The implementing rules for the European Anti-Money Laundering Regulation (AMLR) are gradually taking shape. For investment firms, the draft texts clarify what is expected in terms of customer due diligence, risk assessment and ongoing monitoring. Although the details may still change, the proposals provide a basis for reviewing existing processes.
Preparing for the AMLR requires looking beyond the regulation itself. Many obligations are further elaborated in technical standards and guidelines issued by the European Anti-Money Laundering Authority (AMLA). Once adopted, the technical standards will become binding. The guidelines clarify how AMLA expects the rules to be applied consistently and on a risk-based basis.
Three areas are particularly relevant to the investment sector: what information client files must contain, how the business-wide risk assessment should be structured and when changes in a client’s circumstances should trigger further investigation.
1. Review client files for information and supporting evidence
The draft standards for customer due diligence describe what information is required for standard, simplified and enhanced due diligence. They address, among other things, the purpose and nature of the relationship, the identification of politically exposed persons and screening against targeted financial sanctions.
The standards do not prescribe a uniform list of documents for every client file. However, they provide more detailed specifications regarding the required information, source requirements and circumstances in which documentation is necessary. Institutions therefore retain flexibility in selecting appropriate documents and information sources within the proposed requirements.
For investment firms, this means that existing onboarding forms and file requirements do not necessarily need to be replaced. The first step is to determine whether they collectively provide the prescribed information. Is the information sufficiently reliable, and is it verified where necessary? Where is information missing or being requested more than once?
Comparing the proposed requirements with the client acceptance policy and a sample of client files will reveal what adjustments are needed. This will also clarify whether the problem lies in the policy, the available data or its implementation.
2. Make sanctions risks visible in the risk assessment
A business-wide risk assessment is nothing new. However, the AMLR expands its scope to include the risk that targeted financial sanctions will not be implemented or will be circumvented.
The draft guidelines distinguish four components: an overview of the institution and its activities, inherent risks, mitigating measures and residual risk. Institutions must use relevant internal and external information in this assessment.
AMLA does not prescribe a fixed methodology. The level of detail may be tailored to the nature, size and complexity of the institution. However, the chosen approach, sources used and judgments made must be clearly documented and explainable.
The practical question, therefore, is whether the existing assessment clearly covers these four components and explicitly incorporates sanctions risks. It must then be clear how the findings translate into policies, controls and priorities. A risk assessment only becomes meaningful in practice when it guides risk management.
3. Link monitoring to changes in client circumstances
The draft guidelines on ongoing monitoring address both keeping client information up to date and monitoring transactions and activities. They distinguish between periodic reviews and event-driven reviews.
For investment firms, changes in ownership, sources of funding or geographic exposure, for example, may be relevant. Which signals warrant further investigation depends on the services provided and the risk profile. Attention should therefore also be paid to changes in the client relationship, alongside transaction activity.
There is no general obligation to repeat the entire onboarding process for all existing clients before July 10, 2027. However, this does not mean that client files can be left untouched until the next periodic review. Increased risk, a relevant change or doubts about the accuracy or adequacy of information may require an earlier review.
Investment firms should therefore bring together review frequencies, triggers for interim reviews, data sources and responsibilities in a single overview. They should also document when signals must be escalated and how the outcome is recorded. A sample review of client files can then help determine whether the approach is workable in practice.
Prepare while allowing room for adjustments
The texts discussed are still drafts. Institutions can already use them to identify gaps between the proposed requirements and their current practices, but they must allow for changes in the final versions.
Start with adjustments that have the greatest operational impact: missing client information, insufficient visibility of sanctions risks and unclear responsibilities for monitoring. Document which decisions are based on draft requirements. This will provide a well-founded basis for preparation that can be adjusted in a targeted manner once the final texts are published.
Wiljan Enting is a Legal, Risk & Compliance consultant at Projective Group, which is part of Investment Officer’s expert panel.
