AMLA compliance: Five technology questions financial institutions should ask

Quick Summary

Preparing for AMLA's new regulatory requirements requires financial institutions to assess whether their compliance technology can connect customer and beneficial ownership data, support dynamic risk assessments, identify linked transactions, apply consistent controls across jurisdictions, and maintain auditable records of decisions. These five capabilities are central to technology readiness under the EU's evolving AML framework.

Introduction

The European Union’s new anti-money laundering framework has taken another important step from legislation toward implementation.

On October 1, 2026, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) finalized three Regulatory Technical Standards (RTS) impacting customer due diligence for private-sector firms under the EU Anti-Money Laundering Regulation (AMLR).

• Draft Regulatory Technical Standards on Customer Due Diligence, AMLR 28(1) – final report and factsheet

• Draft Regulatory Technical Standards on criteria for identifying business relationships, occasional and linked transactions and lower thresholds, AMLR 19(9) – final report and factsheet

• Draft Regulatory Technical Standards on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries, AMLR 16(4) and 17(3) – final report,  2 factsheet on groupwide requirements and legal impediments for third countries.  

These have now been submitted to the European Commission for adoption.

The October 1 publication is one milestone within a broader program of technical standards that will progressively define how the EU's new AML framework operates in practice. The timeline below shows the key RTS milestones and implementation landscape financial institutions should be preparing for.

AMLA has also proposed an extended six month grace period  after they enter into force  to give institutions additional time to implement the detailed requirements.

That time should not be mistaken for a reason to wait.

The final draft RTS provide greater clarity and new data requirements for how important parts of the new framework will operate in practice. They also reinforce a broader direction already visible across AMLR: greater consistency without abandoning the risk-based approach.

For financial institutions, this creates an important technology question. Not simply “Are we compliant with AMLA?”, but:

Can our existing data, systems and controls support the way AMLA expects financial crime risk to be managed?

Here are five questions financial crime leaders should be asking.

1. Can we collect and connect the customer and beneficial ownership information the RTS require?

Effective customer due diligence starts with reliable information.

The CDD RTS provide greater detail on the information firms should obtain about customers and beneficial owners, how identity should be verified, and the additional information that may be required where higher risk is identified.

For many institutions, however, the challenge is not simply whether the information exists. It is whether it can be accessed, connected and used consistently.

Customer information may sit across onboarding platforms, KYC systems, transaction monitoring environments, screening solutions, case management tools and third-party data sources. Corporate customers introduce another layer of complexity through ownership structures, controlling interests and relationships between entities.

The technology question is therefore broader than data collection:

Can the institution create a sufficiently complete and current view of the customer, beneficial ownership and associated relationships to support risk-based decisions?

This puts data integration, entity resolution and the ability to connect internal and external information at the center of AMLA technology readiness.

2. Can our systems apply CDD dynamically and proportionately according to risk?

Harmonization does not mean treating every customer in the same way.

The AMLR retains the risk-based approach, and the CDD RTS provide further detail on how the extent of due diligence should vary according to the level of money laundering and terrorist financing risk.

That has important implications for technology.

Institutions need to be able to bring relevant risk factors together, assess them consistently and translate changes in risk into appropriate action. Higher-risk circumstances may require enhanced information or additional scrutiny, while lower-risk situations may justify simplified measures where the relevant conditions are met.

The question is whether existing systems can support that differentiation efficiently.

Static customer classifications and periodic reviews can make it difficult to respond when the underlying risk changes between review cycles. More dynamic risk assessment can help institutions identify material changes earlier and direct additional controls and investigator attention where they are most needed.

The objective is not more automation. It is more proportionate application of controls based on risk.

3. Can we identify relationships between customers, entities and transactions?

One of the final RTS establishes criteria for determining when transactions should be considered linked.

This matters because separate transactions may collectively meet thresholds that trigger customer due diligence requirements. Looking at individual transactions without understanding their wider context can therefore leave important relationships hidden.

Financial institutions should consider whether their technology can identify connections across customers, accounts, beneficial owners, counterparties and transactions rather than assessing each data point in isolation.

This is where entity and relationship resolution becomes particularly important.

Connecting fragmented records can help institutions understand whether multiple transactions share common parties, characteristics or other relationships and provide investigators with the context required to assess activity more effectively.

The broader principle extends beyond linked transactions: financial crime risk rarely exists as a series of isolated data points.

Technology that can connect those data points can provide a more complete view of the customer and risk.

4. Can our CDD, screening and investigation workflows adapt consistently across jurisdictions?

One of the fundamental objectives of the EU AML package is greater harmonization.

For multinational institutions, however, implementing harmonized requirements across complex technology estates may itself be challenging.

Different business units or jurisdictions may operate different KYC processes, screening configurations, data models, workflows and legacy systems. Changes to policy can consequently require multiple technology changes across the organization.

The final RTS make this an important readiness consideration.

Institutions should assess how easily their existing environments can accommodate changes to customer information requirements, risk factors, screening processes, escalation criteria and due diligence workflows and whether those changes can be implemented consistently.

The group-wide RTS add another dimension by setting requirements around group-wide policies, controls, risk management and information sharing.

The question is therefore not necessarily whether every system needs to be replaced. It is whether the technology architecture allows requirements to be implemented and adapted consistently across the organization while preserving appropriate local controls and governance.

5. Can we evidence the data, decisions and controls behind our CDD processes?

As financial crime processes become more automated, the ability to explain and evidence how decisions were reached becomes increasingly important.

Institutions need visibility into the information used to assess a customer, the risk factors considered, the controls applied and the actions subsequently taken.

That requires more than retaining a final risk score.

Financial institutions should consider whether their systems provide sufficient traceability across the decision-making process: where information originated, how it was assessed, what changed, why a particular workflow was triggered and where human judgment influenced the outcome.

This becomes particularly important as institutions introduce more advanced analytics and AI into financial crime compliance.

Technology can augment investigator expertise and help teams process increasingly complex information, but human accountability and effective governance remain essential.

For AMLA readiness, auditability should therefore be treated as a core technology requirement rather than an afterthought.

From regulatory readiness to technology readiness

The final draft RTS do not prescribe a particular technology architecture, nor do they mandate the use of AI. AMLA has deliberately sought to remain technologically neutral.

But technological neutrality does not mean technology is irrelevant.

Implementing more harmonized and risk-sensitive requirements across customer due diligence, beneficial ownership, linked transactions and group-wide arrangements will depend in part on institutions' ability to connect data, understand relationships, adapt controls and maintain clear evidence of decisions.

The extended six-month grace period proposed by AMLA provides additional time to update systems, policies and training once the standards enter into force. Financial institutions can use the greater clarity available now to assess where their current technology environment supports the emerging requirements and where gaps remain.

The question for financial crime leaders is therefore moving from “What will AMLA require?” toward “Can our technology environment support it?”

Related resources:

Learn more about how SymphonyAI helps financial institutions prepare for AMLA

Guide: What is AMLA? A Guide for Compliance Leaders

Webinar: From Regulation to Action: Getting EU AMLA-ready

‍

‍