Chapter II of the AML Regulation is the part that changes how a business is organised rather than what it checks: a written framework approved at board level, two separate roles, an independent test, documented training, an integrity assessment of the people doing the work, and a retention period with a deletion date at the end of it.
The requirement is a system, not a document
Regulation (EU) 2024/1624 applies from 10 July 2027, replacing a directive transposed into national law with a text that binds obliged entities directly. Chapter II holds the operating requirements, and reading it as a checklist of documents misses what it asks for.
Article 9(1) requires internal policies, procedures and controls that ensure compliance with the Regulation, with Regulation (EU) 2023/1113 on transfers of funds, and with any administrative act issued by a supervisor. They must be proportionate to the nature of the business, its risks and complexity and its size, and must cover all the activities within scope. Proportionality cuts both ways: a small firm is not asked for a bank's framework, and a complex one cannot claim a small firm's.
What the policies have to contain
Article 9(2)(a) is a list, and it is worth checking a current manual against it line by line. The internal policies and procedures must include:
carrying out and updating the business-wide risk assessment, and the risk management framework itself;
customer due diligence, including the procedure for determining whether a customer, beneficial owner or person on whose behalf a transaction is conducted is a politically exposed person, a family member or a known close associate;
reporting of suspicious transactions;
outsourcing, and reliance on due diligence performed by other obliged entities;
record retention and the processing of personal data under Articles 76 and 77;
monitoring compliance with the policies themselves, identifying deficiencies and implementing remedial action;
verification, proportionate to the risk, that staff, agents and distributors assigned to particular tasks are of good repute;
internal communication of the policies, including to agents, distributors and service providers;
a policy on training.
Two of those are where firms are usually thin. Remedial action is part of the policy, so a framework that detects problems and does not resolve them is non-compliant on its own terms. And the policies must reach agents, distributors and service providers, not only employees.
Someone independent has to test it
Article 9(2)(b) requires internal controls and an independent audit function to test the policies, procedures and controls. Where there is no independent audit function, the test may be carried out by an external expert — which is the route most mid-sized businesses will take, and it is expressly permitted rather than a concession.
The formalities in the same provision are easy to miss and cheap to get right. Everything must be recorded in writing; internal policies must be approved by the management body in its management function, and procedures and controls at least at the level of the compliance manager. Under Article 9(3) the whole set is kept up to date and enhanced where weaknesses are found.
By 10 July 2026, AMLA is to issue guidelines on how far this extends by size and nature of business — staffing of the compliance functions, when controls must be organised separately at commercial, compliance and audit level, and when the audit may be done by an external expert. If your plan turns on any of those, that is the document to watch.
The risk assessment, and what it must take in
Article 10(1) requires a business-wide risk assessment of exposure to money laundering and terrorist financing and to the risks of non-implementation and evasion of targeted financial sanctions. It must take into account at least:
the risk variables in Annex I and the risk factors in Annexes II and III;
the findings of the Union-level risk assessment by the Commission under Article 7 of Directive (EU) 2024/1640;
the findings of the national risk assessments under Article 8 of that Directive, and any relevant sector-specific assessment;
relevant publications by international standard setters, the Commission or AMLA;
risk information provided by competent authorities;
information on the customer base.
There is also a trigger that is not periodic. Before launching new products, services or practices — new delivery channels and new technologies included — and before offering an existing product to a new customer segment or in a new geography, the risks must be identified, assessed and mitigated. A new payment channel is a risk-assessment event before it is a commercial one.
Two roles, and they are not the same person
Article 11 separates responsibility at board level from responsibility in the business.
The compliance manager is one member of the management body in its management function. They ensure the policies are consistent with the entity's risk exposure and that they are implemented, and that sufficient human and material resources are allocated. They receive information on significant or material weaknesses.
The compliance officer is appointed by that body, must have sufficiently high hierarchical standing, and is responsible for the day-to-day operation of the requirements — including the implementation of targeted financial sanctions. They are the contact point for competent authorities and are responsible for reporting suspicious transactions to the FIU.
Three protections sit around the second role, and a supervisor can test all three from the outside. The compliance officer may be removed only after prior notification to the management body; the supervisor must be told of the removal and whether it relates to these tasks, and the officer may give the supervisor their own account of it. They must be protected against retaliation and unfair treatment, and their decisions must not be undermined by the entity's commercial interests. Both the compliance officer and the person responsible for the audit function must be able to report directly to the management body.
Article 11(6) adds the rhythm: the compliance manager reports regularly on implementation and submits at least once a year a report drawn up by the compliance officer. One concession: where justified by size and low risk, an entity in a group may appoint as its compliance officer someone holding that function in another group entity.
Training, and the part about people
Article 12 requires employees and persons in comparable positions whose function requires it — agents and distributors included — to know the requirements, the business-wide risk assessment and the entity's own policies. That comes through specific, ongoing training appropriate to their function and the entity's risk exposure, and it must be documented.
Article 13 is the provision firms tend not to expect. Anyone directly participating in compliance — employees, agents and distributors alike — must be assessed, on content approved by the compliance officer, for skills, knowledge and expertise and for good repute, honesty and integrity. It is done before they take up the role and repeated, with the intensity set by the tasks and risks.
Then the conflict rule: a person entrusted with compliance tasks must inform the compliance officer of any close private or professional relationship with a customer or prospective customer, and must be prevented from performing compliance tasks in relation to that customer. The entity must have procedures to prevent and manage such conflicts. Article 13 does not apply where the obliged entity is a natural person, or a legal person whose activities are performed by one natural person only.
Five years, and what cannot be shortened
Article 77 sets the retention regime. What must be kept: the documents and information obtained in due diligence, including through electronic identification; a record of the assessment of a suspicion under Article 69(2) — what was considered and the result, whether or not it led to a report — and a copy of any report; supporting evidence and records of transactions; and the documents and sharing records from any information-sharing partnership.
Records must not be redacted. The period is five years from termination of the business relationship, from the occasional transaction, or from the refusal to enter into a relationship or carry out a transaction — and at the end of it personal data is to be deleted, not archived indefinitely. A competent authority may require longer retention case by case where necessary for prevention, detection, investigation or prosecution, and that further period cannot exceed five more years.
One practical derogation: references may be kept instead of copies, provided the information can still be given to authorities immediately and cannot be altered, and provided the categories held by reference and the retrieval procedure are defined in the Article 9 procedures.
What to do with this before 2027
Much of this already exists in Latvian law, and a business with a working AML framework is not starting from nothing. What changes is that the text becomes directly applicable and identical across the Union, which removes the argument that a national formulation was satisfied.
The useful exercise now is a gap read, not a rewrite. Take the current manual against the Article 9(2) list and mark what is absent. Confirm the two roles in Article 11 are held by different people and that the removal and reporting mechanics exist on paper. Check that the risk assessment names the Union and national assessments among its inputs and has a pre-launch trigger. Confirm who performs the independent test, and whether that person is independent in fact. Whether any of it is already satisfied by the current Latvian requirements is a point to check against the national text rather than assume either way.