The AML/CFT module tracks the anti-money laundering and counter-terrorist financing programme an obliged entity in the EU has to run and be able to evidence. It is built from four instruments: Regulation (EU) 2024/1624, the AML Regulation (AMLR), the EBA ML/TF Risk Factors Guidelines (EBA/GL/2021/02 as amended by EBA/GL/2024/01), the EBA guidelines on the AML/CFT compliance officer (EBA/GL/2022/05) and the EBA guidelines on restrictive measures (EBA/GL/2024/14 and 2024/15).
It is written for obliged entities across the EU: banks, payment and e-money institutions, crypto-asset service providers, investment firms, insurers and the professional services firms the Regulation lists. Where the Regulation narrows a duty to one class of entity, the requirement says so, and a firm outside that class marks it not applicable with the reason.
What Venvera tracks
The module ships 137 requirements: 80 from the AMLR (refs AMLR-), 30 from the risk factors guidelines (EBARF-), 17 from the compliance officer guidelines (EBACO-) and 10 from the restrictive measures guidelines (EBARM-). Each is cited by the article or guideline paragraph it comes from, because that is how a supervisor, your internal audit function and the compliance officer's annual activity report all cite the duty. They are grouped into eight areas that follow how the programme is run rather than the article numbering, because the four instruments interleave.
| Area | Requirements | What it covers |
|---|---|---|
| Governance and the three lines | 26 | Policies, procedures and controls, the compliance manager and the compliance officer, independence and resources, the annual activity report, internal reporting channels, the firm's own beneficial ownership, independent audit |
| Business-wide risk assessment | 12 | The firm-level and customer-level assessment, risk factors in four categories, weighting that cannot dilute mandatory high-risk flags, new product gating, mandatory information sources |
| Customer due diligence standards | 31 | When due diligence is triggered, identification and verification, beneficial owners and the fallback, timing, register discrepancies, purpose and nature, simplified due diligence and its limits, refresh cycles, anonymous products |
| Enhanced due diligence, PEPs and high-risk countries | 15 | Enhanced measures and how they are chosen, politically exposed persons, high-risk third countries, correspondent relationships, residence by investment, very high net worth customers |
| Monitoring, investigation and reporting | 15 | Ongoing monitoring and its design decisions, examination of unusual transactions, reports to the FIU and its requests, refraining and the 3 working day rule, tipping off, threshold reports, sample reviews |
| Outsourcing, reliance, agents and groups | 16 | Notification before outsourcing starts, the tasks that may never be outsourced, oversight of providers, reliance on other obliged entities, agents and distributors, group-wide policies and third-country establishments |
| Records, data protection and training | 10 | Training and integrity assessments, records of decisions, retention and deletion, special categories of data, automated decisions |
| Sanctions and restrictive measures | 12 | Verification against targeted financial sanctions, the restrictive measures policy and exposure assessment, list management, screening scope and calibration evidence, true match handling, screening vendors |
When each instrument applies
The AMLR applies from 10 July 2027. Until then the same duties exist under Directive (EU) 2015/849 as transposed by your Member State, and every AMLR requirement that replaces a Directive duty says so in its text ("until 10 July 2027 the equivalent duty is Article X of Directive (EU) 2015/849 as transposed"), so the rows are usable today and the evidence you collect now is relabelled, not rebuilt, in 2027. Requirements the Regulation introduces for the first time (virtual IBAN users, the 14 day discrepancy clock, very high net worth customers, high-value goods reports, partnerships for information sharing) say they have no Directive equivalent.
The three EBA guideline sets apply now: the risk factors guidelines since 26 October 2021, the compliance officer guidelines since 1 December 2022 and the restrictive measures guidelines since 30 December 2025.
Dashboard
The dashboard shows implementation coverage across the 137 requirements, a breakdown by the eight areas, and the maturity score from the gap assessment if one has been completed. Coverage and maturity answer different questions: coverage says whether a duty is implemented, maturity says how well the programme is run, which is what a supervisor's inspection and the compliance officer's annual report actually turn on.
Recurring duties
Fifteen obligations land on the compliance calendar with owners, dates and reminders. Each names the article or guideline paragraph it serves. The most important ones:
Annual, AMLR Article 10(2). Approved by the management body in its management function and communicated to the supervisory function; the approved version, the change rationale and the minute are the record.
Annual, AMLR Article 11(6) and EBA/GL/2022/05 paragraphs 13, 49 and 50. The report with every required element, its submission, and the minuted assessment of the compliance function.
Annual by common supervisory expectation, AMLR Article 9(2)(b) and Guideline 7. The law fixes no cadence; the module says so and uses a yearly cycle.
Annual, AMLR Article 26(2). Every higher-risk file within one year, and the yearly cohort of all other customers within the five year maximum, which is a ceiling and not a target.
Quarterly, EBA/GL/2021/02 Guideline 4.75. The guidelines say regularly; the module chooses quarterly and says the cadence is the firm's choice.
Annual, EBA/GL/2024/14 paragraph 26 and EBA/GL/2024/15 paragraphs 6 and 25. The updated exposure assessment, the screening performance report and the calibration rationale.
Event-driven clocks, such as the report to the FIU on forming a suspicion, the 5 working day answer to an FIU request, the 14 day discrepancy report and screening on every list change, are not calendar obligations. They stay on the requirement rows, where the deadline is stated in the requirement text and the guidance.