Learn
If you are the AML compliance officer or MLRO at an EU bank, payment institution, e-money institution or crypto-asset service provider, or the board member who answers for AML, this guide sets out what the role must look like today under the EBA's compliance officer guidelines and from 10 July 2027 under Article 11 of the AML Regulation. You get the split between the compliance manager and the compliance officer, the eight independence safeguards a supervisor checks, the thirteen items of the annual activity report, the outsourcing and group rules, and a table to test your own set-up.
The short answer. From 10 July 2027 every obliged entity needs two roles under Article 11 of Regulation (EU) 2024/1624: a compliance manager, who is a member of the management body in its management function and answers for compliance and resources, and a compliance officer, appointed by the management body with sufficiently high hierarchical standing, who runs the policies and controls day to day, is the contact point for authorities and files suspicious transaction reports. One person may hold both roles where the size and risks of the business justify it. The officer must be protected, must report directly to the management body, can be removed only after prior notice to it with the supervisor informed, and drafts a yearly implementation report. Until then, EBA/GL/2022/05 applies to credit and financial institutions and already sets most of these expectations.
| Duty | Today: EBA/GL/2022/05 | From 10 July 2027: AMLR |
|---|---|---|
| Who needs a compliance officer | A separate officer unless a sole trader, very few staff or documented reasons (paras 32, 33) | Every obliged entity (Art. 11(2)); may be the same person as the compliance manager (Art. 11(7)) |
| Management body seat | A member responsible for AML/CFT (paras 17 to 23) | The compliance manager (Art. 11(1)) |
| Seniority | Appointed at management level (para 25) | Sufficiently high hierarchical standing (Art. 11(2)) |
| Independence and access | Independent of business lines, unrestricted access (para 31) | Protection (Art. 11(4)); direct reporting and access to information (Art. 11(5)) |
| Yearly report | Activity report with the contents in para 50 | Implementation report drawn up by the officer, submitted by the manager (Art. 11(6)) |
| Removal | Not addressed | Prior notice to the management body; the supervisor is informed (Art. 11(2)) |
| Suspicious transaction reports | The officer's reporting function (paras 51 to 54) | The officer transmits them to the FIU (Art. 69(6)) |
| Outsourcing | Strategic decisions stay in-house (para 68) | Six tasks never outsourced; the supervisor is notified first (Art. 18) |
What does Article 11 of the AMLR require?
Article 11 of Regulation (EU) 2024/1624, which applies from 10 July 2027, sets up the compliance functions in seven paragraphs. Paragraph 1 creates the compliance manager: one member of the management body in its management function, responsible for compliance with the AMLR, with Regulation (EU) 2023/1113 on transfers of funds and crypto-assets and with any administrative act of the supervisor. The compliance manager makes sure the internal policies, procedures and controls match the firm's risk exposure and are implemented, makes sure enough human and material resources go to that work, and receives information on significant or material weaknesses. Where the management body decides collectively, the compliance manager assists and advises it and prepares the decisions.
Paragraph 2 creates the compliance officer, appointed by the management body in its management function and with sufficiently high hierarchical standing. The compliance officer is responsible for the policies, procedures and controls in the day-to-day operation of the AML requirements, including the implementation of targeted financial sanctions, is the contact point for competent authorities and reports suspicious transactions to the FIU under Article 69(6). Where a firm is subject to checks on its senior management or owners under Article 6 of Directive (EU) 2024/1640 or other Union law, the compliance officer is verified against those requirements too. A firm in a group may use the compliance officer of another group entity where its size and the low risk of its activities justify it.
The remaining paragraphs give the role its footing. The compliance officer may be removed only after prior notification to the management body, and the firm must notify the supervisor of the removal and say whether it relates to the AML tasks; the officer may also inform the supervisor directly (paragraph 2). The compliance functions get adequate resources, including staff and technology, and the power to propose any measure needed (paragraph 3). The officer is protected against retaliation, discrimination and other unfair treatment, and the officer's decisions must not be undermined by commercial interests (paragraph 4). The officer and the head of the audit function can report directly and independently to the management body in both its functions and raise concerns, and everyone involved in compliance has access to the information they need (paragraph 5). The compliance manager reports regularly to the management body and at least once a year submits a report on the implementation of the policies, procedures and controls, drawn up by the compliance officer, and remedies deficiencies in good time (paragraph 6). Where the nature, risks, complexity and size of the business justify it, one person may perform both functions, and a sole trader performs all of them (paragraph 7).
What do the EBA guidelines require today?
Until 10 July 2027 the legal basis is national law transposing Directive (EU) 2015/849, whose Article 8(4)(a) asked for a compliance officer at management level "where appropriate with regard to the size and nature of the business" and whose Article 46(4) asked firms to identify the member of the management board responsible for AML. The detail sits in EBA/GL/2022/05, the guidelines on the role and responsibilities of the AML/CFT compliance officer, which apply to credit and financial institutions since 1 December 2022. The EBA handed its AML mandates to AMLA on 1 January 2026, and both authorities confirmed that the EBA's AML guidelines stay in force until AMLA replaces them.
The guidelines start with the management body. In its supervisory function it should be informed of the results of the business-wide risk assessment, oversee whether the policies are adequate and effective, review the compliance officer's activity report at least once a year and assess at least once a year whether the compliance function works, including its resources (paragraph 13). In its management function it should build the structure and resources the officer needs, including a dedicated AML/CFT unit where required, implement the policies and review the activity report at least annually (paragraph 16). One member of the management body is responsible for AML/CFT: that person needs the knowledge and time for the role, is the officer's main contact in management, and makes sure the officer's concerns are addressed; if the management body decides not to follow the officer's recommendation, it should justify and record that decision (paragraphs 17 to 23).
For the officer, the guidelines require appointment at management level with the authority to propose measures on their own initiative (paragraph 25); a decision on whether the role is full-time, and on conflicts of interest if it is combined with other duties (paragraphs 26 and 27); availability to the competent authority and the FIU, which normally means being contracted and working in the country where the firm is established (paragraphs 28 and 29); and the ability to delegate tasks while keeping the responsibility (paragraph 30).
Who is the compliance manager, and how does the role differ from the compliance officer?
The compliance manager is a board-level role: a member of the management body in its management function who answers to the rest of the body for whether the programme fits the risks, is implemented and is resourced. The compliance officer is an operational role, appointed by that body, which runs the programme every day, holds the relationship with the supervisor and the FIU, and writes the documents the management body approves. Article 9(2) shows the split in the approvals: internal policies are approved by the management body, and internal procedures and controls at least at the level of the compliance manager.
Titles vary between firms and countries. Many firms call the compliance officer the MLRO, the money laundering reporting officer, and some call a head of compliance below board level a chief compliance officer. The AMLR attaches its duties to the roles it defines, so map your titles to them: the person who sits on the management body and answers for AML is the compliance manager, and the person who runs the function and files reports with the FIU is the compliance officer.
Does every obliged entity need a separate compliance officer?
Today, under the EBA guidelines, a credit or financial institution should appoint a separate AML/CFT compliance officer unless it is a sole trader, has very few employees, or documents reasons for not doing so that refer at least to the nature and risks of its business, the size of its operations and its legal form, including whether it belongs to a group (paragraphs 32 and 33). Without a separate officer, the tasks are carried out by the management body member responsible for AML/CFT, by outsourcing operational functions, or by a combination (paragraph 34).
From 10 July 2027 the starting point changes. Article 11(2) says obliged entities "shall have a compliance officer", without a size threshold. The flexibility moves to Article 11(7): one natural person may perform both the compliance manager and the compliance officer functions where the nature, risks, complexity and size of the business justify it, and may also hold other functions. A firm whose activities are performed by one natural person gives all the tasks to that person. A firm that combines the roles should write down why its size and risk justify it, because that is the question a supervisor will ask.
How senior and how independent must the compliance officer be?
Supervisors test independence through a small number of facts, and each one has a source.
- Standing. Sufficiently high hierarchical standing (Article 11(2)); today, appointment at management level (paragraph 25).
- Independence. The officer is part of the second line, independent of the business lines or units it controls and never subordinate to a person who manages any of them (paragraph 31(a)).
- Access. Unrestricted and direct access to all the information the function needs, and the officer alone decides what that is (paragraph 31(b)); Article 11(5) extends the access right to everyone involved in compliance.
- Reporting line. Direct and independent reporting to the management body in both functions (Article 11(5)); in a significant incident, direct access to the supervisory function (paragraph 31(c)).
- Protection. Protection against retaliation, discrimination and unfair treatment, and from commercial pressure on the officer's decisions (Articles 11(4) and 69(7)).
- Removal. Only after prior notification to the management body, with the supervisor informed of the removal and whether it relates to the AML tasks (Article 11(2)).
- Resources. Adequate staff and technology in proportion to size, nature and risks (Article 11(3)), and a dedicated AML/CFT unit where the scale requires it (paragraphs 16(a) and 22(c)).
- Overrides on record. Decisions taken against the officer's advice are justified and recorded, including on high-risk customers (paragraphs 23 and 43).
The guidelines add two practical points. The officer's suitability is assessed before appointment: reputation, honesty and integrity, AML skills and knowledge of the law, understanding of the business model's risks, relevant experience, and enough time and seniority (paragraph 36). And the function must continue if the officer is absent or their integrity is questioned, which means a deputy with the right skills (paragraph 37).
In Ireland the role also carries personal duties. The head of anti-money laundering and counter terrorist financing compliance is a pre-approval controlled function (PCF-52), so the appointment needs the Central Bank's approval, and the holder must meet the Additional Conduct Standards, including keeping the Central Bank promptly informed. Our guide to the Individual Accountability Framework sets out those duties and who else they bind.
What are the compliance officer's tasks?
The AMLR names the compliance officer in a set of specific duties: running the policies, procedures and controls day to day, including the implementation of targeted financial sanctions, and acting as the contact point for competent authorities (Article 11(2)); drawing up the business-wide risk assessment (Article 10(2)); drawing up the yearly implementation report (Article 11(6)); transmitting suspicious transaction reports to the FIU (Article 69(6)); and approving the content of the integrity and skills assessments of staff, agents and distributors (Article 13(1)), who must also tell the officer about any close relationship with a customer (Article 13(2)). Our guide to the AML business-wide risk assessment covers the first of the documents in detail.
EBA/GL/2022/05 describes the work in more depth, and it is a good job description to test against:
- Risk assessment framework. Develop and maintain the framework for business-wide and individual risk assessments, report the results to the management body and propose mitigating measures; new products, markets or activities should not start until the resources to manage their risks are in place (paragraphs 39 and 40).
- Policies and procedures. Set out the policies and controls, make sure they are implemented and kept up to date, and propose how to address legal changes and deficiencies (paragraphs 41 and 42).
- High-risk customers. Be consulted before senior management decides to take on or keep a high-risk customer; if senior management overrides the advice, it records the decision and how it will mitigate the risk (paragraph 43).
- Monitoring compliance. As the second line, monitor whether the measures comply with the firm's obligations, oversee the first line's controls, update the framework when deficiencies or new risks appear and recommend corrective measures (paragraphs 44 to 46).
- Reporting to the management body. Advise on compliance, assess the impact of legal changes and report areas to improve, progress on remediation and any shortfall in resources (paragraphs 47 and 48).
- Suspicious transaction reporting. Understand how the transaction monitoring system and its scenarios work, receive internal reports, prioritise them, record every evaluation and the FIU's feedback, report promptly, answer FIU requests fully and review why alerts were not escalated (paragraph 52).
- Training. Inform staff of the risks and typologies, oversee an ongoing training programme with an annual plan documented with HR, tailor training to roles, and set indicators to measure whether it works (paragraphs 55 to 60).
What must the annual activity report contain?
Paragraph 50 of EBA/GL/2022/05 lists the minimum content of the compliance officer's activity report, produced at least once a year, proportionate to the business and ready to share with the competent authority (paragraph 49). The report may reuse information already sent to the authorities in other reports.
| Part | Items in paragraph 50 |
|---|---|
| The risk assessment | (a) main findings of the business-wide risk assessment; (b) changes to the method for individual customer risk profiles; (c) customers by risk category, with the number of files whose reviews are outstanding; (d) statistics: unusual transactions detected and analysed, reports to the FIU by country, relationships ended for AML reasons, and requests from the FIU, courts and law enforcement |
| Resources | (e) the organisation of the function and significant changes; (f) the human and technical resources allocated; (g) outsourced AML processes and how they are overseen |
| Policies and procedures | (h) measures and procedures adopted and shortcomings identified; (i) compliance monitoring actions and the adequacy of monitoring tools; (j) training completed and next year's plan; (k) the function's plan for next year; (l) audit findings and progress on them; (m) supervisory activity, breaches, sanctions and the state of remediation |
The report only works if the management body acts on it. The supervisory function reviews it at least once a year and assesses whether the compliance function works, taking audit conclusions and resources into account (paragraph 13(c) and (d)), and the management function reviews it too (paragraph 16(c)). From 10 July 2027, Article 11(6) of the AMLR adds the yearly report on the implementation of the policies, drawn up by the compliance officer and submitted by the compliance manager. Building one document that meets both lists is the efficient answer.
Can compliance officer tasks be outsourced?
Operational tasks can be, where national law permits it, under principles in paragraph 68 of EBA/GL/2022/05: the firm keeps the ultimate responsibility, rights and obligations sit in a written agreement, the firm oversees the quality of the service, and intra-group outsourcing follows the same rules. Strategic decisions are never outsourced: approving the business-wide risk assessment, deciding the internal organisation of the AML framework, adopting policies and procedures, approving the customer risk methodology and the assignment of risk profiles, and approving the criteria for detecting suspicious or unusual transactions. The firm also stays responsible for the decision to report to the FIU. The compliance officer monitors the provider's performance, runs regular controls and reports on the outsourcing in the activity report (paragraph 70), and a firm with no staff of its own beyond a management body may outsource the whole function to a provider with relevant experience (paragraph 71).
From 10 July 2027, Article 18 of the AMLR applies to any outsourcing of AML tasks: the supervisor is notified before the provider starts, the firm stays fully liable, and six tasks can never be outsourced, which closely track the EBA's list. Our guide to performing a third-party risk assessment covers the due diligence on the provider.
How does the role work in a group?
Article 16(2) of the AMLR places compliance functions at group level: a group compliance manager and, where the activities at group level justify it, a group compliance officer, with the decision on the extent of those functions documented. The group compliance manager reports regularly to the parent's management body and at least once a year on the implementation of the group-wide policies. Under EBA/GL/2022/05 the parent designates a group member of the management body responsible for AML/CFT and a group compliance officer (paragraph 79). The group officer coordinates the entities' business-wide risk assessments, drafts the group-wide assessment and sets group standards (paragraph 81), produces a yearly group activity report with consolidated statistics (paragraph 82), and each entity's compliance officer has a direct reporting line to the group officer (paragraph 83).
What changes on 10 July 2027?
Four changes matter most. The compliance officer becomes mandatory for every obliged entity, with combination of roles as the proportionate option. The management body member responsible for AML becomes the compliance manager, with duties written into the Regulation. Removing the officer becomes a notified event, which makes an undocumented exit a supervisory issue. And the yearly implementation report moves into the Regulation itself. Under Annex VI of the AMLR, Article 46(4) of the Directive corresponds to Article 11(1), so a firm that already has a responsible board member is relabelling that appointment and adding the duties around it. The wider set of AMLR duties is in our guide to AMLR requirements.
What evidence shows the role works?
Keep these records, and you can answer the questions a supervisor asks about the function:
- the management body minutes appointing the compliance manager and the compliance officer, with the role descriptions;
- an organisation chart showing the officer's reporting line and independence from the business lines;
- the suitability assessment of the officer and the deputy arrangement;
- the resource plan for the function and any request for more resources;
- the activity report, the management body minutes discussing it and the supervisory function's yearly assessment of the function;
- the record of decisions taken against the officer's advice, with the justification;
- the log of internal reports, evaluations and FIU submissions with their dates;
- the training plan, completion records and effectiveness indicators;
- for outsourced tasks, the agreement, the supervisor notification and the officer's oversight records;
- if the roles are combined, the written reasons why size and risk justify it.
Our guide to collecting audit evidence explains how to keep a record like this current.
What the other results get wrong
We checked the pages that rank for AML compliance officer requirements against Article 11 of the AMLR and EBA/GL/2022/05.
- The wrong name for the board role. Morling Consulting's analysis of AMLR Articles 10 to 12 says obliged entities "must appoint a Chief Compliance Officer (CCO), who must be a member of the management body in its managerial function". Article 11(1) calls that role the compliance manager, and Article 11(2) makes the compliance officer a separate appointment. Many firms use "chief compliance officer" for a head of compliance below board level, so the label invites the wrong appointment.
- A threshold that does not exist. FluxForce's AMLR page says firms must "appoint a dedicated compliance officer at management level for entities above specific thresholds". Article 11 has no size threshold: every obliged entity has a compliance officer, and only combining it with the compliance manager role depends on size and risk.
- The 2022 rule presented without the 2027 one. Paytechlaw's summary of the EBA guidelines says the compliance officer is required "unless the appointment of the latter would not be justified in terms of proportionality", and Ripjar's says the appointment "should be proportional to a firm's compliance needs". That is the EBA's position under the Directive, and it still applies today. Neither page tells the reader that from 10 July 2027 Article 11(2) requires every obliged entity to have a compliance officer and adds the compliance manager.
- The wrong jurisdiction. V-Comply's guide, one of the longest pages for the query, frames the role around US programmes, saying that "appointing a BSA/AML or AML compliance officer is a required part of the AML compliance program", and does not cite Article 11 or EBA/GL/2022/05 at all.
Where do you stand?
Fill this in for your firm. Each blank is a question a supervisor will ask.
| Question | Your answer | Source |
|---|---|---|
| Who is the compliance manager, and which minute appointed them? | Art. 11(1) | |
| Who appointed the compliance officer, and what is their position in the hierarchy? | Art. 11(2); para 25 | |
| Does the officer report to anyone who manages a business line? | Para 31(a) | |
| Can the officer reach the supervisory function directly, and has it happened? | Art. 11(5); para 31(c) | |
| When did the supervisory function last assess the compliance function? | Para 13(d) | |
| Does the last activity report cover all thirteen items in paragraph 50? | Para 50; Art. 11(6) | |
| Where are decisions against the officer's advice recorded? | Paras 23, 43 | |
| Who deputises for the officer, and are they trained? | Para 37 | |
| If the roles are combined, where are the reasons written down? | Art. 11(7); para 33 |
How Venvera supports the role
Venvera gives the compliance officer and the compliance manager one place for the programme they share: every requirement, owner, task, deadline and piece of evidence in one dashboard instead of Outlook, Excel and mail chains. The AML/CFT module tracks the compliance manager, the officer's appointment, standing, protection, reporting lines, resources and yearly report as separate requirements with their articles and EBA paragraphs; its gap assessment opens with the governance questions an inspection tests; an AML/CFT compliance officer charter is among its 11 policy templates; and the activity report and the supervisory function's yearly assessment sit on the compliance calendar as recurring obligations with owners and dates. The board report gives the management body the status of the programme in one view.
You can start a 14-day Professional trial without a credit card, book a demo to walk through the governance requirements with your own questions, or begin with the free compliance check. Plans and prices are on the pricing page.
Frequently asked questions
Is an AML compliance officer mandatory in the EU?
From 10 July 2027, yes, for every obliged entity: Article 11(2) of the AMLR says obliged entities shall have one. Until then, EBA/GL/2022/05 expects credit and financial institutions to appoint a separate officer unless they are sole traders, have very few staff or document reasons not to, and national law may go further.
What is the compliance manager under the AMLR?
A member of the management body in its management function who is responsible for compliance with the AMLR, makes sure the policies fit the risks and are resourced, receives information on significant weaknesses and submits the yearly implementation report to the management body (Article 11(1) and (6)).
Can the compliance manager and the compliance officer be the same person?
Yes, where the nature of the business, its risks and complexity and its size justify it (Article 11(7)). Write down the reasons. Where a firm's activities are carried out by one natural person, that person performs all the tasks.
Who appoints the AML compliance officer?
The management body in its management function (Article 11(2)). Under EBA/GL/2022/05 the suitability of the candidate is assessed before the appointment (paragraph 36).
Can the compliance officer be removed?
Yes, but only after prior notification to the management body, and the firm must notify the supervisor of the removal and say whether it relates to the AML tasks. The officer may also give the supervisor information about the removal (Article 11(2)).
Who does the AML compliance officer report to?
Directly and independently to the management body in its management function and, where there is one, in its supervisory function (Article 11(5)). Day to day, the main contact is the compliance manager, or today the management body member responsible for AML/CFT (EBA/GL/2022/05, paragraph 23).
Does the compliance officer file suspicious transaction reports?
Yes. Article 69(6) of the AMLR makes the compliance officer transmit the reports to the FIU of the Member State where the firm is established, and Article 69(7) protects everyone involved from retaliation.
What must the annual activity report contain?
Under paragraph 50 of EBA/GL/2022/05: the risk assessment findings, customer risk categories with outstanding reviews and suspicious activity statistics; the organisation, resources and outsourcing of the function; and the measures taken, monitoring, training, next year's plan, audit findings and supervisory activity.
Can the compliance officer role be outsourced?
Operational tasks can be, where national law allows, with the firm keeping responsibility and strategic decisions in-house (EBA/GL/2022/05, paragraphs 68 to 73). From 10 July 2027, Article 18 of the AMLR requires prior notice to the supervisor and lists six tasks that can never be outsourced.
Does the compliance officer have to work in the country where the firm is established?
Normally yes, so the officer is available to the competent authority and the FIU. Working from another jurisdiction is possible where it matches the risk and national law permits it, with access to all systems and availability to meet the authorities without delay (EBA/GL/2022/05, paragraphs 28 and 29).
Is the MLRO the same as the AML compliance officer?
In many firms, yes: MLRO is a common title for the person who receives internal reports and files suspicious transaction reports. The AMLR attaches the duties to the compliance officer role, so whoever holds them, under any title, must meet Article 11.
Can one compliance officer serve several companies in a group?
Under the AMLR, a group entity may appoint as its compliance officer someone who performs that function in another group entity, where its size and the low risk of its activities justify it (Article 11(2)). Today, EBA/GL/2022/05 allows an officer to act for several entities only within the same group (paragraph 35).
Primary sources
- Regulation (EU) 2024/1624 (AMLR), OJ L of 19 June 2024
- EBA/GL/2022/05, Guidelines on the role of the AML/CFT compliance officer
- Directive (EU) 2015/849 (the Directive in force until 10 July 2027)
- AMLA and EBA, press release: handover of AML/CFT mandates completed (19 January 2026)
- EBA/GL/2021/02, ML/TF Risk Factors Guidelines (final report)
- Directive (EU) 2024/1640 (AMLD), OJ L of 19 June 2024
Checked against Article 11 and the related articles of Regulation (EU) 2024/1624, EBA/GL/2022/05 and Directive (EU) 2015/849 on 19 October 2026. National law may add requirements, such as a pre-approval of the compliance officer by your supervisor; check yours.
