On 30 September 2026, AMLA published its final report on the regulatory technical standards (RTS) under Article 28(1) AMLR, which specify the information obliged entities must collect and verify as part of customer due diligence. Compared with the February consultation draft, the text has been reduced from 33 to 29 articles and made considerably more flexible. The European Commission still needs to adopt the RTS, which are then intended to apply six months after their entry into force.
Table of Contents
The Consultation Draft as a Starting Point
The draft received 325 responses. Criticism focused, among other things, on overly rigid information requirements, the preference for automated screening tools and provisions that merely repeated the AMLR. AMLA has addressed many of these points but could not introduce exemptions from the AMLR. The update intervals under Article 26 AMLR therefore remain unchanged: one year for higher-risk customers and five years for all other customers, calculated from the entry into force of the RTS. AMLA also rejected automatic simplified due diligence for certain sectors and ruled out a generally risk-based approach to sanctions screening.
The Main Changes
A stronger risk-based approach: Mandatory lists in the draft, which required at least one of the listed items of information to be collected, have become optional lists, for example in relation to the purpose of the business relationship and enhanced due diligence. According to AMLA’s factsheet, information on the purpose and intended nature of the business relationship should expressly not be treated as a checklist, but collected only to the extent required by the specific risk. Article 1 now also explicitly refers to simplified due diligence in low-risk situations, and information already held by the institution or its group must be taken into account in the assessment.
Simplified due diligence: In low-risk situations, the purpose and intended nature of the business relationship may now be inferred from the customer’s profile, the product or previous transactions. The minimum information comprises the intended use, expected transaction value and the customer’s business activity; the source of funds is no longer part of that minimum. For the identification of beneficial owners, the requirement to use one of the listed sources has likewise become an option. The business register may now also be used for verification, provided it has not already been used for identification.
Remote onboarding and identification: Electronic identification (eID) and qualified trust services remain the standard methods for remote onboarding. This approach was already reflected in the draft and has now been expressed more clearly. Alternative procedures are permitted only if the customer cannot appear in person or use eID or qualified trust services, and their use must be justified to the supervisory authority. Existing remote onboarding tools may continue to be used, provided they meet the minimum requirements under Article 7. The final text also allows greater flexibility regarding place of birth, nationalities and trading names. Where a customer holds multiple nationalities, verifying one is sufficient.
Ownership structures: The rigid definition of a “complex structure”, which automatically triggered additional measures where there were three or more layers and further criteria were met, has been removed. Articles 11 and 12 have been merged, and complexity now serves merely as an indicator, assessed by reference to factors such as the number of layers, legal arrangements such as trusts, high-risk jurisdictions and nominees. The separate article on senior managing officials has been deleted, although it remains possible to collect the registered office address instead of the residential address.
PEP and sanctions screening: Manual checks are now placed on an equal footing with automated tools, provided the chosen approach is effective and appropriate to the institution’s size, business model and risks. Former Articles 29 and 30 have been merged into Article 25, and the triggers for re-screening, such as changes to data or new listings, have been clarified.
Funds and pooled accounts: The intermediary’s obligation to provide fund management companies with end-investor data without delay has been removed, meaning that a look-through is not required. The relationship with the intermediary must, however, remain below the high-risk threshold. The special provision for pooled accounts has been deleted because AMLA considers guidelines a more appropriate way to address this issue.
Implications for the Financial Sector
Less prescriptive detail does not mean less work. The remediation of existing customer files remains necessary. In the cost survey, 40.7% of financial institutions that provided a substantiated assessment expected disruptive one-off costs, while 37.0% considered them manageable. At the same time, greater flexibility shifts responsibility to institutions. They will need to justify the scope of data collection, their screening methods and their assessment of ownership structures, and substantiate these choices to the supervisory authority.
What Should Institutions Review?
- Are existing remote onboarding procedures documented sufficiently to justify their use alongside eID?
- Is the screening setup appropriate to the institution’s size, business model and risk profile, and have re-screening triggers been defined?
- How is the complexity of ownership structures assessed and documented?
- Is information already available within the group used to avoid requesting the same information from customers more than once?
- Is the remediation of existing customer files aligned with the deadlines under Article 26 AMLR?
Conclusion and Outlook
The final RTS are more pragmatic than the consultation draft, but leave the specific requirements of the AMLR unchanged. The flexibility therefore lies primarily in how those requirements are implemented. How supervisory authorities will interpret this discretion in practice remains open, although AMLA has already indicated that further guidance will follow. Institutions should therefore align their gap analyses with the final text now, so that only fine-tuning remains once the Commission has adopted the RTS.
