In the first part of our blog series, we provided an overview of the new EU anti-money laundering package; the second part addressed the question of who will actually be subject to these obligations in future. In this third part, we now turn our attention to a core aspect of practical compliance work: the new requirements for Customer Due Diligence (CDD) and Know Your Customer (KYC).

With the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624, or AMLR for short), which is directly applicable, due diligence obligations towards contractual partners are, for the first time, laid down uniformly across the EU without the need for them to be transposed into national law. However, the AMLR also sets out the CDD requirements in much greater detail than has previously been the case. From 10 July 2027, the AMLR will apply as a so-called ‘Single Rulebook’, which will largely eliminate the scope for national discretion that previously existed – for example, under the Austrian Financial Market and Money Laundering Act or the Trade Regulation Act. Anyone who still believes today that they need only make minor adjustments to their existing KYC procedures should read the following changes particularly carefully.

When do customer-related due diligence obligations actually apply?

Article 19 of the AMLR sets out the circumstances in which obliged entities must apply CDD measures. The basic principles remain familiar: appropriate due diligence obligations must be fulfilled when establishing a business relationship, in the case of occasional transactions of EUR 10,000 or more (including linked transactions), and always where there is a suspicion of money laundering – the latter being independent of any exceptions or thresholds.

• The main new development is the sector-specific differentiation of these thresholds:
• Credit and financial institutions (excluding crypto-asset service providers) must also apply CDD from as little as EUR 1,000 for money transfers.
• Crypto service providers (CASPs) are subject to a separate threshold of EUR 1,000 for full due diligence, including a certain minimum identification requirement below this threshold.
• Gambling operators must carry out KYC when paying out winnings or for stakes of EUR 2,000 or more.
• For cash transactions, at least a limited identification requirement applies from as little as EUR 3,000, provided the Member State has not set a lower cash threshold.

It is also worth noting that the AMLR broadens the definition of ‘customer’ to include certain professional groups. In the case of notaries, solicitors and other independent legal professionals who act as intermediaries in a transaction – provided they are the sole intermediary – both parties to the transaction are regarded as customers. Similarly, in the case of estate agents, both sides of the transaction are regarded as customers. Anyone who has hitherto only verified their own clients must broaden their understanding of the duty of due diligence accordingly.

Regarding the exact thresholds and delineation criteria, on 1 October 2026 the AMLA published the final draft RTS concerning criteria for business relationships, occasional transactions and linked transactions under Article 19(9) of the AMLR and submitted it to the European Commission (Final Report – Draft RTS under Article 19(9) AMLR, see also below regarding the RTS). The AMLA has not introduced any new thresholds in the draft that are lower than the basic threshold of EUR 10,000. The existing sector-specific AMLR thresholds therefore remain unchanged. Although the draft is final at AMLA level, it still requires adoption by the European Commission and publication in the Official Journal of the EU before it becomes applicable.

The new catalogue of obligations under Article 20 of the AMLR

Article 20 of the AMLR now brings together all due diligence measures in a single, detailed catalogue. Accordingly, obliged entities must in future cumulatively do the following:

• Identify the customer and verify their identity.
• Identify the beneficial owners and implement appropriate verification measures so that the ownership and control structures are properly understood (we plan to publish a separate blog article on this shortly).
• Assess and document the purpose and intended nature of the business relationship or transaction.
• Check whether the customer or the beneficial owner is subject to targeted financial sanctions – in the case of legal entities, also whether sanctioned persons hold more than 50 per cent of the ownership rights or a majority stake.
• Assess the nature of the customer’s business activities, employment or profession.
• Monitor the business relationship on an ongoing basis and check transactions for plausibility against the known risk profile and – where necessary – the source of funds.
• Determine whether the customer, their beneficial owner or a beneficiary is a politically exposed person, a family member or a known associate of such a person.
• In the case of transactions for the benefit of third parties, identify and verify those persons.
• Verify the authority to act on behalf of the customer and verify the identity of persons acting on their behalf.

Crucially, Article 20(2) of the AMLR explicitly links the scope of these measures to an individual risk assessment – taking into account the firm-wide risk assessment under Article 10 of the AMLR, as well as the risk variables set out in Annex I and the risk factors listed in Annexes II and III. Obliged entities must be able to demonstrate to their supervisory authorities at any time that the measures taken are proportionate to the risks identified.

The risk-based approach: not entirely at the discretion of the obliged entity

Whilst the risk-based approach remains the guiding principle of the AMLR, the individual risk analysis under Article 20(2) of the AMLR does not operate autonomously but is embedded within a strict sequence of checks which, in certain cases, leaves no room for discretion on the part of the obliged entities.

In practice, the following sequence of checks is therefore recommended for the future:

1. First, it should be clarified whether the business relationship is legally permissible at all – for example, because UN financial sanctions apply (Article 27 of the AMLR) or because there is a strict prohibition on correspondent relationships with shell institutions (Article 39 of the AMLR).
2. Next, it must be assessed whether any of the legally predefined high-risk scenarios apply, in which the legislator has already anticipated the risk assessment itself.
3. Only then does the actual individual risk analysis come into play, where there is scope for company-specific judgement.

For the second stage, Article 34(1) of the AMLR expressly refers to a number of scenarios in which enhanced due diligence (EDD) must be applied without exception, without any allowance for risk-mitigating factors as set out in Annex II. These include, in particular, dealings with high-risk third countries (Articles 29 to 31 AMLR), cross-border correspondent banking relationships (Articles 36 to 38 AMLR), transactions involving so-called self-hosted addresses in the crypto sector (Article 40 AMLR), applicants under residence-for-investment programmes (Article 41 AMLR), and politically exposed persons, their family members and associated persons (Articles 42 to 46 AMLR).

For obliged entities, this means that the company-wide risk analysis and the customer-specific risk classification remain important, but only take effect in the remaining areas not already predetermined by statutory risk classifications – such as product-, service- and distribution channel-related risk factors that depend on the obliged entity’s own business activities.

At the other end of the spectrum, Article 33 of the AMLR continues to permit simplified due diligence (SDD) where the risk is demonstrably low – taking into account the risk factors set out in Annexes II and III – such as verifying the identity of customers and beneficial owners only after the business relationship has been established, or applying a reduced level of scrutiny during ongoing monitoring. However, the permissible application of simplified due diligence does not constitute an exemption from the duty of due diligence as such, but merely a reduced level of scrutiny.

Politically Exposed Persons: a narrower but also more clearly defined group

Articles 42 to 46 of the AMLR set out in detail the treatment of politically exposed persons (PEPs), their family members and associated persons. The underlying principle – that there is an increased risk when holding a prominent public office at national or regional level – remains in place, but is clarified by new, more objective criteria, such as population thresholds for regional and local office-holders or clearer criteria for senior executives of state-controlled enterprises.

For obliged entities, the new regulations mean that PEP screenings must in future be carried out in accordance with more uniform criteria applicable across the EU – the list of positions classified as PEPs is to be published by the Member States in accordance with Article 43 of the AMLR and submitted to the Commission. Existing screening processes and the PEP databases used should therefore be reviewed in good time to ensure their compatibility with the new EU-wide categories.

Updating obligations: from a vague requirement to a strict set of deadlines

One of the most significant legal changes in practical terms concerns the obligation to update customer data as part of ongoing monitoring under Article 26(2) of the AMLR. Unlike previously, the AMLR prescribes mandatory maximum time limits which must not be exceeded:

• One year for high-risk customers subject to enhanced due diligence requirements.
• Five years for all other customers.

The final regulatory technical standards on customer due diligence (RTS-CDD, see below for these and further AMLA-related work) also make it clear that the five-year period must be strictly adhered to even where simplified due diligence measures are applied in low-risk cases – simplified due diligence therefore does not result in a mere event-driven obligation to update data, as is currently still accepted by the FMA in Austria. According to the explanatory notes to the AMLR, the obligation to update information does not, moreover, relate solely to individual products or services, but to the business relationship as a whole.

In addition to periodic updates, Article 26(3) of the AMLR provides for an event-driven review obligation: whenever there is a change in the customer’s relevant circumstances, a statutory obligation to make contact exists in the relevant calendar year, or a fact relevant to the risk assessment comes to light. For existing customers, the RTS-CDD also stipulates a risk-sensitive obligation to bring information into line with the new requirements, which must be completed by the specified deadlines at the latest.

In practice, this means that data and deadline management will likely need to be revised. Without a system that automatically monitors update deadlines for each customer and risk category, compliance with these deadlines will be unfeasible in mass-market banking.

Due diligence obligations towards contractual counterparties: reliability rather than formalism

The AMLR shifts the focus of due diligence obligations towards contractual counterparties from mere documentation to demonstrable effectiveness. This is particularly evident in the reliance placed on due diligence checks carried out by other obliged entities (reliance) under Articles 48 and 49 of the AMLR: an obliged entity that relies on the CDD measures of another obliged entity must be able to access the underlying information and documents at any time. Information relevant to CDD must be provided without delay; copies of documents must be provided within five working days at the latest; and the reliance relationship must be agreed in writing. In other words, reliance must not lead to a lack of information – supervisory authorities, internal audit and external auditors must be able to verify at any time which measures have actually been carried out.

A similar principle applies to the outsourcing of AML/CFT tasks under Article 18 of the AMLR: outsourcing to service providers is generally permitted, but must never result in responsibility, risk ownership or decision-making authority being effectively outsourced. In principle, there is a ban on outsourcing to service providers in high-risk third countries; this ban may only be waived within a group under strict, cumulative conditions that must be met.

For companies that have outsourced KYC processes to specialised service providers or intra-group service centres, this results in a clear audit mandate: existing outsourcing and reliance agreements should be reviewed to ensure they comply with the new requirements regarding evidence, documentation and access.

The status of the regulatory technical standards

A significant part of the practical implementation of the new CDD requirements has taken shape since the consultation phase on the regulatory technical standards (RTS) to be drawn up by the AMLA. Following the public consultation launched on 9 February 2026 and the public hearing held on 24 March 2026, the AMLA recently – specifically on 1 October 2026 – finalised the following three key draft RTSs and submitted them to the European Commission (see the AMLA’s press release of 1 October 2026):

• Draft Regulatory Technical Standards on Customer Due Diligence, AMLR 28(1)
• Draft Regulatory Technical Standards on criteria for identifying business relationships, occasional and linked transactions and lower thresholds, AMLR 19(9)
• Draft Regulatory Technical Standards on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries, AMLR 16(4) and 17(3)

These three final draft RTSs consolidate the regulatory frameworks previously developed separately by the European Banking Authority (EBA) for the financial sector and by a European Commission expert group for non-financial firms into a single, uniform standard. The aim is to establish a consistent basis for due diligence obligations that eliminates regulatory differences between banks, crypto-service providers, estate agents, solicitors, auditors and other non-financial entities.

Although these drafts are now final at AMLA level, they are not yet legally in force: the European Commission must first adopt them and publish them in the Official Journal of the EU as delegated regulations. The standards will only enter into force 20 days later, and will apply a further six months after that.

Work on the fourth key AMLA mandate concerning risk variables and factors under Article 20(3) of the AMLR, as well as the guidelines on ongoing monitoring and firm-wide risk analysis, had not yet been completed by early October 2026.

This has important practical implications: the key RTS on customer due diligence and business relationships have been included in the final draft of the AMLA since early October 2026. Although they will only become applicable once the European Commission has adopted them and published them in the Official Journal, plus the six-month transition period, implementation should not be delayed until this entire process is complete, as the time remaining until the AMLR comes into force on 10 July 2027 is short. The basic structure of the requirements set out in the AMLR itself, as well as the further substantive provisions of the final draft RTS, are sufficiently specific to allow implementation to begin.

What this means in practice

Obliged entities – whether already covered today or affected by the AMLR for the first time – should not view the new KYC and CDD requirements merely as an adjustment to existing forms, but as an opportunity for a fundamental review of their customer due diligence measures. The following points deserve particular attention:

• Thresholds and triggers for CDD measures must be recalibrated on a sector-by-sector basis, particularly in the case of occasional transactions and linked transactions.
• The risk analysis process must be restructured: first, assess legal permissibility; then identify high-risk cases defined by law; and only thereafter apply the individual risk analysis for the remaining discretionary scope.
• PEP screening processes and the data sources used must be adapted to the new, more objective criteria under EU law.
• Updating customer data requires a system that automatically monitors the maximum time limits of one year (high-risk) or five years (other customers) per customer; this must also be implemented in a risk-sensitive manner for existing customers.
• Existing outsourcing and reliance agreements with third-party service providers or other obliged entities must be reviewed in light of the new requirements regarding evidence, access and time limits.
• As central technical standards have not yet been finalised, implementation should be structured in a modular manner to allow for subsequent adjustments to the final RTS texts without the need for a fundamental overhaul.

Outlook

In the next part of our blog series, we will turn our attention to beneficial owners: what changes will there be for companies with complex shareholding structures, and what new requirements does the AMLR entail for the identification and verification of beneficial owners?