AMLA Finalises Customer Due Diligence Standards for EU Firms
On 1 October 2026 the EU Anti-Money Laundering Authority finalised its first three sets of technical standards for the private sector under the EU AML Regulation, covering customer due diligence, business relationships and linked transactions, and group-wide controls. They now go to the European Commission for adoption.
The standards fill in the operational detail of the AML Regulation, which applies from 10 July 2027. The Commission can still amend them, and they become final only when published in the Official Journal.
What AMLA Finalised
- Customer due diligence (Article 28(1)). The information firms must collect and verify, proportionate measures for lower-risk situations, non-face-to-face verification, electronic identification, and screening for politically exposed persons, their family members and close associates.
- Business relationships and occasional transactions (Article 19(9)). Criteria for telling a business relationship from an occasional transaction, and for identifying linked transactions so that CDD thresholds are applied consistently.
- Group-wide arrangements (Articles 16(4) and 17(3)). Minimum requirements for group-wide governance, risk management, internal controls and secure information sharing, with additional measures for branches and subsidiaries in third countries.
Customer Due Diligence: Key Points
- Names and place of birth. Firms collect all names on the identity document or electronic identification, and a place of birth that includes at least the country and the city, town or village.
- Address. Country and city, town or village are mandatory, with other elements such as street and postal code where they exist.
- Lower-risk individuals. Firms collect and verify a reduced set — names, date and place of birth, and nationality — and do not need to obtain and verify the address.
- Nationality. Firms take reasonable measures to find out whether a person has more than one nationality, but verifying one is enough.
- Non-face-to-face. Where a customer cannot present an identity document in person and cannot use electronic identification, firms may use alternative verification methods with the safeguards set out in the standard.
- Beneficial owners. The central register may be used to identify beneficial owners in low-risk situations, but the register alone is not enough to verify them.
- Sanctions and PEPs. Screening may be automated, manual or both, and should cover aliases, trade names and digital wallet addresses where relevant.
- Existing customers. Records must be brought into line on a risk-sensitive basis within one year for higher-risk customers and five years for all others.
For how these rules fit the wider regulation, see our EU AML Regulation readiness guide.
Business Relationships and Linked Transactions
The occasional-transaction threshold is usually €10,000, so whether an engagement is a business relationship or a series of linked transactions decides whether CDD applies. The standard sets general criteria — repetition and duration for relationships; the same or similar origin, destination and purpose for linked transactions, by one customer or several acting together — and sector-specific indicators:
- Money remittance, currency exchange and crypto-asset exchange: three or more transactions within 12 months indicate repetition, and two or more occasional transactions within one month is the period for assessing whether they are linked.
- Professional service providers such as auditors, tax advisers, lawyers and estate agents: consider the expected duration and number of services. Where the provider does not carry out the transaction itself, the threshold is assessed on the value of the underlying asset or transaction, not the fee.
- Gambling providers: voluntary membership at physical premises indicates repetition.
When the Standards Apply
The Commission will now decide whether to adopt the standards, with or without amendments, as delegated regulations. AMLA proposes that they apply six months after entry into force, or from 10 July 2029 for football agents and professional football clubs. AMLA has also finalised standards on pecuniary sanctions and on home-host supervisory cooperation; guidelines on the business-wide risk assessment and on ongoing monitoring, and the format for suspicious transaction reports, have been consulted on and are still to be finalised.
Firms should start mapping their onboarding data to the new fields — place of birth, address elements and nationality — design an alternative non-face-to-face route, set linked-transaction windows for remittance, exchange and crypto businesses, and plan the remediation of their existing customer base.
Sources: AMLA press release, 1 October 2026 · Final report: RTS on CDD (Article 28(1) AMLR) · Final report: RTS under Article 19(9) AMLR · Final report: RTS on group-wide requirements. General information, not legal advice.
Customer Due Diligence Built for the Single Rulebook
Configurable identification data, risk-based verification routes, sanctions and PEP screening and review cycles — so new EU standards become configuration, not a rebuild.
