The Anti-Money Laundering Regulation establishes a directly applicable EU single rulebook for core AML and CFT requirements from 10 July 2027.
In parallel, the Anti-Money Laundering Authority is developing technical standards and guidelines covering customer due diligence, the business-wide risk assessment and the ongoing monitoring of business relationships. For banks, payment and e-money institutions, investment firms, asset managers, fintechs and crypto-asset service providers, the task is not to understand new rules but to turn them into working governance, processes, data, technology, controls and audit-ready evidence. S+P Compliance combines German regulatory expertise with European implementation, financial crime technology and managed operations.
What you get
Audit-ready for BaFin and external auditors
What S+P delivers
What remains with the institution
Outsourcing shifts execution, not accountability. Decisions carrying reporting or freezing effect remain with the authorised function of the institution.
Regulation (EU) 2024/1624 will apply directly across the European Union from 10 July 2027, harmonising central AML and CFT obligations and reducing national variation. This does not mean national requirements disappear. Supervisory practice, criminal law, FIU processes and organisational requirements remain relevant, and the sixth anti-money laundering directive still has to be transposed into national law.
The practical detail is being written now. AMLA has consulted on draft regulatory technical standards specifying the information to be collected for customer due diligence under Article 28(1) AMLR, on draft guidelines for the business-wide risk assessment under Article 10(4) AMLR, and on draft guidelines for the ongoing monitoring of business relationships under Article 26(5) AMLR. This level determines what data must be held, how risk classes are formed, when reviews are triggered and how monitoring outcomes must be documented.
The action plan follows from that: assess the current framework, review group and local governance, strengthen customer due diligence and ongoing monitoring, revisit screening and transaction monitoring controls, improve data quality and evidence, build operational capacity for backlogs and alert volumes, and prepare management, board and supervisory reporting.
Six patterns we encounter repeatedly in readiness assessments.
The framework reads well but does not describe how requirements are executed, documented and controlled day to day. Supervisors and auditors do not assess the text, they assess the effect. The gap becomes visible in files, not in policies.
The business-wide risk assessment exists as a document but is not connected to customer risk classification, review cycles, enhanced due diligence, screening scope or monitoring scenarios. It describes risk without shaping controls.
Periodic reviews accumulate, trigger events are not consistently captured and beneficial ownership information is incomplete. Ongoing monitoring cannot work reliably on a stale customer record.
Screening and monitoring produce more hits than the function can process within deadlines. Preparation consumes the time needed for assessment and escalation, and case files remain incomplete.
Central policies describe principles but leave open how a German branch or subsidiary implements, documents and controls them. Without local addenda and documented deviations, gaps belong to nobody.
It cannot be demonstrated why an alert was closed, a customer was classified, a review was completed or a scenario was adjusted. The decision may have been sound; the record does not show it.
Six areas, available individually or as one programme.
Assess the current framework against AMLR and the evolving AMLA implementation standards, and translate the findings into a prioritised roadmap.
A consistent framework across head office, EU parent undertakings, branches and subsidiaries, that remains implementable locally.
Turn systems into an effective, auditable and scalable operating model — independently of any software provider.
S+P prepares and calibrates scenarios, indicators and thresholds and documents the rationale. Sign-off on material rules, models and changes takes place within the institution’s own governance and delegated authorities.
Prepare for supervisory reviews, external and internal audit, and close findings in a way that holds.
Turn the assessment from a static document into a management tool that actually drives controls.
Article 10 AMLR requires obliged entities to identify and assess exposure to money laundering and terrorist financing as well as the risks of non-implementation and evasion of targeted financial sanctions. New products, services, business practices, delivery channels and technologies must be assessed before launch. AMLA is developing guidelines on the minimum content under Article 10(4) AMLR.
Due diligence does not end at onboarding. Keeping the customer record current is a control in its own right.
Article 26 AMLR requires ongoing monitoring of business relationships and of the transactions and activities carried out within them. AMLA has consulted on draft guidelines under Article 26(5) AMLR covering both the currency of customer information and the transaction and activity monitoring framework.
We represent no platform and receive no vendor commission. Recommendations follow requirements and risk profile, not product interests.
We specify, calibrate, test and operate on the functional side. System administration, development and vendor support stay with your authorised partners.
Every decision on parameters, classifications and case outcomes is documented so that it can be reconstructed under review.
Design work does not stop at go-live. Where useful, we take on the processing volume so implementation and daily business do not compete.
Four phases, from transparency to a stable operating model.
Regulatory mapping, gap assessment, review of governance, customer processes, screening, monitoring, technology and data, closing with a prioritised roadmap and board briefing.
Target operating model for roles, processes, minimum standards, data, technology and reporting, aligned between group and local entities.
Policies and work instructions, process redesign, rulebook implementation, data remediation, backlog reduction, training, testing and go-live readiness.
Local compliance support, managed operations, rulebook governance and calibration, quality assurance, audit readiness and bilingual reporting.
Business model, obliged entity status, entities in scope, jurisdictions, products, systems, data sources and stakeholders.
Review of the risk assessment, policies, work instructions, control plans, rulebooks, reports, case files, findings and open actions.
Structured discussions with compliance, operations, IT, data and audit. Walkthroughs reveal how processes actually run.
Maturity, gaps, risks and dependencies are assessed and translated into a target picture, action plan and management readout.
S+P can support operational, compliance and audit-related workstreams. These roles must remain separated — particularly when one provider covers more than one of them.
We separate delivery, oversight and assurance through distinct teams, roles, access rights, delegated authorities and reporting lines.
| Line of defence | Core role | S+P support |
|---|---|---|
| First line | Operates processes, handles cases, maintains data, deadlines and evidence | Customer due diligence, alert and screening operations, data remediation |
| Second line | Sets standards, assesses risk, monitors, challenges and escalates | Money laundering reporting officer, group governance, compliance monitoring |
| Third line | Provides independent assurance over the framework and its controls | Internal audit, independent testing and follow-up |
| Management body | Approves the framework and carries overall accountability | Decision papers, board briefings and reporting formats |
Findings come from files and data rather than assumptions, which makes the scope of work credible.
ClarityLimited capacity goes first to the gaps carrying the highest regulatory risk.
SteeringCentral standards and local requirements fit together instead of running in parallel.
GovernanceControl rules, error lists and clear ownership make data quality measurable and manageable.
DataDecisions, parameters and case outcomes are documented and can be reconstructed under review.
AssuranceProcessing capacity is available when implementation and daily business coincide.
CapacityGap assessment against AMLR and AMLA standards, with a prioritised roadmap to 10 July 2027.
Explore AMLR ReadinessConsistent standards across head office, EU parent, branches and subsidiaries.
Explore Group AML GovernanceRulebooks, calibration, data quality and managed operations for AML systems.
Explore Technology & OperationsAudit readiness, evidence management and closure of regulatory findings.
Explore Audit & RemediationLocal AML governance, reporting officer support and BaFin-ready documentation.
Explore German AML ComplianceDescribe your situation — entity type, processes in scope, trigger and timeline — and we will respond with an assessment.
Contact S+P ComplianceRegulation (EU) 2024/1624 applies directly across the European Union from 10 July 2027 for most obliged entities. No national transposition is required for the regulation itself. In parallel, member states are transposing Directive (EU) 2024/1640 into national law.
No. AMLR harmonises central obligations at EU level, while national rules remain relevant in areas such as supervisory practice, criminal law, financial intelligence unit processes and organisational requirements. Readiness work therefore has to cover both layers.
AMLA is the EU Anti-Money Laundering Authority, established by Regulation (EU) 2024/1620 and based in Frankfurt am Main. It develops technical standards, guidelines and supervisory approaches, and is expected to directly supervise selected financial sector entities from 2028.
Because the work is operational, not editorial. Governance, risk assessment, customer processes, beneficial ownership, screening, monitoring, technology, data, operations and evidence all need design, implementation, testing and a transition into daily business. Data remediation and backlog reduction alone bind capacity over months.
Yes. Readiness assessment, governance, technology work, remediation, alert and screening operations, audit readiness and regulatory remediation can be combined. First line, second line and internal audit responsibilities remain separated through distinct teams, roles, access rights and reporting lines.
No. We provide regulatory, functional and operational support. Technical system operation, software development, configuration by authorised administrators, licensing and vendor support remain with the institution, the software provider or the appointed technical implementation partner.
AMLR and AMLA are reshaping European financial crime compliance. Institutions that prepare governance, processes, technology, data and operational capacity now will be in a stronger position from July 2027 onwards. S+P Compliance helps you translate European requirements into practical, scalable and audit-ready operating models.
Wir verwenden Cookies und ähnliche Technologien, um Ihre Erfahrung auf unserer Website zu verbessern. Weitere Informationen in unserer Datenschutzerklärung.