The Annual AML Compliance Calendar: Every Recurring Obligation in One Place

Most AML failures that regulators write about are not dramatic. They are a risk assessment that was last updated three years ago, a backlog of overdue customer reviews, training records that stop in 2023, or an independent audit that was "planned" but never commissioned. None of these come from a lack of policy. They come from recurring obligations that nobody put on a calendar.

This guide walks through the recurring obligations a typical AML program has to plan for in a year, grouped by how often they come around, and explains how to turn them into a calendar your team will actually follow.

Why recurring AML obligations slip

Event-driven work — an alert, a suspicious transaction, a new high-risk customer — tends to get done because something forces it onto someone's desk. Recurring work has no such trigger. It slips for three predictable reasons:

No single owner. "Compliance" owns the risk assessment, but no named person owns the date it is due for review.
Long cycles. An obligation that comes around once a year, or once every three years, is easy to forget between cycles — especially if the person who did it last time has left.
No evidence trail. Even when the work is done, nobody records when, by whom, and what changed. To a supervisor, undocumented work looks the same as work that was never done.

A compliance calendar solves all three: every obligation gets a date, an owner and a place to store the evidence.

The international baseline

Obligations differ by country and sector, but almost every AML regime is built on the FATF Recommendations. Several of them create recurring work by design:

Recommendation 1 requires firms to identify and assess their money laundering and terrorist financing risks — and to keep that assessment up to date.
Recommendation 10 requires ongoing due diligence on business relationships, not just checks at onboarding.
Recommendation 11 requires records to be kept for at least five years.
Recommendation 18 requires internal programs that include ongoing employee training and an independent audit function to test the system.

Your local rules will add specifics — deadlines, report formats, review intervals — but if you plan around these four, you have the backbone of the calendar.

Continuous and event-driven obligations

These don't belong on the calendar as dates, but they do need defined service levels, and you should review whether you are meeting them.

Suspicious activity reporting. FATF requires reports to be filed "promptly". Many regimes set hard deadlines — in the United States, for example, a SAR is generally due within 30 calendar days of initial detection of facts that may constitute a basis for filing. Set an internal SLA tighter than the legal one.
Sanctions screening. Sanctions lists change constantly, and in many jurisdictions asset-freezing obligations apply immediately. Screening must run against updated lists, not a monthly download.
Trigger-event reviews. A change of ownership, a sudden change in transaction behaviour or adverse media should trigger a customer review outside the normal cycle.
Threshold reports. Some regimes require reports of cash or wire transactions above a threshold within a fixed period — for example, US currency transaction reports are due within 15 days.

Calendar item: a monthly or quarterly check that SLAs were met, reported to senior management.

Monthly and quarterly obligations

Management information (MI) to senior management. Alert volumes, backlogs, overdue reviews, reports filed, training completion. Quarterly is common; higher-risk firms often report monthly.
Transaction monitoring tuning review. Review rule performance, false-positive rates and coverage gaps against your risk assessment. Many firms do a light review quarterly and a full review annually.
Screening quality checks. Sample-test screening matches and dispositions to confirm that alerts are being handled consistently.
High-risk customer reviews. Some firms review their highest-risk relationships more often than annually — for example, every six months for certain politically exposed persons or correspondent relationships.

Annual obligations

This is where most firms' calendars are densest, and where most findings come from.

Obligation	Typical owner	What evidence to keep
Business-wide risk assessment review	Compliance officer / MLRO	Updated assessment, change log, senior management approval
AML policies and procedures review	Compliance officer	Redlined versions, approval record
Staff AML training	Compliance with HR	Training content, attendance and test results per employee
Compliance officer / MLRO annual report	MLRO	Report and board or senior management minutes
Independent audit or testing	Internal audit or external provider	Scope, report, findings and remediation tracker
Regulatory returns	Compliance / finance	Submission confirmations
Supervisory registration renewals	Compliance / company secretary	Renewal confirmation and fee receipt

A few notes on these:

Risk assessment. Most regimes don't fix an exact interval, but supervisors widely expect at least an annual review — plus an ad-hoc review when you launch a new product, enter a new market or a new national risk assessment is published. See our guide to the business-wide risk assessment for the full list of triggers.
MLRO report. In the UK, for example, the FCA expects the MLRO of an authorised firm to report to senior management at least annually on the operation and effectiveness of the firm's AML systems and controls. See what to include in the MLRO annual report.
Independent audit. The frequency is usually risk-based. US banking examiners generally expect independent testing every 12 to 18 months, and many firms outside the US use a similar cycle.
Regulatory returns. Examples include the FCA's annual financial crime return (REP-CRIM) for in-scope UK firms. The due date often depends on your financial year end, so calculate it for your own firm.
Registration renewals. Non-financial businesses supervised for AML purposes often have annual renewals — for example, businesses supervised by HMRC in the UK pay an annual fee on the anniversary of their registration.

Risk-based customer review cycles

Ongoing due diligence means each customer file has its own review date, based on its risk rating. A common pattern is:

Customer risk rating	Common review interval
High	Every 12 months (sometimes more often)
Medium	Every 2–3 years
Low	Every 3–5 years

These intervals are industry practice, not legal requirements in most jurisdictions. What matters is that your intervals are written down in your policy, justified by your risk assessment, and actually met. The calendar item here isn't each individual review — your systems should track those — but a monthly check of the overdue review backlog. Our guide to periodic KYC reviews covers how to set and manage these cycles.

Multi-year and end-of-life obligations

Record retention and disposal. Records generally have to be kept for at least five years after the business relationship ends or the transaction is completed. Some regimes, such as the UK and EU, also require personal data to be deleted once the retention period ends unless there is a legal basis to keep it. Schedule a periodic disposal review so you don't keep data longer than you are allowed to.
Regulatory change. Big changes come with long lead times, and those lead times belong on the calendar too. In the EU, for example, the new Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies from 10 July 2027, and the new EU Anti-Money Laundering Authority (AMLA) is preparing to begin direct supervision of selected firms in 2028. Gap analyses, policy rewrites and system changes all need start dates well before then.

How to build your calendar

Inventory your obligations. List every jurisdiction and supervisor you answer to, and pull the recurring obligations from each set of rules, as well as from your own policies. Your policies count: if your policy says "annual review", a supervisor will hold you to it.
Give every item a named owner. A person, not a team. Add a backup for when they are absent.
Set lead times, not just due dates. An independent audit due in March needs to be commissioned in November. A board-approved risk assessment needs a draft ready before the board meeting, not on the day.
Define the evidence up front. For each item, decide what "done" looks like and where the proof will be stored.
Schedule the next cycle as soon as one closes. The most common failure is that an annual task is completed, and next year's date is never set.
Review the calendar itself. Once a year — ideally straight after your risk assessment review — check that the calendar still reflects your products, jurisdictions and rules.

Spreadsheet or dedicated tool?

A well-maintained spreadsheet works for a small firm with a handful of obligations. It starts to break down when you have several jurisdictions, more than one person involved, or a need to show a supervisor who did what and when. Spreadsheets don't send reminders, don't roll dates forward and don't keep a tamper-proof history.

If you want a starting point, Regmindr offers a free compliance calendar template that you can download as a spreadsheet or calendar file without signing up, and an AML compliance checklist of common recurring AML tasks. Regmindr is a sister product to Regpin focused on deadline tracking and reminders.

The calendar is only the schedule, though. The substance — the risk assessment, the policies, the customer risk ratings that drive your review cycles — is your AML program itself. That's what Regpin is built to help you manage.

Key takeaways

Most recurring AML obligations trace back to a few FATF Recommendations: risk assessment, ongoing due diligence, record keeping, training and independent audit.
Group obligations by frequency: continuous, monthly or quarterly, annual, risk-based and multi-year.
Every item needs a date, a named owner, a lead time and a defined piece of evidence.
Schedule the next occurrence as soon as the current one is done.
Review the calendar itself every year as your business and the rules change.

This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.