Readiness does not rest on policy documents. It rests on the systems, data, workflows, case files and teams that perform due diligence, screening and monitoring every day.
S+P Compliance helps financial institutions translate AMLR requirements into an effective technology and operating model, connecting governance, customer due diligence platforms, screening, transaction monitoring, rulebook design, data quality, case management, testing and managed operations. The objective is not to make a platform technically live. It is to make your systems work as regulatory controls — on reliable data, with risk-based workflows, documented decision paths, effective escalation and evidence that holds up under review.
What you get
Audit-ready for BaFin and external auditors
What S+P delivers
What remains with the institution
S+P specifies, calibrates, tests and processes. Approval of the rulebook and any decision carrying reporting or freezing effect stays within your own governance and delegated authorities.
An institution can hold a fully compliant policy and still not be ready. What gets examined is not the text but the effect: whether customer records are current, whether scenarios fit the business model, whether hits are handled within deadlines and whether it can be shown why a case was closed.
AMLA’s draft guidance on ongoing monitoring under Article 26(5) AMLR points at two operationally intensive areas. The first is keeping customer documents, data and information current through periodic and event-driven reviews. The second is designing, implementing and testing a framework for monitoring transactions and activities. The guidance also expects monitoring outputs to be assessed and escalated effectively, and ongoing monitoring to stay integrated with customer due diligence rather than running beside it.
Both points land on the system layer — on data fields, workflows, rulebooks and evidence — and on the operating model behind them. Readiness therefore has to cover the architecture and the delivery capacity together, because a well-configured system still produces backlogs when nobody has the capacity to work it.
Six findings that usually appear together.
The platform is live, but risk categories, review cycles, triggers for enhanced due diligence, ownership structures, screening workflows and escalation rules are not consistently configured. What the policy requires does not happen in the system.
Missing identification data, outdated ownership information, absent country attributes, unassigned risk classes and inconsistent account and transaction records all reduce the effectiveness of screening and monitoring directly.
Scenarios, thresholds, indicators and customer profiles have not been reviewed, calibrated, tested or documented since implementation. The settings may still be reasonable, but the reasoning is no longer available.
High hit rates, unclear prioritisation, incomplete case files and missing investigation guidance create backlogs. Attention spreads evenly instead of concentrating on genuinely higher-risk cases.
Regulatory requirement, functional specification, change request, release, test evidence, acceptance and operating documentation are managed separately rather than in one traceable process. Changes then happen without a recorded rationale.
It cannot be demonstrated why an alert was closed, a customer was rated, a review was completed or a scenario was amended. The decision may have been correct; the record does not carry it.
Eight building blocks, available individually or as one programme.
A model that ties systems, roles, data and controls into something that can actually be steered.
Functional design and operation of the platform across the whole customer lifecycle.
Ownership and control data captured so that it actually reaches screening and case work.
Decisions on discrepancy reports to the national transparency register remain with the authorised function of the institution. S+P prepares and documents the case.
From the screening matrix through the hit logic to day-to-day handling.
Functional design, calibration and ongoing operation of monitoring and case handling.
Decisions on suspicious activity reports, sanctions freezes and termination of relationships remain with the authorised function of the institution. S+P prepares the case file, the supporting evidence and the documentation.
Data quality as a running control process rather than a one-off clean-up before an audit.
Every parameter change justified, tested, approved and recorded.
S+P prepares, analyses, calibrates and assesses the effectiveness of scenarios, indicators, thresholds and rulebooks. Approval of material rules, models and changes remains subject to your governance, decision rights and approval framework.
The functional workstream of implementations, migrations and optimisation programmes.
Processing under your policies, work instructions, decision limits and escalation rules.
Onboarding support, document collection, periodic and event-driven reviews, data maintenance, ownership documentation, deadlines and evidence.
Alert intake and prioritisation, collection of customer, account and transaction information, case files, follow-ups and preparation for decision-making.
Pre-processing of sanctions, exposed person and adverse media hits under defined rules, false positive documentation, escalation and rescreening.
Backlog reduction, overdue reviews and data gaps, refresh of customer and ownership data, completion of case files and transition into ongoing operations.
S+P works independently of software vendors, in existing and newly implemented landscapes. Where product or company names are mentioned, this describes possible system environments only and implies no partnership, certification or appointment by the named provider unless expressly published. Technical infrastructure, software development, licences and vendor support remain with the institution, the technology provider or the appointed technical implementation partner.
Depending on where your programme stands.
Before implementation, selection or migration: transparency over systems, data sources, rulebooks, alert volumes, case files, access rights and open issues.
For implementations, system changes and migrations: functional specification, data mapping, test cases, acceptance, training, go-live readiness and handover.
For high alert volumes, elevated false positive rates, outdated scenarios or data gaps: calibration, backtesting, root cause analysis and file remediation.
Continuous delivery of defined customer file, screening, alert, data and evidence processes with agreed volumes, service levels and reporting.
Systems, data sources, workflows, rulebooks, alert volumes, case files, interfaces, access rights, controls and open issues.
Target processes, roles, data models, workflows, rulebooks, control logic, evidence requirements, metrics and service levels.
Functional specification, data mapping, test cases, acceptance testing, work instructions, training, go-live readiness and hypercare.
Defined operations, data quality, backlog reduction, alert handling, quality assurance, backtesting and continuous improvement.
Technology and processing touch all three lines of defence. What matters is that operational delivery, functional governance and independent assurance stay separated — particularly where one provider covers more than one building block.
S+P separates these levels through distinct teams, roles, access rights, decision limits and reporting lines.
| Level | Role in technology and operations | S+P support |
|---|---|---|
| First line | Maintains customer data, handles alerts, keeps case files, evidence and deadlines | Managed operations and operational quality assurance |
| Second line | Owns standards and rulebook, assesses risk, monitors, escalates and approves | Reporting officer support, methodology, calibration and independent challenge |
| Technology and vendor | Technical configuration, interfaces, development and system operation | Functional specification, test cases and acceptance support |
| Third line | Reviews systems, processes, controls and governance independently | Internal audit, audit preparation and follow-up |
Functional logic, workflows, data and evidence interlock instead of existing side by side.
EffectivenessControl rules, error lists and named ownership make data quality measurable and manageable.
DataPrioritisation, guidance and processing capacity create focus on the cases that carry risk.
CapacityScenarios, changes, tests and approvals are versioned and can be reconstructed under review.
AssuranceCompliance, technology and operations gain time for risk decisions, oversight and system governance.
ReliefRequirements become a concrete operating model with technology, roles, controls and capacity.
DeliveryThe overview of our European AML services, from assessment through implementation to managed operations.
Back to the hubGap assessment against AMLR and AMLA standards, with a prioritised roadmap to 10 July 2027.
Explore AMLR ReadinessConsistent standards across head office, EU parent, branches and subsidiaries, implementable locally.
Explore Group AML GovernanceAudit readiness, evidence management and closure of supervisory and audit findings.
Explore Audit & RemediationLocal AML governance, reporting officer support and documentation prepared for the German supervisor.
Explore German AML ComplianceDescribe your system landscape, the processes in scope and your timeline, and we will respond with an assessment.
Contact S+P ComplianceNo. We support regulatory and functional requirements, target processes, data models, rulebooks, testing, acceptance, training, go-live readiness and operations. Technical configuration, development, system operation and vendor support remain with the institution, the provider or the appointed technical implementation partner.
S+P prepares, analyses, calibrates and assesses the effectiveness of scenarios, indicators, thresholds and rulebooks, and documents the rationale. Approval of material rules and changes remains within your governance and decision framework, so responsibility for the control environment stays with the institution.
Yes. Standardised processing is performed under your work instructions, decision limits and escalation routes. Decisions on complex cases, suspicious activity reports, sanctions freezes and material actions remain with the authorised functions of the institution.
We are vendor independent and work in existing as well as newly implemented landscapes. What matters is the regulatory process, the data, the workflow, the rulebook, testability and delivery capacity, not the product. The relevant system environment is captured during the assessment and reflected in the target model.
Operational work is performed by clearly separated first-line teams. The second line defines standards, assesses risk, monitors compliance and escalates material deviations. Where S+P covers both, teams, access rights and reporting lines are separated and documented in the role model, and internal audit provides independent assurance.
Yes. We support groups running central platforms alongside local entities through role models, data flows, local functional requirements, rulebook governance, bilingual reporting and operational delivery on the ground. The design is agreed as part of group governance.
Effective financial crime controls require aligned systems, data, processes, people, governance and operational capacity. S+P Compliance combines regulatory design, compliance technology, data quality and managed operations into an operating model that works in daily business and holds up under review.
Wir verwenden Cookies und ähnliche Technologien, um Ihre Erfahrung auf unserer Website zu verbessern. Weitere Informationen in unserer Datenschutzerklärung.