New Enhanced Due Diligence under Section 4 AMLR
Why Section 4 AMLR Is a Structural Break
Section 4 of Regulation (EU) 2024/1624 (AMLR) is not a refinement of existing enhanced due diligence (EDD).
It is a structural reset.
For the first time, EU law no longer treats EDD primarily as a risk-based option. Instead, it defines mandatory escalation, prohibition, continuation, and exit logic for entire categories of customers, relationships, and transactions.
Articles 34–46 AMLR collectively determine:
- When EDD is unavoidable
- Who must approve it
- How long it must apply
- When business relationships must end
- Which risks are no longer subject to internal discretion
For Compliance Managers and AML Officers, Section 4 is where professional accountability becomes operationally testable.
From Risk Assessment to Mandatory Action
The End of Pure Discretion
Under previous AML regimes, enhanced due diligence was often framed as:
Apply where higher risk is identified.
Section 4 AMLR fundamentally changes this logic.
High risk is now:
- Declared by law (e.g. PEPs, residence-by-investment applicants),
- Imposed by Union institutions (AMLA recommendations, Commission countermeasures),
- Triggered by transaction characteristics (complex, unusually large, purposeless),
- Derived from structural exposure (correspondent banking, crypto-asset flows, self-hosted wallets).
Once triggered, EDD is not optional, not deferrable, and not replaceable by lighter controls.
What “New EDD” Means in Practice
1. Mandatory Escalation and Governance
Section 4 hard-wires governance into AML execution:
- Senior management approval is required for:
- PEP relationships and transactions,
- continuation of certain high-risk relationships,
- correspondent banking exposure.
- Documentation is mandatory for:
- onboarding decisions,
- terminations,
- continuation despite elevated risk.
- Silence, delay, or informal tolerance becomes non-compliance.
EDD is no longer a compliance process.
It is a governance decision chain.
2. Prohibitions Replace Mitigation in Key Areas
Several risks are no longer “mitigable”:
- Shell institutions: absolute prohibition of correspondent relationships.
- Certain third-country risks: countermeasures may require limitation or termination.
- Deficient respondent institutions: default expectation is exit unless mitigation is provably sufficient.
This removes a common legacy defence:
“We mitigated the risk.”
In Section 4 AMLR, some risks must be avoided, not managed.
3. Expansion Beyond the Customer Perimeter
Enhanced due diligence now explicitly extends to:
- Correspondent institutions (banks and CASPs),
- Third-country supervisory quality,
- Family members and close associates of PEPs,
- Insurance beneficiaries,
- Former PEPs (with mandatory cooling-off),
- Self-hosted crypto-asset addresses.
Compliance is required to control networks, flows, and indirect access, not just individual customers.
4. Crypto-Specific EDD Is No Longer Exceptional
Section 4 ends the regulatory ambiguity around crypto risk:
- CASPs are subject to correspondent-style EDD.
- Self-hosted wallets are not banned—but must be identified, assessed, and mitigated.
- Reliance on third-party controls must be justified and reviewable.
- Sanctions-evasion risk is explicitly embedded.
Crypto EDD is no longer “emerging best practice”.
It is hard law.
PEP Risk: Lifecycle, Not Status
Articles 42–46 AMLR redesign PEP handling entirely.
Key changes:
- PEP status triggers mandatory EDD and senior management involvement.
- Official EU and Member State lists define prominent public functions.
- Beneficiaries of insurance policies are explicitly in scope.
- Former PEPs remain subject to EDD for at least 12 months, often longer.
- Family members and close associates are fully captured.
The core shift:
PEP risk is treated as persistent influence risk, not a binary flag.
Why Legacy EDD Frameworks Will Fail Inspections
Institutions relying on pre-AMLR EDD designs typically show:
- Inconsistent escalation logic,
- Weak documentation of continuation decisions,
- Over-reliance on vendor screening without legal alignment,
- Poor linkage between risk identification and governance action,
- No exit playbooks for forced termination scenarios.
Under Section 4 AMLR, these are no longer weaknesses.
They are clear breaches.
Supervisory reviews will focus on:
- Timing,
- Documentation,
- Approval evidence,
- and decision rationales—not intentions.
What Compliance Must Redesign Now
To remain defensible under Section 4 AMLR, institutions must:
- Re-map EDD triggers from “risk indicators” to legal obligations.
- Embed senior management approval into workflows, not policies.
- Define continuation vs. termination logic for high-risk relationships.
- Operationalise PEP lifecycle management, including post-mandate risk.
- Integrate crypto-specific EDD controls, including self-hosted wallets.
- Prepare AMLA-response playbooks for recommendations and countermeasures.
- Ensure audit-grade documentation for every EDD decision.
This is not an IT exercise.
It is a control-architecture redesign.
Conclusion: Section 4 AMLR as the New Compliance Stress Test
Section 4 AMLR is where regulators will test whether AML frameworks actually work under pressure.
Not through abstract risk assessments, but through:
- real customers,
- real payments,
- real correspondent exits,
- real PEP relationships,
- and real crypto flows.
For Compliance Managers and AML Officers, the question is no longer:
“Did we assess the risk?”
It is:
“Can we prove that we escalated, approved, mitigated, or exited exactly as the Regulation requires?”
Under the new Enhanced Due Diligence regime, defensibility is the product.