Towards the AMLR 3: Governance

3 November 2026 9 minutes

The AMLR prescribes in much more detail than the Wwft how an institution must set up its governance. Part 3 of the blog series deals with the new governance obligations under the AMLR.

Many requirements have already been shared with the financial sector in recent years through guidelines of the European Banking Authority (EBA). Supervised institutions that have implemented these guidelines are therefore largely familiar with them and have a good starting position. It should be noted, however, that the AFM does not appear to have adopted all relevant EBA guidelines, while the Dutch Central Bank has been more generous in this respect in recent years. For smaller and non-licensed parties, the step is bigger. This may also apply to non-financial undertakings. They are not covered by the EBA guidelines, and their framework of policies and procedures will often need to be set up in more robustly under the AMLR.

In an earlier article we already discussed the new governance requirements in more detail. A number of key aspects, and our first experiences, are set out below.

Framework: policies, procedures and measures

An institution must have written policies and procedures that are appropriate to its nature and size. The management board explicitly approves the policies. The framework must be kept up to date and, where necessary, adjusted if the institution has identified a weakness.

Two points stand out:

The framework must cover all activities that fall within the scope of the AMLR. The AMLR thereby appears to leave room for an approach in which activities that are not ‘subject to the AMLR’ can be excluded from the scope of the policies; and
Policies for complying with targeted financial sanctions are mandatory. Sanctions screening thus becomes a fixed part of the framework and of customer due diligence. For many institutions this is new. This development is all the more interesting because the Dutch legislator is also currently revising the national regime governing (compliance with) sanctions legislation. Institutions need to think carefully about how to translate both developments into future-proof policies.

We raise the question here whether the AMLR is a reason to set up the internal AML/CFT framework anew, or whether adjusting it is enough. A gap analysis (see below) can help with that decision, and the most efficient choice will then differ per institution. For now, we lean towards a completely new set-up, given the many (new) requirements, for example in the area of governance. At work instruction level, for example, it is possible to build on what already existed. In blog 4 we go into more detail on how an institution can best prepare for the upcoming implementation of the AMLR.

Business-wide risk assessment

The business-wide risk assessment (which institutions often also incorporate in the broader Systematic Integrity Risk Analysis (SIRA)) continues to exist, with additions. For example, the institution must now also take into account the risk of evasion or non-compliance with targeted financial sanctions, and consider the (new) risk variables and factors from the AMLR annexes.

The assessment must be updated before the launch of a new product, a new service or technology, and before a product is offered to a new customer segment or in a new area. The assessment must also be reviewed periodically, but the AMLR does not specify a fixed period. For the time being, we would opt for at least an annual review, or more often if necessary. In short: the business-wide risk assessment is becoming more extensive and institutions must ensure in practice that it is updated both periodically and on an event-driven basis. In practice, both still regularly go wrong.

AMLA put draft guidelines on the business-wide risk assessment out for consultation earlier this year. The final version is expected this quarter. As the business-wide risk assessment forms the basis of the policies and procedures, we advise market parties to first update the business-wide risk assessment on the basis of the final guidelines, and then adjust the policies and procedures (partly on that basis) to the new rules.

Management board, compliance manager, compliance officer and the audit function

As under the Wwft, the AMLR requires a board member to be expressly designated as responsible for compliance with the AMLR (the so-called ‘compliance manager’; at present we still call this person the ‘Wwft-responsible person’). Ultimate responsibility lies with the management board as a whole. In our view, this presupposes basic knowledge of the AMLR for every board member, to be acquired through training and education.

The compliance manager must, among other things, ensure that the management board receives a report from the compliance officer on the implementation of the policies at least once a year, and more often if necessary. The management board approves the policies. Procedures implementing those policies may also (only) be approved by the compliance manager.

As regards the appointment of a compliance officer, the AMLR leaves less room for tailoring and proportionality than we are used to under the Wwft. A compliance officer is mandatory. An institution may, however, where its size and risks justify this, assign the role to the compliance manager or appoint a compliance officer from another group entity.

The AMLR sets extensive requirements for the position and tasks of the compliance officer. In our view, this is best described as a statutory codification of the EBA guidelines on the AML/CFT compliance officer. This will be a heavy lift, especially for parties that currently have a proportionate set-up of the compliance function.

The AMLR provides that an institution must have an (internal or external) independent audit function. We do not see the possibility of a proportionate set-up, as currently applies under the Wwft, in the AMLR, or at least only to a much more limited extent. The (yet to be published) AMLA guidelines on the audit function may perhaps bring some relief, but on the basis of the level 1 texts this appears to be a considerable tightening. Many larger market parties already have an internal independent audit function. Smaller parties regularly do not. We therefore do see scope for temporarily hiring an external audit function – for example for a certain period of the year and with a specific assignment.

Employees: training, screening and whistleblowers

Training. Employees are trained on an ongoing basis, tailored to their role and the risks. The AMLR adds that the training must also cover the risk assessment, the policies, the Transfer of Funds Regulation and the acts of supervisors. Unlike the Wwft, board members are not expressly mentioned. In our view, this should not be read too literally. The training obligation is prescribed more specifically, and the question is whether an annual or biennial business-wide training is still sufficient, or whether institutions should vary their training according to topic and target group.
Screening. Employees involved in compliance are assessed on whether they are fit and proper before they start and regularly thereafter. Institutions must also have a conflicts of interest policy that covers compliance with the AMLR. Those that already have one under the Wft can often reuse it.
Whistleblowers. The internal reporting channel must comply with the EU Whistleblower Directive, implemented in the Netherlands through the Whistleblower Protection Act. For organisations active in the field of financial services or the prevention of money laundering, that act already applies regardless of their size. Parties that do not yet fall under the act, for example because they are newly in scope of the AMLR and have fewer than 50 employees, still need to set up a reporting channel.

Group policy

The standard is addressed to the parent undertaking. For a group with its head office in the EU, this is the institution that is not itself a subsidiary of another EU undertaking and that has at least one institution as a subsidiary. For groups outside the EU, additional conditions apply. Because holding companies can qualify as institutions (see Towards the AMLR 2: Scope), they fall in particular within the scope of this provision.

The parent undertaking, among other things, carries out a group-wide risk assessment, establishes group policies, appoints a compliance manager (and, where necessary, a compliance officer) at group level, and arranges the exchange of information within the group.

On 1 October 2026, AMLA submitted final technical standards on group-wide requirements to the European Commission for adoption.

Uncertainty: guidance from AMLA

The elephant in the room is, of course, AMLA. Many (draft) guidelines or technical standards are not yet available, or have only recently been consulted on (see also its planning from earlier this year). AMLA appears to be taking this delay into account by, for example, proposing a transitional period of six months, which starts running after the various technical standards have entered into force.

This delay is not conducive to an easy transition to the new framework. The AFM has recently encouraged market parties to get started on the basis of what is available (in draft). We understand the AFM’s call. At the same time, this is rather suboptimal. Adjusting policies and procedures is one thing; setting them up and implementing them within the organisation is another. If it all has to change again afterwards, that is, to put it mildly, frustrating. It is also not easy to implement level 1 first and only then level 2 and/or level 3. A general (deferred) transitional period for all levels would then be more appropriate by that time, but we are not there yet.

To-dos for market parties

In our experience, adjusting governance is a long-haul process. It is already possible to start with:

a gap analysis between the current framework and the AMLR;
appointing the compliance manager and reviewing the compliance and audit functions;
updating the business-wide risk assessment, including sanctions risks, on the basis of the final guidelines;
screening, a conflicts of interest policy, training and a whistleblowing channel; and
group policy, where applicable.

We have developed a checklist that institutions can use when drawing up the new framework.

For parties that do not yet do so, it may be worthwhile to split the policies and procedures for compliance with the AML/CFT obligations into several policy documents. In practice we still see parties using one or at most two or three policy documents for this. The drawback is that this cannot easily be adjusted. If the policy framework is split into topic-specific policy documents, procedures and measures, and work instructions, it is also easier to anticipate the new rules in advance.

Finnius is, in any case, currently hard at work developing its own substantive AI tool that can assist institutions in drawing up policies. We hope that this tool will be operational in the spring of 2027, by which time hopefully much will have become clear, and can be taken up by clients. If you are interested, please let us know by completing this form. We can then take the various profiles into account.

For assistance, please contact Pim Smith and/or Tim de Wit.

Don’t want to miss any blogs in the ‘Towards the AMLR’ series?