The AMLR for sole practitioners: meeting prescribed roles in a firm of one

Read the AMLR's provisions on compliance governance and you can picture the firm they were drafted for: a management body, a board-level compliance manager, a compliance officer of sufficiently high standing, reporting lines between them. Now picture a sole practitioner - one accountant, one solicitor, one estate agent, one TCSP principal - reading the same text and asking the obvious question: all of these people are me. What am I supposed to do?

This post is for that reader. The AMLR - Regulation (EU) 2024/1624, applying directly in Ireland from 10 July 2027 - does not exempt small firms from having a compliance structure. But its requirements are about functions being performed and owned, and a firm of one can meet that test credibly if it approaches the roles the right way.

What are the prescribed roles?

The AMLR prescribes two:

• A compliance manager at board level - a member of the management body responsible for the firm's compliance with the AML rulebook. This is the ownership role: the person accountable for the programme existing, being resourced and being taken seriously.
• A compliance officer of sufficiently high standing - the person who runs compliance day to day. From 10 July 2027, the compliance officer is also responsible for implementing targeted financial sanctions within the firm.

In an Irish context these sit alongside the role you already know: the MLRO who receives internal escalations and files Suspicious Transaction Reports - dual-reported in Ireland to FIU Ireland via the goAML portal at fiu-ireland.ie and to Revenue via ROS.

Can one person hold every role?

For a genuine sole practitioner there is no one else, and you should be honest about that rather than inventing paper structures. The realistic position is this: you will be the management body, the compliance manager, the compliance officer and the MLRO, and your task is to show that each function is actually performed, not merely nominally assigned.

One caution on precision. Exactly how the AMLR's governance provisions apply proportionately to the smallest firms is among the details that AMLA - the EU's new AML authority - is expected to shape through guidance and technical standards. AMLA submitted its first draft technical standards to the European Commission around 10 July 2026, and they are awaiting adoption; follow amla.europa.eu rather than relying on anyone's confident guess, including templates that claim settled answers today. What follows is the preparation that makes sense under any plausible reading.

What does "performing the function" look like when it is all you?

The risk in a firm of one is not that the roles are combined - it is that they collapse into "I keep it all in my head". The fix is documentation and rhythm:

1. Write the designation down. A one-page record: you are the compliance manager and compliance officer, with sanctions implementation in your remit from 10 July 2027. Date it and keep it with your policies. It sounds odd to appoint yourself in writing; it reads very well at inspection.
2. Separate the hats in time, not in people. You cannot get independent review from yourself, but you can create deliberate checkpoints: a scheduled compliance review - monthly or quarterly - where you step out of fee-earning mode and work through a checklist: new clients onboarded correctly, screening current, RBO extracts and comparisons on file, training log up to date, business-wide risk assessment still accurate.
3. Let systems be your second pair of eyes. In a larger firm, colleagues catch what you miss. In a firm of one, checklists and software play that part - onboarding workflows that will not complete with a step missing, reminders for reviews, screening that re-runs automatically.
4. Consider external support for the genuinely hard calls. An external reviewer or professional-body resource for an annual programme check gives you the challenge a sole practice structurally lacks. Your supervisor's guidance - the Law Society of Ireland, your accountancy body, the PSRA at psr.ie, or the AMLCU - is written with small firms in mind more often than people assume.

Does being small reduce the substance of the obligations?

The programme scales; the duties do not disappear. A sole practitioner still needs a current business-wide risk assessment, written policies and procedures, CDD on every client - including beneficial-ownership work at the AMLR's 25 per cent threshold and the RBO extract before each new corporate relationship - sanctions screening, a training record (yes, for yourself: log what you studied and when), and five-year retention followed by deletion.

The honest advantage of a firm of one is coherence: your risk assessment can describe your actual practice precisely, your procedures can be short because they only cover what you really do, and nothing is lost between departments. A tight fifteen-page pack that matches reality beats a fifty-page template that does not.

What to do now

• Draft your role-designation record - compliance manager, compliance officer, MLRO, sanctions from July 2027 - and date it.
• Put a recurring compliance review in your diary and build the checklist you will run each time.
• Refresh your business-wide risk assessment so it describes your practice as it operates today.
• Check your goAML and ROS registrations are live and accessible - not set up years ago on credentials you cannot find.
• Start your own training log with the AMLR reading you are doing right now.
• Diarise a governance review for when AMLA's technical standards are adopted, in case the detail shifts.

Where CompliDesk fits

CompliDesk Ireland was built with the smallest firms in mind: guided onboarding, automatic screening, RBO evidence and review reminders act as the second pair of eyes a sole practice does not have. See how it works on your own client book by booking a demo.