# AMLR Art. 9 — Scope of internal policies > GwG Art. 8's TJPG-amended first sentence and GwG Art. 8d have been in force since 1 October 2026. AMLR Art. 9 applies from 10 July 2027; AMLA's Art. 9(4) guidelines are due by 10 July 2026. See [[Effective-dates timeline]] and [[The adviser regime (2025 GwG revision)]]. - **Part of:** [[AMLR]] - **FATF keying:** [[FATF R.18 - Internal controls and foreign branches and subsidiaries|FATF R.18]] - **Swiss provisions:** [[GwG Art. 8 - Organisational measures (training, internal controls)|GwG Art. 8]], [[GwG Art. 8d - Adviser organisational measures; training and|GwG Art. 8d]], [[GwV-FINMA Art. 26 - Internal directives|GwV-FINMA Art. 26]] - **Detailed citation:** GwG Art. 8 (rev.); GwG Art. 8d (advisers, new); GwV-FINMA Art. 26 ## What it requires Obliged entities must maintain risk-proportionate internal policies, procedures and controls covering compliance generally and, specifically, mitigating ML/TF risk and the risk of evading targeted financial sanctions. Required content includes the business-wide risk assessment, CDD procedures, suspicious-transaction reporting, outsourcing and reliance rules, record retention, staff vetting, internal communication, a training policy, and internal controls with an independent (or externally performed) audit function. Policies are approved by the management body; procedures and controls by at least the compliance manager. Everything must be recorded in writing and kept up to date. ## Swiss position GwG Art. 8 requires financial intermediaries to take the organisational measures necessary to prevent money laundering and terrorist financing in their area, in particular adequate staff training and controls; its first sentence is itself amended by the TJPG Annex, in force 1 October 2026, to extend that duty to preventing breaches of Embargo Act coercive measures. GwG Art. 8d (rev., same date) imposes the parallel duty on advisers, using the identical EmbG language. GwV-FINMA Art. 26 supplies the itemised content for FINMA-supervised intermediaries: board-approved internal directives must set out, among other things, the criteria for elevated-risk relationships and transactions, transaction-monitoring principles, when the Geldwäschereifachstelle and the oberstes Geschäftsführungsorgan must be involved, staff-training principles, PEP policy, reporting responsibility, threshold amounts and the division of tasks between the AML unit and other business units. ## Key divergences AMLR Art. 9 itemises required policy content directly in the Regulation, mandates an independent audit function (or an external expert in its absence), and splits approval authority between the management body (policies) and the compliance manager (procedures and controls), with AMLA guidance due by 10 July 2026. GwG Art. 8 is a compact general clause without that itemisation; the detailed content instead sits in GwV-FINMA Art. 26, which binds only intermediaries directly supervised by FINMA. SRO-supervised intermediaries and advisers get the parallel itemised content, if at all, from their own SRO's regulations rather than from this ordinance. Since 1 October 2026, GwG Art. 8 (amended by the TJPG Annex) and GwG Art. 8d also cover preventing EmbG sanctions breaches - a point AMLR Art. 9(1)(b) states directly for all obliged entities. ## Effective dates GwG Art. 8's TJPG-amended first sentence and GwG Art. 8d have been in force since 1 October 2026. AMLR Art. 9 applies from 10 July 2027; AMLA's Art. 9(4) guidelines are due by 10 July 2026. See [[Effective-dates timeline]] and [[The adviser regime (2025 GwG revision)]]. ## Further connections *These links come from an article-by-article comparison of the primary texts. They add to the provisions listed at the top of this note and make no equivalence claim.* - [[FATF R.1 - Assessing risks and applying a risk-based approach|FATF R.1 — Assessing risks and applying a risk-based approach]] — AMLR Art. 9 requires written policies, procedures and controls to mitigate ML/TF risks (identified at Union, Member State and entity level) and the risks of non-implementation or evasion of targeted financial sanctions; R.1 requires institutions to identify, assess and take risk-based action to mitigate their own ML, TF and proliferation-financing risks, so it also covers the assessment step (AMLR Art. 10). *(related)* - [[GwV-FINMA Art. 27 - Integrity and training|GwV-FINMA Art. 27]] — AMLR requires written policies on good-repute verification at hiring and on staff training; GwV-FINMA requires careful personnel selection and regular training, and Art. 26 Abs. 2 Bst. e requires the internal directives to set the training principles. *(related)* - [[GwV-FINMA Art. 25 - Further duties of AML compliance|GwV-FINMA Art. 25]] — AMLR Art. 9(2)(a) requires policies covering the business-wide risk assessment and the monitoring of compliance with internal policies; GwV-FINMA Art. 25 assigns monitoring of the internal AML directives (Abs. 1 lit. a) and the risk analysis (Abs. 2, adopted by the board or top management) to the AML unit or another independent body. *(related)* ## Authoritative text > [!quote]- Regulation (EU) 2024/1624 (AMLR), Article 9 — English text (EUR-Lex, CELEX 32024R1624) > **Article 9** > *Scope of internal policies, procedures and controls* > 1. Obliged entities shall have in place internal policies, procedures and controls in order to ensure compliance with this Regulation, Regulation (EU) 2023/1113 and any administrative act issued by any supervisor and in particular to: > (a) mitigate and manage effectively the risks of money laundering and terrorist financing identified at the level of the Union, the Member State and the obliged entity; > (b) in addition to the obligation to apply targeted financial sanctions, mitigate and manage the risks of non-implementation and evasion of targeted financial sanctions. > The policies, procedures and controls referred to in the first subparagraph shall be proportionate to the nature of the business, including its risks and complexity, and the size of the obliged entity and shall cover all the activities of the obliged entity that fall under the scope of this Regulation. > 2. The policies, procedures and controls referred to in paragraph 1 shall include: > (a) internal policies and procedures, including in particular: > (i) the carrying out and updating of the business-wide risk assessment; > (ii) the obliged entity’s risk management framework; > (iii) customer due diligence to implement Chapter III of this Regulation, including procedures to determine whether the customer, the beneficial owner, or the person on whose behalf or for the benefit of whom a transaction or activity is being conducted, is a politically exposed person or a family member or person known to be a close associate; > (iv) reporting of suspicious transactions; > (v) outsourcing and reliance on customer due diligence performed by other obliged entities; > (vi) record retention and policies in relation to the processing of personal data pursuant to Articles 76 and 77; > (vii) the monitoring and management of compliance with such internal policies and procedures in accordance with point (b) of this paragraph, the identification and management of deficiencies and the implementation of remedial actions; > (viii) the verification, proportionate to the risks associated with the tasks and functions to be performed, when recruiting and assigning staff to certain tasks and functions and when appointing agents and distributors, that those persons are of good repute; > (ix) the internal communication of the obliged entity’s internal policies, procedures and controls, including to its agents, distributors and service providers involved in the implementation of its AML/CFT policies; > (x) a policy on the training of employees and, where relevant, agents and distributors with regard to measures in place in the obliged entity to comply with the requirements of this Regulation, Regulation (EU) 2023/1113 and any administrative act issued by any supervisor; > (b) internal controls and an independent audit function to test the internal policies and procedures referred to in point (a) of this paragraph and the controls in place in the obliged entity; in the absence of an independent audit function, obliged entities may have this test carried out by an external expert. > The internal policies, procedures and controls set out in the first subparagraph shall be recorded in writing. Internal policies shall be approved by the management body in its management function. Internal procedures and controls shall be approved at least at the level of the compliance manager. > 3. The obliged entities shall keep the internal policies, procedures and controls up-to-date, and enhance them where weaknesses are identified. > 4. By 10 July 2026, AMLA shall issue guidelines on the elements that obliged entities should take into account, based on the nature of their business, including its risks and complexity, and their size, when deciding on the extent of their internal policies, procedures and controls, in particular as regards the staff allocated to the compliance functions. Those guidelines shall also identify situations where, due to the nature and size of the obliged entity: > (i) internal controls are to be organised at the level of the commercial function, of the compliance function and of the audit function; > (ii) the independent audit function can be carried out by an external expert. ## Sources - AMLR Art. 9 — CELEX 32024R1624 - GwG SR 955.0, Art. 8 - GwG Art. 8 erster Satz (TJPG amending annex) — sources/raw/tjpg.txt - GwG (rev. BBl 2025 2899, in force 1.10.2026), Art. 8d - GwV-FINMA SR 955.033.0, Art. 26