- Governance, CDD & UBO
- Fully, partially, or not evidenced
- Know your gaps before July 2027
Trusted by leading financial institutions across Europe
Key facts:
- One rulebook across all 27 member states: AMLR significantly reduces national divergence by introducing directly applicable obligations across all Member States from 10 July 2027.
- Under AMLR, what matters is not the policy but the proof it was applied. Each obligation requires a retrievable chain from policy to process to documented output, maintained across the full customer relationship.
- cleverKYC closes the gap structurally. Onboarding, screening, risk scoring, periodic review, and case management run on one platform, delivering a holistic, AMLR-aligned client lifecycle with a full audit trail exportable on demand.
Why Having a BWRA and a Screening Tool Is Not the Same as Being Audit-Ready Under AMLR
Most compliance teams reach the same recognition moment: a documented business-wide risk assessment sits on the shared drive, policies are signed off, and the screening tool runs daily in isolation from the risk scoring logic and case management system. Yet none of that answers the supervisor’s actual question, “Show me why this customer scored ten points.” Being audit-ready means producing that reasoning instantly, traceable from the BWRA driver to the final risk decision.
EU enforcement actions and EBA peer reviews keep surfacing the same failure patterns across institutions that believed their frameworks were sufficient.
Article 77 sets the retention and retrievability standard: CDD records, transaction data, and supporting documentation must be retained for five years and made available to the competent authority on request, including immediate provision where references rather than full copies are held. In practice, audit-readiness means being able to respond promptly to an inspection notice.
| What most teams have | What AMLR requires |
|---|---|
| BWRA drafted once, stored on the shared drive, not updated after material changes to the customer base or product mix | Living document, reviewed annually, board-approved, retrievable on supervisory request (Art. 10) |
| Risk scores assigned without a documented rationale linking them back to inherent risk drivers | Every score traceable to a specific BWRA risk driver, reconstructable on demand (Art. 10) |
| EDD trails where trigger reason, evidence, and approver cannot be reconstructed | Full decision file: trigger, evidence, reviewer identity, timestamp, and approver (Art. 34) |
| Case data scattered across screening, monitoring, and onboarding systems that never reconcile | Complete, retrievable records in one system, provided to the competent authority on request. Where references are retained instead of copies, the underlying information must be available immediately and protected from alteration (Art. 69, 77) |
Excel-based risk matrices and disconnected tools cannot satisfy these requirements. The regulation expects a traceable evidence chain available within hours of an inspection notice, not weeks of manual reconstruction across siloed databases.
The AMLR Regulation-to-Process Mapping Matrix: From Article to Audit Evidence
An audit-ready program needs a translation layer: a regulation-to-process mapping matrix that connects each AMLR article to the policy it requires, the process that implements it, and the evidence that process must generate.
The table below condenses the articles that drive most supervisory inspections into concrete operational outputs.
| AMLR Article | Internal Policy Required | Process That Implements It | Evidence It Must Generate |
|---|---|---|---|
| Art. 9 | Risk-based approach policy | Risk factor weighting methodology | Documented scoring rationale per customer |
| Art. 10 | BWRA framework | Annual review with board approval | Signed BWRA, retrievable on supervisory request |
| Art. 20–22 | Standard CDD policy | Identity verification against authoritative sources | Verified ID records, source attribution |
| Art. 26 | Ongoing monitoring policy | Event-driven CDD review | Monitoring log with alert disposition |
| Art. 34 | Enhanced due diligence policy | Trigger-based escalation workflow | EDD decision file with reviewer and approver |
| Art. 69 | SAR decision policy | Case review with documented reasoning | Filed and not-filed decision records |
| Art. 77 | Record retention policy | Retention and retrievability workflow | Complete, retrievable records, provided on request, protected from alteration |
Find Out Where Your AMLR Framework Stands Before the Supervisory Authority Does
The AMLR Reality Check is a structured self-assessment across governance, customer due diligence, beneficial ownership, screening, and recordkeeping. Each domain is scored as fully evidenced, partially evidenced, or not evidenced, giving you a clear view of where your current framework will hold up and where it needs structural work before July 2027. Learn more about preparing for an AML audit and how structured case management supports defensible evidence trails.
Art. 10 BWRA: From Static Document to Board-Approved Living File
A defensible BWRA under Art. 10 is no longer a one-time drafting exercise. Supervisory authorities expect it to be available on request, typically within a short defined window under applicable national procedural rules. AMLA’s May public hearing on the draft BWRA guidelines drew over 1,000 stakeholders, with final guidelines expected in Q4 2026, sharpening expectations on methodology and evidence depth.
The practical implication is straightforward: the BWRA must directly feed your risk-scoring logic. Every customer score has to be traceable back to a documented risk driver in the assessment, linking inherent risk factors to the weighting applied in onboarding and ongoing monitoring. Supervisors no longer ask whether the review happened. They ask why this customer received this score, and they expect the BWRA to supply the answer.
Customer Due Diligence Under AMLR: Building a Verifiable Decision Trail
AMLR structures customer due diligence into three tiers, each with its own trigger and its own evidence expectation:
- Standard CDD under Art. 20 to 26: the baseline for most customers, covering identification and verification of the customer and beneficial owner, the purpose and intended nature of the relationship, and ongoing monitoring. Article 22 is the operational core: identity must be verified against reliable and independent sources, not customer self-declaration, with each check recording the source used and the date.
- Simplified due diligence under Art. 33: permitted only where the risk assessment produces a documented low-risk finding, with the specific measures defined in the CDD regulatory technical standards that AMLA is mandated to develop under Article 28. Simplified does not mean undocumented; a supervisor will still ask why a customer received reduced scrutiny.
- Enhanced due diligence under Art.34 and related higher-risk provisions: triggered by elevated risk, including high-risk third countries and politically exposed persons, and requiring a full documented decision trail.
Two changes raise the operational bar immediately. The CDD trigger for occasional transactions drops from EUR 15,000 to EUR 10,000 under Art. 19. Art. 20 requires identifying beneficial owners and taking reasonable measures to verify their identity, while Article 22 sets out how customer and beneficial owner identity must be identified and verified.
In practice, customer self-declaration alone may not be sufficient where verification against reliable and independent sources is required.
An EDD audit trail has to reconstruct the full decision on demand. That means the documented trigger reason, the evidence captured during review, the identity of the reviewer, the approval record with timestamp, and a direct link back to the specific BWRA risk factor that drove the escalation. Without that chain, a supervisor treats the EDD file as policy compliance without operational substance.
Art. 69 SAR Decisions: Documenting Why You Did Not File
Art. 69 is the basis for the suspicion assessment: an obliged entity must assess whether a transaction or activity gives rise to a suspicion of money laundering or terrorist financing, and decide whether to file. Art. 77 then requires that the record of that assessment be retained, covering both filed and not-filed decisions.
Together they mean a supervisor expects to see the documented reasoning, the reviewer identity, the approval chain, and the supporting evidence behind every SAR decision, including the decision not to file.
A missing rationale for a non-filing decision is treated as a control failure. Closed alerts without a written disposition signal that the institution cannot demonstrate why a suspicion was discounted.
The workflow has to generate this trail automatically as a byproduct of daily case management, not through retrospective reconstruction after an inspection notice arrives.
A Likely Supervisory Request Sequence: What AMLA or National Supervisors May Ask to See
In the opening phase of an inspection, a national competent authority or AMLA supervisor follows a predictable request sequence. Under Regulation (EU) 2024/1620, supervisors have investigatory powers that extend beyond document review into algorithm inspection and decision-making documentation. They will not ask whether your screening tool runs daily. They will ask which parameters drive the matching logic, who configured them, and on what basis.
Every customer rating must be reconstructed on demand: the BWRA risk driver that triggered it, the inherent risk weighting applied, the controls quality factored in, and the residual risk score now in the file.
Use the table below as your first artefact inventory. Each item is tied to a specific AMLR article and typically requested within the opening hours of an inspection. Missing or inconsistent items signal structural weakness before any deeper review begins.
| Artefact the supervisor may request | Regulatory basis | What audit-ready looks like |
|---|---|---|
| Business-wide risk assessment (BWRA) | Art. 10 | Signed, board-approved, updated after material changes, retrievable on request |
| CDD files for sampled customers across risk tiers | Art. 20–22 | Identity verified against reliable and independent sources, source attribution documented |
| Screening coverage report | Art. 9, 20, 26 | List sources named, refresh frequency logged, every match disposition recorded |
| EDD decision records | Art. 34 | Trigger reason, evidence, reviewer identity, timestamp, and BWRA link all present |
| SAR and non-SAR decision log | Art. 69, Art. 77 | Both filed and not-filed decisions documented with reasoning and approval chain |
| Staff training and awareness records | Art. 12 | Dated, role-specific, covering current regulatory requirements |
| Staff integrity records | Art. 13 | Current for all relevant staff, retrievable by individual |
| UBO verification records | Art. 20, Art. 22 | Verified against reliable and independent sources, not based on customer self-declaration alone |
| Algorithm and rule configuration documentation for screening and monitoring | Regulation (EU) 2024/1620 | Parameters documented, configuration owner identified, basis recorded |
The most common finding pattern in recent enforcement is divergence between the written policy and the live system configuration. The policy describes a risk-based threshold, the screening engine runs a different one, and no change log explains the gap. Supervisors treat that disconnect as evidence the framework is documented but not operated. A gap analysis that only checks whether documents exist will miss this. Each artefact above needs to be tested against the live configuration, not just confirmed as present.
Closing the Audit Gap With cleverKYC
cleverKYC is built for compliance teams that have done the foundational work: a documented BWRA, written policies, daily screening. The gap it closes is the one that matters most in an inspection: the ability to reconstruct a traceable evidence chain quickly, rather than through days of manual effort across siloed systems.
What that looks like in practice:
- Risk scoring configurable from the BWRA with 34 parameters available to tune matching logic, driving a significant reduction in false positives documented across client implementations
- Continuous screening across PEP, sanctions, and adverse media lists, with complete exportable history for regulatory review
- Trigger-based periodic reviews with documented approval chains, reconstructable on demand
- Holistic client view consolidating KYC data and risk ratings into one record, retrievable within hours of an inspection notice
The cleversoft Compliance Commitment ensures audit-readiness does not expire. Regulatory updates including binding RTS and ITS, AMLA supervisory handbook revisions, and final EBA guidelines are incorporated within the running licence fee, with no re-procurement or change-request cycle. The framework stays current through 2027 and into the AMLA direct-supervision phase beyond.
Let's Map Your AMLR Process Gaps Before the Supervisor Does
Connect with cleversoft’s FinCrime specialists for a focused working session on your specific AMLR process architecture, not a generic product demo. We review your BWRA-to-scoring linkage, EDD evidence trail, and case workflow against Articles 10, 26, 69, and 77. With the realistic implementation window at twelve to eighteen months ahead of the July 2027 deadline, the gap analysis you act on now defines what the supervisor finds later.
Conclusion: Audit-Ready AMLR Compliance Starts With the Right Process Architecture
A documented BWRA, written policies, and an active screening tool are not the same as being audit-ready. Articles 9, 10, 20 to 26, 69, and 77 ask for processes that generate evidence automatically as a byproduct of daily operations, with every risk score, escalation, and case decision reconstructable on demand.
The operational window is finite. With 10 July 2027 fixed and AMLA peer reviews expected in Q3 2027, the time to act on process architecture is now.
This is not a documentation problem. cleverKYC consolidates onboarding, screening, monitoring, and case management into the single client lifecycle that supervisors now expect to see, with the cleversoft Compliance Commitment keeping the framework current as AMLA guidelines, RTS, and ITS finalise through 2027.
FAQ
What Does Audit-Ready Mean Under AMLR?
Audit-ready means producing retrievable evidence that each control functioned in daily operations, with records retained, complete, protected from alteration, and capable of being provided to the competent authority on request under Art. 77. Policies on file are not enough. The supervisory authority distinguishes sharply between documented intent and operational evidence, reconstructing the actual decision behind every customer rating.
How Long Must AML Process Documentation Be Retained and in What Format?
Art. 77 AMLR sets a five-year minimum retention period after the end of the business relationship, with possible extension to ten years where national authorities justify it. Records must be retained in a complete and controlled form, protected from alteration, and capable of being provided to the competent authority on request. Where references are held instead of full copies, the underlying information must still be available immediately. Excel-based risk matrices and shared-drive archives rarely meet this standard in practice, because they struggle to guarantee that records stay complete, tamper-resistant, and retrievable under the time pressure of an inspection.
Should We Wait for AMLA's RTS (Regulatory Technical Standards) Before Redesigning CDD Processes?
No. The AMLR text is published and binding from 10 July 2027, and institutions can act on it now. Gaps identified today become operational emergencies given the twelve to eighteen month implementation lead time for CDD redesign.