October 13, 2026 · 6min read
Preparing for AMLR: Why Onboarding is No Longer a Point-in-Time Event
Financial institutions have spent years improving how they identify, verify, and assess customers at onboarding. But customer risk does not stop changing once an account is opened.
Customers move. Ownership structures change. New products are added. Transaction patterns evolve. Sanctions and adverse information emerge. Data that was accurate when a relationship began can quickly become outdated.
The European Union’s new Anti-Money Laundering Regulation (AMLR) framework creates a directly applicable AML/CFT rulebook across the EU. Meanwhile, the new Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) will develop standards and guidance to support more consistent implementation and supervision.
The new AMLR rules will apply from 10 July 2027.1 AMLA is now developing the detailed standards and guidance that will shape implementation, including on customer due diligence and ongoing monitoring. Financial institutions should use this time to prepare, because the data, technology and operating model changes required to support ongoing, risk-based monitoring cannot be implemented overnight.
Key Takeaways
- The EU’s Anti-Money Laundering Regulation (AMLR) goes into effect on 10 July 2027;1 AMLR requires ongoing monitoring of business relationships and customer information to be kept up to date on a risk-sensitive basis.
- AMLR reinforces the shift from point-in-time customer due diligence towards an ongoing, risk-based understanding of the customer throughout the relationship.
- Financial institutions must move toward dynamic monitoring that detects material changes (e.g., beneficial ownership, geography, or transaction patterns) and triggers targeted re-screening.
- Feedzai Secure Onboarding can help institutions connect customer data and orchestrate risk-based checks and decisions as relevant information changes throughout the customer relationship.
How Do Recent AMLR Changes Impact Risk Assessment?
Under new AMLR rules, the important question is no longer, “Did we complete the right checks when this customer joined?”
It becomes:
- “What do we know about this customer now?”
- “What has changed?” and
- “Does that change require us to do something?”
Answering these questions consistently across millions of customers opens a significant data, decisioning, and orchestration challenge.
Many institutions still operate onboarding, periodic KYC, screening, and ongoing monitoring across different systems and teams.
Grow Digital Banking. Reduce Fraud.
"A bank that remembers its customers can say yes to more of them, and keep saying yes as they prove themselves, instead of treating a known customer like a stranger every time they log in." — Ali Adib, Principal Product Marketing Manager, Feedzai
A customer may be verified and risk-assessed at onboarding, with subsequent reviews relying on separate processes, scheduled remediation exercises, or significant manual intervention.
This fragmentation becomes increasingly difficult when you need to understand and evidence customer risk throughout the relationship.
Consider a customer who was assessed as “low risk” at onboarding. Twelve months later, their beneficial ownership changes. Or their activity expands into a higher-risk geography. Or new adverse information emerges.
AMLR specifically recognizes changes in circumstances such as jurisdictions transacted with, the value or volume of transactions, significantly different new products or services, and changes in beneficial ownership as potential reasons to review the customer file again.
How Often Should Banks Review Customer Risk Under AMLR’s Rules?
The updated AMLR reinforces an important principle: customer due diligence (CDD) is not a one-time exercise performed at onboarding alone.
Crucially, this does not mean running the same KYC checks against every customer every month.
Instead, the approach is risk-based. AMLR requires customer information to be updated at intervals determined by risk, with maximum intervals of one year for higher-risk customers and five years for other customers. But these are not simply a schedule for periodic reviews. Reviews can also be required sooner when relevant circumstances change, or new information about the customer emerges.
However, this creates a different operational challenge:
How do you identify when something meaningful has changed, determine whether it affects customer risk, run the appropriate checks, and take action without unnecessarily putting every customer through the same review process?
The key is to treat onboarding as the beginning, not the end, of the review cycle.
From Point-in-time Onboarding to a Persistent Customer Risk Profile
This is where onboarding technology can evolve.
Rather than treating onboarding as a workflow that finishes when a customer is approved, institutions can establish a persistent customer risk profile that evolves as relevant information and circumstances change. The lifecycle becomes:
Onboard → establish customer profile → monitor for relevant changes → re-enrich or re-screen when appropriate → reassess risk → prioritize material changes for investigation → apply EDD or customer outreach where required.
The important distinction is that this does not require continuously running every available check against every customer.
A lower-risk customer whose circumstances remain unchanged may require relatively little intervention. A material change in ownership, geography, identity information, or another risk indicator could trigger additional data, screening, or review.
Identifying those changes is itself part of the challenge. Relevant signals may sit across customer records, transaction activity, corporate registries, sanctions and PEP screening, and other internal or external data sources. Institutions need to bring those signals together to understand what has changed, whether it matters, what additional information is needed, and what action should follow.
The goal is simple: apply the right check to the right customer at the right time.
What Steps Should Financial Institutions Take Now to Prepare for AMLR?
The AMLR regulatory application date is July 2027, but the technology and operating-model changes required to support ongoing, risk-based monitoring cannot necessarily be implemented overnight.
Institutions can use the time now to answer some fundamental questions:
- Where does customer information sit today?;
- What events trigger a review?;
- How do we know when customer information has changed?;
- Which checks should be rerun? How is customer risk reassessed?;
- How are material changes prioritized?; and
- How much of that process still relies on manual intervention?
Institutions that cannot answer these questions risk more than inefficient operations. AMLR requires obligated entities to demonstrate that their customer due diligence measures are appropriate to the risks they have identified. Fragmented data, static customer profiles, and manual remediation can make that increasingly difficult to demonstrate at scale.
How Feedzai’s Secure Onboarding Tracks Customer Risk
Feedzai’s Secure Onboarding orchestrates data, risk decisions, and customer workflows at the point a relationship begins. Extending that orchestration beyond onboarding can help institutions connect the initial customer risk assessment with ongoing monitoring throughout the relationship.
A persistent customer profile can provide continuity from the information and evidence collected during onboarding. From there, internal and third-party data can be re-enriched or re-screened when new information is required, and customer risk can be reassessed as relevant circumstances change.
Secure Onboarding can support this through:
- Persistent customer profiles, retaining relevant customer information, evidence, and previous decisions.
- Risk-based orchestration, determining which data and checks are required based on the customer and the event rather than applying every check universally.
- Re-enrichment and re-screening, bringing in updated internal and external information when required.
- Dynamic risk reassessment, updating the customer’s risk profile as relevant information changes.
- Risk-based case prioritization, ensuring material changes requiring investigation are surfaced to the appropriate teams.
- Explainability and auditability, maintaining the evidence behind the checks and decisions made throughout the relationship.
The result is a shift from point-in-time onboarding towards lifecycle customer risk management.
AMLR is a regulatory requirement. And an opportunity.
Preparing for AMLR should not simply mean doing more KYC/CDD checks.
It is an opportunity to rethink how customer risk is managed across the entire lifecycle.
A more dynamic approach can let institutions focus additional checks and operational effort where risk actually changes, reduce unnecessary friction for lower-risk customers, use third-party data more intelligently, and give investigators better-prioritized cases.
As regulation moves towards a more consistent, risk-based and ongoing understanding of the customer, the technology supporting customer due diligence needs to move with it.
Onboarding should no longer be viewed as the end of the customer risk assessment. It can be the beginning of a persistent, evolving understanding of customer risk.
Additional Resources
Frequently Asked Questions about AMLR
What is AMLR?
The EU’s Anti-Money Laundering Regulation (AMLR) is a unified rulebook establishing single, directly applicable AML/CFT standards across the European Union. Designed to modernize financial compliance, AMLR shifts customer due diligence from a static, point-in-time onboarding check to an ongoing, dynamic risk assessment throughout the customer lifecycle.
When does AMLR apply?
The EU Anti-Money Laundering Regulation (AMLR) will generally apply from 10 July 2027. Financial institutions can use the time before then to assess whether their customer data, monitoring processes and technology can support the ongoing, risk-based customer due diligence required under the new framework.
Does AMLR require continuous KYC checks?
No. Ongoing monitoring does not mean continuously rerunning every KYC check against every customer. The approach is risk-based: institutions must keep customer information up to date, monitor business relationships, and respond when relevant circumstances or information change.
How often must customer information be updated under AMLR?
The frequency depends on the risk associated with the business relationship. AMLR sets maximum intervals of one year for higher-risk customers and five years for other customers. However, institutions may need to review and update information sooner when relevant circumstances change, or new information emerges.
What changes can trigger a customer review under AMLR?
A review may be required when relevant customer circumstances change, or new information emerges. This could include changes to beneficial ownership, customer activity, or other information that affects the institution’s understanding of the customer and their risk.
How can financial institutions prepare for AMLR?
Institutions can start by understanding where customer information sits today, what events trigger a review, how changes are detected, which checks should be re-run, and how customer risk is reassessed. This can help identify where fragmented data, manual processes, or disconnected systems make ongoing, risk-based customer due diligence harder to manage at scale.
Footnotes
All expertise and insights are from human Feedzaians, but we may leverage AI to enhance phrasing or efficiency. Welcome to the future.