An AMLA readiness review should determine whether a cross-border financial institution can produce consistent, evidence-based, explainable and traceable anti-money laundering decisions across its operations.

This matters because the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) will select 40 of the most complex high-risk cross-border financial institutions or groups for direct supervision. The first selection process will take place in 2027, with direct supervision beginning in 2028.

The preparation process is already underway. AMLA is testing and calibrating its risk-assessment models in 2026, while the data collected in 2027 will inform the first selection exercise.

Even institutions that are not selected may experience more consistent supervisory expectations as AMLA develops a common approach to risk assessment and promotes greater supervisory convergence across national authorities.

Here are seven questions by A Data Pro’s Head of R&C Business Services, Siyana Vacheva, that provide a practical starting point for reviewing readiness.

Want to learn more about AMLA’s risk-assessment methodology and selection process? Read this article: AMLA Direct Supervision: What Cross-Border Institutions Should Prepare Before the 2027 Selection

Do we understand our potential eligibility?

Credit institutions, financial institutions and groups operating in at least six EU Member States may be eligible for assessment.

Institutions should map their legal entities, branches, establishments and qualifying cross-border services. Compliance, legal and regulatory teams should agree on which activities contribute to the group’s potential eligibility and maintain evidence supporting that assessment.

The exercise should be treated as more than a regulatory mapping exercise. The group should be able to explain how its structure, activities and cross-border presence meet the relevant eligibility criteria and ensure the underlying data is consistent across the organisation. 

This is particularly important because AMLA and national supervisors are already preparing the data collection process that will support the 2027 selection exercise. Institutions identified as provisionally eligible in 2026 will be required to provide or confirm relevant information in the following stage of the process. 

Practical test: Could we produce a single, agreed view of our EU footprint to explain the data behind it?

Is our risk information consistent across jurisdictions?

The same customer or connected group should not have materially different risk classifications across countries without a documented reason.

Compare customer records across relevant entities. Look for differences in beneficial ownership, politically exposed person status, jurisdictional risk, review dates and escalation decisions. Any justified local variation should be clearly recorded.

Do not limit the exercise to the final risk rating. Compare the underlying information and decision-making factors as well. A difference in customer data, ownership information, PEP status or jurisdictional assessment may explain a different outcome — or may reveal an underlying data or process weakness.

Where local requirements or genuinely different circumstances justify different treatment, the reason should be identifiable rather than left to individual knowledge.

Practical test: If two compliance teams reviewed the same customer in different Member States, could we explain why they reached the same or different conclusions?

Can we reconstruct beneficial ownership?

A customer file should show more than the name of the declared ultimate beneficial owner. It should explain the ownership chain, relevant percentages, other forms of control and the sources used for verification.

Complex structures, trusts, nominees and recent ownership changes may require additional investigation. Our e-book on how to follow a chain of ownership provides a practical introduction to tracing ultimate beneficial owners and persons with significant control.

A useful readiness review should test whether the ownership structure can still be reconstructed after the original analyst has left the case.

Look for gaps between the information declared by the customer, information held in internal systems and information available from external corporate or regulatory sources. Pay particular attention to changes in ownership, layered structures, nominee arrangements and situations where legal ownership does not by itself explain control.

The question is not simply whether a UBO name appears in the file. It is whether the institution can demonstrate how it arrived at that conclusion.

Practical test: Could an independent reviewer reproduce our beneficial-ownership conclusion using the evidence retained in the file?

Is source-of-wealth information supported by evidence?

A customer declaration is not necessarily sufficient evidence.

Review whether the stated source of wealth is plausible when compared with the customer’s professional history, businesses, assets and known transactions. Distinguish between source of wealth and source of funds, and document any discrepancies requiring further investigation.

The review should also test whether the evidence supports the scale and nature of the wealth being described. A plausible occupation or business does not, by itself, necessarily explain a significant accumulation of wealth.

Where the institution relies on external information, record the source, date, relevant finding and how the information contributed to the assessment. Where information cannot be independently verified, that limitation should be visible in the file.

Practical test: Could we explain not only where the customer says the wealth came from, but why the available evidence supports the explanation?

Can an independent reviewer reconstruct the decision?

A reviewer should be able to understand what was investigated, which sources were consulted, what was found and why the customer was accepted, escalated or retained.

The file should preserve retrieval dates, original documents, reliable translations, analyst conclusions, approvals and the reasoning behind material decisions.

This should be tested across the entire decision chain: information gathered > findings > risk assessment > escalation or decision > approval.

A file may contain extensive documentation and still be difficult to defend if the connection between the evidence and the final decision is unclear. Conversely, a concise file may be strong if it clearly demonstrates the relevant evidence, reasoning and approvals.

One useful exercise is to give a sample of files to someone who was not involved in the original investigation and ask them to reconstruct the decision without contacting the original analyst.

Practical test: Could an independent reviewer understand what we knew, when we knew it, what we concluded and why we acted as well?

Do we know where our data coverage ends?

Standard databases may not provide complete information in every jurisdiction or language.

Institutions should understand when additional research is required across local corporate registers, court records, regulatory notices and local-language media. They should also define how conflicting records, unclear identities and possible sanctions ownership or control are escalated.

This is an important part of readiness because a screening or database result is not necessarily the same thing as a complete investigation. Data coverage can vary by jurisdiction, language, source type and the complexity of the subject.

Institutions should therefore identify known coverage gaps and define clear escalation triggers for cases where standard screening cannot resolve the question.

For example, additional research may be appropriate where ownership information conflicts across sources, a subject has a common or transliterated name, relevant information is available primarily in a local language, or adverse information requires contextual investigation before a conclusion can be reached.

Practical test: Do our investigators know when the standard tools are no longer sufficient – and do they know what to do next?

Is the remediation backlog managed according to risk?

A large backlog should not be addressed solely by closing the easiest cases first.

Prioritisation should consider customer risk, complex ownership, outdated information, high-risk jurisdictions, unresolved alerts and previous compliance exceptions. Every case should have an owner, deadline, escalation route and quality-control stage.

The key question is whether remediation resources are being directed towards the cases that could create the greatest financial-crime or supervisory risk.

Institutions should also distinguish between cases that are genuinely resolved and cases that have simply been administratively closed because information could not be obtained. Where a case remains subject to uncertainty, that uncertainty should be documented and appropriately escalated rather than obscured by the closure status.

A simple way to conduct the review is to score each question as Yes, Partly or No. 

For every partial or negative answer, record:

• the evidence supporting the assessment
• the identified weakness or gap
• the responsible owner, 
• the required remediation action 
• the target completion date
• the escalation or quality control route

The result should be a prioritised remediation plan rather than simply a readiness score.

Where can external intelligence support the review?

Some weaknesses can be resolved through internal data reconciliation. Others require investigation beyond the institution’s existing records and screening tools.

This is particularly relevant where the issue involves complex ownership, limited public information, local-language sources, difficult-to-verify wealth, conflicting records or potentially significant adverse information.

A Data Pro supports compliance teams through multilingual enhanced due diligence, beneficial ownership analysis, adverse-media research and source-of-wealth investigations. This support can be applied to complex individual cases or defined groups of higher-risk files while preserving a clear research and evidence trail.

External research should complement — not replace — the institution’s own risk assessment and decision-making. Its value is in helping compliance teams obtain, assess and document information that may not be readily available through standard internal systems or databases.

An AMLA readiness review cannot guarantee selection outcomes or regulatory compliance. Its value lies in identifying weaknesses early enough for the institution to address them systematically.

The most useful outcome is therefore not a “pass” or “fail”. It is a clear picture of where evidence, data, investigation quality or decision-making could be challenged — together with an actionable plan to address those weaknesses before they become supervisory issues.

A practical AMLA readiness review: what should the output look like?

A useful review should leave the institution with more than a set of observations. At minimum, it should produce:

• A documented assessment of potential eligibility
• A map of material cross-boarder data and risk inconsistencies
• A sample-based assessment of high risk customer files
• An assessment of beneficial ownership and source of wealth evidence
• A view of data and research coverage gaps
• A risk-ranked remediation backlog
• Named owners and deadlines for the most important corrective actions

This turns AMLA readiness from a theoretical compliance exercise into a practical programme of work.

The final question: could we defend our decisions?

The seven questions above ultimately lead to one broader test. If a supervisor asked the institution to explain one of its highest-risk customers, could the institution show the information it relied on, reconstruct the ownership and wealth assessment, explain the risk classification, identify the investigation performed, and demonstrate why the final decision was reasonable?

And could it do the same thing consistently across jurisdictions?

That is the standard institutions should be working towards as AMLA’s 2027 selection process approaches.

Speak to a risk and compliance expert

FAQs