A structured view of your current operating model, the gaps that matter and a prioritised roadmap to the application date.
Regulation (EU) 2024/1624 applies directly across the European Union from 10 July 2027 and raises expectations for governance, business-wide risk assessment, customer due diligence, beneficial ownership, ongoing monitoring, screening, transaction monitoring, data quality, technology and evidence. Readiness is therefore not a legal update exercise. It changes how your organisation identifies risk, onboards and reviews customers, handles alerts, uses technology, documents decisions and reports to management, boards and supervisors.
What you get
Audit-ready for BaFin and external auditors
What S+P delivers
What remains with the institution
A readiness assessment is an evaluation and a decision paper. It does not replace approval of the framework by the responsible bodies, nor independent assurance by internal audit.
AMLR is a directly applicable regulation. From 10 July 2027, core AML and CFT requirements will apply across the Union through a more harmonised rulebook. National supervisory practice, criminal law, financial intelligence unit processes and organisational obligations remain relevant, so readiness work has to cover both layers rather than replace one with the other.
The detail that determines implementation is being written now. AMLA has consulted on draft regulatory technical standards for the information required to perform customer due diligence under Article 28 AMLR, on draft guidelines for the business-wide risk assessment under Article 10(4) AMLR, and on draft guidelines for ongoing monitoring under Article 26(5) AMLR. The monitoring guidance matters most in practice because it covers periodic reviews, transaction and activity monitoring, and how unusual behaviour is detected across the life of a relationship.
The transition period is therefore not spare time. It is the window in which the current framework is assessed, the target operating model is redesigned where needed, policies and procedures are updated, systems and data are strengthened, operational capacity is built and evidence of effective implementation is prepared. Institutions that begin late carry existing backlogs into the new regime under stricter documentation expectations.
Six patterns that recur across readiness assessments.
The business-wide risk assessment exists as a document but is disconnected from customer risk classification, review cycles, enhanced due diligence, screening scope and monitoring scenarios. It describes exposure without shaping controls.
Responsibilities between head office, EU parent, branch and subsidiary are not documented, escalation routes are informal and it is unclear who may approve exceptions. Gaps then belong to nobody in particular.
Periodic reviews accumulate, trigger events are captured inconsistently and beneficial ownership data is incomplete. Ongoing monitoring cannot work reliably on a customer record that no longer reflects reality.
Scenarios and thresholds were inherited from implementation and never revisited, calibrated or tested. The settings may be reasonable, but the rationale cannot be reconstructed under review.
Identification data, ownership information, country attributes and risk classes are incomplete or inconsistent across systems. Every metric built on that base is contestable, including the ones reported upward.
Files are reconstructed when a review is announced rather than produced as work happens. That approach consumes capacity, produces gaps and rarely convinces an experienced examiner.
Eight workstreams, assessed individually or as a full programme.
Readiness begins with clear responsibility across boards, senior management, the AML function, business units, technology, operations and internal audit.
The assessment should drive the framework rather than sit beside it, and it must be updated when material changes occur.
Article 10 AMLR requires obliged entities to identify and assess exposure to money laundering and terrorist financing as well as the risks of non-implementation and evasion of targeted financial sanctions. New products, services, business practices, delivery channels and technologies must be assessed before launch. AMLA is developing guidelines on the minimum content under Article 10(4) AMLR.
Due diligence has to work across the entire customer lifecycle, not only at onboarding.
Complete, current and evidenced ownership and control information remains a central risk area.
Decisions on discrepancy reports to the national transparency register remain with the authorised function of the institution. S+P prepares and documents the case.
Customer information, risk profile and transactional behaviour have to stay aligned over the life of the relationship.
Article 26 AMLR requires ongoing monitoring of business relationships and of the transactions and activities carried out within them. Decisions on suspicious activity reports remain with the authorised function of the institution.
Screening must be risk-based, timely, documented and operationally workable at the volumes it produces.
Systems support compliance only where platforms, data, workflows and governance are aligned.
Readiness has to be evidenced. Policies, controls, files, cases, reviews, changes and decisions should be traceable on request.
A management and implementation basis, not a legal summary.
A condensed view for senior management and the board: critical gaps, regulatory risk and the decisions required, in a few pages.
Assessment per workstream by maturity and risk level, visually prioritised across governance, customer processes, screening, monitoring, data and technology.
Actions with owners, dependencies, milestones and target dates, sequenced towards 10 July 2027 with room for testing and backlog reduction.
Target operating model across all three lines, an estimate of technology, data and staffing needs, and a proposal for programme governance and reporting.
Depending on scope, urgency and organisational size.
A comprehensive assessment across all eight workstreams, including processes, data, systems and evidence, delivering the complete roadmap.
A deep review of one area — governance, risk assessment, customer due diligence, beneficial ownership, screening, monitoring, technology or audit readiness.
Regulatory developments, board and senior management responsibilities, implementation risks, resource requirements and the decision points ahead.
Coordination of parallel workstreams from governance and policies through technology and data to training, evidence and group reporting.
Regulatory scope, legal entities, countries, business lines, products, systems, data sources and stakeholders are defined and agreed.
Review of the framework, risk assessment, policies, work instructions, rulebooks, reports, case files, findings and open actions.
Structured discussions with compliance, operations, risk, technology, data and internal audit. Walkthroughs show how processes actually run.
Gaps, risks and dependencies are assessed and translated into a target state, action plan and roadmap, presented in an executive readout.
AMLR readiness affects every line of defence, not only the compliance function. The assessment therefore examines whether operational delivery, independent oversight and assurance are genuinely separated — mixed roles are among the most common findings.
Where S+P supports implementation afterwards, those lines remain separated through distinct teams, roles, access rights, delegated authorities and reporting lines.
| Level | Role under AMLR | Assessment perspective |
|---|---|---|
| Management body | Approves the risk assessment, policies and control framework | Quality of decision papers, reporting and steering capability |
| First line | Operates customer, data, alert, case and evidence processes | Process and throughput analysis, backlogs and data quality |
| Second line | Sets standards, assesses risk, monitors, challenges and escalates | Governance, methodology and control analysis |
| Third line | Provides independent assurance over framework and controls | Audit readiness, evidence and follow-up of findings |
Findings come from files and data rather than assumptions, which makes the scope of work credible internally.
ClarityLimited capacity goes first to the gaps carrying the highest regulatory risk, not the easiest ones.
SteeringDependencies and lead times become visible before they turn into bottlenecks close to the deadline.
PlanningThe assessment, its findings and the action plan are documented and can be shown to supervisors and auditors.
AssuranceSenior management and the board receive what they need to decide on budget, resourcing and sequencing.
GovernanceThe output converts directly into projects and operational capacity rather than requiring another round of analysis.
DeliveryThe overview of our European AML services, from assessment through implementation to managed operations.
Back to the hubConsistent standards across head office, EU parent, branches and subsidiaries, implementable locally.
Explore Group AML GovernanceRulebooks, calibration, data quality, testing and managed operations for AML systems.
Explore Technology & OperationsAudit readiness, evidence management and closure of supervisory and audit findings.
Explore Audit & RemediationLocal AML governance, reporting officer support and BaFin-ready documentation.
Explore German AML ComplianceDescribe your situation — entity type, processes in scope, trigger and timeline — and we will respond with an assessment.
Contact S+P ComplianceRegulation (EU) 2024/1624 applies directly across the European Union from 10 July 2027 for most obliged entities. No national transposition is required for the regulation itself, while member states transpose Directive (EU) 2024/1640 into national law in parallel.
Because readiness changes governance, policies, the risk assessment, customer processes, beneficial ownership, screening, monitoring, systems, data, operations and evidence. Each of those needs design, implementation, testing, training and a transition into daily business. Data remediation and backlog reduction alone bind capacity over months.
No. AMLR harmonises core requirements at EU level. National supervisory practice, criminal law provisions, financial intelligence unit processes, organisational obligations and other local rules remain relevant, so the assessment covers both layers.
Yes. Alongside the full assessment we run focused reviews covering governance, the business-wide risk assessment, customer due diligence, beneficial ownership, screening, transaction monitoring, technology and data quality, group governance or audit readiness.
Yes. Findings can be taken into governance work, technology and operations projects, customer file remediation, managed operations, screening operations, audit readiness and regulatory remediation. First line, second line and internal audit responsibilities remain separated throughout.
Yes. We support head offices, EU parent undertakings, German branches and local subsidiaries with group governance, local implementation, technology governance, AML operations and reporting in both German and English.
S+P Compliance turns European AML requirements into a prioritised, practical and auditable implementation roadmap — based on findings from your own files and data, and sequenced so that the work is finished before the application date rather than starting at it.
Wir verwenden Cookies und ähnliche Technologien, um Ihre Erfahrung auf unserer Website zu verbessern. Weitere Informationen in unserer Datenschutzerklärung.