Part 3 of 3.
Parts 1 and 2 covered the three final draft RTS, CDD and linked transactions. This final part looks at groups, evidence and what to do next.
TL;DR: For cross-border groups, the challenge goes beyond centralising a policy. The group needs a consistent view of the customer, the risk and the investigation across entities. And when evidence sits in separate systems, the investigator becomes the integration layer. You can start on seven practical steps now, whatever the final text says.
What does the group-wide RTS mean for cross-border firms?
For groups, the issue goes beyond centralising a policy. The draft covers group-wide policies and controls, information sharing, governance, and what happens when third-country law restricts the application of group requirements.
Where such an impediment exists, the draft expects the firm to inform its supervisor without undue delay and no later than 28 calendar days after identifying it.
The practical question is whether the group can produce a consistent view of the customer, the risk and the investigation across entities. A well-written global policy can sit on top of different systems, different data fields and different local case histories. The new framework makes those seams easier to see.
Where does investigation evidence become critical?
Identifying a new obligation is often the easy part. Proving it was applied correctly in a particular case is harder. An investigator may need customer data, transactions, KYC/CDD records, screening results, earlier decisions, internal policy and regulatory guidance. When those sit in separate systems, the investigator becomes the integration layer.
That is the problem TechnoXander’s AML Investigation Platform is built around. It brings transactions, KYC/CDD, screening, prior cases and regulatory intelligence into one structured investigation workflow, with source traceability and an authorised human making the decision. Software shouldn’t replace compliance judgement. The useful test is whether it makes it easier to assemble the evidence that judgement depends on.
TechnoXander’s work with the CFIT coalition on economic crime gives a wider view of the same challenge, and the key learnings are summarised here.
Should firms wait for the RTS to become law?
No, but keep the legal position clear. These are final drafts submitted to the Commission, not adopted rules. Some work is unlikely to be wasted whatever changes:
- Create a requirements register. Map each RTS provision to a process, a system and a control owner.
- Map the data. Find where CDD, transaction, screening, ownership and case information actually lives.
- Test the investigator’s view. Open representative cases and see whether the required evidence is there without manual digging.
- Test linked transactions. Run historical patterns through your logic and check whether connected activity is identified consistently.
- Review group information flows. Find where local entities can’t access, share or reconcile the information group controls depend on.
- Plan customer remediation. Size the populations and the workload, counting from entry into force.
- Build the evidence trail. For each significant control, decide what you would need to show a supervisor: source, action, decision, reviewer and rationale.
The aim isn’t to guess the final text. It’s to find the expensive problems early.
What should financial crime teams do next?
Run a gap assessment that joins regulation to workflow. Don’t hand the RTS to Legal and Compliance alone. Put Operations, KYC, Transaction Monitoring, Financial Crime, Data, Technology and Internal Audit at the same table, then take one requirement at a time.
My view is that most programmes will spend their first months on policy wording and meet the data problems only when remediation starts. The firms that ask what data each requirement needs, and who can see it, will find those problems sooner.
That is when a regulatory text turns into an operating model. The firms that gain most won’t be the ones that rewrite policies first. They will be the ones that learn early how the new requirements change the work inside each case.
If you want to talk through how this applies to your firm, you can reach the TechnoXander team here.
This article is for general information and is not legal advice.
About Author:
