AMLA's final CDD standards (October 2026): what changed, what to do
AMLA announced its final draft customer due diligence standards on 1 October 2026 and sent them to the Commission. What the draft says by topic, what AMLA refused to relax, what is still pending and what to build before July 2027.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
AMLA, the EU Anti-Money Laundering Authority, announced its final draft regulatory technical standards (RTS) on customer due diligence on 1 October 2026 and submitted them to the European Commission. The report is dated 30 September 2026.[2][3] The AMLA RTS customer due diligence text is a final draft, not law. It binds only after the Commission adopts it and publishes it in the Official Journal, and AMLA proposes that it applies six months after it enters into force.[3][4]
- Electronic identification and the identity document stay the default. Remote document-based checks are the alternative you must justify.[2]
- In its final draft, AMLA kept the 1-year and 5-year refresh limits and refused risk-based sanctions screening.[2]
- No application date exists yet.
On 1 October 2026 AMLA announced final reports on customer due diligence (CDD) under Article 28(1) of the EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), on business relationships and thresholds under Article 19(9), and on group-wide requirements under Articles 16(4) and 17(3).[3] The AMLR itself applies from 10 July 2027.[1]
For the regulation as a whole, start with AMLR explained. For the authority, see our profile of AMLA.
What AMLA announced on 1 October 2026
The final report on the CDD standard is dated Frankfurt am Main, 30 September 2026, and was announced the next day.[2] The press release says the standards "have now been submitted to the European Commission".[3]
| Standard | Legal basis | Status on 2 October 2026 |
|---|---|---|
| Customer due diligence | Article 28(1) AMLR | Final report dated 30 September 2026. Submitted, not adopted.[7] |
| Business relationships, occasional and linked transactions, lower thresholds | Article 19(9) AMLR | Final report announced 1 October 2026. Submitted, not adopted.[7] |
| Group-wide requirements and third-country branches | Articles 16(4) and 17(3) AMLR | Final report announced 1 October 2026. Submitted, not adopted.[7] |
The AMLR set 10 July 2026 as AMLA's deadline for all three.[1] AMLA's consultation on the CDD standard drew 325 responses, and more than 1 600 stakeholders joined the hearing of 24 March 2026.[2]
- 12 March 2024Call for adviceThe Commission asks the European Banking Authority (EBA).
- 30 October 2025EBA responseThe EBA answers the Commission.
- 9 February 2026ConsultationAMLA consults on its own draft until 8 May.
- 30 September 2026Final reportSent to the Commission, announced 1 October.
- 10 July 2027AMLR appliesThe regulation binds, with or without the standard.
The road to the final draft.[1][2]
The group-wide standard builds on Article 16 AMLR, which requires a parent undertaking to apply group-wide policies, procedures and controls.[1]
What "final" means for the AMLA technical standards
"Final" describes AMLA's work, not the legal status of the text. AMLA drafts the standards, the Commission adopts them, and they bind only once published in the Official Journal. AMLA's factsheet says they "remain subject to review and potential amendments by the European Commission and their provisions will only become definitive upon publication in the Official Journal of the European Union".[4]
1AMLA final report
Dated 30 September 2026. Done.
2Commission review
The Commission may amend the draft before adopting it.
The standard is adopted and published in the Official Journal
3Entry into force
The twentieth day after publication.
4Application
Six months later, as proposed.
Still a draft
The AMLR applies from 10 July 2027 anyway.
From AMLA final report to a binding standard.[2][4]
Draft Article 29AMLA final draft RTS, 30 September 2026
"It shall apply from six months after the date of its entry into force except in relation to obliged entities referred to in Article 3, points (3)(n) and (o), of Regulation (EU) 2024/1624, to which it shall apply from 10 July 2029."
Source: AMLA final report[2]
The entities carved out to 2029 are football agents and professional football clubs.[1] For everyone else the start date depends on Commission adoption, which had not happened on 2 October 2026.[7]
Watch out
Any calendar date quoted for the CDD standard is a guess. On 2 October 2026 the honest answer is: not yet known.
One signal: in October 2025 the Commission told AMLA that it would not adopt a list of non-essential Level 2 acts before 1 October 2027. The three standards are not on that list.[9] That is not a commitment to a date.
Meanwhile, AMLA's tracker lists the EBA guidelines that "continue to apply until AMLA's new regulatory instruments on the same subject enter into force", including those on remote customer onboarding.[7][8]
What changed between the consultation draft and the final draft
We list only the changes that AMLA's final report documents itself. This is not a redline.
- The article numbers moved. Several articles were merged or deleted, so the numbering differs from the February 2026 consultation draft and from the EBA's October 2025 draft.[2]
- The remote verification wording was revised. Respondents worried about an "eIDAS-first" approach. AMLA replied: "The revised wording makes clear that the measures in Article 22(6) AMLR are still the default option with alternative verification methods only to be used when neither of the two means required by AMLR can be used."[2]
- Existing tools are addressed directly. In the same reply AMLA "also clarifies that obliged entities may continue using existing remote onboarding tools" that meet the minimum requirements.[2]
The default did not change, because it sits in the regulation and not in the standard.
Article 22(6)Regulation (EU) 2024/1624
"[...] through either of the following means: (a) the submission of an identity document, passport or equivalent [...]; (b) the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high' and relevant qualified trust services as set out in that Regulation."
Source: EUR-Lex, Regulation (EU) 2024/1624[1]
What the AMLA RTS on customer due diligence says, by topic
Most teams will read draft Article 7 first, the gateway for remote onboarding without electronic identification (eID).
Draft Article 7(1)AMLA final draft RTS, 30 September 2026
"where a natural person cannot reasonably be expected to submit the identity document, passport or equivalent in a face-to-face context and does not have access to electronic identification means and relevant qualified trust services that meet the requirements stipulated by Article 22(6), point (b), of Regulation (EU) 2024/1624, obliged entities shall verify the natural person's identity through their identity document, passport or equivalent using alternative solutions that meet the conditions set out in this Article."
Source: AMLA final report[2]
Draft Article 7(3) adds the burden: entities "shall be able to justify why the customer could not be verified through the methods referred to in Article 22(6)".[2] Every row below is a draft the Commission may still change.
| Topic | What the final draft says | What to build |
|---|---|---|
| Identity data | All Article 22(1) data points are verified, not only collected. Gaps are filled "from reliable and independent sources".[2][4] | A second source for what a passport lacks, such as the address. |
| Identity documents (Article 6) | Issued by a designated authority, with names, birth data, number, expiry date, facial image, signature and security features.[2] | A document acceptance policy and authenticity checks. |
| Electronic identification (Article 27) | eID at substantial or high qualifies, including EUDI Wallets. Missing attributes are obtained "through other means".[2] | An eID route, an attribute map and a fallback for gaps. |
| Remote alternative (Article 7) | Controls that the presenter is the document holder, a secure channel, capture of sufficient quality, a stop on faults or doubts, and time-stamped copies.[2] | Holder checks, abort logic, an evidence store and a recorded reason. |
| Low-risk customers (Article 18) | A reduced data set. The address is not required.[4] | A shorter flow for assessed low risk. |
| Beneficial owners | Central registers "are not sufficient on their own to fulfil the verification requirements".[2] | A second source next to the register extract. |
| Politically exposed persons, or PEPs (Article 17) | Checked before the relationship, then at a risk-sensitive frequency, and "without delay" on new information.[2] | A schedule by risk class. |
| Sanctions (Article 25) | All names in the original alphabet or transliterated and, where available, aliases and digital wallet addresses.[2] | Matching across alphabets, aliases and wallet addresses. |
| Existing customers (Article 28) | Brought into line "on a risk-sensitive basis within the periods set out in Article 26(2)", counted from the standard's entry into force.[2] | A remediation plan ordered by risk. |
The final draft names no technique. The words "selfie", "liveness" and "biometric" do not appear in it.[2] More detail: AMLR identity verification, AMLR and the EUDI Wallet and AMLR beneficial ownership.
On thresholds, the Article 19(9) final draft adds no lower ones: AMLA "did not identify additional higher risks that justify such thresholds at this point in time".[5][6] For money remittance, currency exchange and crypto-asset exchange, three or more transactions within 12 months indicate repetition, and two or more within one month are assessed as linked.[6] Sector detail is in AMLR for crypto.
What AMLA refused to relax
On four points AMLA said no to respondents, mostly because a standard cannot change what the regulation fixes.
- Refresh intervals. Article 26(2) AMLR caps the period between updates at 1 year for higher-risk customers and 5 years for all others.[1] AMLA: "As the periods between updates of customer information are determined by the AMLR, they cannot be amended or extended through RTS provisions."[2] See Article 26 ongoing monitoring.
- Sanctions re-screening. "AMLA did not accept proposals that would introduce a general risk-based approach to targeted financial sanctions screening".[2] Draft Article 25 requires screening at onboarding, when a sanctions listing changes, when customer data changes and on a regular basis.[2]
- Verifying only "essential" data points. Refused: "The draft RTS cannot create derogations from the AMLR".[2]
- Wider simplified due diligence (SDD). AMLA "did not identify opportunities for further simplifying SDD measures without effectively creating exemptions from the AMLR obligations".[2]
Note
Simplified due diligence is not closed. AMLA is preparing own-initiative guidelines, with roundtables from 9 November to 2 December 2026 and a consultation to follow.[11]
What is still pending, with dates
Most guidelines on applying the AMLR are still drafts or not started.
| Instrument | Status on 2 October 2026 | Expected |
|---|---|---|
| Guidelines on business-wide risk assessment, Article 10(4) | Draft. Consultation closed 15 July 2026.[7] | Not published |
| Guidelines on ongoing monitoring, Article 26(5) | Draft. Consultation closed 3 September 2026.[7] | Not published |
| Format for reporting suspicions, Article 69(3) | Draft. Consultation closed 20 September 2026.[7] | Not published |
| Guidelines on risk variables and risk factors, Article 20(3) | No entry on AMLA's tracker.[7] | AMLA planned a consultation in Q3 2026 and a final draft in Q4 2026[10] |
| Guidelines on internal policies and controls, Article 9(4) | No consultation found. | Consultation planned for Q1 2027, final for Q2 2027[10] |
| Guidelines on simplified due diligence | Roundtables announced 2 October 2026.[11] | Consultation "at a later stage" |
| Guidelines on outsourcing, PEPs, self-hosted addresses and three more topics | No drafts found. | Legal deadline 10 July 2027[1] |
The first five rows had the same 10 July 2026 legal deadline as the standards.[1] AMLA issues guidelines itself, and obliged entities "shall make every effort to comply".[8] For what the regulation already fixes on providers, read AMLR Article 18.
A build list for the next nine months
Nine months remain until 10 July 2027. A sector view is in the AMLR checklist by obliged entity, and the make-or-buy question in AMLR software.
- Map every Article 22(1) data point to the source that verifies it.[4]
- Add an eID route at assurance level substantial or high.[2]
- Record a reason each time the remote document-based route is used.[2]
- Store time-stamped, readable copies of remote verification evidence.[2]
- Re-screen for sanctions when a listing or customer data changes.[2]
- Set PEP check frequency by risk class.[2]
- Schedule refresh at 1 year for higher-risk customers and 5 years for the rest.[1]
- Rank existing customer files by risk for remediation.[2]
- Add a second source next to the beneficial ownership register.[2]
- Keep thresholds, periods and data sets as configuration.
- Check the Official Journal and AMLA's tracker each month.[7]
How Didit helps teams build to the final draft
Didit runs both verification routes in one workflow, so the default and the alternative are a configuration choice. The AMLR solution page maps each requirement to a check, and the AMLR guide in the docs shows the setup.
On the electronic route, the national eIDs in production are MitID, the Finnish Trust Network, Smart-ID, Mobile-ID and BankID Sweden. Support for the EU Digital Identity (EUDI) Wallet is coming soon. Confirm that a scheme meets the assurance level your case needs. On the document route, identity verification covers 14,000+ document types with NFC chip reading, liveness and face match. A full Know Your Customer (KYC) check costs $0.33.
AML screening checks 1,300+ sanctions, PEP and watchlists at $0.20 per check, and ongoing monitoring re-screens daily at $0.07 per person per year. Business verification covers companies and their owners. Other prices are on the pricing page.
Didit provides
- Identity checks by national eID or by document
- Sanctions and PEP screening, re-screened daily
- The evidence of every check, with configurable retention
Stays with you
- The choice of route, the risk assessment and the customer risk profile
- The onboarding decision and reporting to the financial intelligence unit
- The liability: the obliged entity "shall remain fully liable"[1]
Run the eID route and the document route side by side
Configure both routes, screening and the evidence trail in one workflow, and pay per check.
Key takeaways
- AMLA's CDD standard is a final draft dated 30 September 2026. It is not adopted and it is not law.
- It is proposed to apply six months after entry into force. No calendar date exists yet.
- The two Article 22(6) means stay the default. Remote document-based verification must be justified.
- In its final draft, AMLA kept the 1-year and 5-year refresh limits and refused risk-based sanctions screening.
Frequently asked questions
Are AMLA's technical standards final, and when do they start to apply?
AMLA's work is final, and the Commission received the reports.[3] They are proposed to apply six months after entry into force. The Commission had not adopted them on 2 October 2026, so no calendar date exists.[7]
Is the AMLA RTS on customer due diligence law now?
No. It is a final draft dated 30 September 2026. Its provisions "will only become definitive upon publication in the Official Journal of the European Union".[4] The AMLR itself is law and applies from 10 July 2027.[1]
Can the Commission still change the final draft?
Yes. The standards "remain subject to review and potential amendments by the European Commission".[4] Keep thresholds, periods and data sets configurable.
Is remote onboarding with a document and a face check still allowed?
Yes, as the alternative route. Draft Article 7 allows it where the person cannot reasonably be expected to present the document in person and has no qualifying eID. The obliged entity must justify each use.[2]
Does the final draft require liveness detection, biometrics or video identification?
No technique is named. The draft requires "controls" that the person presenting the document "is the document holder". The words liveness and biometric do not appear.[2]
Do existing customers have to be re-verified when the standard applies?
Not all at once. Draft Article 28 brings existing files into line within one year for higher-risk customers and five years for all others.[4] Those periods start at the standard's entry into force, a date not yet known.[2]
Did AMLA lower any customer due diligence thresholds?
No. The Article 19(9) final draft introduces no additional lower thresholds, so the amounts in Article 19 AMLR stand.[5] It adds criteria for repetition and for linked transactions.[6]
What should compliance teams do before the Commission adopts the standards?
Build to the AMLR, which is fixed, and to the final draft for the detail. Start with what takes longest: an eID route, evidence storage for remote checks and re-screening triggers.
Sources
- Regulation (EU) 2024/1624 (AMLR), EUR-Lex, Official Journal of 19 June 2024.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- Press release: AMLA finalises key standards for the private sector, AMLA, 1 October 2026.
- Factsheet on the RTS under Article 28(1) AMLR, AMLA, September 2026.
- Final Report, draft RTS under Article 19(9) AMLR, AMLA.
- Factsheet on the RTS under Article 19(9) AMLR, AMLA.
- Regulatory instruments tracker, AMLA, last update 30 September 2026.
- Regulation (EU) 2024/1620 (AMLA Regulation), Article 54, EUR-Lex.
- De-prioritisation of Level 2 acts in financial services legislation, European Commission, letter of 1 October 2025.
- Single Programming Document 2026-2028, Annex XI, AMLA.
- AMLA invites stakeholders to sectoral roundtables on simplified customer due diligence, AMLA, 2 October 2026.
We will update this post when the Commission adopts the standard. The requirement map is on the AMLR solution page.
Build to the final draft without locking it in
Set up the checks your risk assessment calls for and change a rule when the adopted text arrives.