Published 7 October 2026

Choosing AML compliance software: thirteen checks you can verify

A demo shows a dashboard, a score, a green button. What sets one product apart shows up later: the day your supervisor asks for a 2026 file, or the day you change vendors. Here is what to ask before you sign, and the document that proves the answer.

This guide covers European Union law. What each Member State sets for itself (the authority that supervises you, the financial intelligence unit that receives your reports, how you file them) is set out country by country: Ireland, Malta and every other Member State.

First, the words in the title. A verifiable criterion is a requirement you can check yourself, with any vendor, before you sign: a precise question, and a document you are shown or handed. "Our software is compliant" is not one. "Show me the audit trail of this demo file, and tell me how I can check it without you" is.

Three EU texts set out what you must be able to do and show: Directive (EU) 2015/849, in force today; Regulation (EU) 2024/1624, the AMLR, which applies from 10 July 2027 to most obliged entities; and the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). None of them makes AML software subject to any approval. A tool is judged, then, by what it lets you do and prove. The grid below turns that into thirteen checks: for each one, the question to ask, the evidence to request and, where there is one, the EU rule behind it.

What the tool covers

1. Scope: your profession, your Member State, your texts

The EU baseline is shared; the rest is not. The authority that supervises you, the financial intelligence unit that receives your reports, the filing portal and whatever your national law adds to the Directive all stay national. A tool built around one Member State's law can apply a rule that does not exist where you work, or miss one that does. And on 10 July 2027 the AMLR replaces much of the transposed law with a directly applicable regulation, so the tool has to keep up.

The question to ask. "For my profession and my Member State, which texts does your tool apply, when did you last review them, and how will it move to the AMLR on 10 July 2027?"

The evidence to request. A list of the texts and settings specific to your Member State, with the date each was last reviewed, and the log of regulatory changes over the last twelve months.

What EU law says. The Directive lists the obliged entities (Article 2); the AMLR takes them over (Article 3) and applies from 10 July 2027 (Article 90).

2. Risk rating: a result you can explain

You assign the customer's risk profile, and you are the one who will have to justify it to your supervisor. A score without an explanation does not help you; it exposes you. From 10 July 2027, the AMLR lists the decision on a customer's risk profile among the tasks that can never be outsourced, and where a provider carries out a task for you, you must be able to show the supervisor that you understand the rationale behind it.

The question to ask. "Which factors does the score rest on, with what weight, and why does this demo customer come out as high risk? Does the same file always get the same score?"

The evidence to request. The rating sheet of a demo file, factor by factor, and the version of the rating rules applied, kept with the file.

What EU law says. You must be able to show that your measures are appropriate to the risks identified (Directive, Article 13(4); AMLR, Article 20(4), from 2027). The AMLR bars any outsourcing of the decision on the customer's risk profile (Article 18(3)(c)) and requires you to understand the rationale of an outsourced task (Article 18(2)).

3. Screening: which lists, how fresh, and where the names go

Screening is only as good as its lists. Find out which ones are checked (EU sanctions and UN sanctions, your Member State's own lists, politically exposed persons), how often the vendor reloads them, and whether the date of the version used stays in the file. An alert cleared against a list that was three weeks old does not prove much.

One question rarely gets asked: does your client's name leave the tool to be screened by a data provider? If it does, that provider processes personal data on your behalf, and it belongs on the list of sub-processors, with its country.

The question to ask. "Where do your lists come from, how often are they reloaded, and does the date of each one appear in the file? Does my client's name leave your servers to be screened elsewhere, and if so, by whom?"

The evidence to request. A demo screening result showing the list dates, the written list of sources, and the list of sub-processors.

What EU law says. Today, the Directive requires you to determine whether the customer or the beneficial owner is a politically exposed person (Article 20). From 10 July 2027, the AMLR adds a check against targeted financial sanctions to the due diligence measures (Article 20(1)(d)), to be repeated regularly at a frequency that matches your exposure (Article 26(4)). A provider that processes those names on your behalf is a processor under the GDPR (Article 28).

What the tool proves

4. Audit trail: who did what, when, with nothing rewritten

At an inspection, nobody asks what you know today. They ask what you knew on the day you took the client on, and what you did about it. An audit trail answers that question if every action carries its author and its date, and if nobody, the vendor included, can rewrite it without leaving a mark.

The question to ask. "How can I prove, without you and after my subscription has ended, that this file has not been changed since it was closed?"

The evidence to request. The exported audit trail of a demo file, and the verification method, described in writing and usable by a third party.

What EU law says. The Directive requires due diligence documents and information to be kept for five years after the business relationship ends (Article 40). From 10 July 2027, the AMLR adds that those records must not be redacted, and allows a mere reference instead of a copy only if the information cannot be modified or altered (Article 77(1) and (2)).

5. Human decisions, and where AI fits

Software can prepare an onboarding, a risk rating, a report. It should decide none of them. EU law will say so in plain terms in 2027, and it covers artificial intelligence too: a decision that comes out of an automated process is only allowed if it is subject to meaningful human intervention.

So ask two things. What the AI does, task by task: which model, which provider, in which country, and whether the tool still works with it switched off. And where the human approval is recorded: by whom, when, and what was changed.

The question to ask. "Which decision can your tool take without a human approving it? What does the AI receive, who runs it, where, and is that data used to train a model?"

The evidence to request. A demo file in which the human approval appears with its author and date, and the AI provider on the list of sub-processors.

What EU law says. From 10 July 2027, the AMLR allows decisions resulting from automated processes or AI systems on three conditions, one of which is meaningful human intervention in any decision to enter into, refuse or maintain a business relationship, or to change the extent of due diligence (Article 76(5)). It also bars outsourcing the decision to take on a customer and the report to the FIU (Article 18(3)). The GDPR already restricts decisions based solely on automated processing (Article 22).

6. Suspicious activity reports: the format, and who knows they exist

The tool prepares the report; you file it. Two things are worth checking before you sign. First the format: each financial intelligence unit has its own way of receiving reports, several in the EU use goAML, others a portal of their own, and a tool that does not produce the one your FIU accepts leaves you retyping everything. Then confidentiality: the existence of a report must not be disclosed to the customer or to third parties. In a tool shared by a team or a network, who can see it?

The question to ask. "Which export formats does the tool produce, which one does my Member State's FIU accept, and who, in my team or at your company, can see that a report exists?"

The evidence to request. A demo export in the format your FIU accepts, and the access matrix: who sees what, role by role.

What EU law says. The Directive requires reports to the FIU (Article 33) and prohibits disclosing to the customer or third parties that one has been made (Article 39). From 10 July 2027, the AMLR keeps both rules (Articles 69 and 73) and tasks AMLA with drafting the technical standards that will specify the reporting format (Article 69(3)).

7. Answering the FIU and the supervisor

A request from the FIU or the supervisor never arrives at a good time. What matters then is how long it takes you to produce a complete file that someone unfamiliar with your tool can read, and to say whether you have had a business relationship with a given person over the last five years.

The question to ask. "How long does it take me, on my own, to export a complete file, and to list all my files in a spreadsheet?"

The evidence to request. A complete file exported in front of you during the demo, against the clock, then read by someone who has never seen the tool.

What EU law says. The Directive requires systems that let you respond fully and speedily to enquiries from the FIU or other authorities about your business relationships over the previous five years (Article 42), and a documented risk assessment made available to the authorities (Article 8(2)). From 10 July 2027, the AMLR keeps the first requirement (Article 78) and sets five working days for answering FIU requests (Article 69(1)).

Where the data goes

8. Hosting: the country of every copy

The GDPR does not require any particular country. What it governs is data leaving the EU: a transfer to a third country is only allowed on its terms, an adequacy decision by the Commission or one of the transfer tools it provides for. The question covers every copy: the production database, the backups, the documents, and also AI assistance, support and technical monitoring, which can involve a country other than the one where the service is hosted.

The question to ask. "In which countries are production, each backup and AI assistance located? Does any data go to a third country, even for support, and if so, on what legal basis?"

The evidence to request. The list of processing locations, backups included, and for any transfer outside the EU, the transfer tool used, written into the contract.

What EU law says. GDPR, Articles 44 to 46: a transfer to a third country requires an adequacy decision (Article 45) or, failing that, one of the tools in Article 46, such as standard contractual clauses. The processor only transfers data on your documented instructions (Article 28(3)(a)).

9. Processors: the agreement, and the full list

Once a vendor processes the personal data in your files on your behalf, it is your processor under the GDPR. It owes you a written agreement stating what it processes, for how long, and what happens to the data at the end. It also owes you the list of its own sub-processors: hosting, backups, email delivery, payments, AI. None can be added without your prior written authorisation, specific or general; under a general authorisation, you must be told of any change and be able to object.

The question to ask. "Can you give me your data processing agreement and the full list of your sub-processors, with their role and country? How will I hear about an addition?"

The evidence to request. The agreement itself, with the terms Article 28 requires, and a dated list of sub-processors that you compare with the one on the vendor's public pages.

What EU law says. GDPR, Article 28: a written contract, a minimum content, sub-processors subject to your authorisation. If the vendor carries out a due diligence task for you, the AMLR will also require, from 10 July 2027, a written agreement and regular checks on your side (Article 18(4)).

10. Security: encryption, keys, access, restores

A due diligence file holds identity documents, evidence of wealth, sometimes a suspicion. The GDPR names encryption among the security measures, and asks for the ability to restore data after an incident and for regular testing of the measures taken. An acronym on a slide rarely settles it: ask what is encrypted, who holds the keys, how people sign in, and when a backup was last restored.

The question to ask. "What is encrypted at rest, with which algorithm, and who holds the keys? Can I make a second authentication factor mandatory for my whole team? When did you last restore a backup, and how quickly will you tell me about a data breach?"

The evidence to request. A written technical description, the date of the last restore test, and the breach notification commitment set out in the processing agreement.

What EU law says. GDPR, Article 32: encryption, the ability to restore the availability of data, regular testing. Article 33(2): the processor notifies the controller of any personal data breach without undue delay.

11. Retention, and erasure

Keep too little and your supervisor has questions; keep too long and your data protection authority does. The EU rule comes in two parts: five years after the relationship ends, then erasure, unless your national law provides otherwise. The vendor should be able to tell you when a file is erased, and when its last backup copy goes too.

The question to ask. "How long is a file kept after the relationship ends, what triggers erasure, and how long does it survive in backups?"

The evidence to request. The written retention policy, with its periods, backups included.

What EU law says. Directive, Article 40: five years after the business relationship ends or the occasional transaction is carried out, then deletion of personal data, unless national law provides otherwise, which may extend retention by up to five further years. From 10 July 2027, the AMLR also starts the five years from the date of a refusal to enter into a relationship (Article 77(3)). GDPR, Article 5(1)(e): no longer than necessary.

What the contract says

12. Reversibility: leaving with your files

You may change tools one day. Your obligations will not change with them: a file closed in 2026 has to stay readable and probative until 2031 at least. So the right to get your data back is only half the question. The other half is its form: files you can open without the vendor, with what you need to show they have not been altered.

The question to ask. "At the end of the contract, what will I get back, in which format, for how long, and at what cost? Will the integrity proof still be verifiable without a subscription?"

The evidence to request. The exit clause, in writing, and a full test export, opened on your own computer.

What EU law says. GDPR, Article 28(3)(g): at the end of the service, the processor deletes or returns all personal data, at your choice, and deletes existing copies, unless the law requires them to be kept.

13. Price, and what it covers

A monthly price says nothing until you know what it includes. Work out what your practice will actually use: users, files, screenings and re-screenings, the volume of documents. Then look at what is optional, the price at renewal, and what leaving will cost.

The question to ask. "What does the price include, what does each option cost, how does it change at renewal, and what will a full export of my files cost on the day I leave?"

The evidence to request. A written price list, renewal and exit included, attached to the contract.

What EU law says. No EU text cited in this guide covers this point: it is a matter for the contract, to be read before you sign.

Vigilae, against these thirteen checks

Vigilae is AML/CFT compliance software. Here is its answer to the grid, check by check, each with the public page that describes the essentials. Ask us the same questions you ask any other vendor, and ask us for the same evidence.

What Vigilae does not do, its About page says plainly: it never sends a suspicious activity report in your place; it does not say whether your framework is compliant, which only your supervisor can; and it holds no certification. Vigilae prepares, the human decides, and the reporting professional remains solely responsible.

Informative article, current as of 7 October 2026, not constituting legal advice. The checks describe what EU law requires of you; they do not replace reading your national law or the contract you sign.

Frequently asked questions