AML compliance under the AMLR.
The biggest reform of Europe’s anti-money-laundering rules in years. Answers on the AMLR, AMLA, the business-wide risk assessment and what you can already do to be ready.
Status · last updated 7 October 2026.
What we do for you.
Three ways we help you with AML and the Wwft.
Customer due diligence, transaction monitoring, UBO and PEP in policies, procedures and systems; a SIRA in line with the DNB good practices and the AMLA guidelines.
What the AMLR and AMLD6 change for your set-up from 10 July 2027 and a step-by-step plan to be compliant in time.
Second-line role, DNB information requests, FIU reporting and file reviews — temporary or ongoing.
The new AML rules.
What changes with the arrival of the AMLR?
The AMLR harmonises anti-money-laundering rules at EU level in a single directly applicable regulation. Where the Wwft (Dutch Anti-Money Laundering and Anti-Terrorist Financing Act) now differs per member state, largely the same rules will apply across the EU, with stricter requirements for risk assessment, customer due diligence and governance.
When does the AMLR apply?
The AMLR applies from 10 July 2027 and is directly effective in all EU member states. AMLA’s accompanying guidelines are published in phases in the run-up to that date.
What is AMLA and what does it do?
AMLA is the new European anti-money-laundering authority, based in Frankfurt. It issues guidelines and technical standards and will directly supervise a number of the highest-risk institutions.
Where do AMLA’s technical standards (RTS and guidelines) stand?
AMLA ran public consultations in early 2026 on the first set of regulatory technical standards, covering customer due diligence (Article 28 AMLR), the criteria for business relationships and linked transactions (Article 19 AMLR) and pecuniary sanctions under AMLD6; those consultations closed on 8 May 2026. The final draft RTS were submitted to the European Commission by 10 July 2026. On 1 October 2026 AMLA published the final reports on customer due diligence (Article 28 AMLR), business relationships and linked transactions (Article 19 AMLR) and group-wide requirements (Articles 16 and 17 AMLR); once adopted and published by the Commission, these standards apply six months after entry into force. The AMLR itself applies from 10 July 2027 — institutions therefore have less than a year to adapt policies and systems. On 1 October 2026 the AFM advised firms to start a gap analysis, risk assessment and training now.
What is the difference between the AMLR and the Wwft?
The Wwft is the current Dutch anti-money-laundering act, based on EU directives. The AMLR is a regulation that applies directly and makes the core rules uniform; national discretion largely disappears. The Wwft will be adapted accordingly.
Does the Netherlands still need to implement the AMLR?
No, a regulation applies directly. The package does include a directive (AMLD6) that the Netherlands must transpose, and the Wwft will be aligned with the new framework. The Council of State issued its advice on the Dutch implementing act on 12 August 2026; as at 7 October 2026 the bill had not yet been submitted to the House of Representatives.
Which countries are on the EU list of high-risk third countries?
The European Commission amends the list by delegated regulation. Since January 2026 the list also includes Russia (Delegated Regulation (EU) 2026/46) and Bolivia and the British Virgin Islands (Delegated Regulation (EU) 2026/83); in 2025 countries such as Algeria, Kenya, Lebanon, Monaco, Namibia, Nepal and Venezuela were added. Enhanced due diligence is mandatory for customers from these countries, independently of sanctions screening. Check the country lists in policies and systems after every amendment.
BWRA and SIRA.
What is a business-wide risk assessment (BWRA)?
The BWRA is the institution-wide assessment of your money-laundering, terrorist-financing and sanctions risk. It is the foundation under your policy, customer acceptance and transaction monitoring.
What does Article 10(4) AMLR require of the BWRA?
Article 10(4) gives the BWRA a fixed shape and content. The assessment must, among other things, explicitly weigh the risk of non-compliance and of evasion of sanctions, and be updated periodically.
What is the difference between a BWRA and a SIRA?
In practice they overlap strongly. The SIRA is the Dutch systematic integrity risk analysis; the BWRA is the AMLR term for the institution-wide risk assessment. We place your SIRA against the BWRA requirements and close the gaps.
Who drafts the BWRA and who approves it?
The compliance officer drafts the BWRA, while the board approves it and remains ultimately responsible. That division of roles must be demonstrably documented.
Must the BWRA also weigh sanctions risk?
Yes. New under the AMLR is that the risk assessment also covers the risk of evasion of sanctions measures, bringing sanctions compliance and AML closer together.
Onboarding, sanctions and approach.
What changes for remote identification and digital onboarding?
The AMLR reshapes the requirements for remote identification. Onboarding flows must be demonstrably reliable, explainable and auditable. This directly affects your KYC and customer acceptance process.
How does sanctions screening relate to the AML framework?
Sanctions screening and monitoring become an explicit part of the framework. Screening, hit handling and escalation must align with your risk profile and the AMLR requirements.
What should PSPs and fintechs already be doing now?
Start with a gap analysis of your current SIRA/BWRA, policy and onboarding against the AMLR. Using the run-up to 10 July 2027 avoids a forced catch-up later.
How can Compliance-support help with AML compliance?
We perform gap analyses, draft or renew AML policy, BWRA/SIRA and sanctions frameworks, and provide interim compliance support to carry the implementation.
How quickly can you start?
We usually schedule an introduction and a first gap analysis within one to two weeks. Get in touch for a 30-minute conversation.