AMLA’s Three Latest RTS's and What They Mean for AMLR Implementation

The three standards in brief

The Anti-Money Laundering Regulation (AMLR) applies across the EU from July 2027, but it leaves much of the detail to Regulatory Technical Standards (RTS): binding rules that AMLA, the EU’s new Anti-Money Laundering Authority, drafts and the European Commission adopts. On 30 September 2026, AMLA published final drafts of three of them.

• Customer due diligence (Article 28(1)). What information firms collect to identify and verify customers and their beneficial owners, how often customers are reviewed, and how firms bring existing customers up to the new standard.
• Group-wide requirements (Articles 16(4) and 17(3)). The minimum standards for running anti-money laundering controls across a group: the group risk assessment, information sharing between entities, what to do when another country’s laws get in the way, and how a group headquartered outside the EU names an EU parent.
• Business relationships and linked transactions (Article 19(9)). How firms decide whether a customer interaction is an ongoing business relationship or a one-off transaction, and when separate transactions must be added together.

The drafts are now with the European Commission for adoption and could still change. Once in force, they apply six months later.

The RTS set out the information firms must collect to identify and verify customers, and to apply simplified and enhanced due diligence.

The instrument covers:

• Identification and verification data
• Purpose and intended nature of the business relationship
• Politically exposed persons (PEPs)
• Simplified and enhanced due diligence
• Sanctions screening
• E-money exemptions
• Electronic Identification

The RTS apply six months after they enter into force, with the precise date still to be confirmed.

AMLA received 325 consultation responses and accepted several of the main criticisms:

• Lists are illustrative. The lists on purpose and nature, beneficial owners and enhanced due diligence are now examples. The scope of information must match the customer’s risk.

• Low-risk purpose and nature can be inferred from the product or service itself.

• Manual screening is permitted. Firms can screen for PEPs and sanctions manually, automatically or with a mix, provided the approach is effective. AMLA states that manual checks are not a lower standard of compliance.

• Ownership provisions are clearer. The “complex structure” criteria have been merged into a single risk-based assessment.

• Look-through for funds is removed. Intermediaries no longer have to supply final investor data for collective investment undertakings.

• Existing remote onboarding tools can stay, provided they meet minimum safeguards. Documents and qualifying electronic identification remain the default routes.

• No automatic simplified due diligence for any sector, product or customer type.

• No longer review cycles. The one-year limit for higher-risk customers and the five-year limit for all others stay as they are.

• No risk-based sanctions screening in general. Firms can choose their tool and how often routine screening runs. Who and what must be screened, and when a re-screen is triggered, do not scale down with customer risk.

• No later start for the clock. Firms asked for the existing-customer updating periods to run from the application date. AMLA moved the start point from publication to entry into force but refused to extend the AMLR periods.

The EU now sets out much of CDD in prescriptive law. The UK takes a more risk-based approach, with detailed guidance that is not itself law. How much changes in practice depends on where a firm sits.

A UK firm with no EU operations is not directly affected. But the RTS are still a useful benchmark for UK policy.

A UK firm operating in the EU is in scope for its EU business. Periodic review is a good example of how little may change. UK rules require ongoing monitoring but set no timetable. In my experience, UK firms already run fixed review cycles, commonly one, three and five years, or one and three. For a firm already reviewing standard-risk customers every three years, the AMLR five-year limit asks nothing new on frequency. The change is that the rules are now fixed in law and no longer left to each firm’s policy.

An EU firm in a member state with strict national rules will see the least change. In Germany, for example, the rules are already demanding.

An EU firm in a member state with lighter national rules, such as Italy, will find the standards more stringent. This is where the purpose of AMLA comes in: one rulebook across 27 member states, with less room for local variation.

A group operating across several member states faces the biggest task. It may currently run CDD several different ways in different countries. The RTS push it towards a single approach, governed centrally.

Getting the data in shape is the real challenge 

The standards may be achievable, but the question is whether firms have the data quality, resources and governance to meet them.

The RTS specify the data that must be collected, including:

•  All names as shown on the identity document

•  Prescribed address elements

•  Place of birth

•  Additional nationalities, where reasonable measures establish them

Filling one gap for one customer is easy. A firm with 100,000 customers that holds three of five required data points for each has 200,000 gaps to close. Multiply that across larger books or several countries and it becomes a substantial remediation exercise.

For groups, the challenge is structural. Before planning a harmonised approach, a firm needs to know where it stands in each market, and many lack the data to do that. BeyondFS is seeing groups move early to align several local processes around a single approach, on the basis that they will have to do it eventually. The data is usually what holds them back.

The existing-customer clock starts early 

The one-year and five-year updating periods for existing customers run from entry into force. That is six months before the RTS apply. Firms with data gaps across a large book have less time than the application date suggests.

Questions to put to your team 

What comes next?

The RTS on ongoing monitoring under Article 26 has not yet been finalised. BeyondFS expects it to bring more debate than the CDD standards, particularly on transaction monitoring. We will publish our view once the final text is out.

How BeyondFS helps

KYC and CDD is a core BeyondFS specialism. We help firms strengthen customer due diligence frameworks by connecting regulatory obligations to practical controls, operating models and evidence, then supporting delivery through to implementation and sustained operation. If this is something your firm is less than confident on the new RTS, get in touch.