AML deadline · Anti-money laundering and know your customer (KYC)
Your AML and KYC framework, measured requirement by requirement and turned into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
AML deadline · Anti-money laundering and know your customer (KYC)
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One EU AML package 2024: regulation (EU) 2024/1624, directive (EU) 2024/1640 (AMLD6), regulation (EU) 2024/1620 establishing AMLA assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism, a level, a level above, and the action linking the two, that turns an observation into a trajectory.
Are customer files reviewed periodically at a frequency dependent on risk level?
- N1
No organised periodic review. Files are updated only when an alert or transaction makes it necessary.
- N2
A frequency rule exists in the procedure, but it is not tooled. Reviews are carried out unevenly across portfolios and teams.
- N3
Reviews are scheduled by risk level and tracked in a system. The overdue backlog is identified and subject to a reduction plan.
- N4
Review deadlines are met, reviews are also triggered by events, and the rate of up-to-date files is an indicator tracked by management.
- N5
Frequencies are recalibrated periodically based on review findings and alerts, with a documented record of adjustments and a review of their relevance.
Action to move from L2 to L3
Extract the population of files by risk level, calculate review deadlines and load the schedule into the customer relationship management system, then add the rate of overdue files to the monthly compliance committee agenda.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon AML.
What this framework covers
The anti-money laundering and counter-terrorist financing framework rests on a precise chain of obligations: a documented risk-based approach, an up-to-date risk classification, due diligence measures at onboarding and throughout the relationship, identification of beneficial owners, sanctions and politically exposed persons screening, transaction monitoring, suspicious activity reporting to the financial intelligence unit, record-keeping and staff training. The 2024 EU package turns this into a directly applicable foundation, with a single regulation and a European supervisory authority.
In practice, this framework is hard to steer. Obligations are split between compliance, business lines, operations and IT, and no one holds a consolidated view of the level of control. Is the risk classification actually used to modulate due diligence, or does it remain an annual document? Are older customer files updated on a set frequency, or only when an alert arises? Are alerts from transaction monitoring handled within a controlled timeframe, with the decision traceable? When several entities and countries are involved, inconsistency becomes the norm.
Regulation (EU) 2024/1624 harmonises points previously left to national transposition: thresholds, enhanced due diligence measures, the scope of obliged entities, access to beneficial ownership registers. AMLA, based in Frankfurt, will exercise direct supervision over certain entities and indirect supervision over the rest. One common confusion is worth clearing up: KYC is not the AML framework. Customer knowledge is its documentary foundation, but transaction monitoring, screening, suspicious activity reporting and governance make up the other half, and it is often the least well-equipped.
A compliance audit concludes with a gap or a pass: the procedure exists, is documented, is applied. A maturity assessment asks a different question: what level of control does each practice sit at, and what specific action moves it to the next level. An internal control that checks whether a risk classification exists does not say whether it actually drives the intensity of due diligence. The assessment does, and it costs the effort needed to get there.
In Datamensio, the framework is ready to use and adaptable. The AI adjusts the themes, questions and levels to your sector (banking, insurance, payments, digital assets, non-financial obliged professions), or builds a variant from your existing procedures and risk classification.
Reference standard: EU AML package 2024: regulation (EU) 2024/1624, directive (EU) 2024/1640 (AMLD6), regulation (EU) 2024/1620 establishing AMLA
The themes assessed
Governance and organisation of the framework
Roles and responsibilities, appointment of the compliance officer and reporting officer, involvement of the management body, resources allocated, alignment between group and subsidiaries.
Risk assessment and classification
Entity-wide risk assessment, criteria used (customers, products, distribution channels, geographic areas), update frequency, actual use to modulate due diligence.
Customer identification and verification
Collection and verification of identity, identification of beneficial owners, use of registers, remote onboarding, quality and completeness of data.
Enhanced due diligence and special cases
Politically exposed persons, high-risk third countries, correspondent banking relationships, complex or unusual transactions, hierarchical validation of sensitive onboarding.
Ongoing due diligence and file reviews
Review frequency by risk level, event-triggered reviews, handling of the backlog of incomplete files, updating knowledge of the customer’s activity.
Sanctions and embargo screening
Scope and frequency of screening, quality of configuration, handling of name matches, time to process hits, incorporation of list updates.
Transaction monitoring and alert management
Detection scenarios and their review, threshold calibration, alert volume and backlog, traceability of closure or escalation decisions.
Suspicious activity reporting and cooperation
Chain from internal flagging to filing, timeframes, quality of the accompanying analysis, response to authority requests, asset freezing, confidentiality of the report.
Training and awareness
Coverage of exposed populations, content tailored to business lines, frequency, measurement of learning, awareness for new joiners and distribution networks.
Control, record-keeping and continuous improvement
First and second-line controls, permanent control plan, record-keeping and accessibility, follow-up of recommendations, reporting to the management body.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does this assessment count as a compliance attestation for the supervisor?
No. Datamensio measures the maturity of your framework and prepares you for supervision, it does not issue any attestation. The output is a documented baseline and an action plan, usable as an internal working document and as a basis for discussion with your supervisors.
What is the difference between a maturity assessment and a compliance check?
A compliance check verifies the presence and application of a requirement, and concludes with a gap or pass. The assessment places each practice on a progressive scale and states the action that moves it up a level. The two are complementary: the assessment prepares and prioritises, the check validates.
How long does the assessment take?
The short version can be completed in one working session. The full version involves several contributors, compliance, operations, IT, and spans one to two weeks. Most of the time goes into gathering evidence from the teams.
Is the framework adaptable to our business?
Yes. You can change the questions, levels and themes, or start from your own procedures: the AI then builds a variant suited to your sector and your risk classification. You retain full control of the framework.
How can we compare several subsidiaries or countries?
The assessment can be run on each business unit with the same framework, then compared theme by theme. A cross-entity roadmap consolidates common gaps and avoids duplicating actions, even when entities fall under different supervisors.
Does the 2024 AML package change the content of the framework?
The framework incorporates the requirements of regulation (EU) 2024/1624 and directive (EU) 2024/1640, notably on beneficial owners, enhanced due diligence and AMLA supervision. The themes remain stable: it is the expected levels that rise.
Is KYC enough to cover AML obligations?
No. Knowing your customer is the documentary foundation of the framework. Transaction monitoring, sanctions screening, suspicious activity reporting and governance make up the other half, and these are often the themes with the lowest scores.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European solutions.