--- title: "AMLA — Report — Draft RTS under Article 28(1) [final draft submitted]" shortTitle: "AMLA — Report — Draft RTS under Article 28(1) [final draft submitted]" type: final_report instrument_type: final_report authority: AMLA binding: false binding_character: non_binding legal_status: pending regulation: AMLR amlr_level3: true mica_level2: false reference: "Final Report – Draft RTS under Article 28(1) of Regulation (EU) 2024/1624" legal_basis: "Article 28(1) AMLR" date: 30 September 2026 source_link: "https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en" source_pdf: "https://www.amla.europa.eu/document/download/e15ab2e5-4074-4de8-bb9d-613dd8b7fdd1_en?filename=Final%20Report%20-%20draft%20RTS%2028%281%29%20AMLR.pdf" lifecycle: "final draft submitted" text_version: "AMLA publication" source_url: "https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the AMLA publication" source: prepared_by: "AMLA" published_by: "AMLA" evidence: prepared_by: "2.2 AMLA’s approach - focus on simplification _________________________________________ 4" locator: "PDF, first line naming AMLA (page 1 names no issuer) (https://www.amla.europa.eu/document/download/e15ab2e5-4074-4de8-bb9d-613dd8b7fdd1_en?filename=Final%20Report%20-%20draft%20RTS%2028%281%29%20AMLR.pdf)" document_type: "final_draft_rts" legal_nature: "not_adopted_draft" addressees: "not stated in the document" dates: document_date: "2026-09-30" locators: document_date: "PDF page 1: \"30/09/2026\"" adoption: status: "not_adopted" checked_on: "2026-10-28" method: "CELLAR: no regulation based on 32024R1624 dated on/after 2026-09-30" lifecycle_label: "final draft submitted" --- **Final draft RTS by AMLA, submission date not stated in the source · not adopted as of 28 Oct 2026 · not binding · dated 30 Sep 2026 [final draft submitted]** *Final draft submitted · AMLA publication · Checked against the AMLA publication on 26 Oct 2026 · [Official source](https://www.amla.europa.eu/press-release-amla-finalises-key-standards-private-sector_en)* | | | |---|---| | **Full title** | AMLA — Report — Draft RTS under Article 28(1) \[final draft submitted\] | | **Prepared by** | AMLA | | **Published by** | AMLA | | **Reference** | Final Report – Draft RTS under Article 28(1) of Regulation (EU) 2024/1624 | | **Document type** | Report | | **Legal nature** | Not binding | | **Adoption** | Not adopted as of 28 October 2026 (CELLAR search) | | **Addressees** | Not stated in the document | | **Dates** | Dated 30 September 2026 | | **Legal basis** | Article 28(1) AMLR | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the AMLA publication | ## Final Report Draft Regulatory Technical Standards under Article 28(1) of Regulation (EU) 2024/1624 Frankfurt am Main – 30/09/2026 ## 1 Executive Summary In order to strengthen the Union’s rules for anti-money laundering and countering the financing of terrorism (AML/CFT), Regulation (EU) 2024/1624 (AMLR) aims to harmonise the preventative measures to be put in place at Union level. To this end, Article 28(1) AMLR mandates the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) to develop draft Regulatory Technical Standards specifying, among others, the requirements and information to be collected for standard customer due diligence, simplified due diligence (SDD) and enhanced due diligence (EDD) purposes. The mandate also requires AMLA to specify risk factors that supervisors must consider when determining the extent to which certain electronic money instruments may be exempted from some customer due diligence (CDD) measures and which reliable and independent sources of information obliged entities may use to verify the identity of natural or legal persons for the purposes of Article 22(6) and (7) AMLR. The mandate further covers the attributes which electronic identification means, and relevant qualified trust services referred to in Article 22(6), point (b), AMLR must feature to fulfil the requirements of Article 20(1), points (a) and (b), AMLR in the case of standard, simplified and enhanced due diligence. To frontload work on AMLA’s mandates before the effective operation of AMLA, the European Commission issued a Call for Advice (CfA) to the European Banking Authority (EBA) on 12 March 2024, requesting preparation of these regulatory technical standards under the mandate in Article 28(1) AMLR. The EBA issued its response to the CfA on 30 October 2025 which served as a strong foundation for AMLA to finalise the work. In preparing this final report, AMLA sought and considered input from national supervisors across both financial and non-financial sectors, AMLA also liaised closely with private sector representatives. AMLA further enhanced the final report by considering the responses provided by respondents collected through the public consultation conducted between 9 February and 8 May 2026. The draft RTS outlined in this final report contains proportionate, risk-based CDD measures that contribute to harmonising the way AML/CFT requirements are applied in the Union. The provisions are flexible enough to ensure applicability across the range of products and services offered by obliged entities in both the financial and non-financial sector. These draft RTS support simplification efforts and enable obliged entities to determine the most effective and proportionate measures to be applied. These draft RTS are part of a broader set of AMLA instruments that will be delivered and that will touch upon the AML/CFT requirements of obliged entities. AMLA will continue its endeavors to place proportionality and the risk-based approach at the heart of this work and ensure the effectiveness of the instruments to be delivered while simplifying AML/CFT compliance for obliged entities where possible. ### 1.1 Next steps These draft regulatory technical standards will be submitted to the European Commission for adoption before being published in the Official Journal of the European Union. ## 2 Background and rationale ### 2.1 Background In 2024, the European Union adopted a new package of laws to strengthen the EU's anti-money laundering and counter-terrorist financing (AML/CFT) rules. With this package, the rules that apply to obliged entities are transferred to a directly applicable regulation, moving away from divergent national frameworks towards a single harmonised set of rules across the Union. Regulation (EU) 2024/1624 (AMLR) sets out detailed requirements including on customer due diligence measures and suspicious transaction reporting and extends the application of AML/CFT rules to new categories of obliged entities. To further ensure that customer due diligence (CDD) measures are applied in the same way, Article 28(1) AMLR requires the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) to develop draft Regulatory Technical Standards (RTS) setting out the requirements and information to be collected for standard customer due diligence, simplified due diligence (SDD) and enhanced due diligence (EDD) purposes. That mandate also requires AMLA to specify risk factors that supervisors must take into account when determining the extent to which certain electronic money instruments may be exempted from some customer due diligence measures and which reliable and independent sources of information obliged entities may use to verify the identity of natural or legal persons for the purposes of Article 22(6) and (7) AMLR. The mandate also specifies the attributes which electronic identification means, and relevant qualified trust services referred to in Article 22(6), point (b), AMLR must feature in order to fulfil the requirements of Article 20(1), points (a) and (b), of the AMLR in the case of standard, simplified and enhanced due diligence. On 12 March 2024, the European Commission asked the European Banking Authority (EBA) by way of a Call for Advice (CfA) to prepare the above-mentioned regulatory technical standards to support the rapid and effective start of AMLA. The CfA included a mandate under Article 28(1) AMLR on CDD. The process established by the EBA to deliver on the CfA included a 3-month public consultation as well as a public hearing in April 2025, which more than 600 stakeholders joined, mostly from the financial sector. Based on the written feedback provided by 170 respondents to the consultation as well as subsequent discussions, the EBA’s draft RTS that went out for public consultation were amended. The EBA submitted its response to the European Commission’s Call for Advice, on 30 October 2025 AMLA used EBA’s work as a basis to further refine the draft RTS, with a special attention given to the non-financial sector. A revised version of the draft was submitted to a three-month public consultation on 9 February 2026. 325 responses were received through the consultation process. On 24 March 2026, AMLA also held a public hearing in which AMLA staff engaged with more than 1 600 stakeholders from Member States and third countries. Associations and obliged entities from both the financial and non-financial sectors were represented during the public hearing. To ensure greater insight into specific sectors, AMLA also set up targeted meetings with key stakeholders. AMLA also engaged with the European Data Protection Supervisor (EDPS). Following the conclusion of the consultation process, AMLA further refined the draft RTS in light of the feedback received from respondents and stakeholders. ### 2.2 AMLA’s approach - focus on simplification In developing these draft RTS, and taking into account the outcome of the public consultation, AMLA built on the EBA’s five guiding principles[^1] to ensure continuity, whilst placing specific focus on simplification by minimizing complexity, regulatory burden and compliance costs. This means that AMLA sought to establish a single, horizontal applicable framework to obliged entities from the financial and non-financial sector by: * ensuring that the draft RTS complement what is provided in the AMLR, without repeating the Level 1 provisions that are sufficiently detailed; * ensuring that the draft RTS continue to allow flexibility by setting out options obliged entities can consider when deciding on the most effective and proportionate measures; * confining modifications to the EBA’s text where duly justified, for example, where AMLA saw a need to enhance or add to an RTS provision proposed by the EBA to ensure a wider applicability to both the financial and the non-financial sector; and * balancing the need to ensure continuity and respecting the agreement reached among competent authorities and the EBA, while ensuring the draft RTS reflects AMLA’s mandate and accountability, as well as the views of its stakeholders. ### 2.3 Rationale AMLA sought to ensure that the requirements in the EBA's draft RTS can be applied by all obliged entities, particularly those in the non-financial sector, which were outside the scope and focus of the EBA's work. To this end, AMLA engaged with supervisors of the non-financial sector, with a view to identifying sectoral specificities that may impact the harmonised application of CDD requirements. On this basis, AMLA did not identify a need for major adjustments in the structure or content of the draft RTS initially submitted by the EBA. AMLA’s continuation of the work therefore focused on identifying any outstanding issues and assessing whether this would require adjustments to the draft RTS. As part of this, AMLA explored whether CDD measures could be further simplified beyond the existing reduced measures already permitted under Article 33 AMLR. AMLA did not identify opportunities for further simplifying SDD measures without effectively creating exemptions from the AMLR obligations, which would exceed AMLA’s mandate. The feedback received during the public consultation did not alter this assessment, nor did it identify any additional horizontally applicable SDD measures that could be specified in these draft RTS in a manner consistent with the AMLR. At the same time, AMLA recognises the importance of ensuring that the AMLR can be applied in a proportionate and operationally effective manner. Accordingly, AMLA intends to continue engaging with stakeholders, including in particular the non-financial sector, to assess whether additional guidance on the application of SDD measures would be warranted. In the final draft RTS, AMLA introduced targeted amendments to the EBA’s initial draft aimed at enhancing legal clarity, promote simplification, while ensuring the applicability of the requirements across both the financial and non-financial sectors, and strengthening consistency and alignment with the AMLR ensuring AMLA does not derogate from it. This also means that where concerns were raised by respondents regarding provisions in the AMLR, AMLA was not able to address them through these RTS. The AML/CFT package mandates AMLA with the development of a broad set of legal instruments concerning the AML/CFT requirements of obliged entities. Together, these instruments support a more harmonised framework by aligning supervisory expectations and reducing cross-border divergences. In developing this work, AMLA places simplification and the risk-based approach at the heart of its approach, to ensure that rules are applied proportionately and effectively in combating money laundering and terrorist financing. Therefore, in revising these draft RTS, AMLA also considered their interaction with its other mandates to ensure consistency and coherence across the regulatory and supervisory framework, while supporting simplification and reducing compliance burden for obliged entities. This approach further promotes a more harmonized, proportionate and risk-based AML/CFT framework. ## 3 Draft regulatory technical standards ### COMMISSION DELEGATED REGULATION (EU) .../... ### of XXX supplementing Regulation (EU) 2024/1624 of the European Parliament and of the Council with regard to regulatory technical standards specifying the information and requirements necessary for the performance of customer due diligence for the purposes of Article 28(1) (Text with EEA relevance) ### THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing[^2], and in particular Article 28(1), points (a) to (e), thereof, Whereas: (1) Regulation (EU) 2024/1624 aims for the harmonisation of customer due diligence measures across Member States and obliged entities within the EU. To achieve this, this Commission Delegated Regulation (‘Regulation’) sets common parameters for the application of customer due diligence measures. Obliged entities are required to adjust the customer due diligence measures based on the money laundering and terrorist financing risks associated with their business relationships or occasional transactions. This will ensure a proportionate and effective approach. Accordingly, obliged entities shall collect information on a risk-sensitive basis and apply the measures laid down in this Regulation, ensuring that their scope, intensity and frequency are proportionate to the money laundering and terrorist financing risks associated with the business relationship or occasional transaction. (2) Obliged entities should, when identifying a customer and verifying their identity, collect data and information in a consistent way in all Member States. The same approach should apply to all customers, whether they are a natural person or a legal person. However, certain identity details are indicated differently on identity documents, passports or equivalent documents, depending on the issuing designated authority. For instance, on some documents the place of birth is indicated by the city or state, while in others it is indicated by the country of birth. Similarly, middle names are not consistently featured in documents but may in some cases be a relevant part of an individual’s identity information. To this end, this Regulation should allow obliged entities to verify such information as it is indicated in the identity document, passport or equivalent, or as available through electronic identification means and relevant qualified trust services as set out in Regulation (EU) No 910//2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC[^3]. A document does not necessarily need to include a middle name for it to be compliant with the requirements of this Regulation. Where obliged entities collect only the state, city, municipality, town, or village of birth, they should assess the need to also ascertain the country, for instance where the name of the city in question is not unique to one country and there are doubts as to the country of birth or where the country cannot be readily identified from the city name. (3) In the course of their operations, some legal entities adopt trade names that differ from their legal name. Since such trade names do not typically hold the same legal status as the legal name of the entity, they are not mandatory components of the identification details for legal entities. However, such information may bear relevance for anti-money laundering and countering the financing of terrorism (AML/CFT) purposes and could contribute to improving risk mitigation, including screening. To this end, and even where such names are not verifiable against reliable and independent sources, obliged entities should collect them together with the identification details of the legal entity. (4) Identity documents, passports or equivalent issued by a designated authority in accordance with the applicable law may not always contain all the identification information required for AML/CFT purposes. For instance, passports do not typically include a residential address. In such cases, and where verification of the address is required, obliged entities must take measures to verify such information using reliable and independent sources. However, obliged entities need not request additional documents to verify information that has already been verified through the identification documents issued by a designated authority in accordance with the applicable law, as this would entail the unnecessary duplication and processing of data. (5) Regulation (EU) 2024/1624 requires obliged entities to identify senior managing officials in certain situations where no beneficial owner can be identified. Recital 125 of that Regulation explains that, although identified as such, senior managing officials are not the beneficial owners. Since those persons act in their capacity as officials of the legal entity rather than for their direct personal benefit, and to minimise the processing of personal data, it should be sufficient to identify the registered office address of the legal entity rather than the residential address of those senior managing officials. (6) Obliged entities are expected to identify the nationalities held by a customer or beneficial owner. However, to establish whether a person holds any additional nationalities to those already identified and verified, obliged entities would, in most cases, have to rely on a declaration from the customer or beneficial owner. To this end, this Regulation only requires taking reasonable measures to identify any additional nationalities; and in the case of multiple nationalities, verifying one nationality will be sufficient. In situations where the person is stateless or has refugee or subsidiary protection status, this information should be obtained instead. (7) Information or data collected by obliged entities for customer due diligence purposes may not always be in the form of documents. This Regulation specifies the situations where documents should be collected. (8) For a document to be considered equivalent to an identity document or passport, it should give obliged entities sufficient reassurance of a person’s identity. Therefore, this Regulation sets out the minimum conditions, including the information and security features. Those security features may be based on international standards such as those set out in Part 2 of the International Civil Aviation Organization Document 9303. In order to ensure the reliability and integrity of identity verification processes, it is also appropriate for documents obtained for the purpose of verifying the identity of a natural person to be subject to checks for authenticity, including to ascertain that they have not been forged or otherwise tampered with. (9) Obtaining data and documents from independent and reliable sources is key to ensuring that obliged entities can be satisfied that they know who their customers are. Reliable and independent sources of information for customers that are not natural persons include, but are not limited to statutory documents of the legal entity or legal arrangement required by law, including certificates of incorporation or audited financial statements; the most recent version of the constitutive documents establishing the legal entity or legal arrangement, including a memorandum of association and articles of association, or a recent official copy or extract of these documents issued by the applicable public registers and lists or an unofficial copy thereof certified by an independent professional or a public authority. In the case of a trust or similar legal arrangement that may not be subject to registration, a recent copy of the trust deed or an extract thereof, together with any other document that determines the exercise of any powers by the trustees or similar administrators, certified by an independent professional, could qualify as a reliable and independent source of information. Obliged entities should also take into account the recency of a document and whether the passage of time has reduced the reliability of that information. It should be left to the obliged entity to determine the most appropriate method for ensuring they understand information in a foreign language. (10) There may be situations where the customer does not hold an identity document(s), passport(s) or equivalent that meets all the conditions set out in this Regulation. This could be the case where the customer has credible and legitimate reasons for being unable to provide traditional forms of identity documentation, for example being an asylum seeker; a refugee; a person to whom a residence permit was not granted but whose repatriation is impossible for legal or factual reasons; being homeless; or being otherwise vulnerable. Regulation (EU) 2024/1624 does not provide an exemption from the list of information obliged entities should collect for natural persons in this category. To mitigate the risk of financial exclusion and unwarranted de-risking, obliged entities should be able to obtain the requested information from these natural persons via other reliable and independent means. This could be the case where the customer is or acts on behalf of a minor who does not possess a passport or identity document. In view of the minor’s representation by a parent or legal guardian, who would themselves be subject to identification and verification, it would be appropriate to consider a birth certificate as a credible source for the purposes of identifying and verifying the identity of the minor. In situations where a verified copy of the identity document, passport or equivalent is required, it should be attested that the copy corresponds to the original document. (11) Regulation (EU) 2024/1624 requires obliged entities to verify identity through identity documents, passports or equivalent or through certain electronic identification solutions set out in Regulation (EU) No 910/2014. Those electronic identification solutions comprise electronic identification means as defined in Article 3(2) of Regulation (EU) No 910/2014, regardless of whether they are notified under Article 9 of that Regulation or not, as long as they comply with the requirements of either ‘substantial’ or ‘high’ assurance levels, as specified in Commission Implementing Regulation (EU) 2015/1502 of 8 September 2015 on setting out minimum technical specifications and procedures for assurance levels for electronic identification means pursuant to Article 8(3) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market[^4]. This includes European Digital Identity Wallets. Those electronic identification solutions also comprise relevant qualified trust services as defined in Article 3(17) of Regulation (EU) No 910/2014. While the electronic identification means and relevant qualified trust services described above should be used wherever possible, there may be situations where none of them can be used. This may occur where the customer cannot reasonably be expected to present identification documents in person and the customer cannot use the electronic identification solutions referred to above in Regulation (EU) No 910/2014. To ensure that such persons are not excluded and that financial or commercial services can continue to be provided, this Regulation enables the use of alternative verification measures through other means, taking advantage of developments in digital identity verification technologies. Such alternative solutions should nevertheless meet minimum requirements regarding the quality, security and confidentiality of the verification process, especially in the face of emerging technological threats. In these situations, obliged entities may continue using existing remote onboarding tools that meet those requirements. As such alternative solutions should only be used on a case-by-case basis where customers cannot be verified through either of the methods set out in Article 22(6) of Regulation (EU) 2024/1624, obliged entities should be required to justify instances of verification through such tools. Obliged entities may choose to demonstrate compliance with the minimum requirements through adherence to recognised international or European technical standards. Verification through electronic identification means or relevant qualified trust services need not be limited to non-face-to-face situations, and obliged entities should be able to use such means when verifying the customer’s identity in person. (12) Obtaining beneficial owner information for all customers that are not natural persons is essential for complying with AML/CFT requirements and with targeted financial sanctions obligations. For this reason, consultation of central registers for information on the beneficial owners is necessary. Central registers can be a source of information for the identification of the beneficial owner but are not sufficient on their own to fulfil the verification requirements. (13) The process of verifying that a person purporting to act on behalf of a customer is authorised to do so enables obliged entities to confirm that such person has legal or juridical representation of the customer or any other similar power to legally bind the customer. Where the customer is a legal entity, such persons could include the legal representatives, signatories or similar persons that seek to exercise such powers with regard to the customer. On the other hand, the authority to act on behalf of a natural person could be verified through instruments such as power of attorney or proof of legal or parental representation, including a court-appointed guardianship. (14) Understanding the purpose and intended nature of a business relationship or occasional transaction enables obliged entities to develop a holistic understanding of the customer. This allows them to assess whether the service or product requested is aligned with the customer’s profile and to conduct meaningful ongoing monitoring. To this end, the type and amount of information collected may vary depending on the product or service and should be proportionate to the risks sought to be mitigated. This also means that certain information will not always be relevant. Information on the source of funds, where needed, may provide reassurance that the funds to be used are derived from a legitimate source. However, the extent of information needed on the source of funds, if at all, should be commensurate to the risk to be mitigated. To avoid unnecessary processing of information, obliged entities should consider whether information already at their disposal contributes to understanding the purpose and intended nature of the business relationship or occasional transaction. (15) Article 20(1), point (h), of Regulation (EU) 2024/1624 requires that obliged entities identify and verify the identity of the natural person on whose behalf or for the benefit of whom a transaction or activity is being conducted. This Regulation lays down specific rules for the identification and verification of the identity of the final investors of a collective investment undertaking that distributes its shares or units through another credit or financial institution, which acts in its own name but on behalf or for the benefit of one or more final investors. To ensure the effectiveness of customer due diligence measures and the proportionality of their application, it is appropriate to allow collective investment undertakings, where the relationship with the intermediary institution is not assessed as posing a high risk, to rely on that institution for the identification and verification of the final investors, provided that strict conditions are met. (16) Regulation (EU) 2024/1624 requires specific measures to be applied to transactions or business relationships with politically exposed persons (PEPs). The focus of this Regulation is on measures for the identification, by obliged entities of PEPs, their family members or persons known to be close associates. PEP screening measures should apply to the customer, its beneficial owner and the person on whose behalf or for the benefit of whom a transaction or activity is being carried out. These measures are important because once a PEP, family member or person known to be close associate is identified, the obliged entity should apply specific and additional customer due diligence measures in relation to that customer. (17) Simplified due diligence measures should ease the administrative burden on obliged entities and on their customers and allow obliged entities to focus efforts where risks are higher. (18) Minimum requirements for the identification of natural persons in low-risk situations should include at least the type of information that is usually included in a passport or identity document. As such, this Regulation permits that in situations of low risk, obliged entities are not required to collect and verify the address of the natural person. This ensures that obliged entities have sufficient and verifiable information to establish the identity of their customers, while keeping the requirements proportionate to the low level of money laundering / terrorism financing risk. (19) This Regulation specifies the minimum information to identify the purpose and intended nature of the business relationship or occasional transaction in low-risk situations. When assessing the purpose and intended nature in such situations, there may be situations in which the risk-based approach still requires obliged entities to determine whether any additional information, such as the source of funds, is needed to mitigate specific risks. (20) In situations where the money laundering / terrorism financing risks are higher, Regulation (EU) 2024/1624 calls for the application of enhanced due diligence measures to manage and mitigate these risks appropriately. These measures apply in addition to the customer due diligence measures laid down in Article 20 of Regulation (EU) 2024/1624. Where obliged entities obtain additional information in relation to the measures referred to in Article 34(4) of Regulation (EU) 2024/1624, to meet these requirements and mitigate the higher risk appropriately and effectively, that information should be of sufficient quality to enable an assessment of the authenticity and accuracy of the information already held on the customer and to inform the overall assessment of the business relationship or occasional transaction. (21) Additional information obliged entities obtain to understand customers’ and beneficial owners’ source of funds and source of wealth in high-risk situations should enable them to satisfy themselves that the funds and assets used by the customer and beneficial owners are of legitimate origin. (22) There may be situations where the information to be collected under Regulation (EU) 2024/1624 and this Regulation is already available to the obliged entity or, for example, to other obliged entities within the group. This could also be the case when information is obtained, for instance, to understand the customer's investment profile, insurance needs, the nature of the engagement or as part of the audit acceptance process. Where this is the case, obliged entities should consider how such information contributes to complying with their AML/CFT requirements, such as understanding the purpose and intended nature of the business relationship or occasional transaction, before requesting similar information to avoid unnecessary duplication and reduce the regulatory burden on both the obliged entity and its customers. Where existing information is not deemed sufficient, additional information should be obtained. (23) Customer due diligence measures include a specific requirement for obliged entities to verify whether the customer or the beneficial owner is subject to targeted financial sanctions as defined by Article 2(49) of Regulation (EU) 2024/1624. Screening for the application of trade or economic sanctions, such as arms embargoes, trade restrictions or travel bans, falls outside the scope of Regulation (EU) 2024/1624 and, consequently, of this Regulation. (24) Article 19(7) of Regulation (EU) 2024/1624 provides a list of four conditions on the basis of which AML/CFT supervisors may decide to grant an exemption for electronic money issuers from the customer due diligence measures in Article 20(1), points (a), (b) and (c), of that Regulation. To enable supervisors to determine the extent of such exemption (i.e. ‘in full or in part’) in a consistent way across Member States, this Regulation provides AML/CFT supervisors with a non-exhaustive list of risk factors associated with features of electronic money instruments. (25) This Regulation sets out the minimum attributes that electronic identification means or qualified trust services must include to enable the identification and verification of the identity of a person for customer due diligence purposes. Some data points are only required when they are available, such as certain elements of an address, and certain data points are not relevant in all situations, for example data points concerning legal entities are not relevant when the customer is a natural person. The electronic identification means or qualified trust services used must nevertheless enable the capture of the minimum attributes specified in Annex I in structured data fields, so that obliged entities can verify a broad range of customers. This does not mean that obliged entities using electronic identification means or qualified trust services should identify and verify a larger set of data than the identification data required under this Regulation or Regulation (EU) 2024/1624. (26) Obliged entities need to ensure that their customer information remains up to date. The maximum periods of 1 and 5 years respectively for updating customer information in accordance with the requirements of Article 26(2) of Regulation (EU) 2024/1624 should only start with the date of entry into force of this Commission Delegated Regulation for ongoing business relationships established before that date. (27) To allow obliged entities sufficient time to adapt, where necessary, their systems, policies, controls and procedures, including training of staff, to the requirements laid down in this Regulation, and thereby facilitate their effective implementation, this Regulation should apply six months after its entry into force. (28) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (the ‘Authority’). (29) The Authority has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based and analysed the potential related costs and benefits, ### HAS ADOPTED THIS REGULATION: ## SECTION 1 ### GENERAL PROVISIONS ### Article 1 ### Proportionality and risk-based approach This Commission Delegated Regulation (‘Regulation’) shall be applied in line with the risk-based approach. The extent and the nature of the information to be obtained and the measures to be applied by obliged entities shall be proportionate to the type and level of risk identified and shall enable obliged entities to manage and mitigate that risk appropriately, including through the application of simplified due diligence measures in situations of low risk. ## SECTION 2 ### INFORMATION TO BE COLLECTED FOR IDENTIFICATION AND VERIFICATION PURPOSES ### Article 2 ### Information to be obtained in relation to names 1\. In relation to the names and surnames of a natural person as referred to in Article 22(1), point (a)(i), and Article 22(2) of Regulation (EU) 2024/1624, obliged entities shall obtain all names, including first name(s) (given name(s)) and surname(s) (family name(s)) that feature on the identity document, passport or equivalent or through the electronic identification means and relevant qualified trust services referred to in Article 22(6), point (b), of Regulation (EU) 2024/1624. 2\. In relation to the name of a legal entity as referred to in Article 22(1), point (b)(i), or other organisations that have legal capacity under national law as referred to in Article 22(1), point (d)(i), of Regulation (EU) 2024/1624, obliged entities shall obtain the legal name and, where applicable, the trade name where it differs from the legal name. ### Article 3 ### Information to be obtained in relation to address 1\. The information on the address as referred to in Article 22(1) and (2) of Regulation (EU) 2024/1624 shall consist of the following information: (a) the full country name or the abbreviation in accordance with the International Standard for country codes (ISO 3166); (b) the name of a city, municipality, town or village, including postal code if such code has been issued and the name of the state where relevant; (c) street name, building number, apartment number and post-box number, where such information exists. 2\. For the purposes of the first paragraph, in the case of the senior managing officials referred to in Article 22(2) of Regulation (EU) 2024/1624, obliged entities may obtain the address of the registered or official office of the legal entity instead of the residential address and country of residence. ### Article 4 ### Specification on the provision of the place of birth The information on place of birth as referred to in Article 22(1), point (a)(ii), and Article 22(2) of Regulation (EU) 2024/1624 shall consist of at least the name of the country, state, city, municipality, town or village as it features on the identity document, passport or equivalent or through electronic identification means and relevant qualified trust services referred to in Article 22(6), point (b), of Regulation (EU) 2024/1624. ### Article 5 ### Specification on nationalities For the purposes of Article 22(1), point (a)(iii), and Article 22(2) of Regulation (EU) 2024/1624, obliged entities shall take reasonable measures to establish whether a natural person referred to in those Articles holds more than one nationality. Where a natural person declares more than one nationality, obliged entities shall record this information and verify at least one nationality. ### Article 6 ### Documents for the verification of identity 1\. For the purposes of verifying the identity of the natural person in accordance with Article 20(1), Article 22(6), point (a), and Article 22(7), point (a), of Regulation (EU) 2024/1624, the obliged entity shall use an identity document(s), passport(s) or equivalent document. A document shall be considered equivalent to an identity document or passport if it is issued by a designated authority in accordance with applicable the law and contains the following information: (a) first name(s) (given name(s)) and surname(s) (family name(s)) and the place and date of birth of the document holder; (b) the document’s number and date of expiration; (c) a facial image and the signature of the document holder; (d) security features to ensure authenticity. 2\. In situations where the natural person cannot provide an identity document, passport or document that meets the requirements in paragraph (1) for a legitimate reason such as their statelessness or refugee or subsidiary protection status, a document shall be considered equivalent to an identity document or passport if it is issued by a designated authority in accordance with the applicable law and contains the following information: (a) first name(s) (given name(s)) and surname(s) (family name(s)) of the document holder; (b) the date of birth of the document holder; (c) a facial image of the document holder. If the document provided does not contain the information specified in points (a) to (c), and provided there are no grounds for suspicion, obliged entities shall use additional reliable and independent means to obtain and verify missing information. 3\. For the purposes of verifying the identity of the persons referred to in Article 22(6) and Article 22(7), point (a), of Regulation (EU) 2024/1624, obliged entities shall obtain the identity document, passport or equivalent, or a verified copy thereof; verify the identity using electronic identification means or relevant qualified trust services; or act in accordance with Article 7. 4\. Electronic identification means and relevant qualified trust services, as described in Article 22(6), point (b), of Regulation (EU) 2024/1624, shall be permitted to verify the identity of the natural person also in a face-to-face context. 5\. For the purposes of verifying the identity of a customer that is not a natural person, obliged entities shall refer to the documents set out in Article 2(1), points (33) (a)(ii) and (b)(ii), of Regulation (EU) 2024/1624 and extracts from public registers that can be used for legal purposes, whether obtained from the customer or retrieved directly by the obliged entity. ### Article 7 ### Alternative verification measures in non-face-to-face circumstances 1\. For the purposes of verifying the identity of a natural person in accordance with Article 20(1), as set out in Article 22(6) and (7), point (a), of Regulation (EU) 2024/1624, where a natural person cannot reasonably be expected to submit the identity document, passport or equivalent in a face-to-face context and does not have access to electronic identification means and relevant qualified trust services that meet the requirements stipulated by Article 22(6), point (b), of Regulation (EU) 2024/1624, obliged entities shall verify the natural person’s identity through their identity document, passport or equivalent using alternative solutions that meet the conditions set out in this Article. 2\. Obliged entities shall ensure that the alternative solutions referred to in the first paragraph use reliable and independent information sources and include the following safeguards regarding the quality and accuracy of the data and documents to be verified: (a) controls are in place to ensure that the natural person presenting the customer’s identity document, passport or equivalent is the document holder; (b) the integrity and confidentiality of the communication through the solution are ensured; (c) any images, video, sound and data processed through the solution are captured in a readable format and of sufficient quality that the natural person is unambiguously identifiable; (d) where applicable, the identification process does not continue if technical shortcomings or unexpected connection interruptions are detected, or there are any doubts or suspicions regarding the identity of the natural person or the integrity of the verification process; (e) the information, documents and data verified through the alternative solution are valid and up to date, and copies are retained, time-stamped and stored securely by the obliged entity. The content of stored records, including images, videos, sound and data, shall be available in a readable format and allow for ex post verifications. 3\. Obliged entities using alternative solutions shall be able to justify why the customer could not be verified through the methods referred to in Article 22(6) of Regulation (EU) 2024/1624 and demonstrate to their supervisor that the alternative solutions used comply with the requirements of this Article. ### Article 8 ### Reliable and independent sources of information * Obliged entities shall take risk-sensitive measures to ensure that sources of information used for customer due diligence measures, including simplified and enhanced due diligence, are reliable and independent, having regard to: (a) the credibility of the source, including its reputation; (b) the official status and independence of the information source; (c) the extent to which the information is up to date; (d) the accuracy of the source, based on whether the information or data was subject to verification or validation or is consistent with other sources; (e) the ease with which the identity information or data provided can be forged. 2\. Obliged entities shall ensure that they understand the information required for customer due diligence purposes, regardless of the language in which that information is provided. ### Article 9 ### Identification and verification of the identity of the natural or legal persons using a virtual IBAN 1\. For the purposes of Article 22(3) of Regulation (EU) 2024/1624, credit and financial institutions shall obtain and verify the following information: (a) in relation to the natural or legal person(s) using the virtual IBAN, the information required pursuant to Article 22(1) of Regulation (EU) 2024/1624; (b) the virtual IBAN assigned to the natural or legal person(s). 2\. Credit and financial institutions, when obtaining information on the associated bank or payment account pursuant to Article 22(3) of Regulation (EU) 2024/1624, shall ensure that such information contains the associated bank or payment account number and the dates on which such associated bank or payment account was opened and, where applicable, closed. ### Article 10 ### Reasonable measures for the verification of the beneficial owner and the persons on whose behalf or for the benefit of whom a transaction or activity is being carried out When obliged entities take reasonable measures pursuant to Article 22(7), point (b), of Regulation (EU) 2024/1624, the information from the customer or other reliable sources may include the following information: (a) information from public registers, other than the central registers, or other reliable national systems, such as the business register, residence register, tax register, passport database and the property register, to the extent that these are accessible to obliged entities; or (b) information from other sources, which may include third-party sources, such as: (i) reputable data services providers, including credit agencies; (ii) credit institutions or financial institutions; (iii) obliged entities within the group; (iv) documents from the legal entity or the legal arrangement where the beneficial owner is named, and where the identity of the named person is certified by persons that are authorised for document certification purposes. ### Article 11 ### Understanding the ownership and control structure of the customer 1\. Obliged entities shall take risk-sensitive measures to ensure they understand the ownership and control structure of the customer pursuant to Article 20(1), point (b), of Regulation (EU) 2024/1624. 2\. For the purposes of the first paragraph and in situations where the customer’s ownership and control structure contain more than one legal entity or legal arrangement between the customer and their beneficial owners, obliged entities shall obtain the following information on those intermediate legal entities and/or legal arrangements: (a) the legal form of such entities and/or arrangements; (b) the existence of any nominee directors or shareholders; (c) the jurisdiction of incorporation or registration of the legal person or legal arrangement; (d) in the case of a trust, the jurisdiction of its governing law; (e) where applicable, the shares of interest held by each legal entity or legal arrangement, its subdivision, by class or type of shares and/or voting rights expressed as a percentage of the respective total; (f) where applicable, if a legal entity at an intermediate level of the ownership and control structure has its securities listed on a regulated market, information about the regulated market on which the securities are listed and the number and percentage of shares listed on a regulated market. 3\. Obliged entities shall ensure they understand how the ownership and control structure affect the money laundering and terrorist financing risks associated with the customer. 4\. Obliged entities shall assess whether additional information is needed to understand the ownership and control structure, having regard to elements that may increase complexity, such as: (a) the number of intermediate layers between the customer and the beneficial owner; (b) the presence of legal arrangements or similar legal entities in any of those layers; (c) the fact that the customer or any legal entities present at any of these layers are registered in high-risk jurisdictions; (d) the involvement of nominee shareholders or nominee directors in the structure. ### Article 12 ### Identification and verification of beneficiaries of trusts and similar legal entities or arrangements 1\. For the purposes of Article 22(4) of Regulation (EU) 2024/1624, the information obliged entities shall obtain from the trustee, legal entity or legal arrangement includes: * a description of the class of beneficiaries and its characteristics, which shall contain sufficient information to allow the obliged entity to determine whether individual beneficiaries are ascertainable at the time of payout or at the time of the exercise by the beneficiary of its vested rights, and shall be treated as beneficial owners; and * relevant documents to enable the obliged entity to establish that the description provided is correct and up to date. 2\. Obliged entities shall take risk-sensitive measures to ensure that the trustee, legal entity or legal arrangement provide timely updates, including on specific material events that may lead beneficiaries previously identified by class or characteristics to become ascertainable and thus beneficial owners. ### Article 13 ### Identification and verification of beneficiaries of discretionary trusts 1\. For the purposes of Article 22(5) of Regulation (EU) 2024/1624, the information obliged entities shall obtain from the trustee of the discretionary trust includes: (a) details on the objects of a power and default takers, to establish whether it is a class of natural or legal persons or if the natural or legal persons are already identified; (b) relevant documents to enable the obliged entity to establish that these details are correct and up to date. 2\. To comply with paragraph 1, obliged entities shall take risk-sensitive measures to: (a) obtain sufficient information about how and in which ways the power of discretion can be exercised by the trustee(s); (b) establish whether trustees have exercised their power of discretion and appointed one or more beneficiaries from among the objects of a power, or whether the default takers have become the beneficiaries due to the trustees’ failure to exercise their power of discretion. 3\. Obliged entities shall take risk-sensitive measures to ensure that the trustee provides timely updates, including on specific material events that may lead to beneficiaries to become ascertainable and thus beneficial owners. ### Article 14 ### Identification and verification of the person purporting to act on behalf of the customer In relation to the identification and verification of the person purporting to act on behalf of the customer as referred to in Article 22 of Regulation (EU) 2024/1624, and in addition to the information to be collected pursuant to the relevant provisions in Section 2, obliged entities shall obtain information that enables them to verify the existence and extent of the power of representation. ### Article 15 ### Identification and verification obligations for collective investment undertakings 1\. When a collective investment undertaking distributes its shares or units through another credit institution or financial institution that acts in its own name but on behalf or for the benefit of one or more final investors, it may fulfil the requirement under Article 20(1), point (h), of Regulation (EU) 2024/1624 by ensuring that the following conditions are met: * the credit institution or financial institution is subject to AML/CFT obligations in a Member State or in a third country that has AML/CFT requirements that are at least equivalent to those stipulated by Regulation (EU) 2024/1624; * the credit institution or financial institution is effectively supervised for compliance with obligations as provided for in point (a); * the risk associated with the relationship with the credit or financial institution is not high; and (d) the collective investment undertaking is satisfied that the credit institution or financial institution applies robust and risk-sensitive AML/CFT controls, including customer due diligence measures, to its own customers, which can be the final investors and its customers’ beneficial owners. 2\. A collective investment undertaking that relies on this Article shall be able to demonstrate to its supervisory authority, upon request by such authority, that the conditions under points (a) to (d) of the first paragraph have been complied with. ## SECTION 3 ### PURPOSE AND INTENDED NATURE OF THE BUSINESS RELATIONSHIP OR THE OCCASIONAL TRANSACTION ### Article 16 ### Identification of the purpose and intended nature of a business relationship or occasional transaction 1\. For the purposes of Article 20(1), point (c), and Article 25 of Regulation (EU) 2024/1624, obliged entities shall understand and, where necessary, obtain information on the purpose and intended nature of a business relationship or occasional transaction, which may include the following: (a) in relation to the purpose and economic rationale of the occasional transaction or business relationship, taking into account the nature of the product or service provided, information on: (i) the reason the customer has requested the obliged entities’ products or services; (ii) the intended use of the products or services requested by the customer; (iii) the reason for performing the occasional transaction; (iv) whether the customer has additional business relationships with the obliged entity or, where applicable, its wider group, and the extent to which that information influences the obliged entity’s understanding of the customer; (b) in relation to the estimated amount of the envisaged activities: (i) the estimated amount or range of funds to be deposited; (ii) the estimated amount or range of funds to be used in connection with the product offered or service provided, which may be supplemented, where available, with sectoral benchmarks or forecasts; (iii) information to understand the anticipated type and frequency of activities that are likely to be performed during the business relationship or occasional transaction; (iv) information to understand the anticipated number, size, volume, type and frequency of transactions that are likely to be performed during the business relationship or occasional transaction; * in relation to the source of funds, information to understand the activity that generated the funds and the means through which the customer’s funds were transferred, such as: (i) employment income, including salary, wages, bonuses and other compensation from employment; (ii) pension or retirement funds and government benefits, including social benefits; (iii) grants; (iv) business revenue; (v) capital provided by shareholders and intercompany funding; (vi) loans and credit facilities; (vii) saving and investment income and similar activities; (viii) inheritance, gifts, sales of assets and legal settlements; (d) in relation to the destination of funds, information on: (i) the expected types of recipient(s); (ii) the jurisdiction where the transactions are to be received; (iii) whether the recipient of the funds is the intended beneficiary of the transferred funds or acting as an intermediary for the beneficiary; (e) in relation to the business activity or the occupation of the customer, information such as: (i) the customer’s employment status; (ii) the sector in which the customer is active, including information on the customer’s industry, operations, products and services; (iii) whether the business activity or the occupation of the customer is regulated, including whether the customer is an obliged entity; (iv) whether the customer is actively engaged in business; (v) the geographical presence of the customer; (vi) information on the customer’s main sources of revenue; (vii) the customer’s key stakeholders. 2\. The extent of the information required pursuant to the first paragraph, and the extent of verification of that information shall be commensurate to what is necessary to understand the purpose and intended nature of the business relationship or occasional transaction, taking into account the money laundering and terrorist financing risks posed. 3\. When assessing the purpose and intended nature of a business relationship or occasional transaction, obliged entities shall also consider the information already available to them or from other obliged entities within the same group. ## SECTION 4 POLITICALLY EXPOSED PERSONS ### Article 17 ### Identification of politically exposed persons 1\. To identify a PEP, a family member, or person known to be a close associate of a PEP, pursuant to Article 20(1), point (g), of Regulation (EU) 2024/1624, obliged entities shall determine: (a) with the exception of the situations referred to in Article 44 of Regulation (EU) 2024/1624, before establishing a business relationship or carrying out an occasional transaction, if the customer, the beneficial owner of the customer and, where relevant, the person on whose behalf or for the benefit of whom a transaction or activity is being carried out, is a PEP, a family member, or person known to be a close associate; and (b) whether existing customers, the beneficial owner of the customer and, where relevant, the person on whose behalf or for the benefit of whom a transaction or activity is being carried out are or have become PEPs, family members or persons known to be close associates of a PEP. 2\. The determination specified in paragraph 1, point (b), shall take place: (a) with a frequency established on the basis of a risk-sensitive approach; (b) without delay in case of new information or changes in the information collected for the purposes of performing customer due diligence measures that may have an impact on the identification as a PEP, a family member or person known to be a close associate; (c) without delay in case of updates to the list of prominent public functions published pursuant to Article 43(5) of Regulation (EU) 2024/1624. 3\. To comply with paragraphs 1 and 2, obliged entities shall put in place tools and measures that may consist of automated screening tools, manual checks or a combination thereof. These tools and measures shall be effective and proportionate to the nature of the obliged entity's business, including its risks and complexity, and the size of the obliged entity. ## SECTION 5 SIMPLIFIED DUE DILIGENCE MEASURES ### Article 18 ### Minimum requirements for customer identification in situations of low risk 1\. In situations of low risk, obliged entities shall obtain at least the following information to identify the customer and the person purporting to act on behalf of the customer: (a) for a natural person: (i) all names, including first name(s) (given name(s)) and surname(s) (family name(s)) as set out in Article 2 of this Regulation; (ii) place of birth as set out in Article 4 of this Regulation; (iii) date of birth; (iv) nationalities of the natural person as set out in Article 5 of this Regulation or their statelessness, refugee or subsidiary protection status; * for a legal entity and other organisations that have legal capacity under national law: * the legal form; (ii) the legal name of the legal entity, and where applicable, its trade name where it differs from its legal name; (iii) the address of the registered or official office; (iv) where available, the registration number or tax identification number, or the legal entity identifier. 2\. Paragraph 1 shall also apply to persons on whose behalf or for the benefit of whom a transaction or activity is being carried out. ### Article 19 ### Identification and verification of the beneficial owner or senior managing officials in situations of low risk 1\. In situations of low risk, obliged entities may identify the beneficial owner or senior managing officials by consulting one of the following sources of information: (a) the information contained in the central register; (b) the information contained in a business or company register; (c) any information provided by the customer, including confirmation that the information obliged entities may already hold or that is shared within the group is adequate, accurate and up to date; (d) any publicly available information contained in a reliable independent open source. 2\. To verify the identity of the beneficial owner or senior managing officials in situations of low risk, the obliged entity may consult one of the sources of information listed in paragraph 1, points (b) to (d), that was not used for identification purposes. ### Article 20 ### Minimum information to identify the purpose and intended nature of the business relationship or occasional transaction in low-risk situations 1\. In order to apply simplified due diligence measures pursuant to Article 33(1), point (c), of Regulation (EU) 2024/1624, obliged entities shall take risk-sensitive measures to ensure they understand at least the following: (a) the intended use of the products or services requested by the customer; (b) where applicable, the estimated value of transactions during the business relationship or of the occasional transaction; (c) the business activity or occupation of the customer. 2\. The information referred to in paragraph 1 may be obtained from the customer or other sources or inferred from the product or service. ## SECTION 6 ### ENHANCED DUE DILIGENCE MEASURES ### Article 21 ### Additional information on the customer and the beneficial owners For the purposes of Article 34(4), point (a), of Regulation (EU) 2024/1624, additional information on the customer and the beneficial owner may include: (a) information to verify the customer and the beneficial owners or the ownership and control structure of the customer other than a natural person; (b) information to assess the reputation of the customer and the beneficial owners; (c) any other information that allows for a more comprehensive assessment of the money laundering / terrorism financing risks associated with the customer, the beneficial owners or any close relationships that are known to the obliged entity or publicly known; (d) in the case of high risk resulting from the complexity or absence of an apparent legitimate purpose of the ownership and control structure of the customer, an analysis or expert opinion on the economic, legal or other rationale behind the structure. ### Article 22 ### Additional information on the intended nature of the business relationship For the purposes of Article 34(4), point (b), of Regulation (EU) 2024/1624, additional information on the intended nature of the business relationship may include: (a) information to be satisfied that the destination of funds is consistent with the stated nature of the business relationship or occasional transaction and the customer’s risk profile; (b) information on the expected number, size, type, volume and frequency of transactions expected to be performed, to enable enhanced scrutiny of the activities taking place within the business relationship; (c) information on the customer’s key customers, business partners or associates, including, where relevant, the beneficial owner’s business partners or associates. ### Article 23 ### Additional information on the source of funds and source of wealth of the customer and of the beneficial owners For the purposes of Article 34(4), point (c), of Regulation (EU) 2024/1624, that additional information shall enable obliged entities to be satisfied that the source of funds or source of wealth is lawful. Such information may include: (a) in relation to proof of income: (i) tax declarations, tax assessment notices or other equivalent official documentation issued by, filed with or acknowledged by the competent tax authority; (ii) recent payslips or employment documentation specifying at least the amount of salary; (iii) other official income statements; * audited financial statements, investment documentation, credit facility agreements and loan agreements; * in the case of immovable property, public deeds or extracts from the property or residents register; * inheritance, gifts and legal settlements documentation, documentation from certified independent professionals or public authorities; (e) a property transfer contract or confirmation of change of ownership; (f) information from reliable asset or public registers; (g) information from reputable media publications or reputable commercially available service providers, including analytical services; (h) any other relevant information from independent and reliable sources, providing a high degree of reassurance that the customer’s and beneficial owners’ source of funds, and source of wealth are lawful and are consistent with the obliged entities’ knowledge of the customer and the nature of the business relationship. ### Article 24 ### Information on the reasons for the intended or performed transactions and their consistency with the business relationship Information collected for the purposes of Article 34(4), point (d), of Regulation (EU) 2024/1624, shall allow obliged entities to further scrutinise the intended or performed transactions. Such scrutiny may include: (a) the extent to which the reason provided for the transaction is credible and in line with the obliged entity’s knowledge of the customer, such as with regard to the customer’s declared business activity, source of funds or source of wealth; (b) the consistency of the overall transactions performed during the business relationship with the activities carried out and the customer’s turnover, especially in the case of economic activities characterised by the use of assets representing higher money laundering / terrorism financing risks; (c) information to clarify any higher risks the obliged entity may have identified in respect of the parties involved in the transaction, including any intermediaries, and their relationship with the customer. ## SECTION 7 ### TARGETED FINANCIAL SANCTIONS ### Article 25 ### Screening requirements 1\. Obliged entities shall establish whether their customers, the beneficial owners and the entities or persons that control or meet the ownership conditions stipulated in Article 20(1), point (d), of Regulation (EU) 2024/1624 are subject to targeted financial sanctions. Where there is a suspicion of circumvention or evasion of targeted financial sanctions, obliged entities shall also establish whether the person acting on behalf of the customer is subject to targeted financial sanctions. 2\. For the purposes of paragraph 1, obliged entities shall: (a) screen, through automated screening tools or solutions, manual checks or a combination thereof, at least the following information on customers, beneficial owners and the entities or persons that control or meet the ownership conditions in relation to such customers: * in the case of a natural person, all names, including first name(s) (given name(s)) and surname(s) (family name(s)), in their original alphabet and/or transliterated into the Latin alphabet; (ii) in the case of a legal person, the legal name of the legal person, and, where applicable, trade names where they differ from the legal name in the original alphabet and/or transliterated into the Latin alphabet; (iii) where available, any other names, aliases and digital wallet addresses, and where included in the lists of targeted financial sanctions. Obliged entities shall determine whether to use automated screening tools, manual checks or a combination thereof having regard to the nature of the obliged entity's business, including its risks and complexity, and the size of the obliged entity, ensuring that the screening arrangements are effective; (b) in the case that any of the persons specified in Article 20(1), point (d) of Regulation (EU) 2024/1624 are identified as subject to targeted financial sanctions, the information referred to in point (a) shall be checked against all available due diligence information related to that person. In the case of doubt, the obliged entity shall refer to all other sources available to them, including public sources of information, such as registers of owned and controlled entities and central registers; (c) screen their customers, beneficial owners and entities or persons that control or meet the ownership conditions under Article 20(1), point (d), of Regulation (EU) 2024/1624, at least under the following circumstances: (i) when entering into a business relationship or performing an occasional transaction; (ii) when there is a change in any of the existing targeted financial sanctions or in the case of credit and financial institutions a new designation is made pursuant to Article 26(4) of Regulation (EU) 2024/1624; (iii) when there is a change in the due diligence data of an existing customer, beneficial owner, or entity or person that controls or meets the ownership conditions under Article 20(1), point (d), of Regulation (EU) 2024/1624, such as but not limited to a change of name, residence, nationality or business operations, or a change in beneficial owner or designation of beneficiary, which may have a potential impact on the designation as a listed person, body or entity; (d) screen their customers, beneficial owners and entities or persons that control or meet the ownership conditions under Article 20(1), point (d), of Regulation (EU) 2024/1624 on a regular basis with a frequency that is commensurate with the exposure of the obliged entity and the business relationship to risks of non-implementation and evasion of targeted financial sanctions; (e) ensure that the screening and verification are performed without undue delay from the moment the UN financial sanctions are made public; (f) ensure that the screening and verification are performed without undue delay from the moment the updated targeted financial sanctions are applicable. ## SECTION 8 ### RISK FACTORS ASSOCIATED WITH FEATURES OF ELECTRONIC MONEY INSTRUMENTS ### Article 26 ### Risk factors Where supervisors decide to allow for an exemption specified under Article 19(7) of Regulation (EU) 2024/1624, supervisors shall consider one or more of the following risk factors to determine the extent of that exemption: (a) the extent to which the payment instrument has low transaction limits or thresholds to limit transaction values; (b) the nature of the goods or services that can be acquired, including the level of risks associated with these goods and services; (c) the extent to which the transactions through the electronic money instrument are executed by an obliged entity that applies customer due diligence measures and record-keeping requirements laid down in Regulation (EU) 2024/1624; (d) the extent to which the payment instrument has a specific and limited duration in which it can be used; (e) the extent to which the payment instrument is available through direct channels, which may include the issuer or a network of service providers; (f) the extent to which the payment instrument has a limited geographical distribution; (g) the extent to which the issuer applies adequate safeguards, including geofencing, monitoring, IP tracking and other technological measures to detect and prevent unauthorised activity and to restrict access to the payment instrument from third counties; (h) the extent to which the issuer has measures in place to monitor the merchants that accept payments through the payment instrument in order to prevent and detect suspicious activities; (i) the measures implemented by the issuer to detect and prevent suspicious bulk purchasing of the payment instrument by or for the benefit of the same person. ## SECTION 9 ### ELECTRONIC IDENTIFICATION MEANS AND RELEVANT QUALIFIED TRUST ### SERVICES ### Article 27 ### Electronic identification means and relevant qualified trust services 1\. Annex I defines the corresponding list of attributes that electronic identification means and qualified trust services are required to feature in accordance with Article 22(6), point (b), of Regulation (EU) 2024/1624, in order to fulfil the requirements of Article 20(1), points (a) and (b), and Article 22(1) of that Regulation, for the purposes of applying standard and enhanced due diligence measures. Where simplified due diligence is to be applied, the electronic identification means and relevant qualified trust services shall have the corresponding attributes laid down in Annex I that allow compliance with Section 5 of this Regulation. * Where an electronic identification means or qualified trust service does not possess all attributes that allow for the identification and verification of the customer or beneficial owner, as required in Article 22 of Regulation (EU) 2024/1624 or Section 5 of this Regulation, the obliged entity shall take steps to obtain and verify the missing attributes through other means in line with Article 22(6) of Regulation (EU) 2024/1624. ## SECTION 10 TRANSITIONAL PROVISIONS ### Article 28 Transitional provisions In the case of existing business relationships established before the date of entry into force of this Regulation, the documents, data and information relating to those customers shall be brought in line with the requirements of this Regulation and Regulation (EU) 2024/1624 on a risk-sensitive basis within the periods set out in Article 26(2) of Regulation (EU) 2024/1624. ### Article 29 ### Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from six months after the date of its entry into force except in relation to obliged entities referred to in Article 3, points (3)(n) and (o), of Regulation (EU) 2024/1624, to which it shall apply from 10 July 2029. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, For the Commission The President ANNEX I List of attributes referred to in Section 9 Article 22(1) of Regulation (EU) Corresponding attributes[^5] 2024/1624 (a) for a natural person (i) all names and surnames * family\_name * given\_name (ii) place and full date of birth * birth\_date * birth\_place (iii) nationalities, or statelessness and refugee or subsidiary protection status where applicable, and national identification number, where applicable * nationality * other existing attributes covering statelessness and refugee or subsidiary protection status (where applicable) * personal\_administrative\_number (where applicable) (iv) the usual place of residence or, if there is no fixed residential address with legitimate residence in the Union, the postal address at which the natural person can be reached and, where available the tax identification number * resident\_country * resident\_state * resident\_city * resident\_postal\_code * resident\_street * resident\_house\_number * resident\_address * other existing attributes covering the tax identification code (where available) (b) for a legal entity (i) legal form and name of the legal entity * current legal name * other existing attributes covering legal form * a unique identifier constructed by the sending Member State in accordance with the technical specifications for the purposes of cross-border identification and which is as persistent as possible in time (ii) address of the registered or official office and, if different, the principal place of business, and the country of establishment * current address * other existing attributes covering additional addresses * other existing attributes covering the country of creation (iii) the names of the legal representatives of the legal entity as well as, where available, the registration number, tax * other existing attributes covering the names of the legal representatives of the legal entity * Legal Entity Identifier (LEI) (where available) identification number and Legal Entity Identifier VAT registration number or tax reference number (where available) other existing attributes covering the registration number (where available) * other existing attributes covering the names of persons holding shares or a directorship position in nominee form, including reference to their status as nominee shareholders or directors (iv) the names of persons holding shares or a directorship position in nominee form, including reference to their status as nominee shareholders or directors ## 4 Accompanying documents ### 4.1 Impact assessment with cost-benefit analysis #### Introduction As per Article 49(1) of Regulation (EU) 2024/1620, before submitting draft regulatory technical standards to the European Commission, AMLA shall conduct open public consultations and analyse the potential related costs and benefits. This analysis presents the Impact assessment with cost-benefit analysis (IA/CBA) of the main policy options included in the draft RTS on CDD under Article 28(1) AMLR. This IA/CBA is qualitative and quantitative in nature. The policy choices have been taken primarily in accordance with qualitative considerations, taking into account the experience and professional judgment of supervisors from the financial and the non-financial sectors, self-regulatory bodies (SRBs), and the European Commission. In addition, the analysis was complemented with evidence collected through the public consultation conducted between 9 February and 8 May 2026. This included, among other, information from obliged entities regarding the expected one-off implementation and recurring costs associated with the draft RTS. While the quantitative evidence is based on stakeholders’ estimates and does not constitute a comprehensive assessment of costs across all obliged entities, it provides a useful indication of the expected financial and resource implications of the draft RTS. Where quantitative evidence remained limited or unavailable, the analysis is supported by structured qualitative reasoning and professional judgement informed by supervisory experience and stakeholders’ input. ### A. Problem identification CDD requirements are essential to ensure that obliged entities identify and verify their customers and monitor their business relationships, in relation to the money laundering and terrorist financing (ML/TF) risks that they pose. It is therefore necessary to achieve a uniform and high-standard application of CDD measures in the Union, relying on harmonised requirements, amongst others, for the identification of customers and verification of their identity, as well as identification of the purpose and intended nature of the business relationships and occasional transactions. This ensures the consistent application of the provisions throughout the Union, thus allowing for a level-playing field across sectors and within the internal market. At the same time, it is essential that obliged entities apply CDD measures in a risk-based manner. Under the previous EU AML/CFT framework, relying heavily on the national implementation of EU requirements, notably Directive (EU) 2015/849 and its amendments, the effective prevention of ML/TF was hampered due to divergent interpretations of the AML/CFT framework across Member States. Although the earlier framework sought to ensure equivalent safeguards, the national discretion in transposing the CDD requirements resulted in regulatory divergences that created legal uncertainty and additional costs for obliged entities operating on a cross-border basis, regulatory arbitrage risks, and uneven levels of protection against ML/TF within the internal market. To address these shortcomings, the AMLR introduces harmonised, directly applicable rules, including CDD obligations that are uniform throughout the Union and across sectors. This ensures that obliged entities are subject to the same standards for requirements such as customer and beneficial ownership identification and verification, and ongoing monitoring. The AMLR also broadens the scope of obliged entities within the AML/CFT framework, introducing new categories that were not previously subject to AML/CFT requirements, including CDD measures. These include crowdfunding service providers, investment migration operators, football clubs and agents, credit intermediaries for mortgage and consumer credits, non-financial mixed activity holding companies, as well as types of crypto-asset service providers and traders in certain high-value goods, the latter of which were considered obliged entities under the previous framework within narrower aspects of their business activities. By expanding the list of obliged entities, the Regulation seeks to address emerging ML/FT risks in the financial and non-financial sectors by ensuring that gatekeepers to the financial system are in a position to protect the internal market from criminal misuse. To ensure that all obliged entities have a clear understanding of CDD requirements and apply those obligations consistently and according to a risk-based approach, Article 28(1) AMLR requires AMLA to develop draft RTS on CDD. ### B. Policy objectives The overarching objective of this mandate is to further ensure the consistent, proportionate, and harmonised application of CDD measures by all obliged entities in the EU, drawing upon the experience and support of supervisors in the financial and non-financial sectors. More specifically, these draft RTS establish a harmonised framework specifying the information that obliged entities shall collect for the purpose of performing standard due diligence, including the information to be collected for identification and verification purposes and for identifying the purpose and intended nature of the business relationship or the occasional transaction; the type of simplified due diligence (SDD) measures to be applied in case of lower risk; and the additional information to be collected for the purposes of enhanced due diligence (EDD). The draft RTS also promote a consistent approach towards determining the extent of the exemption under Article 19(7) AMLR for certain electronic money instruments from CDD requirements, by specifying the risk factors associated with features of electronic money instruments that supervisors must take into account in that regard. In addition, the draft RTS set out the reliable and independent sources of information for verifying the identification data of natural and legal persons and define the attributes that electronic identification means and relevant qualified trust services must meet for the purposes of standard due diligence, SDD, and EDD. Overall, the draft RTS aim to clarify and specify how certain obligations established by the AMLR should be applied, within the boundaries of the requirements imposed by the Regulation and without imposing additional obligations. The draft RTS aim to provide details where required by the legal mandate and where this brings added value for obliged entities, in line with the underlying principle of proportionality and bearing in mind the need to ensure effectiveness in the fight against ML/TF without imposing unnecessary regulatory burden on the private sector. As an overarching objective, the draft RTS contribute to the harmonised, risk-based goal of the AML/CFT package, by setting robust and consistent requirements that are at the same time proportionate and risk-based. The framework is designed to be technologically neutral and to achieve a high level of harmonisation, including sector-specific criteria where necessary. ### C. Baseline scenario Under the baseline scenario, obliged entities would apply the CDD obligations as set out in Chapter III of the AMLR. The relevant provisions in that Regulation are more detailed than those of the currently applicable Directive, enabling a greater degree of harmonisation in the Union. However, the level of detail, particularly on the information to be collected, is not sufficient to guarantee the consistent and effective application of those CDD measures. These gaps may give rise to different supervisory approaches and expectations, which would continue to pose a regulatory burden on obliged entities that operate across borders. Where rules are not sufficiently clear, there is an additional risk that obliged entities apply different standards and their supervisors have different supervisory expectations, creating an uneven playing field across the Union. Furthermore, the AMLR grants supervisors discretion to exempt certain electronic money instruments from some of the CDD rules, subject to a proven low risk. The AMLR requires AMLA to specify the risk factors that supervisors should take into account when determining the extent of that exemption. In the absence of a commonly agreed set of minimum risk factors, supervisors might apply divergent criteria. This may create an uneven landscape in which some Member States base their decisions on a narrower set of risk factors than others or otherwise fail to take important risks into account. Given that an exemption granted by one national supervisor has implications across the internal market, Member States must have a degree of reassurance on the exemptions granted within the Union. A common set of minimum risk factors is needed to reach these objectives. Finally, technological innovation in the area of qualified trust services and electronic identification could be hampered by uncertainty on the attributes that such solutions should feature if they are to be compliant for verification purposes. ### D. Options considered, cost-benefit analysis, and preferred option Section D. presents the main policy options discussed and the decisions taken by AMLA during the development of the draft RTS. The background part describes the process followed by AMLA to deliver this legal mandate, while the methodological section explains how the IA/CBA has been conducted and how stakeholders’ input has been taken into account. After that, the different policy options, along with the assessment of their potential costs and benefits, followed by the choice of the preferred option, are presented. Lastly, the assessment of the additional evidence collected as part of the public consultation is presented. #### Background Article 28(1) AMLR requires AMLA to develop draft RTS on CDD, in line with the overall objective to introduce directly applicable rules that ensure the consistent, proportionate, and harmonised application of CDD measures by all obliged entities in the EU. To lay the ground for the development of this important mandate before AMLA’s establishment, on 12 March 2024 the European Commission issued a Call for Advice to EBA. To prepare its response, the EBA established a drafting process involving experts from 60 EU AML/CFT supervisors. Given the EBA’s remit on the financial sector, most of the supervisors involved were responsible for the financial sector, but some were supervising both the financial and non-financial sectors. The EBA also engaged closely with the European Commission, the other European Supervisory Authorities (ESAs), and AMLA, once established. In addition, the EBA engaged with the private sector and consumer groups, the Financial Intelligence Unit (FIU) Platform, the European Data Protection Board (EDPB) and the EDPS. The process also included a 3-month public consultation as well as a public hearing, which more than 600 stakeholders joined. The draft RTS that went out for public consultation were amended, based on the written feedback provided by 170 respondents, mostly belonging to the financial sector, but also the non-financial sector albeit to a lesser extent, as well as feedback from the EDPB and EDPS. The EBA submitted its response to the European Commission’s Call for Advice on 30 October 2025. The response was formally delivered to AMLA immediately after that. In line with its mandate, the EBA’s response focused on the financial sector. In parallel, to specifically address the needs of the non-financial sector, the European Commission set up an informal subgroup of its Expert Group on Money Laundering and Terrorism Financing (EGMLTF) comprising representatives of non-financial supervisors, to complement the EBA’s work with sector-specific input, where needed. The outcome of this exercise was formally handed over to AMLA in September 2025. Through this work the European Commission provided technical advice to facilitate AMLA’s delivery of the mandate under Article 28(1) AMLR. Building on this work, AMLA reviewed and, where needed, amended the EBA’s draft RTS, taking into consideration the European Commission’s input regarding the non-financial sectors, and input collected from other stakeholders representing both the financial and the non-financial sectors. #### Overarching principles Overall, in line with the objectives set out in the AMLR, the draft RTS aim to ensure a high level of harmonisation across Member States and sectors, while preserving flexibility for obliged entities to apply a risk-based approach. In particular, AMLA sought to preserve and promote the risk-based approach, focusing on effective, workable outcomes within the parameters of the AMLR. The policy decisions also adhere to the principle of proportionality. This means that the draft RTS aim to define obligations that are suitable and necessary to achieve the desired outcomes, and do not impose additional burden on the obliged entities that is excessive in relation to the objective pursued. In addition, AMLA placed a particular focus on simplification, by avoiding specifying further provisions in the draft RTS where the AMLR is sufficiently clear, and by ensuring flexibility by setting out options obliged entities shall consider when deciding on the most effective and proportionate measures, according to the risk profile of their customers and the nature of the products or services offered. Moreover, AMLA strived to be comprehensive, by considering the material impact of this regulatory instrument on all obliged entities within both the financial and non-financial sectors, including entities which were not subject to CDD requirements under the previous AML/CFT framework, as well as new AML/CFT supervisors and competent authorities. In addition, AMLA ensured to be unbiased by considering the perspective of the different obliged entities to which this regulatory product is addressed, giving equal importance to the interests and needs of the obliged entities that are impacted at the same level, regardless of whether they operate in the financial or the non-financial sector. The principle of technological neutrality was also respected, for example in relation to the measures related to verification of the identity on a non-face-to-face basis, as well as the screening requirements for the identification of politically exposed persons and the screening of customers and beneficial owners against targeted financial sanctions. Lastly, AMLA aimed to ensure continuity of the regulatory framework by building on the work already undertaken and validated by the EBA and its AML/CFT stakeholders, while also taking into account further input from AMLA’s stakeholders in both the financial and non-financial sectors. Changes to the EBA’s proposed text were therefore limited to duly justified cases. AMLA focused on adapting the draft RTS where necessary to reflect AMLA’s specific mandate and findings, ensuring harmonised regulatory expectations across both the financial and non-financial sectors, while preserving the integrity of the foundational work conducted by the EBA. #### Policy issue 1: Applicability and proportionality to the financial and non-financial sectors In its response to the European Commission's Call for Advice, the EBA highlighted that several of the provisions set out in the proposed draft RTS apply to obliged entities in the non-financial sector in the same manner as they apply to institutions in the financial sector. At the same time, considering the significant differences between the financial and non-financial sectors in terms of business models, operation, AML/CFT capacity and compliance maturity, the EBA suggested that AMLA may wish to assess the need for separate, standalone RTS on CDD measures for the non-financial sector. Therefore, the first decision made by AMLA focused on assessing the cross-sectoral applicability of the draft RTS developed by the EBA and their proportionality on non-financial sector obliged entities. In that context, AMLA considered the following options: * A. Adopting a sector-specific approach, by developing two separate draft RTS for the financial and the non-financial sectors. * B. Adopting a horizontal approach, by issuing one single draft RTS setting flexible, horizontal provisions, complemented with limited, targeted sector-specific measures only where necessary. #### Option A Under Option A, two distinct draft RTS would be developed, one applicable to the financial sector and one to the non-financial sector, including specific provisions reflecting identified differences in business models, risk exposure, and operational needs. #### Benefits * This approach would allow for tailored CDD requirements, closely aligned with sector specificities and operational realities. * It would also allow for more tailored expectations by requiring the use of specific sources or types of documents, which could be useful especially for those obliged entities which have been subject to CDD requirements for the first time under the new AML/CFT framework. * This may reduce the need for interpretative guidance at a later stage for sectors with very specific business models and operational needs. * Sector-specific draft RTS might be easier to apply for some categories of obliged entities, particularly those that are different to traditional credit and financial institutions, as more tailored and prescriptive provisions may limit the room for interpretation in the practical application of specific measures. #### Costs * This approach risks undermining the risk-based approach that underpins an effective AML/CFT regime. The specific rules may reduce the discretion left to obliged entities to determine which measures, including information and documents to be collected, are most appropriate to address the specific risk posed by a given business relationship or occasional transaction. This would in turn reduce the opportunity to focus on resources where risks are higher. This may also reduce an obliged entity’s ability to apply measures that are equally or more effective than those specified in the draft RTS. * When considering that both the financial and non-financial sectors present a certain level of heterogeneity in their subsectors, the rationale for having one instrument for the financial sector and another instrument for the non-financial sector becomes less clear. * Moreover, separate instruments will likely result in different rules for the same requirements. As the CDD requirements (e.g., understanding the ownership and control structure) do not inherently change by sector, there is no obvious, substantial justification for requiring different information and documents to be collected for the financial and non-financial sectors. * In line with the previous point, this approach would aggravate regulatory fragmentation, thus undermining the harmonisation objective pursued by the AMLR and creating an unlevel playing field across Member States and sectors, ultimately increasing the risk of inconsistent application of CDD measures across the Union. * The separation of the draft RTS might also lead to higher compliance costs for obliged entities operating across both the financial and non-financial sectors, which would need to comply with varying regulatory requirements. In practice, this would entail the development and maintenance of parallel internal policies and procedures, additional legal analysis and compliance oversight, higher training and adaptation costs, and would ultimately increase operational complexity. * Lastly, in the medium-long term, updating separate draft RTS would potentially reduce regulatory agility, given the lengthy regulatory process required, particularly where emerging ML/TF risks affect both sectors simultaneously. This would result in slower regulatory responses, increase the risk of regulatory gaps, and potentially delay legal certainty for obliged entities. Assessment: while offering greater granularity and providing tailored sector-specific guidance, this option would entail disproportionate costs relative to the benefits for obliged entities and supervisors. Given that core CDD measures under Level 1 are largely identical across sectors, introducing two separate draft RTS for the financial and the non-financial sector would create unnecessary and unjustified complexity. It would also lead to unnecessary fragmentation without materially improving CDD effectiveness, running counter to the harmonisation objective pursued by the AMLR. #### Option B Under Option B, a single draft RTS would apply to both the financial and non-financial sectors, establishing common CDD requirements, with proportionality and flexibility embedded through risk-based application rather than sector-specific rules. Targeted sector-specific provisions would only be introduced where necessary and justified. #### Benefits * In line with the objective of the AMLR, this approach would promote harmonisation and support the level-playing field, by ensuring consistency and legal clarity across all obliged entities. * A common draft RTS would adhere to the risk-based approach, by setting horizontally applicable CDD requirements which can be applied in a flexible way to address the level and nature of the ML/TF risk identified, rather than differentiating rules according to the sector in which the obliged entity operates. * This approach would also allow the draft RTS to address clearly identified and duly justified sectoral specificities, increasing legal certainty for obliged entities with specific operational needs. * Horizontally applicable provisions would be future proof, being flexible enough for obliged entities to respond to emerging and evolving ML/TF risks and allow them to determine the extent, method and type of information or documents needed to mitigate the ML/TF risks they identify, regardless of sector, product or service. * For obliged entities operating cross-sectoral, this approach would foster simplification and reduce implementation and compliance costs, as the same flexible requirements would apply regardless of sector, product offered, or service provided. #### Costs * The objective to provide legal certainty might not always be achieved, since some entities might face interpretative challenges in applying horizontal rules to very sector-specific business models. This might lead to increased compliance costs for obliged entities, along with increasing the risk of neglectful application due to misinterpretation. * If interpretative challenges arise, interpretative guidance would be needed at a later stage, resulting in increased costs for supervisors by requiring the translation of horizontal rules into sector-specific guidance. Assessment: this approach would be coherent with the co-legislator’s approach in the AMLR, which is to ensure a high level of harmonisation while adhering to the risk-based approach. #### Overall impact assessment and cost-benefit analysis Based on the assessments described above, these draft RTS adopt a horizontal approach with targeted sector-specific measures where necessary (Option B), with one single regulatory instrument setting flexible, horizontal provisions and requirements, complemented with limited, targeted sector-specific measures. The draft RTS are designed to be consistent with the risk-based approach of the AMLR, requiring obliged entities to scale the extent and depth of CDD measures according to ML/TF risks, including those arising out of the business model and customer type. Input from supervisors in the financial and non-financial sectors indicated that principle-based draft RTS provide sufficient flexibility to accommodate sectoral differences in most cases, and that a horizontal framework supports legal certainty, particularly for obliged entities operating across multiple sectors or jurisdictions. Applying the same core CDD principles across sectors also ensures regulatory coherence and reduces the risk of divergent interpretations and expectations across sectors. Feedback from supervisors also suggests that CDD challenges are not primarily sector-specific but risk specific, meaning that the determining factor should be the risk posed by the customer and the transaction, and the application of proportionate, risk-based CDD measures, rather than the sector in which the obliged entity operates (i.e., same risk, same rules). Based on feedback from non-financial supervisors, while in certain cases sectoral specificities in the non-financial sectors translate into specific regulatory requirements at national level, those needs cannot be addressed within this mandate. Since those rules mainly reflect operational differences, AMLA expects that the new, harmonised framework will address many of the divergent practices and divergent supervisory expectations, and any remaining divergence would be better addressed through targeted interpretative guidance rather than differentiated obligations. This decision acknowledges that some newly introduced obliged entities, particularly in parts of the non-financial sector, may incur initial compliance costs in interpreting how horizontal CDD principles apply to their specific business models, mainly associated with internal legal analysis, policy updates, and staff training. However, many of these costs would arise from the application of the AMLR on its own, independently of the draft RTS. Moreover, such costs are expected to be counterbalanced by an increase in the effectiveness of the application of CDD measures over time and would be justified by the objective pursued. In line with the simplification and burden reduction objectives, these draft RTS adopt a streamlined approach, avoiding excessive detail and supporting sector compliance on a risk-based basis. Overall, the benefits outweigh the costs. Principle-based, horizontal provisions ensure harmonisation and legal certainty, while avoiding the significant administrative and compliance burden that would arise from developing and maintaining extensive sector-specific rules for a highly diverse set of obliged entities. While some short-term interpretative costs may arise, particularly for parts of the non-financial sector, these would be mitigated by the principle-based nature of the requirements and can be addressed through targeted interpretative guidance, if necessary. While compliance costs may arise in the short term, these would be counterbalanced by an increase in the effectiveness of the application of CDD measures over time, with an overall benefit in terms of prevention of ML/TF risks. #### Policy issue 2: Potential amendments to the EBA’s draft RTS The second assessment conducted by AMLA focused on evaluating whether and to what extent the draft RTS proposed by the EBA needed to be amended, based on the subsequent input collected. In that context, AMLA considered the following options: * A. Retaining the policy approach set out in the draft RTS proposed by the EBA with targeted amendments where necessary. * B. Using the draft RTS proposed by the EBA as a baseline while reopening the underlying policy approach and proposing substantive amendments. #### Option A Under Option A, AMLA’s draft RTS would retain the policy approach and overall structure of the draft RTS proposed by the EBA, while introducing targeted amendments aimed at further enhancing legal clarity, ensuring consistency with the AMLR, and enhancing applicability of the draft RTS across all categories of obliged entities. These amendments would reflect the outcomes of AMLA’s assessment and additional input collected. #### Benefits * This approach would allow AMLA to preserve the policy framework developed by the EBA and focus on changes that a) ensure that the text of the draft RTS is applicable for all categories of obliged entities, including those in the non-financial sector, and b) promote further legal clarity and consistency with the AMLR. * By building on the consensus already reached by the EBA and supervisors through the drafting and governance process previously established by the EBA, and noting the significant resources dedicated to delivering the draft RTS, this approach aims to facilitate the swift adoption of the draft RTS, also avoiding potential delays in the regulatory process. * This approach would also ensure continuity for obliged entities and supervisors that were already familiar with the EBA’s proposed text and expected that AMLA would not fundamentally depart from it, possibly also facilitating the swift implementation of the draft RTS by obliged entities that were already familiar with its content and preparing to implement it. #### Costs * In preparing its reply to the Call for Advice, the EBA focused on the financial sector. Consequently, certain provisions may not fully reflect the diverse scope of sectors covered by AMLA’s draft RTS, which are extended to the non-financial sector. * This approach would limit AMLA’s opportunity to reopen the underlying policy approach and structure of the EBA's draft RTS beyond targeted amendments aimed at improving legal clarity, consistency and applicability. Assessment: this approach represents a robust and low-risk baseline, capitalising on the maturity of the EBA’s proposed text. It prioritises continuity and cost efficiency, and supports a smooth transition to the new framework, while ensuring that AMLA can propose changes where necessary to improve clarity, consistency and proportionality of the final text, as well as the applicability of the framework to the non-financial sector. #### Option B Under Option B, the draft RTS proposed by the EBA would serve merely as a starting point, with AMLA reopening the underlying policy approach and overall structure of the draft RTS and introducing substantive amendments across a wide range of provisions. #### Benefits * This approach would allow AMLA to undertake a broader review of the underlying policy approach and overall structure of the draft RTS in light of its own assessment and the additional stakeholder input collected. * It would also provide AMLA with greater flexibility to redesign regulatory provisions and introduce more extensive policy and structural changes where considered appropriate. #### Costs * This approach would entail significant drafting, governance and consultation costs associated with reopening policy choices that had already been extensively developed through the EBA drafting process. This would duplicate the discussions previously undertaken by the EBA and supervisors, posing an unnecessary burden on AMLA and supervisors’ resources. * Obliged entities and supervisors which were relying on the adoption of the draft RTS proposed by the EBA might face additional adaptation costs and greater legal uncertainty during implementation. Assessment: this option prioritises reassessing the underlying policy approach and overall structure of the draft RTS over continuity with the mature framework already developed by the EBA. While this could allow greater policy redesign, it would likely result in additional drafting effort, longer implementation timelines, increased legal uncertainty and higher adaptation costs for obliged entities and supervisors. #### Overall impact assessment and cost-benefit analysis Based on the assessments described above, these draft RTS follow the approach described under Option A. The policy approach and overall structure of the draft RTS proposed by the EBA have been retained, with targeted amendments based on AMLA’s assessment and the input collected through AMLA’s public consultation. This approach preserves continuity, aiming to ensure the swift adoption of this important regulatory instrument and to support a smooth transition to the new framework. This approach considers that the draft RTS proposed by the EBA had already been amended based on the outcome of the EBA’s public consultation, and that consensus had already been reached between supervisors and the EBA. Overall, the policy framework developed by the EBA was considered sufficiently robust and flexible to accommodate the diverse scope of obliged entities, allowing consistent application across both the financial and non-financial sectors. By retaining the policy approach and overall structure of the EBA’s draft RTS, this option allows AMLA to focus resources on improving the draft text to increase proportionality and legal clarity, enhance its applicability across all obliged entities, particularly in the non-financial sector, and to identify the most appropriate ways to reflect input received through the public consultation. This approach also minimises transition risks for stakeholders that are already familiar with the earlier draft texts. Overall, the benefits outweigh the costs. Retaining the policy approach underpinning the draft RTS proposed by the EBA limits structural and operational burden, ensures regulatory stability, and reinforces confidence among obliged entities and supervisors. At the same time, the amendments introduced by AMLA improve legal clarity, consistency with the AMLR, proportionality and the applicability of the framework across all categories of obliged entities, while preserving continuity with the mature policy framework developed by the EBA. The draft RTS remain fit for purpose, future-proof, and aligned with AMLA’s mandate, providing a solid foundation for targeted refinements or guidance over time, if needed. #### Further assessments During the public consultation, respondents had the opportunity to provide supporting data, evidence, or concrete examples to substantiate any proposals or suggested amendments to the draft RTS. In particular, stakeholders were invited to submit quantitative information illustrating sector-specific risks, operational constraints, compliance costs, or supervisory impact, where relevant. This evidence-based input supported AMLA in re-assessing, where justified, whether proposed changes would be proportionate, justified, and consistent with the risk-based approach underpinning the draft RTS, and in determining whether any further clarification or targeted adjustments would be warranted. In particular, it supported AMLA’s work in ensuring that CDD rules can be applied in a risk-based manner regardless of the product or service offered or the category of obliged entity. Based on the feedback provided through the public consultation, targeted amendments were made to address the issues that warranted a revision. These amendments took into account the additional evidence provided by the respondents, including obliged entities in the non-financial sector, which may not have contributed to the previous EBA’s public consultation. The amendments are aimed at providing more clarity, reducing burdens and prescriptiveness, and enabling greater flexibility, while maintaining the robustness of the measures and the underlying principles. Respondents also called for sector-specific examples or further sectoral guidance. However, examples could not be included due to the nature of the draft RTS. Moreover, the draft RTS should remain principle-based to preserve a risk-based and proportionate approach. To address sectoral concerns, AMLA will assess the possibility to provide further guidance after the publication of the draft RTS. #### Assessment of the expected implementation costs The assessment of the expected financial and resource implications associated with the draft RTS was further complemented with the evidence collected through the public consultation conducted between 9 February 2026 and 8 May 2026. Respondents were invited to assess the impact that implementation of the draft RTS would have on additional one-off investment costs and recurring costs beyond those already required to comply with Chapter III of AMLR. The analysis included both a quantitative assessment of the expected impact on one-off investment costs and recurring costs, and a qualitative assessment of the nature of the expected implementation costs. Only the responses that included justification and explanation of the estimated additional costs were considered in the analysis. The consultation was open to obliged entities as well as industry associations representing both the financial and non-financial sectors. However, all substantiated responses relating to cost assessments were submitted only by obliged entities. AMLA considered these responses particularly relevant, as obliged entities will directly incur and manage the one-off and recurrent costs arising from the draft RTS, and are therefore best placed to assess their expected financial and resource implications. #### Impact of the expected implementation costs The results have been categorised into responses provided by obliged entities in the financial sector and the non-financial sector. In the financial sector, among respondents providing a substantiated assessment, 40.7% expected one-off implementation costs to be disruptive and 37.0% expected them to be manageable, while 16.7% expected no significant additional costs. Concerning recurring costs, 30.8 % assessed the impact as disruptive and 40.4% as manageable, whereas 21.1% expected no significant additional recurring costs.  Figure 1: Expected additional costs from the implementation of the draft RTS, financial sector Similar results were observed in the non-financial sector. Among respondents providing justified answers, 38.9% expected one-off costs to be disruptive and 41.7% expected them to be manageable, while 5.5% expected no significant additional costs. Regarding recurring costs, 30.6% considered the impact to be disruptive and 36.1% considered it manageable, whereas 13.9% expected no significant additional recurring costs.  Figure 2: Expected additional costs from the implementation of the draft RTS, non-financial sector According to the results, a larger share of respondents either expected the costs to be manageable or anticipated no significant additional costs, compared to the ones expecting disruptive costs, both in the financial and the non-financial sector. #### Nature of the expected implementation costs The qualitative explanations provided by the respondents indicated that the main one-off costs would arise from updating AML/CFT policies and procedures, redesigning CDD and onboarding processes, adapting IT systems and CDD databases, implementing new identity verification solutions, expanding data collection and storage capabilities, updating internal guidance, and training of personnel. Several respondents also highlighted significant implementation costs linked to the collection and verification of additional customer, ownership and control information, the remediation of existing customer files, and the integration of new monitoring, screening and reporting functionalities. Several respondents also noted that compliance costs could increase where requirements lead to the duplication of information already available through public registers or information already verified by intermediaries. Recurring costs were expected to arise primarily from the maintenance and re-verification of expanded customer datasets, additional screening and alert handling activities, subscriptions to external verification and data services, continuous staff training, compliance oversight, and, in some cases, the recruitment of additional compliance personnel. Respondents particularly emphasised that recurring costs may be driven by the need to maintain larger volumes of customer information, and manage increased operational workloads associated with CDD. Overall, while the scale of expected costs varied significantly depending on the business model, size and current level of AML/CFT maturity of the obliged entities, the explanations suggested that the principal cost drivers relate to systems adaptation, CDD data collection and operational process changes. #### Assessment of the results and policy implications The assessment of the results supports the adoption of a horizontal approach, with one single draft RTS setting flexible, horizontal provisions, complemented with limited, targeted sector-specific measures only where necessary. The consultation responses should also be interpreted in the context of the timing of the public consultation. While a significant proportion of respondents considered the expected implementation costs to be disruptive, these assessments related to the draft RTS as consulted upon. Following the public consultation, AMLA introduced targeted amendments to address the concerns raised, improving legal clarity, proportionality and the practical application of the draft RTS. Consequently, some of the implementation costs reflected in the consultation responses relate to provisions that were subsequently revised or simplified in the final draft RTS. In addition, while respondents were asked to estimate only the incremental costs arising from the draft RTS, distinguishing those costs from the implementation costs associated with Chapter III of AMLR is inherently difficult. The reported cost estimates should therefore be interpreted with these considerations in mind. Responses provided by obliged entities indicates that additional implementation and compliance costs are expected across both the financial and non-financial sectors. The fact that respondents in both sectors were more likely to assess the additional implementation costs as manageable or anticipate no significant additional costs than to consider them disruptive supports the conclusion that a horizontal approach can accommodate the specificities of both sectors without imposing a disproportionate burden. This finding is particularly relevant in relation to recurring compliance costs. Unlike one-off implementation costs, recurring costs represent an ongoing operational burden that persists on an ongoing basis and therefore have a greater impact on the long-term cost-effectiveness and proportionality of the framework. In both the financial and non-financial sectors, respondents providing substantiated assessments were more likely to consider recurring costs manageable than disruptive. This suggests that, while the draft RTS may require additional resources and operational adjustments, they are not expected to impose a disproportionate ongoing burden on most obliged entities. The qualitative explanations provided by respondents further suggest that the main cost drivers relate to updates to AML/CFT policies and procedures, adaptation of IT systems, collection and verification of additional customer information, staff training, and ongoing maintenance of CDD processes. These findings support the conclusion that, while implementation costs will arise, they are generally proportionate to the objectives pursued and are outweighed by the expected benefits in terms of harmonisation, legal certainty and the effectiveness of AML/CFT controls. Moreover, many of the implementation activities identified by respondents would arise not only from the implementation of the provisions in the draft RTS, but also from the compliance with the new requirements stemming from Chapter III of AMLR. The consultation findings were particularly notable in the non-financial sector, where, despite the diversity of business models, varying levels of AML/CFT maturity, and the inclusion of newly designated obliged entities, respondents providing substantiated assessments were more likely to consider both one-off implementation costs and recurring compliance costs manageable than disruptive. This provides additional support for the conclusion that the principle-based and risk-based nature of the draft RTS is sufficiently flexible to accommodate sector-specifics across both the financial and non-financial sectors. The public consultation responses also informed the assessment of whether the policy approach set out in the draft RTS proposed by the EBA remained appropriate. The public consultation also did not indicate a need to reconsider that approach or the overall structure of the draft RTS developed by the EBA. Instead, respondents primarily identified areas where greater legal clarity, flexibility, proportionality and consistency with the AMLR could improve implementation. The targeted amendments introduced by AMLA therefore respond directly to the evidence gathered through the public consultation, while preserving continuity with the mature policy framework already developed by the EBA. This approach strikes an appropriate balance between harmonisation, legal certainty and effective implementation, while avoiding unnecessary regulatory disruption, additional implementation costs and delays associated with reopening settled policy choices. #### Methodology The assessment of the policy options underpinning these draft RTS was informed by a combination of supervisory expertise, comparative legal analysis and stakeholder feedback obtained through the public consultation. The assessment drew on structured exchanges with experts from supervisors responsible for the supervision of both financial and non-financial sectors. These discussions focused on supervisory experience with the application of CDD requirements across different sectors and business models, taking into account: * the diversity of business models and risk exposures; * observed challenges in applying horizontal, risk-based CDD obligations in practice; * supervisory expectations regarding proportionality and scalability of CDD measures; * the potential compliance and supervisory implications of sector-specific versus principle-based regulatory approaches; * provisions that have proven effective and operationally workable in practice; * areas where divergent interpretations or supervisory practices have emerged; * the impact of the draft RTS proposed by the EBA on compliance costs and supervisory convergence; and * the extent to which the EBA’s text can accommodate the expanded scope of obliged entities under the new framework. The assessment also included a comparative legal analysis of the AMLR, notably the use of horizontal AML/CFT obligations applicable across both the financial and non-financial sectors, as well as AMLA's mandate under that Regulation. This analysis aimed to ensure that the draft RTS remain consistent with the underlying legislative framework, support regulatory coherence and avoid introducing unnecessary divergences that could undermine legal certainty or effective implementation or supervision. In addition, AMLA considered the results of the public consultation conducted between 9 February and 8 May 2026. The consultation included both qualitative and quantitative evidence submitted by respondents, including assessments of the expected additional one-off implementation costs and recurring costs associated with implementing the draft RTS, together with explanations substantiating those estimates. Particular attention was given to responses providing sufficiently detailed justifications to support the assessment of the expected costs and practical implications of the proposed requirements. The combined supervisory, legal and stakeholder evidence informed the assessment of the operational feasibility, proportionality and expected impacts of the policy options, including their implications for compliance costs, supervisory convergence, legal certainty and the consistent application of the AML/CFT framework across both the financial and non-financial sectors. It also supported the assessment of whether the issues identified through the public consultation warranted substantive changes to the draft RTS or could be addressed through targeted amendments aimed at improving clarity, consistency and the practical application of the requirements. #### Limitations The analysis is primarily based on qualitative evidence derived from structured exchanges with supervisors from the financial and non-financial sectors and comparative legal analysis, complemented by a qualitative and quantitative assessment of the feedback provided through the public consultation. While supervisory experience and comparative legal analysis provide valuable insights into the practical application of the draft RTS, they may not capture all sector-specific particularities across the highly heterogeneous financial and non-financial sectors. In addition, supervisory practices and market structures continue to evolve, particularly in relation to newly designated obliged entities. These limitations are mitigated by the principle-based design of the draft RTS and the possibility of addressing any emerging issues through interpretative tools, where necessary. As regards the evidence collected through the public consultation, it was provided voluntarily by respondents and may therefore not be fully representative of all categories of obliged entities or of the broader market. In addition, the number of respondents providing sufficiently substantiated cost assessments was relatively limited compared with the diversity and overall population of obliged entities affected by the draft RTS. Furthermore, the expected costs reported by respondents may vary depending on the size, business model, level of AML/CFT maturity, and existing AML/CFT compliance framework of the obliged entity. Lastly, while respondents were asked to assess the additional implementation costs attributable to the draft RTS beyond those arising from Chapter III of AMLR, distinguishing between the two regulatory instruments proved challenging. As a result, the cost estimates provided may also reflect implementation costs associated with compliance with the new requirements arising directly from Regulation itself. ### 4.2 Feedback on the public consultation On 9 February 2026 AMLA launched a public consultation on the Draft Regulatory Technical Standards under Article 28(1) AMLR. The consultation lasted 3 months and ended on 8 May 2026. A total of 325 responses were received. In terms of stakeholder representation, 23% of responses were submitted by industry associations representing the financial sector and 14% originated from industry associations representing the non-financial sector, followed by 21% from obliged entities of the financial sector, 13% from obliged entities of the non-financial sector, 5% from SRBs, 4 % from civil societies and the remainder from others. This section presents the summary of the key issues and views raised by the respondents, details AMLA’s assessment of the responses, and concludes with AMLA’s decision regarding potential amendments to the final draft RTS. #### 4.2.1 SUMMARY OF KEY ISSUES AND AMLA’S RESPONSE ##### 1) Risk-based approach and flexibility Respondents from the financial and non-financial sector raised concerns that some requirements, notably those containing lists of information to be collected for identifying the purpose and intended nature of a business relationship or occasional transaction, verification of the beneficial owner and for enhanced due diligence, might be interpreted as too prescriptive and requiring the systematic collection and verification of information irrespective of the ML/TF risk exposure. Respondents therefore stressed the need for greater clarity confirming that the provisions of the draft RTS should not be applied as mandatory checklists and that the extent of information gathered should remain commensurate with the risk profile. While respondents broadly welcomed the objective of achieving more consistent customer due diligence standards, a significant number emphasised the need to retain flexibility and better reflect sector-specific business models, operational practices and challenges. Representatives of auditors, external accountants and tax advisers, notaries, lawyers and other independent legal professionals, real estate agents, gambling service providers, insurance undertakings and pension-related obliged entities highlighted practical challenges in applying certain requirements in the context of occasional transactions and the exercise of their professional activities. These respondents also sought greater recognition that relevant information that is already available through professional mandates, contractual arrangements, products, services or existing business relationships, may be used for CDD purposes, and requested greater clarity regarding the level of detail expected when complying with the requirements set out in former Article 18 (current Article 16) of the draft RTS. Respondents from several sectors commented that the draft RTS appeared to give preference to automated screening tools, while treating manual checks as a secondary or exceptional option. This concern was raised in relation to both former Article 19 (current Article 17), on the identification of politically exposed persons (PEPs), and former Article 30 (current Article 25) of the draft RTS, on targeted financial sanctions screening. The comments were particularly prominent among non-financial sector respondents, including gambling and casino operators, real estate agents, art market and auction-house stakeholders, notaries, lawyers, accountants and auditors. These respondents considered that the mandatory or quasi-mandatory use of automated tools could be disproportionate for smaller obliged entities, entities with low volumes of customers or transactions, or entities whose business model is occasional, local, or non-transactional in nature. Several respondents therefore asked that the RTS clarify that manual checks may be sufficient where justified by the size, nature, business model, complexity, customer base, or transaction volume of the obliged entity. Some respondents also pointed to a perceived inconsistency between former Articles 19 and 30 of the draft RTS, as former Article 19 expressly referred to proportionality-based manual checks whereas former Article 30 was perceived as less clear in this regard. Several respondents also proposed simplified due diligence measures for specific products, sectors and categories of customers considered to present a low degree of ML/TF risks. Finally, respondents also commented on the enhanced due diligence provisions with one of the main concerns related to the scope of information that may be required in higher-risk situations. ##### AMLA’s response Avoiding excessive prescriptiveness was a key consideration for AMLA throughout the drafting of the RTS; for example, the text was revised to clarify that its provisions should not be interpreted as imposing checklist-based obligations instead, be implemented in a proportionate and risk-based manner, taking into account the specific circumstances of the obliged entity. To address these concerns, AMLA strengthened Article 1 of the draft RTS to further emphasize that the RTS should be applied in a proportionate and risk-based manner. AMLA additionally introduced targeted amendments to Articles 10 and former 18 (current Article 16) of the draft RTS and certain enhanced due diligence provisions to specify that the scope of information and supporting documentation should remain commensurate with the ML/TF risks identified while maintaining the obliged entities' responsibility and supervisory discretion in case the information collected is not sufficient to mitigate the specific risks. While this approach reflects the discretion granted to obliged entities through the risk-based approach, it also clarifies that the information necessary should be determined on the basis of the ML/TF risks associated with the business relationship or occasional transaction, reducing unnecessary data requests and processing. A recital already clarified that there may also be situations where the information to be collected under the AMLR and the draft RTS may already be available to the obliged entity or, for example, to other obliged entities within the group. AMLA specifies this further in the operative provisions and provides that information on the purpose and intended nature in low-risk situations may be inferred from the product or service. To alleviate practical implementation challenges and to take into account divergences in identification documents, AMLA introduced greater flexibility on the collection of given names, place of birth information and nationalities, depending on the availability of that information. In the case of legal entities, AMLA also provided more flexibility with regard to the collection of trade names. Regarding the comments on former Articles 19 and 30 of the draft RTS, AMLA agrees that the use of screening measures should remain risk-based and technologically neutral, taking into account the size, nature, complexity and business model of the obliged entity. In particular, smaller obliged entities, entities with limited customer volumes, or entities carrying out occasional or low-volume activities should be able to rely on manual checks where those checks are sufficient to meet the relevant screening obligations. At the same time, the draft RTS must ensure that screening remains effective. Manual checks should therefore not be understood as a lower standard of compliance, but as one possible means of meeting the obligation, where appropriate. Obliged entities remain responsible for ensuring that the method chosen - whether automated, manual, or a combination of both - enables them to detect PEP or sanctions matches in a timely and effective manner. The amendments clarify that, under both former Article 19 and Article 30, obliged entities may use automated screening tools, manual checks, or a combination thereof. The choice of screening approach must be effective taking into account the obliged entity’s size, business model, risks, complexity and nature of business. Manual checks are therefore no longer framed as an exceptional fallback, but as one of the available screening approaches where appropriate in light of the obliged entity’s circumstances. AMLA did not deem it appropriate to introduce automatic simplified due diligence treatment for specific sectors, products or customer categories. This would run counter to the obliged entity’s requirement to assess individual risks under Article 20(2) AMLR. Nonetheless, with the amendments to Article 1 of the draft RTS AMLA does stress the application of simplified due diligence measures in situations presenting a low degree of risk. In response to the feedback received, AMLA amended the provisions relating to EDD to make it clear that obliged entities have discretion to determine the appropriate measures in high-risk situations. This is consistent with the discretion that Article 34(4) AMLR grants to obliged entities to determine the appropriate EDD measures and in accordance with a targeted, tailored and risk-based approach. Through these targeted adjustments, AMLA aimed to further deliver on the risk-based approach and increase flexibility while maintaining compliance with the obligations set out in the AMLR. ##### 2) Simplification A number of stakeholders questioned whether certain requirements in the draft RTS duplicated provisions already established in the AMLR or extended beyond the scope of the mandate conferred by Article 28(1) AMLR. Respondents also emphasised that some provisions did not provide sufficient additional regulatory value compared with those provisions in AMLR and risked creating legal uncertainty or operational complexity. In this regard, respondents from the financial sector and the non-financial sector, in particular respondents from the real estate and legal sectors, questioned the treatment of senior managing officials under former Article 13 of the draft RTS. Several respondents argued that the requirement in the draft RTS could create uncertainty regarding the distinction between beneficial owners and senior managing officials and seemed to require the collection of information beyond what is set out in the AMLR. Respondents across both the financial and non-financial sector, including notaries, also submitted feedback regarding the treatment of complex ownership and control structures and their relationship with ML/TF risk. A prevalent concern among them was that the criteria defining a complex structure in former Article 12 of the draft RTS captures an overly broad range of multi-layered ownership structures as inherently higher risk despite such structures often being established for commercial, regulatory or tax reasons. Consequently, stakeholders called for a more risk-based approach towards complexity indicators and their relationship with the higher-risk indicators set out in Annex III of AMLR. In carefully considering and assessing the responses received, AMLA has taken into account the scope of its mandate under Article 28(1) AMLR, as well as the need to maintain coherence with the existing legislative framework and avoid unnecessary duplication of regulatory provisions. To address concerns relating to senior managing officials, AMLA removed the former Article 13 from the draft RTS since the provision did not provide additional regulatory value and risked creating uncertainty regarding the distinction between beneficial owners and senior managing officials already established in the AMLR. Nonetheless, AMLA retained the core obligation to allow obliged entities to collect the registered office address of a senior managing official in the current Article 3(2) of the draft RTS. AMLA acknowledges the concerns raised regarding the treatment of ownership and control structures and the potential interpretation of structural complexity as an indicator of higher ML/TF risk. Therefore, AMLA moved away from a prescriptive definition of complex structures that automatically triggered certain mandatory measures to a more proportionate, risk-based approach. Consequently, AMLA merged former Articles 11 and 12 (current Article 11) of the draft RTS to allow obliged entities to assess the risk presented by a structure, while still laying out the characteristics that may contribute to complexity. This shifts some discretion back to obliged entities, who are best placed to determine whether a structure is indeed complex and how that impacts the business relationship or occasional transaction’s risk level. This approach acknowledges that complexity varies from one sector to another, and a large multinational structure may be standard for certain obliged entities, for instance company service providers or tax advisors, but complex for others that do not commonly encounter such structures. AMLA considers that these amendments better reflect the scope of its mandate under Article 28(1) AMLR and reduce unnecessary duplication of provisions in the AMLR, thereby ensuring greater legal clarity and contributing to simplification. ##### 3) Interaction with the provisions set out in Regulation (EU) 2024/1624 and scope of the mandate Some respondents considered that the verification requirements of Article 22(6) AMLR apply only to those identification data points that are essential for identification of the relevant natural person instead of the full set of data points reflected in Article 22(1), point (a), AMLR. This would provide greater flexibility to obliged entities with respect to data points that are not consistently reflected in identity documents, passports, or equivalent documents, such as nationality and place of birth, which additional information could be warranted and assessed in specific circumstances, based on the risks identified. Some respondents from the non-financial sector, including legal professionals, raised concerns regarding the interpretation of the concept of a person purporting to act on behalf of the customer under former Article 16 (current Article 14) of the draft RTS. Respondents commented that the extent of representation should be clarified, noting that it may overlap with the role of legal representatives, and that the definition should exclude individuals whose responsibilities are limited to back-office activities. Respondents from the financial sector highlighted significant operational challenges relating to former Article 17 (current Article 15) of the draft RTS on collective investment undertakings. Respondents indicated that the requirement did not reflect the diversity of fund distribution models and intermediary arrangements used across the European Union and requested greater flexibility regarding reliance on intermediaries. Respondent noted that requiring to collect information necessary to identify and verify the identity of the final investor would lead to a duplication of controls as the intermediary credit institution or financial institution already conducted these controls on the final investor. Respondents commenting on former Article 23 of the draft RTS considered that the provision placed excessive emphasis on periodic reviews and did not sufficiently reflect a risk-based approach to ongoing monitoring as set out in Article 26 AMLR. Respondents argued that, particularly in low-risk cases, obliged entities should be able to rely on automated, event-driven and behavioural monitoring mechanisms, without being required to proactively seek updated customer information where no risk indicators or material changes have been identified. Respondents also requested greater flexibility regarding the frequency of customer information updates beyond the 5-year period set out in Article 26(2) AMLR, including longer review cycles for certain low-risk customers and products. ##### AMLA’s response AMLA carefully considered and assessed the responses received. The draft RTS cannot create derogations from the AMLR, such as from the identification and verification requirements in Articles 22(1) and 22(6) AMLR. In accordance with the AMLR obliged entities may, however, benefit from a reduced set of identification data points. In situations where the identity document, passport or equivalent does not contain all the information listed in Article 22(1) AMLR, Article 22(6), point (a), AMLR provides that the obliged entity needs to acquire that information ‘from reliable and independent sources, whether accessed directly or provided by the customer.’ The reliable and independent sources are further set out in Article 8 of the draft RTS. With regard to former Article 16 (current Article 14) of the draft RTS, AMLA considers that the interpretation of the concept of a person purporting to act on behalf of the customer is not to be addressed through an RTS since such Level 2 measures cannot interpret, modify, or extend the scope of provisions included in AMLR. However, current recital 13 clarifies that the information required to verify that a person is authorised to act on another’s behalf should demonstrate that the person has the power to bind or other similar legal powers. In response to the concerns expressed by the sector regarding former Article 17 (current Article 15) of the draft RTS on collective investment undertakings, and to prevent an interpretation that collective investment undertakings must systematically obtain information on the underlying investors (a ‘look-through’ approach) pursuant to Article 20(1), point (h), AMLR, AMLA removed the requirement on credit or financial institutions to provide the information necessary to identify and verify the identity of any final investor without undue delay. Once the framework applies, AMLA will ensure that the conditions set out in this Article are complied with through its indirect supervisory powers. Finally, AMLA deleted former Article 23 from the draft RTS as it largely reiterated the requirements set out in Article 26(2), point (b), AMLR without adding value for obliged entities. Retaining former Article 23 could create uncertainty or give rise to misunderstandings that additional requirements apply. As the periods between updates of customer information are determined by the AMLR, they cannot be amended or extended through RTS provisions. Accordingly, AMLA did not accept proposals introducing additional flexibility that would effectively modify the updating requirements established by the AMLR. ##### 4) Customer identification and verification Stakeholders representing the financial sector and the non-financial sector, including notaries, raised concerns regarding the collection and verification of trade names, place of birth, nationality and the address. Several respondents advocated for increased flexibility where information is not consistently available through identity documents, public registers or electronic identification solutions and requested clarification regarding the application of these requirements to beneficial owners. In addition, respondents across both the financial sector and the non-financial sector, including tax advisers, precious stones and diamonds dealers, legal professionals and gambling and casino operators called for additional clarity regarding acceptable verification methods, the concept of reliable and independent sources and the practical implementation of non-face-to-face verification measures. A recurring concern was that the draft RTS could be interpreted as establishing an “eIDAS-first” approach and insufficiently recognising alternative verification and onboarding methods. Respondents also sought greater recognition of information sources commonly used in practice, including public registers, commercial databases, and professional intermediaries. ##### AMLA’s response AMLA carefully assessed the stakeholder feedback submitted in relation to Articles 2 to 8 of the draft RTS and introduced targeted amendments to improve further operational clarity and legal certainty. AMLA aligned the relevant operational provisions with the corresponding recitals and clarified the applicability of these requirements to beneficial owners. For example, AMLA amended Article 4 of the draft RTS to allow the collection of city, municipality, town or village of birth, country of birth or state, as some documents indicate place of birth by the city, municipality, town, village or state, while others indicate it by the country, and clarified the approach to the collection and verification of multiple nationalities under Article 5 of the draft RTS. Further clarification was also provided in Article 7 of the draft RTS, where AMLA identified a need to clarify when the alternative verification measures provided for in the third paragraph may be used. The revised wording makes clear that the measures in Article 22(6) AMLR are still the default option with alternative verification methods only to be used when neither of the two means required by AMLR can be used. AMLA also clarifies that obliged entities may continue using existing remote onboarding tools that meet the meet the minimum requirements regarding the quality, security and confidentiality of the verification process, as set out in Article 7 of the draft RTS. AMLA considers those requirements necessary especially in the face of emerging technological threats. Finally, AMLA included a new accompanying recital (11) to clearly explain the rationale for these alternative measures. AMLA further removed the explicit requirement to assess every source against the criteria contained in Article 8 of the draft RTS in all circumstances, while maintaining the underlying principles-based approach relating to the use of reliable and independent sources. Finally, AMLA clarifies that in situations in which verification is done through the means specified in Article 22(6), point (b), AMLR, no additional data points need to be obtained and verified through additional information, as the reassurance provided by the means specified in said Article is deemed sufficient. AMLA also sought to clarify this through the amendments to current Article 27 of the draft RTS. ##### 5) Further guidance on sector specific measures Some respondents considered that the draft RTS did not sufficiently accommodate sector-specificities. In particular, respondents noted that certain provisions relating to simplified due diligence measures on pooled accounts may not be appropriate across all sectors and categories of obliged entities. Respondents further noted that the sector-specific measures included in the draft RTS primarily addressed parts of the financial sector, while the specific characteristics of non-financial sector were not reflected to the same extent. ##### AMLA’s response AMLA acknowledges the feedback regarding the need to better reflect sector-specificities in the application of customer due diligence requirements. Therefore, consideration was given to the former Article 22 of the draft RTS on simplified due diligence measures on pooled accounts, taking into account the importance of ensuring equal treatment across sectors and business models. Moreover, to address the diversity of business models, products, and services across the Union, AMLA determined that this would be better addressed through Guidelines rather than in these RTS. This approach also ensures that the RTS remain principle-based, while balancing the request for regulatory certainty and allowing further detailed and specialised measures to be tackled through guidelines. This supports a more proportionate approach and simplification efforts while ensuring the consistent application of the framework. ##### 6) Targeted financial sanctions Respondents commented on two principal aspects of the consultation draft. First, stakeholders questioned whether the scope of the screening obligations set out in former Articles 29 and 30 (current Article 25) of the draft RTS were fully aligned with the requirements established in AMLR. Secondly, respondents sought greater legal certainty regarding the practical operation of screening obligations, including the triggering events for re-screening and the information to be screened. Stakeholders representing credit institutions and legal professionals questioned whether former Article 29 extended screening obligations beyond the requirements established in Article 20(1), point (d), AMLR, particularly in relation to people acting on behalf of the customer. These respondents requested closer alignment with the Level 1 provisions and sought clarification regarding the circumstances in which additional persons should be subject to screening. Respondents from both the financial and non-financial sectors requested clarification regarding the operation of former Article 30. These included credit institutions, legal professionals, notaries, statutory auditors and external accountants, and tax advisers. In particular, respondents commented on the treatment of aliases, trade names and wallet addresses, the meaning of significant changes in customer information, and the circumstances that should trigger re-screening obligations. Respondents questioned whether certain screening events and identifiers were sufficiently clear and requested greater alignment with the requirements established in the AMLR. ##### AMLA’s response With regard to former Article 29 (current article 25) of the draft RTS, AMLA assessed the comments received and reviewed the provision in light of the requirements established by the AMLR and the objective of ensuring the effective implementation of targeted financial sanctions obligations. Following this assessment, AMLA concluded that former Article 29 is appropriate and consistent with the Level 1 framework. Consequently, no amendment was made to the provision. For former Article 30 (current article 25) of the draft RTS, AMLA amended a number of provisions relating to screening identifiers and screening events. In particular, the RTS was amended to clarify that aliases, trade names and wallet identifiers are relevant for screening purposes where such information is available. AMLA also amended former Article 30(c)(ii) of the draft RTS to ensure consistency with Article 26(4) AMLR and revised the drafting concerning changes in customer information that may trigger re-screening obligations. AMLA did not accept proposals that would introduce a general risk-based approach to targeted financial sanctions screening or reduce core screening obligations established by Union law. AMLA considers that compliance with targeted financial sanctions obligations must remain effective and cannot be made dependent on the level of ML/TF risk associated with a customer. As a further simplification measure, former Articles 29 and 30 of the draft RTS were consolidated into a single Article 25. Given the close substantive connection between the provisions, their consolidation improves the coherence and readability of the RTS, and avoids unnecessary duplication and fragmentation. This consolidation did not modify the substance or effectiveness of the relevant obligations. ##### 7) Risk factors associated with features of electronic money instruments Respondents subject to former Article 31 (current Article 26) of the draft RTS on risk factors associated with features of electronic money instruments, mainly electronic money issuers and payment institutions, questioned the relevance and proportionality of certain risk factors included in this Article for the purpose of determining the extent of exemptions under Article 19(7) AMLR. They considered that some of these factors duplicated conditions already set out in Article 19(7) AMLR and could unnecessarily limit access to the exemptions. ##### AMLA’s response AMLA removed certain factors and amended others where feedback demonstrated that the criteria did not provide a sufficiently clear indication of ML/TF risk or could create unintended restrictions on the use of exemptions. In particular, AMLA removed the criterion relating to issuance charges, deleted the criterion requiring funding from accounts held with EEA-regulated institutions and amended the provisions concerning distribution channels and technological safeguards. At the same time, AMLA maintained those risk factors that it considered necessary to support a consistent supervisory assessment of risk under Article 19(7) AMLR. ##### 8) Transitional provisions Some respondents raised concerns regarding the operation of the transitional provisions for existing customers under former Article 33 (current Articles 28 and 29) of the draft RTS and their interaction with the customer updating requirements set out in Article 26 AMLR. The main issues concerned the calculation of implementation deadlines and the treatment of existing customer relationships. Respondents also questioned whether the timelines provided for implementation were sufficient in light of the wider implementation of the AML/CFT package. Some respondents highlighted an inconsistency between references to the "publication date" and the "application date" in the consultation draft. Respondents argued that this created legal uncertainty regarding the starting point for the one-year and five-year remediation periods applicable to existing customers and requested clarification that the relevant deadlines should be calculated by reference to the application of the RTS and the AMLR framework rather than the publication of the delegated regulation. Respondents from the financial sector, notably credit institutions, and from several non-financial sectors, including real-estate agents, trust and company service providers and gambling service providers, sought clarification regarding the treatment of customers onboarded before the application of the AMLR and the RTS and the application of updating requirements to different categories of existing customers. These respondents requested greater legal certainty regarding the operation of the transitional framework and the treatment of existing customer relationships. Some respondents further requested explicit confirmation that ongoing monitoring could be prioritized on a risk-sensitive basis, while others proposed greater flexibility regarding the sequencing of remediation activities and customer updates. Finally, respondents across both the financial and non-financial sectors requested an extension of the implementation timelines established by AMLR. These included credit institutions, financial institutions engaged in leasing activities, insurance undertakings, statutory auditors and external accountants, persons storing, trading or acting as intermediaries in the trade of cultural goods, and providers of gambling services. Respondents argued that additional time would be required to adapt systems, amend internal procedures, train staff, and complete ongoing monitoring in preparation for the application of the new AML/CFT framework. ##### AMLA’s response AMLA provided additional clarity regarding the operation of the transitional provisions. AMLA split former Article 33 into current Articles 28 (Transitional provisions) and 29 (Entry into force and application) of the draft RTS. AMLA further amended the drafting of current Article 28 of the draft RTS to improve legal certainty regarding the application of the transitional framework to existing customer relationships and to better align the provision with the requirements of Article 26 AMLR. Accordingly, the current Article 28 of the draft RTS was amended to align the transitional provisions with the date of entry into force of the draft RTS and to clarify that the relevant updating periods for existing customers should be calculated by reference to that date rather than the publication date of the draft RTS. The creation of a separate Article 29 on entry into force and application further improves the structure and clarity of the draft RTS. In addition, AMLA provided further flexibility for the private sector by deferring the date of application to six months after the date of entry into force of the draft RTS, except in relation to obliged entities referred to in Article 3, points (3)(n) and (o), AMLR, to which it shall apply from 10 July 2029. AMLA did not accept requests to extend or modify the one-year and five-year maximum periods for updating customer information, as established by Article 26 AMLR. [^1]: A proportionate, risk-based approach, a focus on effective, workable outcomes, technological neutrality, maximum harmonisation across supervisors, Member States and sectors, limiting disruption by building on existing EBA standards where possible, whilst aligning with global AML/CFT benchmarks. [^2]: OJ L, 2024/1624, 19.6.2024. [^3]: OJ L 257, 28.8.2014, p. 73. [^4]: OJ L 235, 9.9.2015, pp. 7. [^5]: Based on Commission Implementing Regulation (EU) 2024/2977 of 28 November 2024 laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards person identification data and electronic attestations of attributes issued to European Digital Identity Wallets (OJ L 2977 4.12.2024, p. 1). ## Related Level 1 articles - [Article 28 — Regulatory technical standards on the information necessary for the performance of customer due diligence](../articles/28.md)