AML Compliance Implementation: Plan, Documents, Roles and Timelines

The founder of an EMI, PSP, crypto business or fintech company in the EU usually arrives at AML compliance because a regulator, partner bank or investor has asked directly: "Where is your AML system?" Searches for "AML implementation" or "AML policy" usually mean the same thing: where to start, and how to build a system that works, not a folder of documents "for the file".

At COREDO, since 2016 we have built and supported AML compliance for EMIs, PSPs, crypto-asset providers, fintechs and corporate companies across the EU — from the first risk assessment through to acting as outsourced MLRO. If your company lacks the resource to see implementation through, it is worth discussing outsourced AML implementation and support separately from this article — here we set out the plan in full, step by step.

Why act in 2026, not wait for 2027

As of November 2026, two layers of requirements apply in the EU at the same time. The first is national legislation, which applies right now: for a company registered in the Czech Republic, this is Act No. 253/2008 Coll. on Certain Measures against the Legitimisation of Proceeds of Crime and the Financing of Terrorism, and supervision by the Financial Analytical Office (FAÚ). The second is the new EU-wide package: Regulation (EU) 2024/1624 (AMLR), Directive (EU) 2024/1640 (AMLD6) and Regulation (EU) 2024/1620 on the Anti-Money Laundering Authority (AMLA). AMLR applies directly across all EU member states from 10 July 2027 (for obliged entities linked to football agents and professional clubs — from 10 July 2029), and by the same date member states must complete the transposition of AMLD6 into national law.

This does not mean there is no rush before July 2027. AMLA is already operating: the Authority began operations on 1 July 2025, headquartered in Frankfurt, and from 1 January 2026 took over EBA's AML/CFT mandates and powers. National regulators continue inspecting companies under current rules — we have written about what typically triggers unscheduled inspections in the EU, and why postponing AML implementation is a poor choice in our article on reasons not to postpone AML implementation.

What's changing: AMLR, AMLD6, AMLA and Czech Act No. 253/2008 Coll.

AMLR is a regulation: it applies identically across all EU member states without transposition into national law. AMLD6 is a directive, whose provisions member states transpose through their own legislation, and the pace of transposition differs from country to country. The European Commission maintains a tracker of AMLD6 transposition by country, showing that the "directive date" and the "national-law date" do not always coincide — so deadlines for a specific jurisdiction should be checked separately, not assumed from the regulation.

For a company in the Czech Republic, the practical basis today is Act No. 253/2008 Coll. and FAÚ's implementing decrees. Since 2024, the Act has required an obliged entity to notify FAÚ of its designated contact person via the data box (datová schránka) within 30 days of the date the company became an obliged entity (previously 60 days), and to report changes to that data within 15 days. FAÚ itself states that the current national model will be replaced by the direct application of AMLR by 10 July 2027 — meaning Czech companies face not a one-off amendment, but a transition to a new architecture of roles and procedures.

Step-by-step plan for implementing AML compliance

In practice, the sequence of implementation is almost always the same — what changes is how deeply each step is worked through, depending on the size of the business and its risk profile.

1. Business-wide risk assessment. This is the starting point of the risk-based approach enshrined in FATF Recommendation 1: a company must determine for itself which money-laundering and terrorist-financing risks its products, customers, channels and geographies face, and calibrate its measures accordingly, not copy a template. We set out the logic for building such a matrix in our article on the risk-based approach.
2. Policies and procedures. Based on the risk assessment, the company drafts its AML/KYC policy, CDD/EDD procedures, monitoring and alert-response procedures, reporting and training. It is important that the policy is a document people actually work by, not a translation of regulatory text — we showed a short, workable structure for such a policy in "AML policy: how to build a short version that the business actually reads".
3. Roles and responsibility: MLRO, compliance officer, the board. The EBA Guidelines on policies and procedures for compliance management and the role of the AML/CFT compliance officer (EBA/GL/2022/05) require that one member of the company's management body be designated as ultimately responsible for AML/CFT, and that the compliance officer have direct access to that body on material incidents. An important nuance: even where operational tasks are outsourced, ultimate responsibility for compliance remains with the obliged entity itself — it cannot be transferred to a contractor.
4. KYC/KYB onboarding and due diligence (CDD/EDD). Identifying the customer and beneficial owners, sanctions and PEP screening, risk rating and, for higher-risk cases, enhanced due diligence — this is most often handed to a dedicated KYC/KYB screening service, because it requires both tools and constant updating of databases.
5. Ongoing monitoring and screening. Transaction monitoring, periodic review of customer risk ratings and sanctions screening of counterparties must run not just once at onboarding, but continuously; we wrote separately about choosing a provider and setting thresholds for screening — see "Sanctions screening of counterparties". The resulting stream of alerts needs somewhere to go and clear rules for closing it out — this is the subject of our article on case management for AML alerts.
6. Reporting: STR/SAR to the FIU. Where money laundering or terrorist financing is suspected, the obliged entity must file a suspicious transaction report with the national FIU — for the Czech Republic, this is FAÚ, and the filing procedure is set out in its methodological guidance. This is a separate procedure, with its own deadlines and its own internal logic for deciding whether or not to file, rather than part of ordinary correspondence with the regulator.
7. Staff training. The regulator expects not a one-off induction session at hiring, but a regular training programme with checks on comprehension and documentation of the results — what is actually checked in practice is covered in our article on AML training for employees; as a service, this function is covered by AML training.
8. Document and record retention. Article 77 of Regulation (EU) 2024/1624 sets a single EU-wide retention period — five years from the end of the business relationship, the one-off transaction, or the refusal to establish either, with the possibility of extension by up to a further five years at the discretion of the member state; personal data must be deleted once the period expires, in line with GDPR requirements.
9. Internal audit and independent review. A system cannot be "switched on and forgotten" — it needs periodic independent assessment of whether the policies work as intended. We discuss the difference between internal and external audit, and when each is chosen, through our AML audit service.

The minimum document package

The set of documents without which a company will not pass either an internal or an external review:

• Business-wide risk assessment — records which money-laundering and terrorist-financing risks the company is exposed to, and why.
• AML/KYC policy — the top-level document on principles and responsibility.
• CDD/EDD and onboarding procedure — exactly what is checked on a customer, and when enhanced due diligence is triggered.
• Transaction monitoring and alert-handling procedure — rules for detecting, escalating and closing out suspicious activity.
• STR/SAR filing procedure — who decides, within what deadlines, and to which FIU the report is sent.
• Staff training programme — content, frequency, and how comprehension is confirmed.
• Record retention policy — the periods and procedure for retaining customer and transaction documents.
• MLRO/compliance officer appointment documents — including the record of responsibility at management-body level.
• Sanctions screening policy — provider, trigger thresholds, and the procedure for handling matches.
• Internal or external audit report — confirmation that the system has not only been written, but tested in operation.

Timelines: how long implementation takes in practice

No regulatory text sets a universal timeframe — neither AMLR, nor AMLD6, nor Act No. 253/2008 Coll. states how many weeks a company needs to build a system "from scratch": this is a matter for negotiation with the regulator and the partner bank, not a fixed deadline. What follows are benchmarks from our practice at COREDO, not regulatory deadlines. For a company with no existing procedures, the base document package — risk assessment, policy, key procedures — typically takes several weeks of active joint work; setting up onboarding, screening and monitoring as a working process, not just a document on paper, is the next, longer stage; staff training and the first reporting cycle add further time. If a company already has a partial system needing adaptation to AMLR/AMLD6, the timeline is usually shorter than building from scratch, but the exact figure depends on how much of the above already exists, and in what state.

Common mistakes in implementation

• Documents are written "for the inspection", not for the real processes — the policy exists, but staff work differently, and this becomes obvious at the very first unscheduled inspection.
• Board-level responsibility exists on paper but not in practice — the formally designated responsible member of the management body does not receive reports and does not make decisions on AML risks, which directly contradicts the logic of EBA/GL/2022/05.
• Outsourcing is treated as transferring responsibility — individual tasks can be handed to a contractor, but ultimate responsibility always remains with the obliged entity itself.
• AMLR 2027 is treated as "next year's problem" — while national law and current supervision are already in force, and it is faster to adapt the system to the new architecture of roles when the groundwork is already in place now.
• Screening thresholds and customer risk ratings are set once at launch and never revisited, even though the risk profile of the business and its customer base changes over time.
• Training is delivered once, at hiring, with no repeat cycle and no documentation of what was checked and when.

What to do next

If the company has none of the documents above yet, it is sensible to start with a risk assessment and a basic policy package, rather than hiring a full in-house team for a process not yet built — it is often quicker to discuss outsourced AML implementation and support. If the documents exist but it is unclear how workable they are, the first step is an independent review — this is covered by AML audit. If the company lacks the resource to maintain a permanent in-house MLRO with the required qualifications and access to the management body, this role can be covered through an outsourced MLRO. We set out the details of one real project to build an AML system from scratch for an e-money issuer in the case study "AML system development from scratch".

Frequently asked questions

From what date is AMLR mandatory for all companies in the EU?

Regulation (EU) 2024/1624 applies directly across all EU member states from 10 July 2027; for obliged entities linked to football agents and professional football clubs, from 10 July 2029. Until that date, national legislation continues to apply, and it already requires a fully functioning AML system today.

Does a small company need a separate MLRO?

Yes, but the scale of the role is proportionate to the size and risk profile of the business. The EBA Guidelines on the role of the AML/CFT compliance officer (EBA/GL/2022/05) require a responsible person to be designated both at management-body level and at operational level; for a small company this may be the same individual, but the appointment and access to the management body must be documented.

Can AML compliance be outsourced in full?

Operational tasks — yes; ultimate responsibility — no. Under the logic of EBA/GL/2022/05, legal and regulatory responsibility remains with the obliged entity regardless of whether individual functions are performed by its own team or by a contractor.

What happens if FAÚ is not notified of the contact person?

For Czech obliged entities, Act No. 253/2008 Coll. has, since 2024, directly required notification of FAÚ of the contact person via the data box (datová schránka) within 30 days of the date the company became an obliged entity, and of any changes within 15 days; this is a separate, standalone obligation, not covered by the mere existence of an internal AML policy.

How often does the risk assessment need to be updated?

The regulatory texts do not set a single calendar interval — the risk assessment must remain current in relation to the actual profile of the business, meaning it should be reviewed on material changes (new products, markets, transaction volumes) and periodically as part of an internal or external audit, rather than remaining a static document dated from launch.