Perspectives
Perspective 008Regulation

Waiting for AMLA won't make preparation any easier.

Most of the work firms need to do has very little to do with the remaining technical standards. Strengthening governance, CDD and management information takes time.

By Everett MorganWinter 20269 min read
Frankfurt institutional architecture at dusk
Executive brief

Reading time · 9 minutes  ·  Primary audience · Boards, MLROs, Heads of Compliance and Financial Crime, Chief Risk Officers

Why this matters

The AML Regulation, the Sixth AML Directive and the AMLA regulation entered into force in July 2024 with a phased application from July 2027. AMLA has been established in Frankfurt and its selection framework for directly supervised firms is already known. A common reaction inside regulated firms is to wait for the level-two Regulatory Technical Standards before beginning material preparatory work. That reaction misreads what the transition actually requires. The largest items of work — governance, customer due diligence, management information, second-line effectiveness — are neither dependent on, nor accelerated by, the RTS process.

Key findings
  1. 01The AML package is settled. The RTS still to be published clarify implementation detail, not the direction of travel.
  2. 02The direct supervision perimeter is defined by measurable risk criteria published in the AMLA regulation. Firms can estimate their likelihood of selection today.
  3. 03For non-selected firms, national supervisors will continue to apply the AMLR through a harmonised European Supervisory Handbook. The lens will change more than most firms expect.
  4. 04The largest preparation items — legacy CDD debt, MI rebuild, second-line credibility — take between twelve and thirty months to deliver well. Started late, they cannot be compressed.
Questions Boards should ask
  1. 01Under the criteria in the AMLA regulation, what is our probability of falling within the directly supervised population, and does our plan reflect that answer?
  2. 02Which items of our current AML framework are we confident would withstand a single European supervisory standard, and which items would we not choose to defend?
  3. 03If we started preparation in twelve months rather than today, what specifically would we no longer have time to do well?

The problem: 'waiting for the RTS' is a strategy for missing the runway

A pattern is emerging in firms that would rather not begin preparation before the picture is fully clear. The RTS are in consultation. Guidance is expected in tranches. AMLA is staffing up. It feels reasonable to sequence major investment behind those milestones. It is also a mistake, because the work that actually matters is not RTS-dependent.

The transition to European supervision is a governance event before it is a technical one. It will be won or lost on evidence of judgement, not on the presence of new document templates. The firms that will find the transition manageable are those already improving what they can improve without waiting for anyone.

What is already settled, and what still moves

It helps to be precise about what is genuinely uncertain and what is not. Very little of the strategic direction is in doubt.

None of the items in the second list changes the substantive work in the first list.

The four items that decide the transition

In practical work with firms preparing for the AMLA transition, four items dominate the runway. All four are independent of the level-two texts.

Good practice and poor practice on the AMLA runway

Business impact: the cost of a late start

A firm that begins substantive preparation eighteen months before application has time to sequence the work by materiality, absorb resource constraints, and adjust the plan when reality departs from assumption (which it always does). A firm that begins six months before application runs every stream in parallel, in a market where experienced financial crime resource is already scarce, and accepts execution risk on all of them.

Practical solutions: what to do in the next quarter

The Claritas approach

When a firm asks us to help think about AMLA readiness we begin, deliberately, with the four items above and not with the regulation. We ask the client to accept for the first conversation that the strategic direction is settled, and to concentrate the discussion on what its own framework looks like read against that direction. That framing usually surfaces two or three specific pieces of work the client had been intending to do 'in due course' and moves them forward.

We then produce a short paper: the client's likely supervisory perimeter, the four workstreams sequenced by materiality, the internal capacity assumption behind the plan, and the two decisions the Board would need to take in the next quarter for the plan to be credible. It is not a slide deck. It is a document a Chair could read in twenty minutes and act on the same day.

What success looks like
  • 01The Board can state, in one sentence, whether it expects to be directly or nationally supervised, and why.
  • 02Legacy CDD refresh is running on a documented risk-tiered plan, with monthly progress and a defined completion state.
  • 03The MI pack has been redesigned to answer three governance questions each quarter, and the Board can name them.
  • 04The second line records at least one substantive disagreement with the first line per quarter, and the resolution route is documented.
  • 05When the outstanding RTS are published, the plan absorbs them within a quarter and does not restart.
References
  • Regulation (EU) 2024/1624 (AMLR) and Directive (EU) 2024/1640 (AMLD6). Official Journal, 19 June 2024.
  • Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA).
  • European Banking Authority, Opinions and consultation papers relating to the AML/CFT single rulebook. www.eba.europa.eu/
  • AMLA, Establishment and initial work programme communications, 2025–2026.
About the author
Everett Morgan
Founder & Principal Adviser, Claritas Risk Advisory

Everett has more than twenty years' experience in financial crime, AML governance, regulatory compliance and operational risk gained within Deutsche Bank, Morgan Stanley and BNP Paribas. He established Claritas Risk Advisory to provide smaller regulated financial institutions with experienced independent judgement, practical insight and proportionate recommendations.

Need an independent perspective?

Preparing for regulatory change starts with understanding where your organisation stands today.

If you would like to discuss your financial crime framework or explore how Claritas Risk Advisory can help, I would be pleased to arrange a confidential conversation.

Let's start with a conversation