From Reactive to Proactive: How Pega AML6 is Transforming Anti-Money Laundering Compliance

Why the 2027 EU enforcement deadline is forcing compliance teams to rethink case management and decisioning — and how Pega makes that shift possible.

Most anti-money laundering compliance functions were built to react. An alert fires, a case is opened, an analyst pulls together data from half a dozen systems, and weeks later a decision is reached — usually well after the transaction that triggered it has settled. That model has worked, more or less, for a long time. It will not survive the AML6 package intact.

The EU’s new anti-money laundering framework — the AMLR, the AMLD6 directive and the new European supervisor AMLA — enters direct enforcement from July 2027. It does not simply raise fines or add paperwork. It changes what “being in control” means: from being able to explain a decision after a regulator asks, to being able to demonstrate control continuously, across every entity and every jurisdiction, on demand.

That is a structural shift from reactive to proactive compliance, and it is exactly the shift that Pega’s case management and decisioning capabilities were built to support.

 

The reactive trap

Ask any compliance officer where the time goes and the answer is rarely the analysis itself. It is chasing data across core banking systems, screening tools and spreadsheets; re-keying the same customer information into three different applications; and reconstructing, after the fact, why a particular decision was made.

Industry estimates put the share of staff time large financial institutions spend on KYC and AML work as high as 15 percent of full-time headcount — most of it administrative rather than investigative.
That reactive posture was tolerable when supervision was national, fragmented and, frankly, inconsistent. AML6 removes that tolerance.

A single European supervisor, harmonised rules that apply identically in every member state, a European cap on large cash payments, mandatory traceability of crypto-asset transfers, and materially higher sanctions for serious or repeated violations all point the same direction: organisations that can only reconstruct control after the fact will struggle to prove it exists at all.

 

What AML6 actually asks of your organisation

Strip away the acronyms and AML6 asks three things of every obliged entity.

1. Know who you’re actually doing business with

Organizations must have robust processes in place for Ultimate Beneficial Owner (UBO) identification and Know Your Business (KYB) checks. These checks should not be treated as a one-time onboarding activity but should remain up to date throughout the entire customer relationship.

2. Make every decision demonstrable

Every risk assessment should be fully traceable. Not as a reconstruction after the fact, but as a verifiable audit trail in which every step is automatically recorded.

3. Monitor continuously

Regulators no longer expect periodic reviews but continuous monitoring of customers, transactions, and risks. None of these requirements can be met with better spreadsheets or more efficient manual processes. Risk assessment and case management must become part of day-to-day operations: integrated, standardized, and providing real-time visibility.

 

How Pega turns the requirement into an operating model

This is where Pega’s platform earns its place in the conversation. Two capabilities matter most here, and they work best together.

 

One centralized platform for all compliance cases

Pega case management gives compliance teams a single system of record for every alert, investigation and file — across AML, KYC and sanctions screening — instead of parallel processes stitched together with email and shared drives. Every step, escalation and decision is captured automatically as the case moves, which turns the audit trail from a reconstruction exercise into a by-product of normal work. When AMLA or a national supervisor asks for evidence of control, the evidence already exists.

 

Risk assessment at the right time

Pega Decisioning moves risk assessment earlier in the process. Instead of assessing a customer or transaction after the fact, decisions are made in real time during onboarding or while the transaction is taking place. Pega combines internal risk factors with external data sources, such as:

• santions lists;
• adverse media;
• beneficial ownership registers
• other relevant risk data sources.

This enables an immediate risk-based decision at the moment it is needed. Combined with Case Management, it creates a fundamentally different way of working.
Organizations no longer respond to incidents after they occur. Instead, they continuously assess risks as processes unfold, making compliance inherently proactive. Together, Case Management and Decisioning form an integrated control framework that enables organizations to meet the core principles of AML6: demonstrable, continuous, and harmonized risk management—without increasing the administrative burden on compliance teams.

 

The role of BPM Company

As a boutique Pega implementation partner in the Benelux, BPM Company has built and configured Pega case management and decisioning environments for financial institutions including Rabobank, ING and NWB Bank. We know both sides of this challenge: the regulatory expectations AML6 introduces, and the practical work of translating those expectations into a Pega architecture that holds up under audit — without slowing down the business it is meant to protect.

If your organisation is still assessing what AML6 means for your Pega landscape, or is ready to move from a reactive alert queue to a proactive, decisioning-driven compliance model, BPM Company can help you scope that path. The deadline is fixed. How you get there is not.