AMLR gap analysis
On 10 July 2027 the EU Anti-Money Laundering Regulation replaces much of national AML law, including the Dutch Wwft. In three weeks we map what changes for your institution, what has to be finished before that date, and what it will cost you in time, systems and people.
An AMLR gap analysis sets your current AML framework against Regulation (EU) 2024/1624 obligation by obligation, and tells you what has to change before the regulation applies on 10 July 2027. It is not a general commentary on the EU AML package. It is a comparison of one specific regulation with your own policies, procedures, systems and files, ending in a report, a priority matrix and a roadmap you can put in front of your board.
What the AMLR changes for an obliged entity
The AMLR applies directly. There is no national implementing act sitting in between, and therefore no national margin of interpretation to fall back on. Where the Wwft sets an open, risk-based norm and leaves you to justify how you fill it in, the regulation is considerably more prescriptive: on when enhanced due diligence is mandatory rather than advisable, on which UBO data you must actually record and verify, and on what a group-wide policy has to contain across branches and subsidiaries.
The practical consequence is that judgement calls become rules. Decisions your institution documented as reasonable under a risk-based regime may simply be non-compliant under a text your supervisor reads in exactly the same words you do. Policies stop referring to national law and start referring to the regulation; work instructions have to be rewritten rather than relabelled; and data fields that were optional in your systems become mandatory records.
None of that is difficult in isolation. The difficulty is volume and sequence: a large number of small changes, several of which depend on someone else finishing first.
Why starting in 2027 is starting late
10 July 2027 is the date the obligations bite, not the date you begin. Knowing what must change is only the first step in a chain that runs, in this order:
- decision-making and budget, which for most institutions means fitting the work into a planning cycle a year ahead;
- rewriting policy, procedures and work instructions, and having them approved;
- changes to systems and data fields, usually involving a vendor and a release queue you do not control;
- remediation of existing client files, which is the slowest item on the list because it is manual and high in volume;
- training for the front line, for compliance and for the board.
Practical consequence: institutions that only begin in 2027 will not finish the system and file changes in time, and those are precisely the two things a supervisor looks at first, because they are the two things that cannot be produced retrospectively.
What the gap analysis covers
- Customer due diligence: standard, simplified and enhanced measures, the events that trigger them, when they must be performed, and what has to be recorded as evidence.
- UBO identification and verification: the data the regulation requires you to hold, how you verify it, and what you do with discrepancies.
- Client acceptance and risk classification: the criteria you apply, and whether your risk model still produces defensible outcomes under the new text.
- Business-wide risk assessment: whether it exists, whether it is current, and whether it visibly drives your policy, thresholds and monitoring scenarios.
- Transaction monitoring and reporting: scenarios, alert handling and the route to FIU-the-Netherlands.
- Group-wide policies and controls: what has to apply across branches and subsidiaries, including outside the Netherlands.
- Governance: the compliance function, board responsibility and internal control.
- Record-keeping and retention: what you keep, in what form, and for how long.
- Training: who needs to be trained on what, and how you evidence it.
- Systems and data: which fields you hold today against which fields you will be required to hold.
How the three weeks run
| Week | What happens | What you get |
|---|---|---|
| Week 1 | Intake of one hour and a document request: policies, business-wide risk assessment, CDD procedures, client acceptance policy, monitoring scenarios, UBO records and training plan. | A confirmed scope, a document checklist and the interview schedule |
| Week 2 | Article-by-article mapping of the AMLR against your set-up, plus two to four short deep-dive sessions with the people who actually do the work. | A draft findings list, and early warning of anything that should not wait for the report |
| Week 3 | Prioritisation and roadmap. We discuss the draft findings with you in one two-hour session, then deliver. | Gap report, priority matrix, implementation roadmap and board presentation |
What you receive at the end
A gap report. Per AMLR obligation: what the regulation requires, how your institution has arranged it today, and where the difference sits. It is an article-by-article comparison against your own documentation, not a general briefing with your name on the cover.
A priority matrix. Every gap classified by impact and urgency into three categories: must-fix before 10 July 2027, improve, or no action needed. This is the document that tells you where the budget should go, and it is deliberately blunt about what can wait.
An implementation roadmap. A timeline to July 2027 with the order of work, realistic lead times, and the dependencies on IT, vendors and training that determine when each item has to start.
A board presentation. One set of slides that takes your management, board or supervisory board through the findings in a single session, including the consequences of doing nothing.
Who it suits, and who it does not
The analysis is built for banks and payment institutions, e-money institutions, crypto-asset service providers, trust offices, investment firms and insurers, and in a lighter form for accountants, tax advisors, civil-law notaries and estate agents. For crypto-asset service providers we can combine the AMLR analysis with MiCAR requirements, because our advisor works with both every day.
It is a poor fit in three situations. If your current framework does not yet meet existing national obligations, start there rather than with a 2027 regulation: an AML/CFT gap analysis and remediation plan is the more useful first step. If you are a large or cross-border group with many entities and systems, three weeks and a fixed fee will not do it justice, and we will quote for a wider scope instead. And if what you need is hands to carry out the work rather than an analysis of what the work is, say so at the intro call and we will discuss implementation directly.
What it costs
For small and mid-sized institutions: a fixed fee from € 4,950 excl. VAT, including the report, the roadmap and the board presentation. For complex or cross-border institutions we quote up front. No time-and-materials surprises.
The analysis is deliberately sold as a standalone piece of work. Implementation is a separate phase with its own proposal, so once the report is on the table you decide with the facts in hand whether to pick the work up internally, continue with us, or put it out to someone else.
Further reading
Further reading
What that looks like in practice
Not ready for a full analysis? Book a free thirty-minute AMLR check. We walk through your situation and tell you honestly whether this is urgent for you or whether it can wait. Book the call or ring +31 6 11 32 53 62.
Frequently asked questions
When does my institution need to be AMLR-ready?
The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies directly from 10 July 2027. From that date the obligations apply without national transposition. Institutions that have to change systems, files and procedures realistically need a year, including decision-making, budget and implementation.
What does an AMLR gap analysis cost?
For small and mid-sized institutions we work with a fixed fee from € 4,950 (excl. VAT) for a three-week analysis. For complex or cross-border institutions we quote up front. Either way you know the price before we start.
What exactly do we receive?
A gap report setting out where you stand against each AMLR obligation, a priority matrix (must-fix before 10 July 2027, improve, no action), an implementation roadmap with a timeline, and a presentation you can use to take your management or board through the findings.
Do you also carry out the implementation?
Yes, but that is a separate phase with its own proposal. The gap analysis is deliberately sold on its own, so after delivery you decide whether to pick the work up internally, continue with us, or engage a third party.
How much of our own time does it take?
Allow for a one-hour intake, sending us your existing documentation, two to four short deep-dive conversations with the people who do the work, and one two-hour session to discuss the draft findings. We do the rest.
Which documents do you need from us?
Your AML policy, the business-wide risk assessment, CDD procedures, client acceptance policy, transaction monitoring scenarios, UBO records and the training plan. If something does not exist, that is itself a finding and we note it as one.
We already comply with national AML law. Is that not enough?
No. The AMLR is considerably more prescriptive than the Wwft on points such as when enhanced due diligence is mandatory, which UBO data must be recorded, and what group-wide policy has to contain. Meeting current national obligations is the starting point for the analysis, not a substitute for it.