One year to go: a twelve-month plan to 10 July 2027
With twelve months left before the AMLR applies, a quarter-by-quarter plan for an obliged entity: gap analysis, design, build, test, and the evidence supervisors will want to see on day one.
21 September 2026. Correction of the opening status: in July 2026 two RTS were with the Commission and the first guidelines in consultation; most guidelines had not been drafted. Statuses and dates in this article were aligned with AMLA's publications (regulatory instruments overview of 4 September 2026, Single Programming Document 2026-2028). AMLA has published no final guideline yet; where an EBA guideline exists on a topic it continues to apply until AMLA replaces it.
Twelve months before the AMLR applies is late for a start and early for a finish. Two RTS are with the Commission, the sanctions RTS and the supervisory cooperation ITS are about to follow, the RTS on customer due diligence and thresholds are being finalised, and the first Guidelines are in consultation. That is enough certainty to plan against. Here is a plan in four quarters for an obliged entity of moderate size.
Quarter 1 (July to September 2026): know your gaps
- Complete the gap analysis block by block against the compliance framework, not article by article; the framework view shows where several instruments land on the same process.
- Decide the governance: compliance manager appointed, programme owner named, board reporting cadence fixed.
- Classify every AML task performed by a vendor or group entity as prohibited, outsourcing, reliance or technology.
- Respond to the open consultations that matter to you: the STR template, the business-wide risk assessment, ongoing monitoring.
Quarter 2 (October to December 2026): design
- Customer data model aligned with the CDD RTS and the STR template; one change serves both.
- Beneficial-ownership method: 25% threshold, control through other means, layered structures, discrepancy reporting.
- Risk classification and review frequencies aligned with the draft Guidelines; expected transaction profile made structured.
- Reporting process redesigned around suspicion, with the template as the target output.
Quarter 3 (January to March 2027): build and re-verify
- Start the re-verification wave for customers whose beneficial-ownership data or risk classification does not meet the new rules, highest risk first.
- Implement the twelve-month PEP clock, the HNWI classification and the sanctions screening of beneficial owners.
- Repaper outsourcing and reliance agreements.
- Train staff and the management body; record it.
Quarter 4 (April to June 2027): test and evidence
- Dry-run the STR template on real cases; test the event-driven review end to end.
- Independent review of the programme by the internal audit function or an external party.
- Assemble the evidence pack: risk assessment, policies, appointments, minutes, training records, remediation status.
- Board sign-off before 10 July 2027, with the residual items and their dates.
After 10 July 2027
Compliance becomes a standing cycle: periodic reviews, register checks, reporting on the template, and the next AMLA guidelines. The workspace of AMLR Monitor turns this plan into a readiness tracker with owners, target dates and a board report.