AML for Life Insurers Under AMLR: The 7 Changes to Operationalise Before July 2027

On 10 July 2027, the European Union's Anti-Money Laundering Regulation (AMLR) begins to apply directly across every Member State, with no national transposition to soften or delay it. For life and investment-related insurers, this is not a lighter version of the rules banks already follow. It is a shift in the question an insurer has to answer.

Under AMLR, a firm is judged less on what it collected when a policy was sold and more on what it can still explain, years later, at the moment money leaves the business.

That change is harder than it sounds, because life insurance risk does not sit in a single transaction. It sits in a long chain of events and parties that can stretch across decades.

In this guide we walk you through the seven operational changes AMLR brings for insurers, with the relevant article references, what each looks like in practice, and what to do about it before the deadline. For the broader EU picture, see our overview of the EU AML package and AMLR.

What AMLR Is, and Why It Reaches Insurers

AMLR, Regulation (EU) 2024/1624, is the single rulebook at the centre of the EU's new anti-money-laundering framework. Because it is a regulation rather than a directive, it applies uniformly and directly from 10 July 2027, replacing the patchwork of national rules that grew up under the earlier AML directives.

It is supervised through a new EU Anti-Money Laundering Authority (AMLA), which will begin selecting firms for direct supervision in 2027 and supervising them from 2028, with up to 40 groups active in at least six Member States in scope.

Insurers are squarely in scope. AMLR covers life and investment-related insurance undertakings, and life-insurance intermediaries, with one practical carve-out: intermediaries that collect no premiums or customer money and act under the responsibility of an insurer or another intermediary are not treated as obliged entities in their own right.

Everyone else inside the life and investment-insurance chain carries the obligations directly. That makes mapping your distribution channels an early task, because the rule reaches brokers and bancassurance partners who do handle customer money.

Why Life Insurance AML Is Different

Bank anti-money-laundering tends to follow a short path from a customer to a transaction. Life insurance follows a much longer one. A single policy involves a policyholder, the person who pays the premiums, the life insured, and the beneficiary who is paid at the end, and any of those can be a different person, and any of them can change over the life of the contract. Add surrenders, assignments, top-ups and refunds, and the result is a chain that can run for 10 to 40 years.

Most of the money-laundering risk hides in that chain: parties nobody screened, and non-monetary events nobody monitors. The diagram below maps where AMLR attaches obligations across the policy lifecycle, and why the riskiest moment is often the payout, not the sale.

Life insurance risk sits in events and parties across a policy's life, not in a single payment.

The Seven Changes AMLR Brings for Insurers

AMLR reshapes the whole cycle, from onboarding through to reporting. The table below summarises the seven changes and the main AMLR articles behind them, and the sections that follow explain each one in practice. Where a standard is still being finalised by AMLA, it is flagged as a draft.

1. CDD becomes one EU data standard, remote verification included

AMLR sets the customer identification data directly, including all nationalities and the national identification number where one applies (Art. 22(1)), and it allows remote verification using an identity document plus independent sources, or an eIDAS electronic identity at the substantial or high assurance level (Art. 22(6)).

The finer detail comes from AMLA’s customer due diligence standards, which have been finalised and are awaiting adoption by the European Commission.

In practice, the risk is that the same customer is onboarded differently depending on who sold the policy: bancassurance partners pass a reduced data set, gaps are fixed by hand, and remote journeys built to national rules were never mapped to the AMLR fields.

What to do: standardise one onboarding data model across every channel and confirm your remote flows meet the AMLR conditions. Robust customer due diligence and remote identity verification, including document and biometric checks and alignment with eIDAS, are the foundation everything else rests on.

2. The beneficiary becomes a risk subject, not just a payee

Under AMLR, beneficiaries are recorded at designation and verified at payout (Art. 47), checks for politically exposed persons on beneficiaries happen no later than payout with senior management informed where risk is higher (Arts. 44, 46), and an insurer may withhold a payout where customer due diligence cannot be completed (Art. 21(1)).

The common gap is that beneficiaries are stored as free text, such as “children in equal shares,” which cannot be screened, and that beneficiary changes are treated as administrative updates with no AML review.

What to do: capture beneficiaries as structured records you can screen, run the PEP and sanctions checks before money moves, and document a payout-hold process the claims team can actually use. In life insurance, the riskiest moment is not the sale, it is the payout.

3. Risk classification has to be explainable

AMLR requires insurers to demonstrate “at all times” that their measures are appropriate (Art. 20(4)). The business-wide risk assessment is approved by the management body (Art. 10), and the customer risk-profile decision cannot be outsourced (Art. 18(3)).

The common gap is that a risk rating exists but the reasoning and approvals behind it are scattered across spreadsheets, policy-admin systems and annual rebuilds, so no one can fully explain how it was produced.

What to do: keep the customer risk assessment methodology documented, approved, and reproducible, with a clear audit trail of who decided what and why. The goal is a rating you can defend to a supervisor on demand, not just a number in a file.

4. KYC gets an expiry date

Customer information must be refreshed at least every year for higher-risk customers and at least every five years for everyone else (Art. 26(2)), with reviews also triggered by events (Art. 26(3)) and the whole book checked against new sanctions designations (Art. 26(4)).

For a book of decades-long policies, these fixed EU-wide ceilings turn periodic review from a formality into a standing operational programme, especially where a policy was sold through a broker and the insurer has no direct line to the customer.

What to do: run continuous sanctions and adverse media screening across the in-force book, not only at onboarding and claims, and build a digital refresh journey so reviews do not depend on letters and low response rates. Enhanced due diligence applies where the risk is higher.

5. Monitoring has to see the policy, not just the payment

Ongoing monitoring, including of transactions, is a customer due diligence measure under AMLR (Arts. 20(1)(f), 26(1)), and the approval of detection criteria cannot be outsourced (Art. 18(3)). AMLA's draft guidelines on ongoing monitoring expect detection of linked patterns over time and documented escalation.

The common gap is that monitoring rules were built for payments and miss non-monetary policy events: beneficiary changes, assignments and changes of payer sit in the policy-admin audit log, unseen by compliance.

What to do: extend transaction monitoring so that policy events, not only premium receipts and payouts, can raise a flag. Illustrative indicators, which are risk examples rather than AMLR-mandated scenarios, include a large single premium followed by an early surrender, a third-party payer with no visible link, or a beneficiary change just before payout.

6. Every alert decision becomes evidence

AMLR requires insurers to keep a record of each suspicion assessment, including those that are not reported (Art. 77(1)(b)), for five years after the relationship ends.

Suspected transactions are held until reported, for up to three working days without an instruction from the Financial Intelligence Unit (Art. 71), and tipping off is prohibited (Art. 73). The common gap is that alerts are closed as “no further action” with no rationale, and payout holds are managed by email with no clock.

What to do: give investigators structured case management with evidence captured and retained, so that eighteen months later you can show why an alert was closed, by whom, and on what basis. An alert closed without a reason is a finding waiting to happen.

7. A common reporting format and a five-day clock

FIU information requests must be answered within five working days, or under 24 hours if urgent (Art. 69(1)), and AMLA's draft implementing standards set a common, machine-readable format for suspicion reports and transaction records (Art. 69(3)). Reports still go to the national FIU through its own platform; AMLA does not replace national FIUs.

The common gap is that responses and suspicious transaction reports are assembled by hand, and a name search finds policyholders but misses the same person acting as payer or beneficiary.

What to do: make it possible to find every policy where a person appears as payer or beneficiary, and generate reports from case data rather than retyping them into a portal under time pressure.

Key Dates and Thresholds

The deadline is fixed, and several of the obligations carry their own clocks and thresholds. The most important for insurers are below. Note that AMLA's customer due diligence standards have been finalised by AMLA and are pending adoption by the European Commission, while its ongoing-monitoring guidelines and common reporting format remain in draft at the time of writing.

A Readiness Checklist

With the deadline fixed, the useful question is where you stand today. The following checks, drawn from the changes above, are a quick way for a compliance team to find the gaps worth closing first:

• Can you onboard a life customer the same way across every channel, with the AMLR data set and compliant remote verification?

• Are beneficiaries stored as structured records you can screen, with checks that run before any payout?

• Could you show a supervisor, at random, why one customer is rated high risk, who approved it, and when?

• What share of your in-force book had its KYC confirmed in the last five years, and how fast can you screen the whole book against a new sanctions listing?

• Does your monitoring see beneficiary changes, assignments and changes of payer, or only premium payments?

• For an alert closed last year, can you show the reasoning and the evidence behind the decision?

• When the FIU asks about a person, can you find every policy where they are a payer or a beneficiary, and respond within five working days?

How Technology Closes the Gaps

The common thread across all seven changes is not usually a lack of technology. It is a lack of connection between systems, with customer, transaction, beneficiary and screening data scattered across different applications that analysts have to correlate by hand.

Closing the gaps means connecting identity, screening and monitoring, and keeping an audit-ready record of every decision. This is where the Qoobiss platform fits, used within its stated capabilities:

• Onboarding and verification. Origin builds no-code onboarding workflows with built-in KYC and AML checks and API links to core systems, while Ontrace handles remote document and biometric verification, including of a beneficiary at payout.

• Screening. Omnicheck screens individuals and entities against sanctions, PEP and adverse media data and re-screens them daily.

• Monitoring, context and evidence. Overwatch runs transaction monitoring, consolidates alerts from monitoring, screening and identification, and enriches them with context. It prepares draft suspicious transaction reports for the compliance officer to review and file, and keeps audit-ready, tamper-proof case records with configurable policy management and role-based controls.

The principle, and the limit, is deliberate: these systems reconstruct the context and hold the evidence, so the analyst keeps control of the decision. Qoobiss automates the reconstruction of context, not the judgment. See how this applies across the insurance sector, or how the same stack supports digital onboarding and business verification more broadly.

Prepare for AMLR with Qoobiss

AMLR gives life insurers until July 2027 to turn seven regulatory changes into working operations. Qoobiss helps insurers connect onboarding, screening, monitoring and case evidence into one flow, so that risk decisions are not only made but can be explained at payout. See how Qoobiss supports insurers, or get in touch to talk through your AMLR readiness.

Insurance AMLR - FAQs