Since AMLR is part of the AML package that regulates the requirements for operators, it is primarily this part of the AML package that is relevant if you are an obliged entity. However, it is important to understand that both AMLD6 and AMLA-R can have a direct and indirect impact on your business. AMLA-R contains, for example, requirements for how supervisory authorities should assess the risk of operators, which has been clarified via an RTS in the area. Further AMLD6 regulates areas such as access to the central register of beneficial owners and collaboration with authorities.

In dialogue with our customers, we see that the parts of AMLR perceived as most challenging vary. What type of operator you are, how you are organized and the size of your business are examples of factors that affect challenges in regulatory adaptation. Other factors that can also have an impact are whether you are part of a group, the proportion of outsourced operations, the number of employees and existing access to data. Some of the areas that are most discussed with our customers today include:

• Outsourcing – AMLR introduces restrictions on which parts of the AML work are allowed to be outsourced, the restrictions also apply to intra-group outsourcing. This means that AMLR may entail a need for a change in responsibilities and organization.
• Roles – The current roles within the AML legislation will disappear and be replaced by two new roles, Compliance Manager and Compliance Officer. Where the Compliance Officer should be placed, in the first or second line, is the source of many discussions. Depending on where the function is located, reorganization and reallocation of responsibilities may be required.

• Group – AMLR directs an increased focus on groups compared to previous regulations. The changes concern both intra-group information sharing, and in cases where a subsidiary that is under the scope of AMLR can «affect» a parent company. The implication is thus that the parent company may also fall within the scope of the AMLR.
• Customer due diligence – AMLR and the published draft RTSs emphasize a risk-based approach and clarify, among other things, what information may be required to meet requirements for purpose and intended nature (previous purpose and nature). New areas that are being added are e.g. place of birth and the destination of the means.
• Beneficial owner – The AMLR specifies the methodology to use to identify the beneficial owner. New requirements for reporting in the event of identified deviations from the central register for beneficial owners are also stipulated in AMLR.
• Targeted financial sanctions – The prevention of targeted financial sanctions being circumvented or not implemented becomes an integral part of everything from customer due diligence and general risk assessment to the division of responsibility.
• Expanded reporting requirements – The reporting requirements are now expanded to include certain types of threshold-based reports, which places demands on a new type of monitoring.
• Expanded access to data – Financial sector supervisors will assess risk based on a uniform methodology based on approximately 100-150 data points. These data points are expected to be integrated into periodic reporting to the Financial Supervisory Authority, which is why access to data is important to ensure now.