19 | Application of customer due diligence measures
RTS under Article 19(9)
Article 19 determines when customer due diligence measures must be applied, in particular when establishing a business relationship; when carrying out occasional transactions with a value of at least EUR 10 000 (lower thresholds apply in certain cases); when participating in the creation of legal entities or the setting up of legal arrangements; in connection with certain transfers of ownership; where money laundering or terrorist financing is suspected, irrespective of thresholds and exemptions; and where there are doubts about customer identification data or the identity of the customer or the customer’s representative.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Scope of customer due diligence
AMLR Articles 20–21 | Customer due diligence measures and inability to comply
RTS under Article 28(1)
AMLA guidelines under Article 26(5)
Article 20 sets out the core elements of customer due diligence:
- identifying the customer and verifying the customer’s identity;
- identifying the beneficial owners, verifying their identity and understanding the ownership and control structure;
- understanding and assessing the purpose and nature of the business relationship;
- screening for targeted financial sanctions;
- obtaining and assessing information on the customer;
- conducting ongoing monitoring of the business relationship and transactions;
- determining whether relevant persons are politically exposed persons, their family members or persons known to be close associates;
- identifying and verifying the identity of other persons on whose behalf or for whose benefit activities are carried out;
- identifying representatives and verifying their identity and authority to act.
The obligation to screen targeted financial sanctions applies to the customer or the beneficial owner(s), including the entities in the ownership chain. Additional requirements under individual sanctions regimes remain unaffected.
The extent of customer due diligence measures is determined on the basis of an individual assessment of money laundering and terrorist financing risks.
Under Article 21, an obliged entity that is unable to comply with the customer due diligence measures under Article 20 must refrain from establishing a business relationship or carrying out a transaction, terminate an existing business relationship and consider submitting a suspicious transaction report.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Customer risk assessment (CRA)
AMLR Article 20(2) | Determining customer risk
RTS under Article 28(1)
AMLA guidelines under Article 20(3)
(Note: The draft guidelines under Article 20(3) AMLR were scheduled for 10 July 2026. Until AMLA publishes those guidelines, the EBA guidelines on risk factors continue to apply until the new AMLA regulatory instruments enter into force, pursuant to Article 54(5) AMLAR.)
Article 20(2) requires an individual assessment of the customer’s money laundering and terrorist financing risks. The assessment must consider the specific characteristics of the customer and of the business relationship or occasional transaction, taking into account the business-wide risk assessment under Article 10 AMLR, the risk variables in Annex I and the risk factors in Annexes II and III.
Interaction between the BRA and the CRA
The business-wide risk assessment (BRA) and the individual customer risk assessment (CRA) are interlinked. The BRA provides the framework for understanding risks. For example, it identifies products, countries, delivery channels or customer structures that expose the obliged entity to higher risks. The CRA builds on this framework to assess which risks are actually present for a particular customer and which due diligence measures are required as a result.
Findings from customer due diligence and ongoing monitoring feed back into the review and updating of the BRA. Conversely, changes to the BRA call for a review of the customer risk assessments and measures affected.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Customer identification
AMLR Articles 22–23 | Identification and verification of the customer’s identity and timing
RTS under Article 28(1)
Articles 22 and 23 govern the identity information to be collected, the verification of the customer’s identity and the timing of verification. Identification comprises two steps: (1) establishing and collecting the relevant details and (2) verifying the information used for identification on the basis of identity documents, electronic identification means or other reliable and independent sources.
The prescribed identification data include, for example, all names and surnames and all nationalities.
The identification must be completed before a business relationship is established.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Beneficial ownership
AMLR Articles 22–23 | Identification and verification of the beneficial owner’s identity
AMLR Articles 51–67 | Identification of beneficial owners
RTS under Article 28(1)
Articles 22 and 23 govern the identity information to be collected, the verification of the beneficial owner’s identity and the timing of verification. Identification comprises two steps: (1) establishing and collecting the relevant details and (2) verifying the information used for identification on the basis of identity documents, electronic identification means or other reliable and independent sources.
The prescribed identification data include, for example, all names and surnames and all nationalities. The required data apply to all types of beneficial owners.
The identification of the beneficial owner must be completed before a business relationship is established.
Articles 51–67 lay down rules for identifying the beneficial owners of legal entities, legal entities similar to express trusts (such as foundations), express trusts and similar legal arrangements, and collective investment undertakings. Data must also be collected on intermediary entities. The two criteria for determining beneficial ownership — ownership interest and control — apply independently and in parallel.
For indirect ownership structures, the calculation is generally based on multiplying the shares, voting rights or other ownership interests held by intermediary entities in the chain of entities in which the beneficial owner holds shares or voting rights, and adding the results from the different chains, unless the specific rule in Article 54 applies.
The central register of beneficial ownership must be consulted to verify the information on the beneficial owners identified. However, the central register is not a “golden source”: consulting it does not replace the obliged entity’s own verification.
Under Article 22(2), senior managing officials (SMOs) must be identified as a fallback where no beneficial owners could be identified using the procedures under Article 51 et seq. SMOs are therefore not beneficial owners.
Article 67(4) imposes an obligation on obliged entities whose risk level is classified as medium-high or high (for example, credit institutions and financial institutions) to assist third-country entities, when establishing a business relationship, in relation to their obligation to register in the central register of beneficial ownership.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Business relationship profile
AMLR Article 25 | Purpose and intended nature of the business relationship
RTS under Article 28(1)
Article 25 requires the purpose and intended nature of a business relationship or occasional transaction to be established and understood. In addition, information must be obtained on a risk-sensitive basis on the estimated amount of the envisaged transactions, the source and destination of funds, and the customer’s business activity or occupation. The scope and depth depend on the customer’s risk and encompass the information necessary to understand the expected business activity.
The content of the business relationship profile is also determined by the information required for the customer risk assessment and ongoing monitoring.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Ongoing monitoring, KYC reviews and updating customer information
AMLR Article 26 | Ongoing monitoring of the business relationship and transactions
RTS under Article 28(1)
AMLA guidelines under Article 26(5)
Article 26(1) requires ongoing monitoring of the business relationship and the transactions undertaken throughout its course. Activities must be monitored for consistency with the obliged entity’s knowledge of the customer, the customer’s business and risk profile and, where necessary, information on the source and destination of funds. The aim is to identify transactions that require a more thorough assessment with a view to a possible reporting of suspicions.
Where business relationships cover more than one product or service, obliged entities must ensure that customer due diligence measures cover all those products and services.
Where obliged entities form part of a group and maintain business relationships with customers who are also customers of another undertaking in the group, information on those other business relationships must be taken into account when monitoring their own business relationship. This applies irrespective of whether the other group undertaking is itself an obliged entity under the AMLR or is not subject to AML/CFT requirements. This constitutes a separate obligation that goes beyond the requirements for group-wide information sharing under Art. 16 AMLR.
Article 26(2) lays down maximum intervals for updating customer information: the period between two updates must not exceed one year for higher-risk customers to whom enhanced due diligence measures apply, and five years for all other customers.
Findings from ongoing monitoring feed into the business-wide risk assessment (BRA). For example, where similar unusual transaction patterns are identified across several customers, consideration must be given to whether a risk has previously been underestimated and whether the assessment methodology or controls need to be adjusted. Conversely, changes to the BRA call for a review of the ongoing monitoring measures affected.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Targeted financial sanctions
AMLR Article 27 | Temporary measures for customers subject to UN financial sanctions
RTS under Article 28(1)
Article 27 AMLR lays down temporary record-keeping obligations in relation to new UN financial sanctions. Pending their application at Union level, obliged entities must record the funds and other assets managed for the customers concerned at the time the UN sanctions are made public, together with transactions attempted and transactions carried out. This covers both customers directly subject to sanctions and customers controlled by sanctioned persons or entities, or in which such persons or entities hold, individually or jointly, more than 50 % of the proprietary rights or have a majority interest. The information used is generally the data collected through customer due diligence. Additional information available, for example from organisational charts obtained on a risk-sensitive basis, must be taken into account where relevant.
The AMLR links the prevention of money laundering with sanctions compliance. In addition to money laundering and terrorist financing, the risks of non-implementation and evasion of targeted financial sanctions are included as an additional dimension in the business-wide risk assessment and internal controls. Sanctions checks also become part of customer due diligence: obliged entities must check customers, their beneficial owners and relevant ownership and control structures for sanctions exposure and continue those checks as part of ongoing monitoring.
Additional requirements under individual sanctions regimes remain unaffected.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Simplified due diligence
AMLR Article 33 | Simplified due diligence
RTS under Article 28(1)
Article 33 permits simplified due diligence measures where the business relationship or transaction presents a low degree of risk. Simplification concerns the extent, timing or frequency of individual measures. However, identification itself may not be simplified or waived; only the verification of identity may be deferred.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Enhanced due diligence
AMLR Article 34 et seq. | Enhanced due diligence
RTS under Article 28(1)
AMLA guidelines under Article 34(5)
Article 34(1) determines when enhanced due diligence measures must be applied and how they must be designed. They are mandatory both in the cases expressly specified and where the obliged entity identifies higher risks.
The AMLR provides for the following mandatory cases for enhanced due diligence:
Relevant third-country links under Articles 29–31: business relationships and transactions involving third countries classified accordingly.
Cross-border correspondent relationships with respondent institutions in third countries, including correspondent relationships involving crypto-asset service providers (Articles 36 and 37).
Applicants for residence permits in exchange for investment in a Member State (Article 41).
Politically exposed persons (PEPs), their family members and persons known to be close associates; continuing risks must be considered for former PEPs (Articles 42, 45 and 46).
PEPs as beneficiaries of life insurance or other investment-related insurance policies (Article 44).
Other mandatory higher-risk situations specified under national requirements or Commission delegated acts (Article 34(6) and (7)).
For ultra-high-net-worth (UHNW) customers, Article 34(5) provides for additional due diligence measures where the customer presents a higher risk and has total wealth of at least EUR 50 million, and wealth management services involving assets of at least EUR 5 million are provided to that customer.
Article 34(2) requires obliged entities to examine the origin and destination of funds involved in, and the purpose of, transactions that are complex or unusually large, are conducted in an unusual pattern or have no apparent economic or lawful purpose.
Enhanced measures must be proportionate to the risks identified. They may include additional information on customers, beneficial owners, the source of funds and source of wealth, and the background to transactions, as well as senior management approval and more intensive monitoring. One possible measure is to require the first payment to be made through an account in the customer’s name with a credit institution subject to customer due diligence standards that are not less robust than those laid down in the AMLR (a so-called “one-cent transfer”).
A suspicious transaction report must be submitted promptly, irrespective of the amount involved, where the obliged entity knows, suspects or has reasonable grounds to suspect that funds or activities are related to criminal activities, their proceeds or terrorist financing. This also covers attempted transactions and suspicions arising from an inability to comply with customer due diligence requirements. The AML Officer transmits the suspicious transaction report to the competent FIU.
Suspicious transaction reports must be distinguished from reports to the FIU that do not depend on suspicion: those under Article 74 AMLR concerning transactions involving certain high-value goods, and those under Article 80(4) AMLR concerning the cash payments covered by that provision above the EUR 10 000 limit. Those reporting obligations apply irrespective of whether there is a suspicion. However, complying with them does not relieve obliged entities of the obligation to assess the circumstances for possible grounds for suspicion and, where appropriate, to submit a suspicious transaction report.
Requests for information from the FIU must generally be answered within five working days. The FIU may shorten the deadline in urgent cases or extend it where justified.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Politically exposed persons
AMLR Article 2(1), points (34), (35) and (36)
AMLR Articles 42–46 | PEPs, family members and persons known to be close associates
RTS under Article 28(1)
AMLA guidelines under Article 42(2)
Article 2(1), point (34), defines “politically exposed person”. It expands the previous PEP definition, including by adding members of the governing bodies of political parties holding seats in regional or local executive or legislative bodies representing constituencies of at least 50 000 inhabitants, and heads of regional and local authorities, including groupings of municipalities and metropolitan regions with at least 50 000 inhabitants. Article 2(1), point (35), defines “family members”, and Article 2(1), point (36), defines “persons known to be close associates” (RCAs).
Article 42 provides for specific measures for occasional transactions or business relationships with PEPs. Under Article 46, these also apply to occasional transactions or business relationships with RCAs. The specific measures include obtaining senior management approval, establishing the source of wealth and source of funds, and enhanced ongoing monitoring. Obliged entities may take a risk-based approach when determining the extent of that ongoing monitoring, insofar as this is consistent with the requirements of the AMLA guidelines.
Under Article 45 AMLR, the customer risk assessment must take into account the continuing risks arising from a former PEP’s previous function. One or more enhanced due diligence measures under Article 34(4) must be applied for at least 12 months after the person ceases to hold that function and, beyond that period, until those risks no longer exist. This also applies to new business relationships or occasional transactions with former PEPs.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Reliance on third parties
AMLR Articles 48–50 | Reliance on other obliged entities
AMLA guidelines under Article 50
These Articles set out the conditions under which an obliged entity may rely on another obliged entity for certain customer due diligence measures. The obliged entity relying on the other entity remains ultimately responsible for compliance. Information must be transmitted without delay and no later than five working days. Reliance on other obliged entities must be distinguished from outsourcing under Article 18.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Analysis of suspicions, STRs/SARs and requests for information
AMLR Article 69 | Reporting of suspicions and requests for information
ITS under Article 69 (reporting format)
AMLA guidelines under Article 69(5) (indicators of suspicion)
Article 69 AMLR governs the analysis undertaken to assess whether a suspicion exists, the reporting of suspicions and cooperation with the financial intelligence unit (FIU). The analysis must take account of all relevant facts and information known or available, in particular customer characteristics, transaction patterns, the source and use of funds and the customer’s risk profile. Information held by other group undertakings must also be taken into account in that analysis (Article 17(3) and Article 26(1), third subparagraph).
A suspicious transaction report must be submitted promptly, irrespective of the amount involved, where the obliged entity knows, suspects or has reasonable grounds to suspect that funds or activities are related to criminal activities, their proceeds or terrorist financing. This also covers attempted transactions and suspicions arising from an inability to comply with customer due diligence requirements. The AMLofficer transmits the suspicious transaction report to the competent FIU.
Suspicious transaction reports must be distinguished from reports to the FIU that do not depend on suspicion: those under Article 74 AMLR concerning transactions involving certain high-value goods, and those under Article 80(4) AMLR concerning the cash payments covered by that provision above the EUR 10 000 limit. Those reporting obligations apply irrespective of whether there is a suspicion. However, complying with them does not relieve obliged entities of the obligation to assess the circumstances for possible grounds for suspicion and, where appropriate, to submit a suspicious transaction report.
Requests for information from the FIU must generally be answered within five working days. The FIU may shorten the deadline in urgent cases or extend it where justified.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Freezing of assets and prohibition of disclosure (“tipping off”)
AMLR Article 71 | Refraining from carrying out transactions
AMLR Article 73 | Prohibition of disclosure
Under Article 71, obliged entities must refrain from carrying out transactions which they know or suspect to be related to the proceeds of criminal activity or to terrorist financing until they have submitted a suspicious transaction report under Article 69 and complied with any specific instructions from the FIU. If the FIU issues no instructions to the contrary within three working days of the report, the transaction may be carried out after the obliged entity has assessed the associated risks. Where refraining from carrying out the transaction is impossible or would be likely to frustrate efforts to pursue the beneficiaries of a suspected operation, the transaction may be carried out and the FIU must be informed immediately afterwards.
Article 73 lays down the prohibition of disclosure. Obliged entities and persons acting on their behalf must not inform customers or third parties that a suspicious transaction report is being or has been submitted, that information is to be or has been transmitted to the FIU, or that a money laundering or terrorist financing analysis is being or may be carried out. Subject to the applicable statutory conditions, exceptions apply in particular to disclosures to competent authorities, within a group, within certain professional structures and between certain obliged entities involved in the same transaction.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.
Data protection, documentation and record retention
AMLR Articles 76–78 | Processing of certain categories of personal data, record retention and provision of records to competent authorities
Article 76 governs the processing of personal data under the AMLR. Personal data may be processed under the AMLR solely for the prevention of money laundering and terrorist financing; commercial use is prohibited. Special categories of personal data and data relating to criminal matters may be processed only where strictly necessary and subject to specific safeguards. These include information obligations, reliable and up-to-date data, protection against discrimination and high security standards. Additional requirements apply to decisions made through automated processes or artificial intelligence.
Article 77 governs record retention. The retention period is generally five years from the end of the business relationship, the carrying out of an occasional transaction, or the refusal to enter into a business relationship or carry out a transaction. Personal data must then be deleted unless other lawful retention obligations apply. Competent authorities may require an extension of up to a further five years in individual cases.
Article 78 governs the provision of records to competent authorities. Obliged entities must have systems enabling them to inform competent authorities swiftly and fully whether they maintain, or have maintained during the previous five years, a business relationship with specified persons, and of the nature of that relationship. Information must be provided through secure communication channels, and the confidentiality of requests must be ensured.
To support a structured approach to implementation, reeeg has added potential areas for action to the AMLR Compass. These provide guidance for practical implementation. reeeg is pleased to provide the AMLR Compass free of charge on request.