AMLA's New AML Standards: What the 'Principles-Based' Label Really Means

Alejandro Martínez · 2026-10-15

On October 1, 2026, the Anti-Money Laundering Authority (AMLA) finalized three regulatory technical standards (RTS) under the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624). These standards tackle customer due diligence, the line between a business relationship and an occasional transaction, and group-wide arrangements. They apply to both financial and non-financial obliged entities, and AMLA insists they're principles-based—adding no new obligations beyond the AMLR itself. But here's the catch: "principles-based" isn't a free pass. It actually shifts the burden of proof onto each firm. Supervisory expectations, not a checklist, become the real test. So what does that mean for your compliance team? ### Why 'Principles-Based' Is a Double-Edged Sword At first glance, principles-based sounds flexible. No rigid rules, just broad guidelines—what's not to like? But in practice, it means you have to justify your approach. Regulators won't tell you exactly what to do; they'll assess whether your decisions align with the spirit of the law. That's a big shift. Instead of ticking boxes, you need to demonstrate that your risk management is thoughtful, proportionate, and effective. Supervisors will look at your processes, your documentation, and your culture. If something goes wrong, "we followed the checklist" won't cut it. > "Principles-based regulation puts the onus on firms to prove they've thought critically about their risks—not just followed a script." This approach demands a deeper understanding of your customers and transactions. It also means more judgment calls, which can be uncomfortable. But it allows for innovation and tailoring to your specific business model. ### What the Three RTS Cover The three standards address distinct but interconnected areas: - **Customer due diligence (CDD):** How thoroughly you need to know your customers, including ongoing monitoring. The RTS clarify that CDD must be risk-based, not one-size-fits-all. - **Business relationship vs. occasional transaction:** Where's the line? The RTS define when a transaction is a one-off versus part of an ongoing relationship, which affects the level of due diligence required. - **Group-wide arrangements:** For multinational groups, the RTS set expectations for sharing information and applying policies across entities, ensuring consistency without stifling local flexibility. All three apply to both financial and non-financial obliged entities—so lawyers, accountants, real estate agents, and others are on the hook too. ### The Real Test: Supervisory Expectations AMLA has stressed that these RTS don't create new obligations. But that's a bit of a misdirection. The obligations already exist in the AMLR; the RTS just clarify how to meet them. And the yardstick will be supervisory expectations. In other words, you need to think like a supervisor. What would they expect to see? Probably: - Clear policies that explain your risk-based approach - Evidence that you've assessed risks and tailored your controls - Documentation showing you've made informed decisions - A culture of compliance, not just a paper trail This is where many firms stumble. They treat compliance as a box-ticking exercise, but principles-based regulation requires a mindset shift. It's about demonstrating that you've genuinely engaged with the risks. ### What Should Firms Do Now? Start by reviewing your current CDD and monitoring processes. Are they truly risk-based? Can you explain why you've set certain thresholds or taken certain measures? If not, it's time to rethink. Also, consider how you distinguish between occasional transactions and business relationships. The RTS provide more clarity, but you'll need to apply judgment. Document your rationale. For groups, ensure your policies are consistent yet adaptable. Information sharing should be robust but respect local rules. Finally, train your staff. Principles-based regulation requires front-line employees to understand the why, not just the what. They need to spot red flags and escalate appropriately. ### The Bottom Line AMLA's new RTS are a wake-up call. The principles-based label doesn't mean less work—it means more thought. Firms that embrace this shift will be better prepared for supervisory scrutiny. Those that don't may find themselves explaining why their tick-box approach fell short. So, take a hard look at your compliance program. Are you ready for the real test?