Chapter II of the AML Regulation is the part that changes how a business is organised rather than what it checks: a written framework approved at board level, two separate roles, an independent test, documented training, an integrity assessment of the people doing the work, and a retention period with a deletion date at the end of it.
What the law asks for is a system, not a folder of documents
The EU's new AML Regulation applies from 10 July 2027. It replaces a directive that each country turned into its own law with a text that binds businesses directly. The chapter that matters for day-to-day running is the one on internal organisation, and reading it as a list of documents to produce misses what it is asking for.
You need internal policies, procedures and controls that make sure you comply — with the Regulation, with the rules on transfers of funds, and with anything your supervisor tells you to do. They have to be proportionate to what your business does, how risky and complex it is, and how big it is, and they have to cover everything you do that falls within the rules. Proportionality works both ways: nobody expects a small firm to have a bank's framework, and a complex business cannot claim a small firm's.
What the policies have to contain
The Regulation gives a list, and it is worth going through your current manual against it line by line. Your policies and procedures have to cover:
carrying out and updating the business-wide risk assessment, and the risk framework itself;
client checks, including how you work out whether a client, a beneficial owner or the person behind a transaction is a politically exposed person, a family member or a known close associate;
reporting suspicious transactions;
outsourcing, and relying on checks done by other covered businesses;
keeping records and handling personal data;
checking that the policies are actually being followed, spotting where they are not, and putting it right;
checking, in proportion to the risk, that the staff, agents and distributors you put on particular jobs are of good repute;
telling people inside the business about the policies, including agents, distributors and service providers;
a training policy.
Two of those are where firms are usually thin. Putting things right is part of the policy itself, so a framework that finds problems and leaves them there fails on its own terms. And the policies have to reach agents, distributors and service providers, not just employees.
Someone independent has to test it
You need internal controls and an independent audit function that tests whether the policies, procedures and controls work. If you have no independent audit function, the test may be done by an outside expert — which is the route most mid-sized businesses will take. It is expressly allowed, not a concession someone has to grant you.
The formalities in the same provision are easy to miss and cheap to get right. Everything has to be written down. The policies have to be approved by the management body, and the procedures and controls at least by the compliance manager. And the whole set has to be kept up to date and improved wherever a weakness turns up.
By 10 July 2026 the EU's AML Authority is to publish guidance on how far all this goes depending on size and type of business — how many people the compliance function needs, when commercial, compliance and audit work has to be kept separate, and when an outside expert can do the audit. If your plan depends on any of those, that is the document to watch for.
The risk assessment, and what has to go into it
You need a business-wide risk assessment covering money laundering and terrorist financing and the risk that sanctions are not implemented or are evaded. It has to take into account at least:
the risk factors listed in the Regulation's annexes;
the findings of the EU-wide risk assessment done by the Commission;
the findings of the national risk assessments, and any assessment done for your sector;
relevant publications by international standard setters, the Commission or the AML Authority;
risk information your supervisor gives you;
what you know about your own client base.
There is also a trigger that has nothing to do with the calendar. Before you launch a new product, service or way of working — new channels and new technology included — and before you offer an existing product to a new type of client or in a new country, you have to identify, assess and manage the risks. A new payment channel is a risk-assessment event before it is a commercial one.
Two roles, and they cannot be the same person
The Regulation separates responsibility at board level from responsibility in the business.
The compliance manager is a member of the management body. Their job is to make sure the policies match the risks the business actually runs, that they are put into practice, and that enough people and money are allocated to that. They are the one who has to be told about serious weaknesses.
The compliance officer is appointed by that body, has to be senior enough to be taken seriously, and runs the requirements day to day — including putting sanctions into practice. They are the contact point for the authorities and the person who reports suspicious transactions.
Three protections sit around the second role, and a supervisor can check all three from the outside. The compliance officer can be removed only after the management body has been told first; the supervisor has to be informed of the removal and whether it relates to this work, and the officer can give the supervisor their own account of it. They have to be protected against retaliation and unfair treatment, and their decisions must not be overridden by the business's commercial interests. Both the compliance officer and whoever runs the audit have to be able to go straight to the management body.
There is also a rhythm to it: the compliance manager reports regularly on how the policies are working and, at least once a year, hands the management body a report written by the compliance officer. One concession: where size and low risk justify it, a company in a group can use someone who holds the compliance officer role in another group company.
Training, and the part about people
Everyone whose job requires it — agents and distributors included — has to know the requirements, the business-wide risk assessment and your own policies. That comes through specific, ongoing training that fits what they do and the risks you run, and it has to be documented.
The next part is the one firms do not expect. Anyone directly involved in compliance — employees, agents and distributors alike — has to be assessed on skills, knowledge and experience, and on good repute, honesty and integrity, against criteria the compliance officer approves. The assessment happens before they start the role and is repeated afterwards, more or less intensively depending on the job and the risk.
Then the conflict rule. Anyone with compliance duties has to tell the compliance officer about any close personal or professional relationship with a client or a potential client, and must be kept off compliance work involving that client. You also need procedures for preventing and managing those conflicts. None of this applies where the business is one individual, or a company whose work is done by one individual only.
Five years, and what cannot be shortened
What you have to keep: the documents and information from your client checks, including anything obtained through electronic identification; a record of how you assessed a suspicion — what you considered and what you concluded, whether or not it led to a report — and a copy of any report you made; supporting evidence and records of transactions; and, if you take part in information-sharing arrangements, the documents you received and a record of each exchange.
Records must not be redacted. You keep them for five years from the end of the relationship, from the one-off transaction, or from the day you refused to start a relationship or carry out a transaction. At the end of that period personal data is to be deleted, not kept indefinitely in an archive. An authority can require you to keep something longer, case by case, where that is needed for prevention, detection, investigation or prosecution — and that extra period cannot be more than another five years.
One practical option: you can keep a reference instead of a copy, as long as you can still give the authorities the information immediately, it cannot be altered, and your procedures say which categories you hold by reference and how you retrieve them.
What to do with this before 2027
Much of this already exists in Latvian law, so a business with a working AML framework is not starting from scratch. What changes is that the text becomes directly applicable and identical across the EU, which takes away the argument that a national wording was satisfied.
The useful exercise now is a gap check, not a rewrite:
take your current manual against the list above and mark what is missing;
confirm the two roles are held by different people, and that the rules on removal and reporting exist on paper;
check that your risk assessment names the EU and national assessments among its inputs, and that it has a pre-launch trigger;
confirm who does the independent test, and whether that person is genuinely independent.
Whether any of it is already satisfied by the current Latvian rules is worth checking against the national text rather than assuming, either way.