What Does the AMLR Require of Automated Decisions?

From 10 July 2027, the EU Anti-Money Laundering Regulation (AMLR) allows financial institutions to make customer due diligence (CDD) decisions using automated processes, including AI, on three conditions. Under Article 76(5):

1. The data processed is limited to data obtained through CDD.

2. Certain decisions (entering/refusing/maintaining a relationship, carrying out/refusing an occasional transaction, and increasing/decreasing the level of CDD measures applied) are subject to “meaningful human intervention to ensure the accuracy and appropriateness of such a decision”.

3. The customer may obtain an explanation of the decision and challenge it, except in relation to a suspicious transaction report.

The third condition is the hardest to meet after the fact. An explanation can only be as good as the record made when the decision was taken, and the AMLR does not define what an adequate explanation must contain.

The decisions named in Article 76(5)(b) can be broken down into five categories, each a different stress test.

1. Entering a Business Relationship: Can You Explain the Risk Rating Behind an Approval?

When an automated system assigns a new customer’s initial risk rating, could you show which CDD data drove that rating? Article 76(5)(a) limits processing to “data obtained pursuant to Chapter III”, the regulation’s CDD chapter.

An approval is only as explainable as its CDD. If onboarding information is incomplete, outdated, or held only as model inputs, the risk rating cannot be explained. Records should show what was collected, how it was assessed, and why that rating followed. In complex, high-risk cases, Silent Eight’s Expert CDD Agent closes this gap by documenting the reasoning behind each assessment, so the rating can be explained.

2. Refusing a Business Relationship: Would “The System Flagged You” Be Enough?

Refused customers are the most likely to ask why, often after a screening hit. Do the reasons reflect their circumstances or a model output?

European Banking Authority (EBA) guidelines expect firms to have “considered and rejected all possible mitigating measures” before refusing, and to document each refusal “and the reason for doing so”.

In Jenec (2026), the Court of Justice of the EU (CJEU) held that a US sanctions listing alone did not justify refusing a basic payment account. The case concerned a basic account and a non-EU listing, but the lesson holds: refusals need an individual assessment, not just an automated flag.

3. Maintaining or Ending a Relationship: Was the Human Review Defensible?

Periodic reviews, at least yearly for higher-risk customers (AMLR Article 26), often end with a person approving an automated recommendation. If challenged, could you defend it as the reviewer’s own decision?

The AMLR does not define “meaningful human intervention”, but Anti-Money Laundering Authority (AMLA) guidelines suggest what defensible oversight of automated alert closure involves: decision logic that “can be understood and documented”, and “effective human oversight, including periodic validation through sampling”.

In SCHUFA (a 2023 credit scoring case involving a German credit reference agency), the CJEU found that where a lender “draws strongly” on an automated score, the score itself can count as the decision. A defensible review records what the reviewer saw, changed, and why.

4. Carrying Out or Refusing an Occasional Transaction: Can the Explanation Be Rebuilt Later?

Article 76(5)(b) also covers decisions to carry out or refuse an occasional transaction, and the explanation right applies to them. Often made in real time, they are harder to explain later.

After weeks, could you reconstruct why a transaction was refused, using the data and model version in place at the time? If the model has since been retrained or its thresholds recalibrated, the explanation must reflect the decision as it was made, not as the system would make it today. That requires the same record as slower decisions: inputs, model version, outcome, and any human action.

5. Increasing or Decreasing CDD Measures: The Decision That Is Easy to Overlook

Article 76(5)(b) lists increasing or decreasing CDD measures alongside refusals and exits, so an automated move to enhanced due diligence, or back down, carries the same three conditions.

These changes rarely feel like decisions about the customer, as they are usually triggered by a rule, a score, or a change in data. But extra information requests or closer scrutiny can affect the relationship, and the customer may ask why.

Would your team even recognise this as an in-scope decision? Every automated trigger that changes a customer’s CDD level should be mapped as a decision the customer could ask about.

What Shouldn’t Be Explained?

Under Article 76(5)(c), the customer’s right to an explanation does not apply “in relation to a report as referred to in Article 69”, which details suspicious transaction reporting. This is a place the AMLR limits explanation rather than requiring it, often for the exits customers are most likely to question. In addition, Article 73 prohibits tipping off: telling a customer that such a report has been or may be made.

The two can collide. The facts behind an exit may also prompt a report, and the customer can ask about the exit but must not learn of the report. Explanation and reporting records should be kept separate, and explanations checked for anything that could tip off.

How Ready Are You for July 2027?

Stress test checklist:

• Is the data limited to CDD information?

• Can you evidence a human intervention that could have changed the outcome?

• Could the customer understand the explanation and use it to challenge the decision?

• Is anything in the explanation at risk of tipping off?

Key takeaways:

• Article 76(5)(b) covers five decision types, including changes to CDD measures that are easy to overlook.

• An automated flag needs an individual assessment behind it.

• EBA guidelines already require refusals and terminations to be documented with reasons; the AMLR makes those reasons answerable to the customer.

• Suspicious transaction reports sit outside the explanation right, so explanation and reporting records must be kept apart.

Silent Eight’s Iris platform is designed with this in mind: every decision carries a natural-language rationale and a structured evidence trail, within policy boundaries set by the compliance team. Decisions that meet predefined conditions, or fall outside those boundaries, are escalated for human review.