AMLA final report: draft RTS on customer due diligence

Key takeaways

• Final report published describes AMLA's drafting stage; it does not mean that new CDD technical standards are already binding.
• The proposed RTS application date is six months after entry into force. This is separate from the AMLR's general application on 10 July 2027.
• The proposal covers both financial and non-financial obliged entities within the AMLR's scope, with sector-specific provisions where relevant.
• CDD information and supporting evidence should reflect the risks identified; illustrative information lists should not become indiscriminate collection checklists.
• Simplified due diligence remains conditional on lower risk and retains identity checks; it does not create an automatic sector-wide exemption.
• Effective PEP and sanctions screening may use manual checks, automated tools or both. A low ML/TF risk classification does not waive sanctions obligations.
• Alternative remote verification is conditional. Electronic identification does not excuse obtaining and verifying required attributes that are missing.
• Existing-customer alignment would remain risk-sensitive. The AMLR's one-year and five-year maximum update intervals are not blanket permission to postpone necessary checks.

What changed

The final draft follows AMLA's public consultation from 9 February to 8 May 2026. It advances the same CDD instrument beyond consultation, while Commission adoption remains a separate stage.

Compared with the consultation proposal, AMLA strengthens proportionality, clarifies effective manual screening, and replaces a fixed definition of complex ownership structures with a risk-sensitive assessment. These changes appear in draft Articles 1, 11, 17 and 25.

Identification details include recording declared additional nationalities while verifying at least one, and permitting the entity's office address for senior managing officials identified under AMLR Article 22(2). Such officials are not thereby classified as beneficial owners. See draft Articles 3 and 5.

Simplified due diligence under draft Articles 18-20 permits reduced identification information in qualifying low-risk situations. For natural persons, that reduced set does not include the customer's address. Central register information alone is insufficient to verify a beneficial owner's identity.

Draft Article 7 permits alternative remote verification using an identity document where face-to-face submission cannot reasonably be expected and qualifying electronic identification is unavailable, subject to safeguards and justification. Article 27(2) requires missing electronic identification attributes to be obtained and verified through other permitted means.

Draft Articles 21-24 provide information examples for enhanced due diligence, including source of funds and source of wealth. The response must address the higher risks identified while preserving specific mandatory measures in the AMLR.

Draft Article 29 proposes entry into force 20 days after Official Journal publication and application six months later, with a football-sector exception. An absolute RTS application date cannot yet be calculated. Draft Article 28 addresses relationships established before entry into force, with alignment tied to the AMLR's update periods.

Separately, AMLA announced simplified-CDD sectoral roundtables on 2 October 2026 to inform future guidelines. This engagement is not a formal public consultation and does not itself establish additional CDD permissions.

Why it may matter

The practical implication is a review of the CDD operating model: customer data, verification routes, ownership analysis, screening and evidence retention. A useful preparation exercise should identify which changes concern law, policy, systems, supplier capabilities or staff judgement, rather than treating the report as an instruction to collect every example from every customer.

Proportionality can support a more focused process, but the reasons for selecting information and controls need to be defensible. Teams should distinguish customer identity from beneficial ownership, source of funds from source of wealth, and PEP identification from sanctions compliance when designing procedures and quality checks.

Once the AMLR applies, Article 26 sets maximum intervals between updates of one year for higher-risk customers and five years for others, alongside event-triggered review requirements. These limits do not suspend ongoing monitoring or justify ignoring material changes. Remediation planning should therefore consider risk, file quality and the last review, with implementation dates checked against the eventual adopted text.

Credit and financial institutions should retain applicable existing AML requirements and supervisory expectations during preparation. AMLA's register continues to list relevant EBA guidance, including remote customer onboarding guidance. The CDD proposal should also be assessed alongside the separately finalised draft RTS on transaction criteria and group-wide arrangements.

Who may be affected

The proposal concerns obliged entities within AMLR Articles 2 and 3, including financial institutions and specified non-financial businesses and professions. Scope depends on the applicable definitions, activities, thresholds and exemptions. Insurance coverage concerns the relevant life and investment-related business; legal professionals are covered for specified activities. EU branches of third-country financial institutions may also fall within scope.

Preparation is particularly relevant to AML/CFT compliance, onboarding and KYC operations, sanctions teams, legal teams, data and technology functions, internal audit and advisers. Groups should assess consistency across covered entities, and supervisors will need to consider the proposed standards within their respective mandates.

Practical considerations

• Create a gap register separating current obligations, AMLR requirements and proposed RTS specifications. Record the legal basis, owner, evidence and adoption dependency for each change.
• Review customer-data requirements by customer type and due diligence level. Define how staff handle missing information and justify additional requests without defaulting to one universal questionnaire.
• Test remote onboarding against applicable existing guidance and the proposed safeguards. Assess impersonation risks, data quality, security, interruptions and retrievable evidence before approving a solution or supplier change.
• Review electronic identification attribute coverage. Specify how required missing attributes will be obtained and verified, and keep evidence of the verification route used.
• Update ownership-analysis procedures and templates. Document the significance of intermediate entities, arrangements and nominees instead of assigning risk solely by counting ownership layers.
• Test PEP and sanctions screening separately, including persons covered, relevant identifiers, update triggers, match resolution and escalation. Document why the selected manual or automated arrangement is effective.
• Set evidence expectations for source of funds and source of wealth in higher-risk cases. Train reviewers to assess the explanation and reliability of supporting information.
• Prioritise existing-file review using risk, completeness, material changes and the last update. Confirm implementation milestones against the adopted instrument before assigning definitive remediation deadlines.
• For relevant payment, e-money and investment businesses, assess draft Articles 9, 15 and 26 on virtual IBANs, collective investment distribution and supervisory e-money exemption factors.
• Monitor Commission adoption, scrutiny, Official Journal publication and related AMLA guidelines. Update this page and the control-change register when verified developments alter the legal position.

These considerations support professional review and do not constitute legal advice.

Legal basis and references

Official sources

• AMLA official source
• AMLA CDD factsheet accompanying the final draft
• AMLR: Regulation (EU) 2024/1624
• AMLAR: Regulation (EU) 2024/1620
• AMLA announcement of the final private-sector drafts, 1 October 2026
• AMLA CDD consultation history
• AMLA regulatory instruments register
• AMLA engagement on future simplified-CDD guidelines
• EBA remote customer onboarding guidance: existing framework