14/10/2026
AMLR First Steps for Compliance Officers
You have been told the AMLR applies from 10 July 2027, and someone has asked “are we ready?”. Here is where I would begin, in order.
1. Settle scope in writing
Read Article 3 of the AMLR against your actual activities. Two minutes of scribbling on a whiteboard is not a scope decision. Write a half-page memo. If the answer is “in scope from 2027”, say which Article 3 limb applies. Our page on who must comply lists them.
2. Check your own role
Article 11 splits the job in two. The board must appoint a compliance manager from the management body, and you, the compliance officer, handle the day-to-day policies and report suspicions to the FIU. A smaller firm can combine the two where size and risk justify it (Article 11(7)). If your firm has not decided which applies, put it on the next board agenda. You also need direct reporting access to the board, and protection from retaliation.
3. Pull a small file sample
Pick 20 to 30 customer files and test them against the new rules for CDD and beneficial ownership (Articles 20, 51 and 52). The 25% ownership threshold is familiar. What catches people out is the separate control test and the multiplication of indirect holdings. You will learn more from this exercise than from a week of reading.
4. Find the risk assessment
Where is your business-wide risk assessment, who wrote it, when was it last updated, and does management approve it? Article 10 says the compliance officer drafts and management approves. AMLA was due to issue guidelines on its content by 10 July 2026; watch the AMLA site for the final version.
5. Set a standing calendar
Three recurring items: AMLA publications, your national transposition law, and supervisor guidance. In Malta that means the FIAU.
What I would skip
Do not spend the first month rewriting the AML manual. You do not yet know where the gaps are, so the rewrite will be guesswork. Sample first.
For a full controls list, use the readiness checklist, then the 90-day action plan. If you want to compare notes on typical weaknesses, read common AMLR gaps.
What this means for you
Once you have a scope memo or a file sample, an outside read can save you a wrong turn. Send either through the enquiry form and Shoulder Compliance will respond, or arrange a call.
General information, not legal advice.