Enterprise Guide to Remediate Existing Customer and Business Files under EU AMLR

The Existing Book Is Where AMLR Bites First

From 10 July 2027, Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation (AMLR), applies as a directly applicable baseline across the Union. The duties are older than the Regulation; the level of consistency and precision expected across the existing customer book is what changes.

Most enterprises do not hold a blank book. They hold years of identity records, company documents, ownership charts, screening results and risk decisions, spread across systems and created under different national rules. The gap is rarely absence: the firm often cannot show quickly that what it holds is still current, reliable and sufficient for the relationship that exists today.

The Point

AMLR does not require every existing customer to be re-onboarded on the same day. It does require the existing book to support current, risk-based and traceable decisions.

What follows is a controlled remediation programme, not a one-day refresh of every old file. Much of the programme runs on comparison and internal evidence, and a file that passes closes without the customer ever being contacted.

Four Numbers Set the Shape of AMLR Remediation

Four numbers govern the exercise: AMLR applies from 10 July 2027, Article 26 caps the gap between customer-file updates at one year for higher-risk customers and five years for everyone else, and beneficial ownership now starts at 25% or more of shares, voting rights or other ownership interest.

Risk can shorten either update period, never stretch it, and the maximum periods are not default review cycles. Before AMLR, no EU rule set a refresh frequency at all; Ireland’s law, for example, asked firms to monitor as far as risk warranted and set no deadline.

Source: Regulation (EU) 2024/1624, Articles 26, 52 and 90

As at 31 July 2026, the surrounding detail is still moving: the consultation by the EU Anti-Money Laundering Authority (AMLA) on the draft regulatory technical standards (RTS) for customer due diligence (CDD) closed on 8 May 2026, and the consultation on the draft ongoing-monitoring guidelines runs until 3 September 2026. Neither instrument is adopted, and the remediation clock does not wait for either.

Six AMLR Changes Can Reopen Existing Customer Files

Six changes in AMLR can require an existing customer file to be reopened, updated or reassessed: update intervals, event-triggered reviews, individual identification data, business identification data, the beneficial-ownership threshold and its calculation, and politically exposed person (PEP) functions and family members.

AMLR does not make every legacy file defective. Many of the underlying duties existed under the Fourth Anti-Money Laundering Directive (AMLD4), Directive (EU) 2015/849, the pre-AMLR EU baseline, and national rules may already have been stricter or more detailed. The cards below compare each change against that baseline and name the check it triggers across the book.

Directive (EU) 2015/849, Articles 3(6), 3(9)-(10) and 13-14; Regulation (EU) 2024/1624, Articles 2(34)-(35), 22, 26, 52 and 90.

Two of the changes reset data expectations outright. Article 22 fixes the individual data set for standard CDD, down to nationality, status information and identifiers, and specifies the business set from legal form through registration, tax and LEI identifiers to nominee roles. A third review trigger also arrives in writing under Article 26(3): the firm becomes aware of a relevant fact concerning the customer, which lets monitoring findings reopen a file before its scheduled date.

The programme has to keep one distinction visible at all times: final law, draft detail and firm decisions are three different things, and only the first is settled.

AMLA’s draft CDD RTS proposes that information on customers already in a relationship be brought into line on a risk-sensitive basis within the Article 26 periods, with those periods starting when the future delegated regulation applies. Firms should treat that as a planning assumption for building the inventory now, not as a statutory deadline, and never present draft dates as adopted law.

Article 26 also turns file maintenance into a continuing cycle rather than a diary entry.

The maximum periods are caps, not default review cycles.

A Remediated File Connects Verified Facts to the Current Risk Decision

A remediated customer file is a record that connects verified facts to the current risk decision, not a folder full of documents. No firm can find gaps until it defines the file it wants to finish with, and Articles 20, 22, 25 and 26 of AMLR define that target.

For an individual, the file establishes identity, relevant residence information, the purpose of the relationship, expected activity, screening results and current risk. A business file follows the same logic and must also explain the legal entity, its authorised representatives, and its ownership and control.

Regulation (EU) 2024/1624, Articles 20, 22, 25 and 26.

Registration Evidence Is Not Ownership Evidence

Business remediation is usually heavier because a current certificate of incorporation does not, by itself, show who ultimately owns or controls the customer. Current register information establishes legal existence and supports the ownership review; the firm must still test that the recorded ownership and control picture is complete, plausible and consistent with other evidence.

Where no beneficial owner can be identified after all possible means have been exhausted, AMLR requires that outcome and the steps taken to be recorded. The senior-managing-official route is not a shortcut around an incomplete ownership assessment.

Every business file reaches a point where its ownership information is rechecked, either on its review cycle or sooner when an event pulls it forward. What that recheck means varies, and it rarely means rebuild: where the owners on file still match the registers and nothing signals a change, the firm confirms and records, and reconstruction is reserved for structures that are old, incomplete or contradicted. Every business review still re-runs the threshold test and the separate control-by-other-means check.

Five Outcomes Triage the Book Before Any Customer Hears From You

Assessment starts with the book, not with outreach. Outreach that comes first creates unnecessary friction and usually produces a poor estimate of the work, because the firm already holds much of what it needs to grade each file.

An inventory per relationship brings together customer type, current risk level, last completed review, available identity or entity evidence, ownership information, screening status, known trigger events, open alerts and unresolved exceptions. The book is then compared, file by file, with the target standard from the previous section.

That comparison should separate a real information gap from a storage or retrieval problem. A reliable fact already held may still be usable; a document may be present yet no longer prove the current position; a record may be current yet lack the reasoning that connects it to the risk decision. Each file then takes exactly one of five outcomes.

The first outcome keeps the exercise honest, and files earn it by comparison, not by assumption. For individuals the comparison is concrete because Article 22 fixes the data set down to names, birth details, nationality, identifiers and addresses. Files missing defined fields, common wherever onboarding ran under an older national regime, take outcome 3, Update, and join the queue.

Triage is also what contains the cost. Outcomes 1 and 2 close from internal records and reliable independent sources, so outreach effort concentrates on the files that genuinely need customer input, and the programme stays smaller than the book it covers.

A large book needs a living queue, not one fixed campaign list. Priority rises where a trigger event has occurred, the customer is higher risk, the gap is material, the evidence is old or unreliable, ownership or control has changed, sanctions exposure may exist, activity no longer fits the profile, or the next required review is approaching.

A living queue, re-ranked as facts arrive, not one fixed campaign list.

One Eight-Step Process Remediate Individual and Business Files

One controlled process should remediate both individual and business files. The two paths contain different evidence, and splitting them into separate operating models makes ownership, escalation and quality assurance harder to control.

Its sequence runs from a recorded reason to a reconstructable decision. Steps three and four carry the outreach discipline: the firm checks what it can confirm or reuse from internal records, recent checks and official registers before asking the customer for anything, then collects only what is missing, outdated or doubtful, recording each attempt.

One process for individual and business files; only the evidence at step 5 differs.

Two Hard Rules Protect the Programme

Silence and contradiction are the two situations that test the programme’s integrity, and neither can be closed by a system default. Non-response is never a decision by itself, conflicting evidence is never averaged into a clean field, and both routes end in a recorded human decision.

A Worked Example: An Ownership Change at Northbridge ICT

Northbridge ICT is a hypothetical medium-risk business customer. Monitoring identifies a registry update: a new shareholder now holds 30% and one director has left, while the file still shows the old ownership chart and names the departed director as an authorised representative.

The trigger starts the review; it does not predetermine the outcome. A verified new owner, no material adverse information and activity that still matches the relationship mean the firm updates the file and continues. Ownership that stays unclear, or a change that raises the risk, moves the case to enhanced review or escalation.

A File Is Finished When Another Reviewer Can Reconstruct the Decision

Completion is the point at which current evidence supports a current decision and the record explains how that decision was reached. The date on which the last document arrived proves nothing on its own.

Reconstruction rests on the closure record, and it has eight parts.

Eight entries that let a second reviewer reconstruct the decision.

Once closed, the file returns to periodic review, event-trigger monitoring, transaction or activity monitoring where applicable, PEP and sanctions screening, exception management and quality assurance. Remediation clears a known gap. Ongoing monitoring is what stops the file becoming stale again.

What to Fix Before Scaling

A good pilot can still fail at full volume if nobody has decided who owns the queue, who can approve higher-risk outcomes, what non-response means, or what evidence closes a case. Nine building blocks belong in place before large-scale outreach, from a single customer-file standard and one inventory of relationships through named case owners and decision rights to completion criteria, quality assurance and management reporting.

Settle these before any large-scale outreach begins.

Firms should test the process on six representative files before scaling it across the full book. The pilot should show where data cannot be retrieved, which checks can be reused, where hand-offs stall and where a final decision cannot be reconstructed. A fault found on six files costs little; the same fault found mid-campaign does not.

Shufti Supplies the Evidence; the Firm Makes the Decision

Verification, screening and registry outputs support remediation decisions; the obliged entity makes them. AMLR draws that line itself: the entity stays liable for outsourced tasks, and specified decisions, including the customer risk profile, entry into a relationship and suspicious-activity reporting, cannot be outsourced to any provider.

Shufti is a Glocal Platform built for the full compliance lifecycle, from sign-up, onboarding and authentication through monitoring to remediation, across every industry, region and use case. In a remediation programme it sits at the evidence layer, and the division of labour is explicit.

One Bulk Pass Shows Where the Book Has Drifted

Much of the evidence work runs in bulk. Shufti can re-screen an existing book against PEP, sanctions, watchlist and adverse-media data through AML screening built for batch re-checks, monitor it for status changes, and refresh business and beneficial-owner information from registry sources where coverage allows through business verification and ownership mapping, with results returned per customer and evidence attached.

One pass surfaces stale screening, new matches and ownership that no longer matches the file, without a single email to a customer. Identity re-verification still needs the customer to complete a check, through electronic identity verification against government registries or a document and biometric journey, which is one more reason to reserve outreach for files nothing else can close. Each result returns attached to the customer record as evidence, which is the shape the closure record needs.

No provider can see inside a firm’s own records, so the field-by-field comparison runs on the firm’s systems, with the bulk results feeding it as the freshest evidence. The firm builds the list. Shufti fills in what the world outside its records says about each file.

Technology cannot make a firm AMLR-compliant. The working question is different: can the operating model use verification, registry, screening and monitoring outputs to reach consistent human decisions across the existing book, and show the evidence later? Teams that prefer to build and price a stack without a sales conversation can configure a plan directly at any tier, and deployment references are available on request.