Sizing customer due diligence refresh under the AMLR's one-year and five-year ceilings, tier by tier, in analyst-days rather than files.
Divide each risk tier by its review interval, then divide the reviews by the throughput of that tier, not of the book. On an illustrative 250,000-customer portfolio, a one-year cycle for high risk, three years for medium and five for low gives 65,000 reviews a year and 103.1 analysts. The 4 per cent of customers rated high risk generate 60.6 per cent of the effort.
Worked in full in The EU AML Handbook by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
The AMLR, Regulation (EU) 2024/1624, which applies from July 2027, sets ceilings on how long customer information may go without an update: one year for higher-risk customers and five years for all others. Firms are free to review more often, and most choose an intermediate cycle for a medium tier. Ceilings are easy to read and easy to cost wrongly, because the number of reviews and the work in them are driven by different customers.
| Risk tier | Share | Customers | Interval, years | Files per day |
|---|---|---|---|---|
| High | 4% | 10,000 | 1 | 0.8 |
| Medium | 21% | 52,500 | 3 | 4.0 |
| Low | 75% | 187,500 | 5 | 10.0 |
| Book | 100% | 250,000 |
An analyst has 200 productive days a year and costs €85,000 fully loaded. A high-risk file is an enhanced due diligence review: source of wealth, adverse media, ownership refreshed, senior sign-off. Less than one a day is a realistic pace. A low-risk refresh that is largely data confirmation runs at ten.
Reviews a year = customers in tier ÷ interval
Analyst-days = reviews ÷ files per day, and analysts = analyst-days ÷ 200
In Excel, per tier row: =Customers*Share/Interval, then =Reviews/PerDay, summed and divided by Days.
| Tier | Reviews a year | Share of reviews | Analyst-days | Share of effort | Analysts |
|---|---|---|---|---|---|
| High | 10,000 | 15.4% | 12,500 | 60.6% | 62.5 |
| Medium | 17,500 | 26.9% | 4,375 | 21.2% | 21.9 |
| Low | 37,500 | 57.7% | 3,750 | 18.2% | 18.8 |
| Total | 65,000 | 100% | 20,625 | 100% | 103.1 |
That is about 5,417 reviews a month, a standing team of 103.1 analysts and roughly €8.77m a year, before quality assurance and second-line review. The two shares tell the story. Low-risk customers are 57.7 per cent of the reviews and 18.2 per cent of the work. High-risk customers are the reverse: 15.4 per cent of the reviews, 60.6 per cent of the work. Per customer per year, a high-risk relationship costs 62.5 times the analyst time of a low-risk one, because it is reviewed five times as often and each review takes twelve and a half times as long.
| Case | Reviews a year | Analysts | Cost, €m |
|---|---|---|---|
| High risk 2% of the book | 61,000 | 72.4 | 6.15 |
| High risk 4% (base) | 65,000 | 103.1 | 8.77 |
| High risk 6% | 69,000 | 133.9 | 11.38 |
| High risk 8% | 73,000 | 164.6 | 13.99 |
| Medium tier every 2 years | 73,750 | 114.1 | |
| Medium tier every 5 years | 58,000 | 94.4 |
Each percentage point of the book moved into the high tier, 2,500 customers, adds 15.4 analysts and €1.31m a year, while adding only 2,000 reviews to a total of 65,000. The medium interval, which looks like the main policy choice, matters far less: stretching it from three years to the five-year ceiling saves 8.8 analysts. EDD throughput matters as much as either. At 0.5 files a day the team is 140.6; at 1.2 it is 82.3.
So the lever on a periodic review budget is the risk model, not the review calendar. A scoring change that drifts the high tier from 4 to 6 per cent costs more than doubling the medium-tier frequency, and it is usually approved as a methodology change rather than a resourcing decision.
The calendar still has a role. A firm that reviews its medium tier every three years rather than every five is buying earlier detection of change in 52,500 relationships, and the table shows the price of that choice: 8.8 analysts. That is a defensible line in a risk appetite statement. What is not defensible is approving the calendar without the throughput beside it, because the same board paper will then be silent on the high tier, where the team actually sits.
The quick estimate takes the whole book, divides by the five-year maximum and costs the result at the standard refresh rate: 250,000 ÷ 5 = 50,000 reviews, at ten a day, 5,000 analyst-days, 25.0 analysts. The review count is only 23 per cent light. The team is 4.1 times too small, because the estimate counts files rather than effort, and the effort is concentrated in the tier with the fewest files. A budget built that way is not slightly wrong; it simply leaves the enhanced due diligence unfunded.
A second trap, on the calendar. A file refreshed during a back-book remediation starts its clock on the day it is refreshed. Clear a back book in one year and the whole cohort falls due again together, so the load turns lumpy: some years run well above the steady-state figure and others below it, unless reviews are pulled forward to smooth it, which raises the average.
Size periodic review tier by tier, in analyst-days, and present the team beside the high-risk share that drives it. On these figures the answer is 65,000 reviews and 103.1 analysts, three-fifths of them doing enhanced due diligence on one customer in twenty-five. The free companion workbooks for the book size the back book that comes before this steady state, and a related article works out when a remediation plan has to be triggered.
The AMLR sets maximum intervals: at least once a year for higher-risk customers and at least once every five years for all others, with firms free to review more often. On an illustrative 250,000-customer book with a three-year medium tier, those ceilings produce 65,000 reviews a year, about 5,417 a month.
Convert reviews to analyst-days tier by tier. Here 10,000 high-risk reviews at 0.8 files a day take 12,500 days, 17,500 medium at four a day take 4,375 and 37,500 low at ten a day take 3,750. The 20,625 days, at 200 productive days each, need 103.1 analysts, costing about 8.77 million euros.
The share of customers rated high risk. Each extra percentage point, 2,500 customers here, adds 15.4 analysts and 1.31 million euros a year because enhanced reviews are annual and slow. Stretching the medium tier from three years to five saves only 8.8 analysts by comparison.
This article is one calculation from The EU AML Handbook. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: regulation, compliance and banking → · All 324 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.