International groups need more than a group policy. They need a governance model that turns European standards, group requirements and local obligations into consistent roles, processes, reporting and delivery.
From 10 July 2027, AMLR applies directly across the European Union. For groups with branches, subsidiaries and cross-border relationships this creates a practical problem: central standards must be consistent, yet every local entity remains capable of meeting its own legal, supervisory and operational obligations. S+P Compliance helps head offices, EU parent undertakings, German branches and local subsidiaries connect group policies, risk assessment, customer due diligence, screening, monitoring, technology governance, reporting and audit-ready evidence.
What you get
Audit-ready for BaFin and external auditors
What S+P delivers
What remains with group and local entity
Outsourcing shifts execution, not accountability. A German branch or subsidiary remains answerable to its supervisor even where standards and systems are set centrally.
Article 16 AMLR requires parent undertakings to ensure that internal policies, procedures and controls apply across branches and subsidiaries, to perform a group-wide risk assessment that takes account of the assessments performed by those entities, and to establish group-wide arrangements including data protection and the sharing of information relevant for AML and CFT purposes. Article 17 AMLR addresses the situation where a branch or subsidiary operates in a third country whose law prevents compliance.
AMLA consulted in 2026 on a single set of draft regulatory technical standards covering both mandates, under Articles 16(4) and 17(3) AMLR. The draft addresses organisational aspects of group-wide requirements, information sharing within a group, criteria for identifying the parent undertaking in the Union where several obliged entities are linked to a third-country head office, the extension of group requirements to structures other than traditional groups, and additional measures where branches or subsidiaries operate in third countries.
The practical consequence is that a single global policy document no longer answers the questions that matter. Which decisions sit with head office, which with the EU parent, which with the German entity? How does the local reporting officer operate within the group framework? Which customer, ownership, screening and monitoring information may be shared, and where do data protection or third-country restrictions apply? How are local deviations approved, documented and reported upward?
Six patterns that recur across international groups.
Global standards describe principles but do not explain how a German branch implements, documents and controls local requirements for due diligence, ownership, screening, monitoring, reporting and evidence. The local level improvises, and the gap only becomes visible in files.
A group policy has to interact with local AML law, supervisory expectations, reporting routes to the financial intelligence unit and local governance. Without addenda, work instructions and clear decision rights, implementation gaps appear that nobody owns.
Who owns the group framework, who acts as EU parent undertaking, who sets minimum standards, who approves local deviations, who owns group technology and local data quality, and who receives which escalation? Unanswered, these questions become audit findings.
Customer data, ownership information, screening alerts, monitoring cases, control findings and remediation actions are not available in a consistent format across entities. Data protection, confidentiality and local data residency have to be designed in, not discovered later.
Group platforms for due diligence, screening or monitoring do not fully reflect local data sources, customer structures, language requirements, escalation routes or evidence expectations. The result is workarounds outside the system.
Entities report different metrics, periods, risk categories and thresholds. Head office therefore lacks a reliable view of backlogs, screening volumes, alerts, open findings and data quality — and sees local issues late.
Eight building blocks, available individually or as one programme.
Every activity has an owner, every decision an authority, every escalation a named recipient and an evidence trail.
Binding minimum requirements for every entity, with room for documented local supplements.
Article 16 AMLR requires group-wide policies, procedures and controls to include arrangements for data protection and for the sharing of information relevant to AML and CFT purposes within the group.
One risk picture in which local specifics remain visible rather than averaged away.
Under Article 16 AMLR the group-wide assessment takes account of the business-wide risk assessments performed by branches and subsidiaries. It should therefore not obscure local customer types, products, geographies or delivery channels.
Harmonised standards for the customer lifecycle across entities, with local register realities respected.
Group principles with local calibration, rather than one parameter set imposed on unlike markets.
A group platform works only when local data, processes, escalation routes and evidence requirements are correctly reflected.
Comparable metrics are the precondition for the group being able to steer at all.
A German branch or subsidiary needs a self-standing, examinable model — not a translation of the group policy.
Decisions on suspicious activity reports, sanctions freezes and transparency register discrepancy reports remain with the authorised function of the German entity and cannot be transferred to head office.
The group sets a binding floor. Local entities may go further where local law requires it, but never fall below the standard.
Every departure from a group standard is justified in writing, approved and recorded in a register that can be produced on request.
Reports, freezes and terminations are decided by the authorised function on the ground, whatever the central standard prescribes.
Documentation is produced so it can be given to the German supervisor and to the group without rework or retranslation.
Depending on group structure and maturity.
Transparency over central and local responsibilities, policies, processes, technology, data and reporting, with findings and an action plan.
Group policies, role model, risk assessment, customer processes and reporting aligned to the European framework before July 2027.
For international banks with a German branch or subsidiary: connect local accountability with group-level steering in a workable way.
Continuous local expertise: reporting officer support, operations, bilingual reporting to the group and standing audit readiness.
Group structure, central and local responsibilities, policies, risk assessments, systems, reporting, data flows and existing interfaces.
Target state for roles, processes, minimum standards, data, technology, reporting and escalation, agreed between group and local entity.
Policies, local work instructions, customer processes, screening and monitoring workflows, data models, reporting and evidence structures.
Local compliance support, group reporting, operations, quality assurance, audit readiness and regulatory remediation.
Group-level steering does not replace local accountability; it frames it. What matters is that operational delivery, independent oversight and assurance stay separated across borders as well as within an entity.
Where S+P supports more than one of these levels, we separate them through distinct teams, roles, access rights, delegated authorities and reporting lines.
| Level | Role in the group model | S+P support |
|---|---|---|
| Head office and EU parent | Sets minimum standards, assesses group risk, oversees implementation | Policies, metrics model, reporting formats, governance advice |
| Local first line | Maintains customer data, handles alerts, keeps evidence and deadlines | Managed operations and backlog reduction on the ground |
| Local second line | Translates standards locally, monitors, escalates and decides | Reporting officer support, control plan, local risk assessment |
| Third line | Provides independent assurance over group and local controls | Internal audit, audit planning and follow-up |
A coherent framework across the group that integrates local legal and supervisory requirements rather than ignoring them.
ConsistencyEvery level knows its responsibilities, decision limits and reporting obligations, and can evidence them.
GovernanceLocal processes fit into the group target model without overlooking German regulatory requirements.
DeliveryCustomer, ownership, risk and remediation information is structured for both local and group steering.
DataBilingual reports with a shared metric set give management a basis it can actually act on.
SteeringPolicies, addenda, roles, controls, evidence and remediation are structured for supervisory and audit review.
AssuranceThe overview of our European AML services, from assessment through implementation to managed operations.
Back to the hubGap assessment against AMLR and AMLA standards, with a prioritised roadmap to 10 July 2027.
Explore AMLR ReadinessRulebooks, calibration, data quality, testing and managed operations for AML systems.
Explore Technology & OperationsAudit readiness, evidence management and closure of supervisory and audit findings.
Explore Audit & RemediationLocal AML governance, reporting officer support and documentation prepared for the German supervisor.
Explore German AML ComplianceDescribe your group structure, the entities in scope and your timeline, and we will respond with an assessment.
Contact S+P ComplianceA consistent group policy with binding minimum standards is central to effective governance. Local laws, supervisory expectations and organisational differences are reflected through documented addenda, work instructions and exception procedures. Unified means no entity falls below the standard, not that every entity is identical.
Only in part. Standards, methods, systems and reporting formats can be set centrally. Local accountability, escalation routes, the appointed function on the ground and the evidence owed to the German supervisor remain with the local entity. How far centralisation can go depends on group structure, business model and legal form.
The local officer is responsible for the tasks assigned locally and acts as the interface between local management, head office, business functions, the supervisor and, where applicable, the financial intelligence unit. The precise role reflects local legal requirements, group governance and delegated authority, and is set out in the appointment and the work instruction.
Yes. Management and group reporting is produced in both languages. German regulatory requirements are prepared so they can be used at head office without retranslation, and group requirements so they remain comprehensible to the German supervisor.
Yes. Local reporting officer support, group governance, operations, technology governance, reporting and audit preparation can be combined. This requires clear separation of the lines of defence: distinct teams, roles, access rights and reporting lines, documented in the role model.
Yes, independently of software providers and on the functional level: system governance, data models, rulebooks, scenarios, testing, local workflows, evidence and operations. Technical operation, system administration and vendor support remain with the institution, the provider or the appointed technical partner.
International groups need a model that connects European standards, local accountability, technology, operations, data and reporting — consistent across the group, workable at local level and defensible in front of both the German supervisor and head office.
Wir verwenden Cookies und ähnliche Technologien, um Ihre Erfahrung auf unserer Website zu verbessern. Weitere Informationen in unserer Datenschutzerklärung.