Ready for the AMLR: what changes in July 2027 and what to check now

The EU Anti-Money Laundering Regulation (AMLR) applies across the EU from 10 July 2027. It replaces the national due diligence rules in EU Member States with one regulation. In Norway and the rest of the EEA outside the EU, it applies once it is incorporated into the EEA Agreement.

This post is the web version of our AMLR readiness guide. It covers what changes, how the due diligence rules map to what Strise does today, which duties stay with your team, and ten questions to check where you stand.

The AMLR in brief

• Applies from: 10 July 2027 across the EU, as Regulation (EU) 2024/1624, directly in every Member State.
• Supervision: national supervisors stay in charge; AMLA directly supervises up to 40 large cross-border credit and financial institutions.
• Refresh cycles: customer information updated at least every year for higher-risk customers and every five years for the rest, and sooner when circumstances change (Art. 26).
• Beneficial ownership: indirect stakes are multiplied along each chain and added up across chains (Art. 51 to 54).
• Automated decisions: automated or AI decisions to onboard, refuse or keep a customer, or to change the level of due diligence, need meaningful human intervention (Art. 76(5)).
• Norway and the EEA: the AMLR applies once it is incorporated into the EEA Agreement.

What changes in July 2027

Across all of it, you must be able to show your supervisor that your measures fit the risks you have identified (Art. 20(4)).

A worked example: ownership across chains

Under the AMLR, stakes are multiplied down every chain and added up across chains. Corruption Carlson holds under 25% through each chain, but 28% in total: 40% × 40% = 16% through Mammal Money Laundering Ltd., and 40% × 30% = 12% through Octopus Offshore Holdings. At 28%, Corruption Carlson is a beneficial owner of Shady Sharks Ltd.

No stake in either chain is above 50%, so no holding company is controlled through ownership (Art. 53(2)). The stakes are multiplied along each chain and added together (Art. 52(1)), and control by other means is checked separately. The Commission may set a lower threshold, normally at most 15%, for categories of entities identified as higher risk (Art. 52(2)).

For the full method, including the 25% line, control and what replaces the register check, see our guide to UBO mapping under the AMLR.

In Norway, Strise computes beneficial owners from registry data. In the UK it combines the PSC register with computed ownership. In Sweden, Denmark and Finland it shows the official register's beneficial owners, with a computed fallback where none is registered. Elsewhere Strise builds the chart from global data and uploaded documents, and your analyst confirms the beneficial owners, with every source and edit on record.

Know who you deal with

Customer due diligence is set out in Chapter III of the AMLR (Art. 19 to 50).

Identify and verify (Art. 20, 22)

The AMLR asks for legal form, address, representatives, registration number and LEI, verified from reliable sources or electronic ID. Strise has registry data for Norway, Sweden, Denmark, Finland and the UK and global data elsewhere, with each source shown, and ID verification through Signicat with Norwegian and Swedish BankID and video ID.

Purpose and source of funds (Art. 25)

You need the purpose and economic rationale, the expected activity, and the source and destination of funds. In Strise, branded and pre-filled forms collect the answers and documents, and company details are compared field by field with what Strise holds. Custom risk fields let the analyst score what the customer declares.

Risk-based approach (Art. 20(2), 33, 34)

Measures must be in proportion to each customer's risk, simplified for low risk and enhanced for high. Strise scores risk to your own model: countries, industries, legal forms, PEP, sanctions and your own fields, in up to five risk classes. Every score shows the factors behind it.

Ongoing monitoring (Art. 26)

The AMLR asks you to scrutinise transactions against what you know about the customer, and to refresh customer data within one or five years, or sooner when something changes. Our guide to KYC remediation covers how to bring a back book onto those cycles. Strise covers the customer side with ongoing due diligence: alerts on new owners, roles, sanctions, PEP status and company changes, and with review intervals per risk class. A change in beneficial owner or director raises an alert, and the analyst opens a review from it. Transaction monitoring runs in your own system.

See who owns and controls them

No clear owner (Art. 22(2))

When there is no clear owner, identify and verify all senior managing officials and record the steps and difficulties that led there. Strise maps board and management wherever registries publish them, so the analyst can name the senior managing officials and note the reasoning in the review.

Register discrepancies (Art. 24)

Differences from the central register must be reported within 14 calendar days of detection. With Registry Check (Beta, Norwegian companies first), analysts check Strise data against the official registry and record the outcome as Verified, Discrepancy or Inconclusive, with notes on what differed.

High-risk third countries (Art. 29 to 31)

Enhanced due diligence applies where a country on the EU list is involved. The EU high-risk third countries and the FATF lists are built into Strise and count across the scope you set: registration, owners, directors and, if you choose, companies along the ownership chain.

Sanctions (Art. 20(1)(d), 26(4))

Check the customer and the people who own or control it against targeted financial sanctions regularly. Strise screens the company, its directors, beneficial owners and owners above your threshold, and optionally subsidiaries, against EU, UN, US, UK and Swiss lists. Private persons are screened daily and companies five nights a week, and sanctions hits add to the risk score.

PEPs, family and close associates (Art. 20(1)(g), 42 to 46)

Identify PEPs, their families and close associates, and keep treating former PEPs as a risk while it persists, and for at least 12 months. Strise screens the customer, owners and roles for PEPs and close associates, with Nordic PEP data as standard and global PEP data as an option. Former PEPs stay flagged for the period you set, 18 months by default.

Every decision on record

You must be able to show your supervisor that your measures fit the risks you have identified (Art. 20(4)).

• The risk model in your governance documents lives in Strise as settings. Every version is saved, and changes can carry a reason, so you can show what applied on any date (Art. 9).
• Roles cover analysts, managers such as your compliance officer, admins, and read-only access for internal audit (Art. 11).
• Portfolio Health (Beta) shows your whole book by risk factor, from sanctions and PEPs to high-risk countries and industries, as input for your risk assessment (Art. 10).
• Hit decisions, alert resolutions and data edits are kept with who and when, plus the analyst's comment on why. Each customer's activity log shows registry changes, screening hits, alerts and your team's actions in one timeline. Review reports export as PDF, ready to send to your supervisor (Art. 20(4), 77).
• AI is switched on per team. It summarises and suggests, analysts decide, and every risk score lists its factors. A manual risk level overrides the calculated class, and both stay visible (Art. 76(5)).
• Strise stores your data in the EU, on Google Cloud in Belgium, and is ISO 27001 certified and SOC 2 Type 2 attested. If your use of Strise counts as outsourcing, notify your supervisor first. Decisions on a customer's risk profile and on onboarding cannot be outsourced, so your analysts make them in Strise (Art. 18).

Duties that stay with your team

The AMLR obligations stay with you, and you stay liable for any task you outsource (Art. 18). Strise does not cover the duties below.

Readiness check before July 2027

Tick each question your team can answer yes to today.

1. Can you show who ultimately owns and controls every corporate customer, through every layer? (Art. 51 to 54)
2. When no owner is found, do you identify and verify all senior managing officials, and record why? (Art. 22(2))
3. Do you screen beneficial owners for sanctions and PEP status, not only the customer? (Art. 20(1)(d), (g))
4. Do you see a sanctioned owner several layers up, across borders? (Art. 20(1)(d))
5. Is every higher-risk customer refreshed within a year, and every other within five? (Art. 26(2))
6. Do you review a customer when an owner or director changes, not only on the calendar? (Art. 26(3))
7. Do you collect purpose, expected activity and source of funds, and check the answers? (Art. 25)
8. Are EU high-risk third countries scored wherever they appear in a structure? (Art. 29 to 31)
9. Is every automated onboarding or due diligence decision reviewed by a person, and can you explain it to the customer? (Art. 76(5))
10. Can you show a supervisor who decided what, when and why, in minutes? (Art. 20(4), 77)

BDO in Norway chose Strise as its technology provider for customer due diligence and AML ahead of the AMLR. Read how BDO works with Strise, or book a meeting to go through the checklist with us.