Waiting for AMLA won't make preparation any easier.

Major regulatory reforms tend to create a familiar debate inside compliance teams. One view is that the work should start now. The other is that it is safer to wait until every technical detail is published, so nothing has to be built twice. Both arguments have something in them. Only one of them fits the calendar.

By now, enough of the Level 1 framework is settled, and enough Level 2 work is visible, to separate the changes that can begin now from the implementation detail that genuinely needs to wait. AMLA is operating. The AMLR and AMLD6 are enacted. Selection of the first directly supervised institutions is expected to run through 2027, with direct AMLA supervision of those selected high-risk cross-border financial institutions beginning in 2028. Most firms will continue to be supervised nationally, under a framework designed to be applied more consistently across the EU.

Set the outstanding standards to one side for a moment and look at what is already visible in most frameworks. The Business-Wide Risk Assessment that has not moved while the business has. Customer data that is incomplete on the records that matter most. Management information that counts activity rather than explaining risk. Control weaknesses that have been known for a year and remain open.

The remaining technical standards matter. They will affect implementation detail, data, process design and in some cases systems. But they are not a reason to postpone work on known weaknesses in governance, CDD, MI or control effectiveness. Watching the rulebook develop is not the same as preparing the firm.

The transition to European supervision is a governance event before it is a technical one. Firms will need evidence of judgement, ownership and control effectiveness, not simply new templates.

AMLA is developing common supervisory methodologies intended to increase convergence across the EU. The direction is visible; the final operating detail is still developing. None of that uncertainty is a good reason to delay work on known governance, CDD, MI or control-effectiveness weaknesses.

In my experience, the difficult part of regulatory change is often not reading the rule. It is translating it into data, systems, processes, governance and existing customer relationships. That is where the months go.

Meaningful governance change often takes longer than rewriting the Terms of Reference. Improving customer file quality across a legacy population takes sustained effort, because it depends on operational capacity, outreach and decisions about customers the firm has held for years. Rebuilding management information so it explains risk rather than volume touches definitions, source systems and Board expectations at the same time. None of that is difficult to understand. All of it takes time.

Large institutions may be able to create dedicated change programmes. Smaller firms are more likely to ask the same people who run BAU to deliver the change as well. Alerts still need clearing. Onboarding still needs deciding. The Board still meets.

That is exactly why starting early matters. Work that can be absorbed in small pieces over several quarters becomes very hard to absorb in a single one.

AMLA gets much of the attention, but the change is bigger than the Authority itself. The AMLR, AMLD6 and the move towards more harmonised supervision are reshaping the European framework together.

The new framework is deliberately reducing some of the variation that has existed across Member States, including through more harmonised supervisory methodologies. That does not mean national supervision becomes identical, or that supervisory judgement disappears. It does mean the questions are likely to be put in more similar terms across markets.

A policy has never been evidence that the control works. The direction of the new framework reinforces the need for firms to demonstrate how controls operate, how decisions are made and how weaknesses are identified and corrected. The move towards more harmonised supervision reinforces questions that firms should already be able to answer about governance, control effectiveness and the evidence behind material decisions. Nothing in the new framework makes those questions less important.

In readiness work, these are four areas I keep coming back to. None of them depends on the last technical standard being published. Start with the framework you have today.

The later substantive preparation begins, the more workstreams have to run in parallel and the less room the firm has to absorb failed assumptions, resource constraints or rework. Plans are built on assumptions about data quality, productivity and available capacity. Those assumptions move, as they often do.

Compression gets expensive quickly. More workstreams run in parallel, specialist resource becomes harder to secure and rework has less room to be absorbed.

When a firm asks us to help think about readiness, we start with the parts of the regulatory direction that are already clear, then read the firm's own framework against them. The four areas above are the organising frame for that reading. That usually surfaces a small number of workstreams that have been sitting in due course and need to move.

The output is a short paper covering the likely supervisory perimeter, the material workstreams, the capacity assumptions behind them and the governance actions needed next. It should be short enough that the Chair can understand the position quickly and see what needs to happen next.

The point is not to predict every remaining technical standard. It is to separate what genuinely needs to wait from what plainly does not. If the BWRA is stale, the customer data is weak, the MI does not explain risk or known control weaknesses are sitting unresolved, another RTS is unlikely to solve that for you. That work can start now.