AML Compliance Cost Under AMLR: A Practical 2027 Method

AML compliance cost is easier to size than it looks, because Regulation (EU) 2024/1624 states most of the drivers as numbers. Update intervals, thresholds, retention periods and approval levels are all in the text, and each one has a direct effect on how much work the programme generates every year.

What follows is a framework for costing an AMLR programme in your own firm rather than a benchmark. We do not publish figures for what other firms spend, because we do not have data we can stand behind and an invented average is worse than no number at all. What we can do is show exactly which provisions drive the cost and how to count them.

What this guide covers

• What drives AML compliance cost under AMLR
• AML compliance cost: sizing the one-off build
• AML compliance cost: sizing the annual run
• The AML compliance cost drivers the Regulation sets directly
• Where AML compliance cost is usually underestimated
• Reducing AML compliance cost without reducing compliance
• A worked method for putting a number on AML compliance cost
• Frequently asked questions
• Where the documentation cost lands

What drives AML compliance cost under AMLR

AML compliance cost divides into a one-off build and a recurring run. The build is bounded and finishes; the run continues for as long as the firm holds customers. Most planning errors come from sizing the first and forgetting the second.

Four Regulation provisions set the recurring volume more than anything else: the update intervals in Article 26(2), the enhanced due diligence triggers in Article 34, the transaction examination duty in Article 34(2), and the retention and deletion cycle in Article 77. Everything else is comparatively fixed.

AML compliance cost: sizing the one-off build

The build has a predictable shape because the Regulation prescribes what must exist. Article 9(2) enumerates ten internal policies and procedures plus internal controls and an independent audit function, all of which must be recorded in writing and approved.

The row that most often blows a budget is the identification data backfill. Article 22 asks for fields many legacy onboarding forms never collected — including the names of persons holding shares or a directorship in nominee form and, expressly, their status as nominees. Collecting that for new customers is cheap. Collecting it across an existing book means re-contacting customers, and the cost scales with the book rather than with the firm.

AML compliance cost: sizing the annual run

The recurring AML compliance cost is mostly a function of how many files must be touched each year, and Article 26(2) fixes the ceiling on that. Customer information must be kept up to date at intervals not exceeding one year for higher-risk customers to whom Section 4 measures apply, and five years for everyone else.

That gives a workable arithmetic. Take the number of higher-risk relationships — those all get reviewed annually. Take the remaining book and divide by the interval you set below the five-year ceiling. Add the enhanced cases, which carry more work per file, and the alert and suspicion volumes your monitoring actually produces.

One nuance changes the sum: the Regulation requires the interval to vary with risk below the ceiling, so applying a single five-year cycle to every standard-risk customer does not satisfy Article 26(2). A tiered cycle costs more than a flat one, and it is the compliant option.

The AML compliance cost drivers the Regulation sets directly

Several provisions create work whose volume you can estimate before the application date rather than discover after it.

• Article 34(2) requires examination of the origin and destination of funds and the purpose of all transactions that are complex, unusually large, conducted in an unusual pattern, or without apparent economic or lawful purpose. This applies regardless of the customer’s risk band, so the volume is driven by transaction mix rather than by customer count.
• Article 69 makes attempted transactions and suspicions arising from an inability to complete due diligence expressly reportable. Firms that never captured attempted transactions will find both a systems change and a new case volume.
• Article 77 requires retention for five years and then deletion. Deletion capability is the item most often absent entirely, and it is a build cost followed by a permanent run cost.
• Article 78 requires systems that can answer, fully and speedily, whether the firm has held a relationship with a named person at any point in the preceding five years. Searching former customers across archived and migrated systems is frequently a data project.
• Article 12 extends training to agents and distributors, not only employees, and requires attendance to be documented by named individual.

Where AML compliance cost is usually underestimated

Three areas absorb more effort than their prominence in the Regulation suggests.

Beneficial ownership on layered structures. Article 52(1) prescribes multiplying holdings along each chain and adding the results across chains. That is analyst time per customer, not a system output, and complex structures do not resolve themselves.

Approvals at two levels. Article 9(2) requires internal policies to be approved by the management body in its management function and procedures and controls at least by the compliance manager. Board calendars are fixed points, and an implementation plan that reaches the approval stage a month before the deadline has run out of runway.

The Level 2 tail. Most of the technical standards and guidelines that add detail were still in draft when this was written. Building on the Level 1 text is the only workable strategy, but it means budgeting a revision cycle after adoption rather than treating the build as finished.

Reducing AML compliance cost without reducing compliance

Three levers are legitimate and one common shortcut is not.

Simplified due diligence under Article 33 genuinely reduces effort where low risk is established against Annexes II and III — but only through five specific reductions, and the monitoring floor survives regardless. Reliance under Articles 48 and 49 removes duplicate work on Article 20(1) points (a), (b) and (c), though ultimate responsibility stays with you. Outsourcing under Article 18 moves execution, though six tasks may never be outsourced and the supervisor must be notified before the provider starts.

The shortcut that does not work is buying a template set and treating the AML compliance cost as discharged. A pack shortens the drafting; it does not perform the risk assessment, make the appointments or run the reviews.

A worked method for putting a number on AML compliance cost

Rather than quote an average, here is the arithmetic to run against your own book. Every input is either a number you already hold or a figure the Regulation fixes.

1. Count the population. Total relationships, split into higher-risk and everything else, plus occasional-transaction volume above the Article 19 thresholds.
2. Apply the ceilings. Higher-risk files are reviewed at least annually under Article 26(2). For the rest, choose tiered intervals below the five-year maximum and divide the book accordingly. That gives annual files-to-touch.
3. Weight the file types. An enhanced case under Article 34 carries source of funds and source of wealth, senior management approval and enhanced monitoring. Time it separately from a standard refresh.
4. Add the event-driven work. Alerts cleared, Article 34(2) transaction examinations, Article 69(2) suspicion assessments — and remember Article 77(1)(b) requires the assessment record whether or not it results in a report, so the no-report cases cost the same to document.
5. Add the fixed governance cycle. Annual risk assessment review, the audit test programme, training delivery, and the management body approvals.
6. Add the data obligations. Retention and scheduled deletion under Article 77, and the Article 78 five-year lookback capability.
7. Convert to effort, then to money using your own rates. Compare the result against current compliance headcount, and the gap is the AML compliance cost of the change rather than of the whole programme.

Two sanity checks make the output more useful. Run it twice — once for the position today and once for the position on 10 July 2027 — because the delta is what needs funding. And separate the one-off build from the annual run in the output, because they are approved by different people on different cycles.

The number this produces is specific to your book and defensible internally, which is more than any published average can offer.

Frequently asked questions

Is AML compliance cost proportionate to firm size?

Partly. Article 9(1) requires the policies, procedures and controls to be proportionate to the nature, risks, complexity and size of the business, so the depth scales. The list in Article 9(2) does not shrink, which is why the fixed component falls harder on a small obliged entity.

Does the toolkit route remove the need for advice?

No. A documentation set covers the drafting, which is the largest single line in the build. Scope determination under Article 3, the risk assessment and any question about how a national rule interacts with the Regulation still need judgement, and in some cases legal input.

What is the cheapest thing we can do first?

The Article 3 scope determination. It costs almost nothing, it decides which obligations and which date apply, and getting it wrong makes every downstream estimate wrong too.

Will AMLA supervision add cost?

For most firms, no — direct supervision reaches a capped population of large cross-border credit and financial institutions. The details are in our guide to AMLA direct supervision.

Where the documentation cost lands

Drafting is the largest line in the build and the most compressible. Our EU AMLR Toolkit is 99 editable templates arranged on the Regulation’s own chapter structure, including the registers that carry the recurring evidence. The application date that fixes your runway is in the AMLR 2027 timeline, and the Regulation itself is on EUR-Lex.