The single European anti-money laundering rulebook is taking operational shape. With the final report dated September 30, 2026 and publication in the first days of October, the European Anti-Money Laundering Authority (AMLA) has finalized the RTS on customer due diligence required by Article 28(1) of Regulation (EU) 2024/1624 (AMLR), together with two other key technical standards. The texts have been sent to the European Commission for adoption. For banks, fintechs and professionals, this is the signal that the window to adapt KYC processes and systems before July 10, 2027 is closing.
What AMLA has finalized
The package covers three sets of regulatory technical standards addressed to obliged entities:
- RTS on customer due diligence (Art. 28(1) AMLR): defines what information to collect on the customer and how to verify it.
- RTS on business relationships and occasional transactions (Art. 19(9) AMLR): clarifies how to distinguish a business relationship from an occasional transaction and how to identify linked transactions, so that the thresholds that trigger customer due diligence are applied uniformly.
- RTS on group-wide requirements (Arts. 16(4) and 17(3) AMLR): governance, risk management and anti-money laundering policies at group level, including subsidiaries and branches in third countries.
The public consultation on the CDD RTS, open from February 9 to May 8, 2026, received 325 responses, and the public hearing of March 24, 2026 involved around 1,600 participants from the financial and non-financial sectors. According to AMLA, the final text was revised to gain legal clarity, simplicity and consistency with the AMLR, and to work outside the banking perimeter as well.
CDD RTS: what changes in practice
The core of the package is standardization. Today each Member State applies customer due diligence with its own rules and practices; the RTS instead set a common, directly applicable set of requirements. The areas covered include:
- Identification data: names, address, place of birth and nationality, with a harmonized level of detail.
- Identity verification: permitted methods, including electronic identification means and alternative solutions for remote onboarding, with the minimum attributes these solutions must guarantee.
- Beneficial owner: identification of beneficial owners and assessment of the ownership and control structure.
- Purpose and nature of the relationship: the information to collect in order to understand the customer's expected activity.
- PEPs and targeted financial sanctions: screening procedures for politically exposed persons and checks against restrictive measures.
- Simplified and enhanced measures: what is allowed in low-risk situations and what must be added in high-risk ones.
A detail not to be underestimated: AMLA stated that it found no room to further simplify simplified due diligence beyond what is already provided. Those hoping for lighter requirements on low-risk customers will therefore have to work on process efficiency, not on lighter rules.
Timeline: what happens now
The drafts now go to the European Commission, which will adopt them through delegated acts before publication in the Official Journal of the EU. The AMLR applies generally from July 10, 2027: those who wait for the final text in the Official Journal before starting risk having only a few months to review procedures, onboarding forms, data models and automated controls. We anticipated this step when discussing AMLA's Level 2 measures: now the content is known in its final version.
What to do today in your company
- Gap analysis: compare the data you collect today at onboarding with the list in the RTS and identify missing or unverified fields.
- Portfolio remediation: estimate how many existing customers will need an information update and set priorities based on risk.
- Digital onboarding: check that remote identification solutions meet the required attributes.
- Beneficial owners: strengthen the reconstruction of the chain of control, especially for foreign and multi-layer structures.
- PEP and sanctions screening: make sure it is continuous, documented and with explainable results during inspections.
- Groups: align policies and governance across the parent company, subsidiaries and non-EU branches.
For a complete operational overview of the CDD stages, you can start from our practical guide to customer due diligence.
How AegisX helps you
At AegisX we turn compliance into a strategic advantage. Monitus automates PEP, sanctions and adverse media screening with continuous monitoring and an audit trail ready for supervisors. Lensis reconstructs the chain of control and identifies beneficial owners even in the most complex structures. Two AI-native tools to reach July 10, 2027 with processes already aligned with the new rules.
Want to know how far your KYC processes are from AMLA's requirements? Contact us for an assessment.
This article is for informational purposes only and does not constitute legal or compliance advice.
