Most coverage of the EU AML package reads like a procedural update: new rules, a new authority, new timelines. For the person who signs off on compliance decisions, the change is more personal. Responsibility for a failure was always individual. What the Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), applicable from 10 July 2027, sharpens is the bar that responsibility now has to clear: a decision has to be provable, not merely explainable. The open question is whether a manual process can still clear it.
This piece walks that shift end to end: what AMLR changes for the people who are personally liable, what a defensible decision actually looks like, where manual processes leave the gap, and how to close it.
Whether the title is Head of Compliance, MLRO or AML Officer, the person who signs off has always carried personal accountability for a missed sanctions hit or an incompletely documented check. That part is not new. Sanctions against individuals, including members of the management body, are set by the accompanying directive (AMLD6) and national law, not by the AMLR itself. What the EU AML package changes is the environment in which that accountability is tested.
The package replaces much of the national patchwork with a single, directly applicable rulebook and creates a new EU authority, the Anti-Money Laundering Authority (AMLA). From 2028, AMLA will directly supervise up to 40 selected high-risk financial institutions, and it drafts the regulatory technical standards (RTS) that define adequate due diligence across the bloc. For everyone else, national supervisors such as BaFin stay in charge, but they apply the same rulebook. Harmonized expectations mean the question a supervisor brings is more consistent, and harder to satisfy with a locally accepted practice. Supervisors increasingly treat inconsistency and documentation gaps not as paperwork problems but as evidence that a process cannot be relied on.
The exposure does not stop at the compliance function. The AMLR requires every obliged entity to name a member of its management body who is responsible for AML compliance, alongside a compliance manager (Art. 11 AMLR). Accountability at board level is no longer implicit; it has a name. Executives often carry that risk with even less visibility into whether their processes would hold. The practical effect is the same for everyone who signs: a decision that could once be defended by explaining it can now only be defended by proving it.
Start with the standard, because most teams have never written it down. A defensible decision is one that can be reconstructed from the record alone: what was checked, on which evidence, by whom, and why. The AMLR's record-keeping duties point the same way: what was obtained in due diligence has to be retained for at least five years after the business relationship ends. Defensibility is a property of how the case was worked, not of how well someone wrote it up afterward.
In practice, that record has four properties:
The same reproducibility that lets two analysts reach the same verdict on the same file is what a defensible decision rests on. A decision that clears these properties holds whether it is questioned next week or in five years. A decision that does not is a finding waiting for a trigger.
How defensible are your current case files?
Test five to ten recently approved KYB cases against the four properties of a defensible decision. The Defensibility Checklist shows where your record would not hold in an examination.
Download the Defensibility Checklist
Personal liability becomes dangerous at the exact point where responsibility outruns control. An MLRO is accountable for every case, but with manual processes cannot actually guarantee that nothing was missed.
The gap opens in ordinary places:
In KYB this is sharpest at UBO identification. Untangling a corporate ownership structure across several jurisdictions by hand is where case files most often drift out of consistency, and where a single missed intermediate entity quietly moves a beneficial owner across the 25% ownership threshold. Under the AMLR, indirect ownership is calculated with the accumulation method: stakes are multiplied along each ownership chain and added up across all chains. In multi-layered structures, this is hard to do by hand and easy to get wrong across repeated onboarding reviews. For higher-risk categories, the threshold can also be lowered to 15%, which shrinks the margin for error further.
None of these announce themselves. They surface when a case is reopened: during an examination, after a customer turns out to be a sanctioned person or a PEP, or when a prosecutor asks whether due diligence was met. By then the decision is years old, and the only thing between the individual and a finding is the record the process left behind. When the record was built from scattered notes rather than primary evidence, there is little to stand on.
Even a well-documented decision has a shelf life. A file that was clean at onboarding does not stay clean: ownership structures change across jurisdictions, a customer becomes a PEP, a new sanction lands. The AMLR makes this explicit: business relationships have to be monitored on an ongoing basis, and customer information updated on a risk-based cycle. If due diligence is proven once and never again, the liability window reopens silently, and no one is watching it.
Closing that window is a job no team can do by hand across a whole customer book. It needs the check to keep running:
Due diligence that stays provable over the whole relationship is what keeps liability from reopening behind your back.
Put those pieces together and the pattern is clear: defensibility is produced upstream, in how each case is worked, not assembled in the weeks before an examination. That is the principle behind how Sinpex is built.
Screening across sanctions, PEP and adverse media runs as part of the case, with every hit surfaced and classified rather than lost. Beneficial owners are calculated automatically from official registry data using the accumulation method, so every UBO is determined the same way, traceably and correctly. The audit trail is a byproduct of the work: each decision records who made it, on which evidence, and why, and a lowered risk rating cannot be set without its documented reason. Risk assessment follows the institution's own model, applied the same way to every case, so a required step cannot quietly be skipped. And monitoring keeps running after onboarding, reopening a case when something changes.
The outcome is the thing personal liability actually needs. Due diligence is provable in an examination or a legal proceeding from the record alone, with an audit trail that holds up under regulatory scrutiny. The constant background worry of the unprovable decision gives way to trust in a process that holds.
Compliance with Sinpex
The headline change of AMLR is not a new rule to memorize. It is a change in what the supervisor's question tests: from "did you check" to "can you prove, consistently, how you checked." That is the ground personal liability now stands on, for the MLRO, the Head of Compliance and the executives above them.
The good news is that this is an upstream problem, and a solvable one. Defensibility is not produced in the preparation before an examination. It is produced in how each case is worked, by a process that leaves the evidence behind as it goes and keeps watching after onboarding.
Want to see how a process that produces its own audit trail works in practice? Book a demo with Sinpex, and we will walk you through it together.
This article is for general information and does not constitute legal advice. Status: October 2026.
.png)
CEO & Founder | Sinpex
Camillo is the founder and CEO of Sinpex. He holds a Ph.D. from the University of St. Gallen and brings more than ten years of experience in KYB and compliance. Prior to founding Sinpex, he worked at Deloitte.
