AMLA publishes draft guidelines on ongoing monitoring under Article 26(5) AMLR

Introduction

On 3 June 2026, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism ("AMLA") published a Consultation Paper on Draft guidelines on the ongoing monitoring of business relationships under Article 26(5) of Regulation (EU) 2024/1624 (“AMLR”)(“Draft Guidelines”). 

Background

Article 26 of the AMLR requires obliged entities to conduct ongoing monitoring of business relationships, including periodic customer due diligence reviews and transaction/activity monitoring to detect potentially suspicious behaviour. Paragraph 5 of this Article provides that AMLA will issue guidelines on the expected manner of complying with this obligation. Please see below the general review of the proposed content of the Draft Guidelines.

Guideline 1: Keeping Customer Information Up to Date

This guideline sets out how obliged entities should ensure that customer information remains accurate and up to date throughout the business relationship. Updating customer information is an ongoing process that includes periodic reviews and event-driven updates. As a general rule, customer information should be updated by using:

1. reliable and independent sources of information which may include official registers or databases of government and competent authorities;
2. information collected through reliable and reputable commercial organisations such as vendors and data service providers, and information from reliable and independent open sources;
3. information or confirmation provided directly by the customer, either in writing or through digital means, provided that this information is of sufficient quality to enable them to assess the authenticity and accuracy of the information;
4. information provided by other obliged entities;
5. a combination of the sources above.

Periodic reviews must follow Article 26(2) of AMLR, but their depth and intensity should follow a risk-based approach. Where no new activity has occurred since the last update, obliged entities may adjust the review intensity for low-risk customers.

Event-driven reviews should be triggered by changes in identity, ownership, or legal status; behavioural or transactional anomalies; adverse media or PEP status; or changes in financial situation or business activity.

Expired identity documents. The draft guidelines adopt a risk-based approach to re-collection of expired documents, rather than requiring automatic re-collection upon expiry, by also providing potential indicators when to consider re-collection of a document. Obliged entities should consider the customer’s risk level, the issuing country’s risk, and whether updated documents would provide relevant additional information.

Suspension or restriction of the business relationship. Where updated information cannot be obtained, obliged entities may temporarily suspend or restrict transactions before terminating the relationship as per requirement indicated in Article 21 of the AMLR, provided ML/TF risks are effectively managed.

Guideline 2: Transaction and Activity Monitoring Framework

This guideline sets out how obliged entities should design and operate an effective monitoring framework to detect unusual or suspicious transactions and activities. The monitoring framework should be based on the nature, risks, and complexity of the obliged entity's business and its size, as well as on its overall business-wide risk assessment and its knowledge of its customers. 

Monitoring approaches. Depending on the obliged entity's business model, products, and services offered, monitoring may include pre-transaction checks, real-time monitoring, and post-transaction reviews. In non-financial sectors, and more generally where obliged entities do not execute or control transactions or have structurally limited access to transaction data, obliged entities should adjust their monitoring framework accordingly. This should include applying proportionate and effective alternative measures, such as structured assessments of customer behaviour, reviews of documentation, instructions, mandates, or assets involved, event-driven reviews, monitoring at relevant stages of the business relationship, and the escalation of unusual behaviour identified by staff.

Manual, automated and semi-automated processes. Monitoring may be manual, automated, or semi-automated, as long as it is explainable, regularly tested, properly documented, and proportionate to the size, nature, complexity, and risk exposure of the obliged entity. Obliged entities should determine whether manual processes and controls are sufficient to achieve effective monitoring outcomes, or whether their monitoring framework should be supported by automated or semi-automated systems and processes where justified. 

Enhanced scrutiny for high-risk relationships. Obliged entities should design and maintain their monitoring framework to ensure that high-risk business relationships and transactions receive a level of monitoring commensurate with their risk and are subject to enhanced scrutiny. This may include more targeted or intensified monitoring parameters, scenarios, risk indicators, or analytical approaches; more frequent or in-depth reviews; and specific controls adapted to the customer's activity and risk profile. 

Handling of monitoring outputs. Monitoring outputs, whether generated through automated systems or arising from manual processes, should be assessed without undue delay, prioritised based on risk, and escalated where further analysis is required. Obliged entities that use automated mechanisms to close monitoring outputs should ensure that these mechanisms are only applied to cases which, following automated analysis, do not indicate suspicious or unusual transactions and activities or other material ML/TF risk indicators. 

Use of technology and AI. When considering how to strengthen their monitoring framework, obliged entities should assess whether adopting automated or advanced analytical solutions—including algorithms, machine learning, artificial intelligence, and comparable emerging technologies—would sharpen their capacity to spot and flag money laundering and terrorist financing (ML/TF) exposures. Simply having such technology in place is not, on its own, proof that the framework works well. What matters instead is whether the technology actually allows the entity to pick up on relevant ML/TF risks and raise them internally promptly, without unnecessary delay. Where such tools are used, obliged entities should ensure appropriate safeguards proportionate to their size, nature, complexity, and risk, and should be able to demonstrate and explain the role, functioning, and outputs of such tools to competent authorities. 

Internal controls and ongoing review. Obliged entities should regularly revisit and stress-test their monitoring framework to make sure it continues to function well and stays aligned with the risk profile established in their firm-wide risk assessment. This ongoing review should draw on how the monitoring system has actually performed, what came out of past escalations and suspicious activity reports, newly emerging ML/TF threats, and any other pertinent input. Where obliged entities materially change their monitoring logic, analytical methods, or monitoring approach, they should apply a documented transition and validation framework. 

Key Takeaways

Obliged entities should assess the adequacy of their existing ongoing monitoring frameworks against the Draft Guidelines. Entities using AI or advanced analytical tools should prepare for enhanced governance and explainability requirements.

Next Steps

Comments to the Draft Guidelines may be submitted by 3 September 2026. Final guidelines are expected in Q4 2026. AMLA will consider developing tailored communication materials, including factsheets and explainers, particularly for smaller obliged entities.