AMLR Compliance Checklist for Obliged Entities

Most AML compliance checklists you will find online were written for the United States, around the Bank Secrecy Act, FinCEN and SARs. If you are an obliged entity in the EU, those checklists point you at the wrong rulebook. This one is built around the EU Anti-Money Laundering Regulation, the AMLR, which applies directly across all 27 member states from 10 July 2027.

Use it as a working checklist to pressure-test your programme against the AMLR before the deadline. It runs through eleven workstreams, from governance to training, and ends with a one-page scorecard you can copy and fill in.

For the background on what the AMLR is and how it fits with AMLD6 and the new supervisor AMLA, start with our pillar guide, What is the AMLR. If you are a life insurer, pair this with our sector guide on AMLR for life insurers.

Step 0: Are You an Obliged Entity?

Before any checklist item matters, confirm that the AMLR applies to you, and under which category, because the regulation widens the perimeter significantly. If any of the following describe your business, you are almost certainly an obliged entity:

• Financial sector: banks, payment and e-money firms, investment firms, and insurers offering life or investment-related products.

• Crypto: crypto-asset service providers, now treated as financial institutions and fully in scope.

• Professional services: auditors, accountants, tax advisors, notaries and lawyers for defined transactions, and trust or company service providers.

• Higher-risk trade and other newly obliged sectors: estate agents, dealers in high-value goods and precious metals, crowdfunding platforms, investment-migration operators, and, from 2029, professional football clubs and agents.

The full Article 3 list and the expanded scope are covered in the AMLR pillar guide. Once you have confirmed your category, work through the checklist below.

How to Use This Checklist

Each workstream opens with what the AMLR expects, then lists the concrete actions to tick off. Treat the actions as the floor, not the ceiling: a risk-based approach means a larger or higher-risk firm will do more. Where an item depends on technology, we flag where identity verification, screening and monitoring tools do the heavy lifting. The scorecard near the end maps every workstream to its AMLR anchor so you can track status and evidence in one place.

1. Governance and the Compliance Function

The AMLR expects accountability to sit with named people and with the management body, not with a policy document alone. Get the governance layer right first, because everything else reports into it.

• Appoint a compliance manager at management-body level and a compliance officer responsible for day-to-day AML operations.

• Give the compliance officer genuine authority, resources and access to information, with the independence to report suspicions without being overridden.

• Have the management body approve the business-wide risk assessment and the AML policies, and receive regular reporting.

• Keep the customer risk decision in-house; it cannot be fully outsourced.

2. Business-Wide Risk Assessment

A current, documented risk assessment is the spine of a risk-based programme and the first thing a supervisor will ask to see. It should reflect your own exposure, informed by the EU and national risk assessments.

• Produce a business-wide risk assessment covering customers, products and services, delivery channels, and geographies.

• Translate it into a documented risk appetite and into customer risk ratings you can act on.

• Refresh it on a defined cycle and on material change, and align it with your customer risk assessment methodology.

3. Customer Due Diligence and Identity Verification

Customer due diligence is where the AMLR meets day-to-day operations, and where most obliged entities will feel the change, because the thresholds are lower and remote identity standards are higher. This is the layer Qoobiss is built for.

• Identify and verify every customer and their beneficial owners, and record the purpose and nature of the relationship.

• Apply full CDD at the start of a business relationship, and on occasional transactions at or above the AMLR thresholds (see the table below). Use robust remote verification: document and biometric checks with liveness rather than document upload alone.

• Apply enhanced due diligence for higher-risk situations, including politically exposed persons and high-risk third countries, with defined triggers and review intervals.

• Build the flow so verification, screening and risk rating happen in one onboarding journey rather than as disconnected checks.

4. Beneficial Ownership and EU Registers

Knowing the real people behind a customer is a core AMLR duty, and the regulation expects you to verify ownership rather than take it on trust. Registers are a cross-check, not the source of truth.

• Identify beneficial owners against the 25% ownership-or-control threshold, calculating indirect holdings through each ownership chain. See our guide to the ultimate beneficial owner.

• Consult the relevant national beneficial-ownership register and report discrepancies between the register and what you find. Watch for shell-company structures used to obscure ownership.

• Keep beneficial-ownership evidence current and refresh it when ownership changes.

5. Sanctions, PEP and Adverse-Media Screening

Screening is a continuous obligation, not a one-off at onboarding, and it has to keep pace with list changes. The AMLR also expands the politically-exposed-person definition, so your PEP logic needs to be wider than before.

• Screen customers and, where relevant, counterparties against EU and UN sanctions lists at onboarding and on an ongoing basis.

• Screen for politically exposed persons under the expanded definition, which now reaches regional and local officials and treats siblings as family members for the most senior functions.

• Add adverse-media screening for higher-risk customers, and document match investigation and resolution. Omnicheck runs sanctions, PEP and adverse-media screening together.

6. Ongoing Monitoring and Perpetual KYC

The AMLR shifts the emphasis from periodic form-filling to keeping customer knowledge current, so monitoring and review should be continuous and event-driven. This is where firms most often have the largest gap today.

• Monitor transactions on a risk-sensitive basis, with documented detection scenarios and an alert investigation and escalation workflow that leaves an audit trail.

• Refresh customer information at least every year for higher-risk customers and at least every five years for others, with reviews also triggered by events and new sanctions designations.

• Move toward continuous, event-driven review (perpetual KYC) rather than fixed calendar reviews, supported by transaction monitoring and fraud prevention.

7. Reporting Suspicions to the FIU

When suspicion arises, the AMLR requires you to report to the national Financial Intelligence Unit, not to sit on it, and to do so without tipping off the customer. AMLA is building a single EU-wide reporting format.

• Define an internal process for raising, assessing and reporting suspicious activity to the FIU, with clear turnaround times.

• Submit suspicious-transaction reports through the required channel, and preserve confidentiality so there is no tipping-off.

• Apply the EU-wide EUR 10,000 cash-payment limit in your controls, and watch for structuring designed to stay under thresholds.

8. Record-Keeping and Retention

Good records are a control in their own right under the AMLR, because you have to be able to reconstruct and justify decisions long after they were made.

• Retain CDD records, transaction data and the basis for decisions for the period the AMLR requires, generally five years, in a retrievable form.

• Maintain a data-retention and archival policy aligned with the AMLR and with data-protection rules.

9. Independent Audit

An independent check keeps the programme honest and is something supervisors expect to see evidenced. It should be genuinely independent of the people running day-to-day AML.

• Commission periodic independent testing of the whole AML programme, covering every workstream in this checklist.

• Report findings to the management body and track remediation to closure.

10. Training and Awareness

Controls only work if people apply them, so the AMLR expects ongoing, role-relevant training rather than a yearly tick-box.

• Train all relevant staff on AML obligations and your own policies, and refresh when rules or products change.

• Give role-specific training to frontline, onboarding and operations teams, and record completion.

11. Technology and Outsourcing

The AMLR does not mandate particular tools, but meeting its thresholds and demonstrability expectations at scale is hard without them. Where you outsource, responsibility stays with you.

• Use RegTech to operationalise verification, screening, monitoring and reporting as connected workflows with an audit trail.

• Where functions are outsourced, keep oversight and keep the customer risk decision in-house, with contracts and controls to match.

Key AMLR Thresholds to Build In

Several checklist items depend on getting the numbers right. These are the AMLR thresholds to wire into onboarding and monitoring rules:

The AMLR Checklist Scorecard

Use this one-page summary to track where you stand. Map each workstream to its AMLR anchor, then mark your status as done, in progress, or a gap, and note where the evidence lives.

Article references are indicative and should be confirmed against the AMLR text (Regulation (EU) 2024/1624) for your specific category.

How Qoobiss Helps

Most of this checklist lands at the identity, screening and monitoring layer, which is exactly where Qoobiss works. We help obliged entities turn the actions above into connected, audit-ready workflows:

• Onboarding and CDD. Origin builds no-code onboarding flows with built-in KYC and AML checks, and Ontrace handles remote document and biometric verification with liveness, covering workstream 3.

• Screening and beneficial ownership. Omnicheck runs sanctions, PEP and adverse-media screening and helps evidence ownership and risk-rating decisions, covering workstreams 4 and 5.

• Monitoring and demonstrability. Qoobiss supports continuous transaction monitoring and keeps an audit trail behind each decision, covering workstreams 6 and 8 and the evidence a supervisor will ask for.

Get AMLR-Ready with Qoobiss

The firms that cope best with the AMLR are treating the run-up to 10 July 2027 as a programme and connecting identity, screening and monitoring into one system with an audit trail. Qoobiss helps obliged entities do exactly that. See how Qoobiss supports AML compliance and onboarding, read the AMLR pillar guide for the full picture, or get in touch to review your checklist against your setup.

Frequently Asked Questions