Reporting suspicions — AMLR Article 69 and its clocks

Article 69 replaces twenty-seven national versions of the reporting duty with one, and it carries clocks that most national regimes never wrote down. From 10 July 2027, Regulation (EU) 2024/1624 (the AMLR) requires obliged entities — and, where applicable, their directors and employees — to cooperate fully with the FIU by promptly reporting suspicions on their own initiative, and by answering FIU requests within 5 working days, a period the FIU may shorten to less than 24 hours in justified and urgent cases. This guide sets out the test, every clock that runs around a report, and how a payments firm builds a process that survives the shortest of them.

1. The reporting test

Article 69(1)(a) triggers the duty where the obliged entity knows, suspects or has reasonable grounds to suspect that funds or activities — regardless of the amount involved — are the proceeds of criminal activity, or are related to terrorist financing or criminal activity. The same point also obliges the entity to answer the FIU’s follow-up requests for additional information on the case.

The third subparagraph of Article 69(1) widens the perimeter in two directions that national practice often missed: attempted transactions must be reported, and so must suspicions arising from the inability to conduct customer due diligence. A firm that only reports executed transactions is under-reporting by design.

2. How the assessment must be built

Article 69(2) is new in that it describes the assessment itself. Obliged entities must assess customer transactions and activities against any relevant fact and information known to them or in their possession, and, where necessary, prioritise the assessment by the urgency of the transaction and the risks affecting their Member State.

A suspicion must then rest on identifiable grounds. The article lists them: the characteristics of the customer and of their counterparts; the size and nature of the transaction or activity; its methods and patterns; links between several transactions; the origin, destination or use of funds; and the consistency of the activity with the information gathered under Chapter III — including the customer’s risk profile. In practice this gives you the structure of an alert disposition note: each closed alert should say which of these grounds was examined and what was found.

Two further points shape the operating model. Article 69(6) makes the compliance officer appointed under Article 11(2) the person who transmits reports to the FIU of the Member State where the transmitting entity is established. And Article 69(7) requires the firm to protect that officer — and any employee, agent or distributor involved in the reporting tasks — against retaliation, discrimination or other unfair treatment.

3. The clocks, side by side

Around a single report several deadlines run, set partly by the AMLR and partly by the Sixth AML Directive, Directive (EU) 2024/1640 (AMLD6), which national law will transpose. The table collects them.

The FIU-request clock is the one to design for. A deadline that can drop below 24 hours cannot be met by a process that depends on one named individual, a weekly extraction job or a manual pull from a payment processor. Retrieval capability is separately mandated by Article 78, which requires systems enabling a full and speedy response to enquiries about whether a business relationship exists or existed during the preceding five years, and its nature.

AMLD6 also requires that, where a suspension is based on a report under Article 69, it is imposed on the obliged entity within the Article 71 period. The 3-working-day window is therefore when the FIU decides whether to stop the payment, not a grace period.

4. Refraining, and the three-working-day rule

Article 71(1) obliges entities to refrain from carrying out transactions they know or suspect to be related to proceeds of criminal activity or terrorist financing until they have submitted the report and complied with any further specific instructions from the FIU or another competent authority.

The release valve sits in the same paragraph: entities may carry out the transaction after assessing the risks of proceeding if they have not received instructions to the contrary from the FIU within 3 working days of submitting the report. Proceeding is permitted after an assessment, not automatically when the clock expires, and that assessment should be recorded with the case.

Article 71(2) covers the practical exception: where refraining is not possible, or would be likely to frustrate efforts to pursue the beneficiaries of a suspected transaction, the entity must inform the FIU immediately after carrying it out. For a payments firm, the typical case is a payment detected as suspicious only after it has settled, or one whose sudden hold would alert the customer to the investigation.

5. Three worked scenarios

Scenario one — the onboarding that stops at source of funds. A business applicant opens a payment account. Before verification is complete, a third party attempts an inbound transfer of a five-figure amount. When the firm asks for the source of funds and the ownership chain, the applicant withdraws the application. Rule: Article 69(1), third subparagraph — suspicions arising from the inability to conduct due diligence and attempted transactions are reportable. What the analyst does: records the facts against the Article 69(2) grounds (counterparty unknown to the profile, purpose unexplained, withdrawal at the due-diligence question) and escalates to the compliance officer. Outcome: a report is filed although the account never went live; the incoming funds are handled under the firm’s returns procedure without telling the applicant why.

Scenario two — an outgoing payment the monitoring catches before execution. A long-standing customer instructs a large transfer to a newly added beneficiary in a high-risk jurisdiction, immediately after a run of small inbound credits from unrelated payers. Rule: Article 71(1) — refrain until reported. What compliance does: holds the payment, files promptly and diarises the 3-working-day point. If the FIU suspends the transaction under national law transposing AMLD6 Article 24(1), the hold continues for the period it sets. Outcome: if no instruction arrives, the firm assesses the risk of proceeding — the customer’s explanation, whether new information has emerged — and records whether it releases, rejects or exits.

Scenario three — a Friday afternoon FIU request with a 24-hour deadline. The FIU asks for all transactions over the past twelve months on four accounts, plus device and login data. Rule: Article 69(1)(b) and the third subparagraph — the FIU has shortened the 5-working-day default. What the firm does: the on-call deputy to the compliance officer runs a pre-built extraction, checks it against the account list, and transmits through the FIU’s channel. Outcome: the deadline is met because the extraction was rehearsed; a firm relying on an engineering ticket would not have made it.

6. Safe harbour, tipping-off and shared reports

Article 72 protects good-faith disclosures: a report under Articles 69 or 70 is not a breach of any contractual or legal disclosure restriction, and it does not create liability even where the reporter did not know the underlying crime precisely or no illegal activity actually occurred.

Article 73(1) prohibits disclosing to the customer or third parties that activity is being or has been assessed, that information has been or will be transmitted, or that an analysis may be carried out. Article 73 then sets out the exceptions: disclosure to supervisors and for investigations; within a group that complies with group-wide policies; and, for credit and financial institutions, between obliged entities in the EU (or in equivalent third countries) involved in the same transaction, provided they are subject to professional secrecy and data-protection duties.

Article 69(8) adds a new route: where a partnership for information sharing produces the suspicion, the participants may designate one of them to submit a single report naming all participating entities. If they report separately, each report must state that the suspicion arose from the partnership. Copies are kept under Article 77.

7. What has to be kept

Article 77(1)(b) requires retention of a record of the Article 69(2) assessment — the information and circumstances considered and the result — whether or not it led to a report, together with a copy of any report made. The records must not be redacted, and Article 77(3) sets the 5-year period. The negative decisions are therefore part of the evidence base, and in most inspections they are the more interesting half.

8. Format, indicators and timing

Article 69(3) asked AMLA to submit draft implementing technical standards by 10 July 2026 on the format for reports and for transaction records; AMLA has consulted on that draft (see our guide to the AMLA STR format). Article 69(5) requires AMLA guidelines on indicators of suspicious activity by 10 July 2027, to be updated periodically. Under Article 90 the AMLR applies from 10 July 2027; until then, national law transposing Directive (EU) 2015/849 governs reporting.

9. FAQ

10. What to do, today

• Map your alert disposition template to the Article 69(2) grounds, so every closed alert shows what was examined.
• Add “attempted” and “due diligence not completed” as reportable outcomes in onboarding and payment workflows.
• Build and rehearse a records extraction that meets a sub-24-hour FIU deadline, with a named deputy to the compliance officer.
• Write the 3-working-day rule into the hold procedure, including a recorded risk assessment before any release.
• Check that negative decisions are retained, unredacted, for 5 years.

Related: The AMLA STR format · Tipping-off · AML record retention · Timing of verification under AMLR Article 23