That is the initial scope assessment, but I always also see AMLR as a broader transformation program rather than simply a compliance project.

Yes, I agree.

And this is not just about updating policies.

Firms should review governance arrangements, management accountability, risk management frameworks, customer due diligence processes, group-wide controls, outsourcing arrangement, and compliance operating models.

Particular attention should also be paid to the development RTS and guidelines in areas such as customer due diligence, group-wide controls, and outsourcing.

as these will likely drive much of the practical implementation effort.

Many businesses that have not historically viewed themselves as part of the AML ecosystem may now find themselves squarely within it.

My key takeaway is that AMLR should not be viewed as another regulatory update.