AMLA finalises core EU standards for customer due diligence

On 1 October 2026, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) published final reports on three sets of draft regulatory technical standards for private-sector entities subject to the EU Anti-Money Laundering Regulation.

The standards address three connected areas: distinguishing business relationships from occasional transactions and identifying linked transactions; the customer information and verification measures required for customer due diligence; and minimum group-wide AML/CFT arrangements, including governance, controls and secure information sharing.

The customer-due-diligence standard specifies information to be collected for customers, representatives and beneficial owners. For legal entities, that includes the legal name and, where different, the trade name. AMLA’s factsheet also states that information from a central beneficial-ownership register may be used in low-risk situations to identify a beneficial owner, but is not sufficient by itself for verification. It must be corroborated with information from the customer or another reliable source.

The final draft also covers non-face-to-face verification, electronic identification, simplified measures in lower-risk situations and screening for sanctions and politically exposed persons. For existing relationships, AMLA describes a risk-sensitive transition: information should be brought into compliance within one year for higher-risk customers and within five years for other customers.

The group-wide standard requires proportionate governance, risk assessment, policies, training, remediation and information-sharing arrangements. Customer, beneficial-ownership, transaction and risk information may need to move across the group on a need-to-know basis through secure and documented channels.

The standards have been submitted to the European Commission. They are not yet definitive: AMLA says they remain subject to review and potential amendment, and are proposed to apply six months after entry into force following adoption and publication in the Official Journal.

These standards move the EU rulebook closer to a common operating specification for customer due diligence. For KYB teams, the practical impact is not simply a longer list of required fields. Systems need to distinguish information that has been collected from information that has actually been verified, and retain the source, date and method behind that verification.

The treatment of beneficial-ownership registers is particularly important. A register can support identification, but AMLA’s final draft does not treat it as sufficient evidence on its own. Workflows need to combine registry records with customer evidence or other reliable sources and preserve discrepancies for review. That makes evidence provenance and source coverage part of the control rather than an implementation detail.

The linked-transaction standard also requires teams to see activity that may be split across time or channels. If separate transactions are assessed only in isolation, a relationship or threshold may never be recognised. Identity resolution and aggregation rules therefore need to connect activity to the same customer, beneficial owner or acting party before the CDD decision is made.

For groups, the challenge is controlled information mobility. Customer and ownership evidence, risk findings and transaction context need to be available to the entities that require them, while access remains limited, secure and documented. A common policy without a workable data-sharing process will not produce a consistent group-wide outcome.

Because the standards are still awaiting Commission adoption, teams should not present the final drafts as already binding. They can, however, use the published reports as a concrete basis for gap analysis and prepare KYB workflows that can be adjusted when the definitive texts and application dates are confirmed.