Looking for support with the compliance officer function? Send an enquiry or jump to the staffing options.
From 10 July 2027, the AMLR makes the compliance officer a function that your management body must appoint, with a senior position, a direct line to the board and protection from pressure. The regulation sets that frame but names no personal traits, so the qualities of a successful compliance officer have to be derived from what the role must do.
Article 11 AMLR separates the compliance manager, a member of the management body, from the compliance officer. The officer prepares the business-wide risk assessment (Art. 10(2)) and transmits suspicious activity reports (Art. 69(6)). Both functions may sit with one person where size and risk allow it (Art. 11(7)).
Legal basis Reg. (EU) 2024/1624
Applies from 10 July 2027
Status October 2026
Reading time 21 min
Each point links to a section below. The references are to Regulation (EU) 2024/1624 unless stated otherwise.
Article 11 AMLR requires a compliance manager from the management body and an appointed compliance officer with sufficiently high hierarchical standing. The officer is responsible for day-to-day policies, procedures and controls, including targeted financial sanctions, and is the contact point for the authorities.
Communication, analytical judgement, attention to detail, organisation and integrity map onto the text of Article 11. For personal suitability, EBA/GL/2022/05 lists reputation, expertise, business understanding, experience and time and seniority.
The institution must protect the officer from retaliation and from commercial influence (Art. 11(4)). The officer can report directly to the management body (Art. 11(5)), and removal requires prior notification with information to the supervisor (Art. 11(2)).
Article 18 allows the outsourcing of tasks, but never the six decisions it lists. Whether an externally employed person can be appointed as officer is not answered expressly. AMLA guidelines are due by 10 July 2027 (Art. 18(8)).
Article 11 does not describe a profession. It describes a position inside the institution and the conditions that keep it effective. The table lists what each provision requires.
| Provision | Requirement |
|---|---|
| Art. 11(1) | One member of the management body in its management function is the compliance manager. The manager ensures that policies, procedures and controls fit the risk situation and are implemented, that sufficient human and material resources are allocated, and receives information on significant weaknesses. |
| Art. 11(2), first subparagraph | The management body appoints the compliance officer. The officer holds a sufficiently high hierarchical position, is responsible for day-to-day policies, procedures and controls including targeted financial sanctions, and is the contact point for the competent authorities. |
| Art. 11(2), further subparagraphs | Where senior management is checked under Article 6 of Directive (EU) 2024/1640, the check includes the officer. Removal requires prior notification of the management body, and the institution informs the supervisor, stating whether the decision relates to the officer’s tasks. |
| Art. 11(3) | Appropriate human, technological and other resources, and the authority to propose any measure needed for effective policies, procedures and controls. |
| Art. 11(4) | Measures that protect the officer against retaliation, discrimination and other unfair treatment, and ensure that the officer’s decisions are not undermined or unduly influenced by the institution’s economic interests. |
| Art. 11(5) | The officer and the head of the audit function can report directly and independently to the management body in its management function and, where one exists, in its supervisory function, raise concerns and warn about specific risk developments. Staff involved have access to all information and data they need. |
| Art. 11(6) | The compliance manager reports regularly to the management body and at least annually, or more often where needed, on the implementation of the policies, procedures and controls the officer drew up. The manager remedies deficiencies without delay. |
| Art. 11(7) | Where the nature of the business, its risks and complexity, and its size justify it, one natural person may hold both functions, and the functions may be combined with others. A business run by one natural person carries out the tasks itself. |
| Art. 10(2) | The business-wide risk assessment is prepared by the compliance officer and approved by the management body in its management function. It is documented, kept up to date and reviewed regularly. |
| Art. 69(6) | The officer appointed under Article 11(2) transmits the information on suspicious activity to the financial intelligence unit of the Member State where the institution is established. |
Terminology. The German text of Article 11(2) calls the compliance officer Geldwäschebeauftragter. In German practice both terms refer to the same function.
The AMLR sets the frame and does not list traits. The five qualities below are the classic list. What is new is that each can now be tied to a requirement.
The interview questions are our suggestions, not requirements of the regulation.
| Quality | What the role demands | Anchor | Interview test |
|---|---|---|---|
| 1. Communication | Report directly and independently to the management body, warn it when risks change and act as contact point for the authorities. | Art. 11(2), 11(5) | “Brief a board member on a control weakness in three minutes. What do you ask them to decide?” |
| 2. Analytical judgement | Own the day-to-day implementation of policies, procedures and controls, including targeted financial sanctions, and judge suspicion. | Art. 11(2); EBA/GL/2022/05 Tz. 52 | “Walk me through an alert you chose not to escalate and how you documented the reasons.” |
| 3. Attention to detail | Keep the business-wide risk assessment documented and current. The annual implementation report to the board builds on the officer’s policies and controls. | Art. 10(2), 11(6) | “Here is a policy draft and a control description. Find the three inconsistencies.” |
| 4. Organisation | Work with the resources allocated, delegate under supervision and keep the function running when the officer is absent. | Art. 11(3), 11(6); EBA/GL/2022/05 Tz. 37 | “Who takes over your tasks next week, and what do they need to know today?” |
| 5. Integrity | Decide without being unduly influenced by the institution’s commercial interests, with good repute and honesty. | Art. 11(4); Art. 13(1)(b); EBA/GL/2022/05 Tz. 36(a) | “Describe a time you disagreed with a business decision. What happened next?” |
Use the table twice: as a screening grid when you hire, and as a requirements profile when you brief a provider.
Two sources describe the person behind the qualities: the EBA guidelines for the officer and Article 13 AMLR for everyone directly involved in compliance.
Before the appointment, the institution should assess whether the officer has (Tz. 36):
The guidelines are based on Directive (EU) 2015/849 and have applied since 1 December 2022.
All staff directly involved in compliance undergo an assessment proportionate to the risks of their tasks, with content approved by the compliance officer (Art. 13(1)).
Article 12 adds documented, continuing training for staff whose function requires it.
Red chips mark dates and questions that are still ahead of us.
The AMLR distributes responsibility across the management body, the compliance manager, the officer and the staff around them.
| Function | Core duties | Provision |
|---|---|---|
| Management body in its management function | Appoints the compliance officer and is informed before any removal; approves the business-wide risk assessment; designates one of its members as compliance manager. | Art. 11(1), 11(2), 10(2) |
| Compliance manager | Ensures that policies, procedures and controls fit the risk situation and are implemented; allocates resources; receives information on significant weaknesses; reports at least annually and remedies deficiencies. | Art. 11(1), 11(6) |
| Compliance officer | Prepares the business-wide risk assessment; owns day-to-day policies, procedures and controls including targeted financial sanctions; is contact point for the authorities; transmits suspicious activity reports; reports directly to the management body. | Art. 10(2), 11(2), 11(5), 69(6) |
| Staff directly involved in compliance | Undergo a suitability assessment before starting and at regular intervals; report close private or professional relationships with customers to the officer and are removed from the affected tasks. | Art. 13(1), 13(2) |
These are prompts for your own review, not findings about any institution.
Art. 11(2) requires a sufficiently high hierarchical position and Art. 11(5) a direct reporting line. Check who the officer actually reports to and whether concerns reach the management body without a filter.
Art. 11(2), 11(5)
Art. 11(1) puts a named member of the management body in charge and makes that person responsible for resources. A name in the organisation chart does not show that resources were allocated.
Art. 11(1)
Art. 11(7) lets one person hold both functions only where nature, risks, complexity and size justify it. Write the reasoning down and check for conflicts of interest under Art. 13(3).
Art. 11(7), 13(3)
Art. 10(2) assigns the preparation to the officer, and Art. 18(3)(a) bars outsourcing the proposal. If drafts come from a provider or a business unit, authorship becomes hard to show.
Art. 10(2), 18(3)(a)
Art. 11(4) requires measures against retaliation and commercial influence. Document them, and document the removal procedure with prior notification and information to the supervisor.
Art. 11(2), 11(4)
Art. 69(6) ties the transmission to the officer appointed under Art. 11(2), and Art. 11 does not mention a deputy. EBA/GL/2022/05 expects a delegate with the right skills for absences, so plan for it explicitly.
Art. 69(6); EBA/GL/2022/05 Tz. 37
Choose a state for each question. Your choices are not stored and not sent anywhere. The check is a self-assessment ahead of 10 July 2027.
1. Is a named member of the management body the compliance manager, with time and resources allocated? Art. 11(1)
2. Does the officer hold a documented senior position with a direct, independent reporting line? Art. 11(2), 11(5)
3. Does the officer personally prepare the business-wide risk assessment, with outside input kept visible? Art. 10(2), 18(3)(a)
4. Are measures against retaliation and commercial influence documented, including the removal procedure? Art. 11(2), 11(4)
5. Is the suitability assessment for staff directly involved in compliance defined, approved by the officer and repeated? Art. 13(1)
6. Is there an absence plan for the officer, covering how reports to the financial intelligence unit continue? Art. 69(6); EBA/GL/2022/05 Tz. 37
Four routes lead to a filled role, and they can be combined. The first two do not depend on any open legal question.
The limits of Article 18 are set out in detail in our German-language article: Auslagerung von AML/CFT-Funktionen nach Artikel 18 AMLR.
Use the suitability criteria and the interview table above as the profile. Your management body makes the appointment (Art. 11(2)).
Own employee
Close the skills gap internally. The certification course for compliance officers at S+P Seminare is one route: view the course.
Qualification
S+P Compliance can provide the function through a person employed by S+P. Your management body appoints and can remove that person. Our reading is that this is an organisational act and not outsourcing under Article 18. The regulation does not answer this expressly, so treat it as interpretation until AMLA publishes its guidelines (Art. 18(8)). EBA/GL/2022/05 says an officer should act for several entities only within one group (Tz. 35), and allows an institution without staff of its own to outsource the function to a provider, whose officer then serves as the institution’s officer (Tz. 71).
Function
Fact finding, monitoring, case files, report drafts and deadline tracking can be prepared by S+P Compliance under your policies. The decisions listed in Art. 18(3) stay with your institution, and a provider must be notified to the supervisor before it starts (Art. 18(1)). See 1st Line Services.
Operations
S+P Compliance works in two lanes. In both, the final decisions stay with the management body of your institution.
An officer employed by S+P Compliance and appointed by your management body.
Status: interpretation. Whether this appointment is an organisational act or outsourcing under Art. 18 is open until AMLA’s guidelines are available. Responsibility stays with your management body in either reading.
1st Line Services under your policies. S+P Compliance prepares and documents, your institution decides.
Outsourcing moves the task, not the responsibility: under Article 18(2) you remain fully liable for outsourced tasks.
These six steps work whichever way the open questions are decided. They build the evidence that is required anyway.
Designate one member of the management body and record the resource decision.
Art. 11(1)
Fix position, reporting line, warning right, protection and the removal procedure in one document.
Art. 11(2), 11(4), 11(5)
Let the officer prepare it and keep outside contributions visible and separate.
Art. 10(2)
Use the five criteria and the interview table as a grid, and have the officer approve the content for staff.
Art. 13(1); EBA/GL/2022/05 Tz. 36
Name a delegate with suitable skills and describe how reporting continues.
Art. 69(6); EBA/GL/2022/05 Tz. 37
List each outsourced task, check it against the excluded tasks and notify the supervisor before a provider starts.
Art. 18(1), 18(3)
Three messages to take away.
Article 11 defines seniority, reporting line and protection. The qualities have to be derived from the role and evidenced.
Protection, direct reporting and the removal procedure only help if they are documented and can be shown to the supervisor.
The appointment of a provider-employed officer is not settled by the text. AMLA’s guidelines are due by 10 July 2027 (Art. 18(8)).
The qualities of a successful compliance officer stay familiar: communication, judgement, precision, organisation and integrity. What the AMLR changes is the proof. S+P Compliance helps you test the profile, prepare the operational work and, where your management body decides to appoint a provider-employed officer, document that decision.
The answers reflect the position as of October 2026 and are not legal advice for an individual case.
The AMLR does not list personal traits. It requires a sufficiently senior position, responsibility for day-to-day policies, procedures and controls, a direct reporting line and protection from pressure (Art. 11(2), 11(4), 11(5)). From that follow five qualities: communication, analytical judgement, attention to detail, organisation and integrity. For personal suitability, EBA/GL/2022/05 adds reputation, expertise, understanding of the business model, experience and sufficient time and seniority.
The compliance manager is a member of the management body in its management function and ensures that policies, procedures and controls fit the risk situation, are implemented and are resourced (Art. 11(1)). The compliance officer is appointed by the management body, handles the day-to-day implementation, is the contact point for the authorities and transmits suspicious activity reports (Art. 11(2), Art. 69(6)). The manager reports on the officer’s policies to the management body at least annually (Art. 11(6)).
Yes, where the nature of the business, its risks and complexity, and its size justify it (Art. 11(7)). The functions may also be combined with other functions. Document the reasoning and check for conflicts of interest, because Art. 13(3) requires procedures to prevent and manage them.
No. The compliance manager is the member of the management body (Art. 11(1)). The officer must hold a sufficiently high hierarchical position and be able to report directly to the management body (Art. 11(2), 11(5)).
Article 18 allows the outsourcing of tasks under a written agreement and with prior notice to the supervisor, and the institution remains fully liable. It bars six tasks, including the report to the financial intelligence unit, which can be outsourced only within a group in the same Member State (Art. 18(3)). Whether a person employed by a provider can be appointed as the officer under Art. 11(2) is not answered expressly. Our reading is that the appointment is an organisational act of the management body, but this is interpretation until AMLA issues its guidelines, which are due by 10 July 2027 (Art. 18(8)). S+P Compliance prepares operational work, and the decisions stay with your institution.
The AMLR applies from 10 July 2027, and from 10 July 2029 for obliged entities named in Article 3, point 3(n) and (o) (Art. 90). Until then, § 7 GwG governs the appointment duty in Germany. Whether and in what form it continues afterwards depends on German adaptation legislation, so check the current status before you rely on this page.
Official sources only: EU legal acts, EU agencies and federal legislation. Every statement on this page can be traced to them.
Note on the legal position: this page reflects the position as of October 2026 and does not replace legal advice for an individual case. Compare all statements on provisions, dates and scope with the current official text.
Each link adds a perspective: the legal limits, the preparation, the operational work or the training.
Classification in the S+P service model. The appointed officer function belongs to Compliance as a Service in the second line of defence. Operational case handling on the permitted side of Article 18(3) belongs to 1st Line Services in the cluster Financial Crime and Customer Operations.
The detailed analysis of the excluded tasks, the approval levels and the open question of the appointment.
Structured preparation for 10 July 2027, from the stocktake to the new approval structure.
Your policies, procedures and controls compared against the regulation, with a prioritised action plan.
Group-wide requirements under Article 16 and additional measures for third-country branches and subsidiaries under Article 17.
Appointment, deputy arrangements and continuity of the function under current law, with a documented mandate.
Operational processing of data-intensive, deadline-driven processes under your policies, separate from the officer function.
Case files, alerts and report drafts: the work that stays on the permitted side of Article 18(3).
S+P Seminare trains the people who will fill the role. This is the build route in practice.
S+P Seminare explains duties, qualification and deadlines of the AML compliance officer under the AMLR.
Achim Schulz kennt die Führungsebene aus eigener Verantwortung – langjährig als Vorstand bei Banken und Geschäftsführer sowie als Interim-Manager in Industrieunternehmen. Diese Doppelperspektive aus Finanzsektor und Realwirtschaft prägt seine Beiträge für CEO, COO und CFO. Er kennt das Zusammenspiel von Geschäftsleitung, Aufsichtsrat und Gesellschaftern aus der Praxis und übersetzt strategische wie aufsichtsrechtliche Anforderungen in umsetzbare, haftungssichere Führungsentscheidungen – praxisnah und auf Augenhöhe mit dem Management.
LinkedIn-Profil →Wir verwenden Cookies und ähnliche Technologien, um Ihre Erfahrung auf unserer Website zu verbessern. Weitere Informationen in unserer Datenschutzerklärung.