AMLA is coming: from compliance exercise to demonstrable effectiveness

The European AML landscape is changing fundamentally. With the creation of the Anti-Money Laundering Authority (AMLA) and the introduction of the new Anti-Money Laundering Regulation (AMLR), financial institutions are entering a more harmonised and outcome-driven regulatory environment. The AMLR will apply directly across the EU, while AMLA will drive greater supervisory consistency and convergence. 

For Belgian banks, insurers, asset managers, payment institutions and other regulated entities, the question is no longer whether change is coming, but whether their AML framework will be able to demonstrate its effectiveness.

More than compliance

Historically, AML programmes often focused on regulatory compliance: policies were in place, controls were documented, and alerts were generated.

The future supervisory focus will be different. Regulators increasingly expect institutions to demonstrate that their controls effectively identify, assess and mitigate financial crime risks. In practice, this means being able to evidence why controls exist, how they were calibrated, and whether they actually work. AMLA's objective is to support a more consistent, risk-based and harmonised approach across Europe. 

The key challenge: data quality and customer knowledge

While transaction monitoring often receives most attention, many AML weaknesses originate much earlier in the process. Poor customer data, incomplete beneficial ownership information, outdated risk assessments or inconsistent onboarding practices inevitably reduce the effectiveness of downstream controls such as transaction monitoring, sanctions screening and fraud detection.

Institutions should therefore view AMLA readiness not merely as a monitoring exercise, but as an opportunity to strengthen the entire customer lifecycle, from onboarding through ongoing monitoring and periodic review. AMLA is currently developing further guidance on customer due diligence and business-wide risk assessments, highlighting the importance of these foundations. 

Three practical questions for management

Rather than asking whether your institution is compliant today, management should challenge itself with three simple questions:

Can we explain our AML controls?

Would the institution be able to explain:

• why specific monitoring scenarios exist?
• how thresholds were determined?
• why certain customers are classified as high risk?
• how effectiveness is measured?

Increasingly, regulators expect evidence-based decision making rather than assumptions or historical practices. 

Are we focusing on the right risks?

Many institutions generate large volumes of alerts, while only a limited number ultimately result in meaningful investigations. A mature AML framework focuses on quality rather than quantity by aligning controls with:

• customer risks
• products and services
• geographical exposure
• delivery channels
• emerging financial crime typologies.

The objective is not necessarily fewer alerts, but better alerts.

Is AML embedded across the organisation?

Financial crime risk should not sit exclusively within the compliance function. Effective AML programmes increasingly require collaboration between:

• business teams
• compliance and risk
• operations
• data and technology teams
• internal audit
• senior management.

This enterprise-wide approach is particularly important as institutions continue their digital transformation and introduce new products, channels and technologies. The AMLR explicitly requires business-wide risk assessments and appropriate internal governance arrangements. 

A practical roadmap for 2026-2027

Belgian financial institutions can already take several low-regret actions:

• Review the business-wide AML risk assessment
• Perform a gap analysis against the AMLR requirements
• Assess the quality of customer and beneficial ownership data
• Review transaction monitoring governance and scenario calibration
• Strengthen management reporting and key risk indicators
• Validate whether existing controls are achieving the intended outcomes
• Establish an AMLA readiness programme with clear executive sponsorship.

Looking ahead

AMLA will not necessarily require institutions to reinvent their AML framework. However, it will require them to demonstrate that the framework is effective, proportionate and firmly grounded in risk management.

For Belgian financial institutions, the organisations that start preparing today will not only reduce future compliance challenges but will also gain operational efficiencies, improve data quality and strengthen their overall risk management capabilities.

The message is clear: the future of AML is no longer about doing more controls. It is about proving that the controls you have actually work.