The EU Anti-Money Laundering Regulation (AMLR) applies from 10 July 2027. Verify people by electronic ID or by document, find the owners, screen them and keep the evidence, in one workflow. A full know your customer (KYC) check costs $0.33.
Trusted by 3,000+ organizations worldwide.
What AMLR asks of you
From 10 July 2027, every obliged entity in the EU will follow one set of customer due diligence (CDD) rules. Didit runs the checks and returns the evidence. You keep the decisions and the liability.
Pick the checks your risk policy calls for in the no-code builder: electronic ID or document verification, liveness, face match, screening and questionnaires. You approve the policy. The workflow applies it.
19 June 2024
Regulation (EU) 2024/1624 appears in the Official Journal of the EU.
9 July 2024
AMLR enters into force. It does not apply to obliged entities yet.
1 July 2025
The Anti-Money Laundering Authority (AMLA), based in Frankfurt, starts operations.
1 October 2026
AMLA announces its final draft technical standards on customer due diligence, dated 30 September 2026, and sends them to the European Commission. They are a final draft, not law.
10 July 2027
The rules bind obliged entities across the EU. The EUR 10,000 cap on cash payments for people trading in goods or providing services starts on the same day.
2028
AMLA starts to supervise selected high-risk financial institutions directly, capped at 40 in the first round.
10 July 2029
AMLR starts to apply to football agents and professional football clubs.
Art. 19
When due diligence applies
AMLR asks
Customer due diligence on every new business relationship and on occasional transactions of EUR 10,000 or more. Lower triggers: EUR 1,000 for transfers of funds and for crypto-asset service providers (CASPs), EUR 3,000 in cash (identify and verify), EUR 2,000 in gambling.
Didit provides
Sessions by API or hosted link, started from your own triggers. Transaction monitoring rules that flag amounts and patterns.
Stays with you
Deciding when a threshold is met and which transactions are linked.
Art. 22
Identification and verification
AMLR asks
A fixed set of data for each person (names, place and date of birth, nationalities, address) and for each legal entity, all of it verified.
Didit provides
Document capture for 14,000+ document types, chip reading for e-passports and e-IDs, passive and active liveness, face match and non-document lookup.
Stays with you
Choosing a second reliable source when a document lacks a data point, such as an address.
Art. 22(6)
Electronic identification route
AMLR asks
Verification through an identity document, or through electronic identification at eIDAS assurance level substantial or high and qualified trust services.
Didit provides
Five digital ID wallets live: MitID, Finnish Trust Network, Smart-ID, Mobile-ID and BankID Sweden. EUDI Wallet coming soon.
Stays with you
Confirming that each scheme meets the assurance level you need, and recording why you used the document route when you did, which AMLA’s final draft standards would ask for.
Arts. 22(7), 24, 51 to 55 and 62
Beneficial ownership
AMLR asks
Identify every natural person who holds 25% or more, directly or indirectly, and anyone who controls the entity by other means. Consult the central register and report discrepancies within 14 calendar days (Article 24).
Didit provides
Company registry data in three tiers (Lite, Shareholders, UBOs), a linked identity check for each owner or officer, and company and person screening.
Stays with you
Assessing control by other means, consulting the central register and reporting discrepancies. Tier availability varies by country.
Art. 25
Purpose and source of funds
AMLR asks
Understand the purpose and intended nature of the relationship and, where necessary, the source of funds.
Didit provides
Questionnaires with templates for source of funds and purpose of the relationship.
Stays with you
Deciding how much information each level of risk needs.
Art. 26
Ongoing monitoring and updates
AMLR asks
Monitor the relationship and update customer information at least every 1 year for higher-risk customers and every 5 years for all others, plus event triggers.
Didit provides
Daily re-screening with alerts by webhook and a record of each run, for $0.07 per person per year. New sessions when a refresh is due.
Stays with you
Setting each customer’s risk class and review date.
Arts. 20(1)(g) and 42 to 46
Politically exposed persons (PEPs)
AMLR asks
Determine whether the customer or a beneficial owner is a PEP, a family member or a close associate. Apply senior management approval, source of wealth and source of funds checks and enhanced monitoring. Risk measures continue for at least 12 months after the person leaves office.
Didit provides
PEP screening that covers family members and close associates, questionnaires, manual review and four-eyes approval.
Stays with you
Senior management approval and the enhanced measures you choose.
Arts. 20(1)(d) and 26(4)
Sanctions screening
AMLR asks
Check customers, beneficial owners and controlling persons against EU targeted financial sanctions, and check again regularly.
Didit provides
Screening against 1,300+ sanctions, PEP and watchlists, refreshed daily, for $0.20 per check. Daily re-screening with ongoing monitoring.
Stays with you
Reviewing each match and acting on a confirmed one.
Arts. 26(1) and 69
Transactions and reporting
AMLR asks
Monitor transactions against what you know about the customer, and report suspicions to the financial intelligence unit (FIU).
Didit provides
Real-time rules for fiat and crypto, 11 rule bundles, alerts, case management and report preparation.
Stays with you
Approving the detection criteria and filing the report.
Art. 18
Outsourcing
AMLR asks
Outsourcing is allowed with a written agreement, notification to your supervisor before the provider starts, and regular controls. You remain fully liable.
Didit provides
The checks, the evidence behind each result and exportable records for your controls.
Stays with you
Six tasks that can never be outsourced: approving the business-wide risk assessment, approving policies and controls, deciding the customer’s risk profile, deciding to onboard, reporting to the FIU and approving detection criteria.
Art. 77
Records
AMLR asks
Keep due diligence records, unredacted, for 5 years after the relationship or transaction ends. Then delete the personal data.
Didit provides
Session records with retention you set from 1 month to 10 years, deletion on demand and EU storage by default.
Stays with you
The retention duty itself, and any extension an authority requires.
Art. 76(5)
Human intervention
AMLR asks
Automated decisions to accept or refuse a customer, or to change the level of due diligence, need meaningful human intervention. The customer can ask for an explanation.
Didit provides
Manual review queues, four-eyes approval and the evidence behind every automated result.
Stays with you
The human decision and the explanation to your customer.
Last reviewed: 2 October 2026. Not legal advice. Confirm your obligations with counsel. AMLR applies from 10 July 2027, and AMLA’s technical standards are a final draft dated 30 September 2026, not law.
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "YOUR_AMLR_WORKFLOW_UUID",
"vendor_data": "customer_8412"
}'{ "url": "https://verify.didit.me/session/…" }app.post("/webhooks/didit", async (req, res) => {
const expected = crypto.createHmac("sha256", process.env.DIDIT_WEBHOOK_SECRET)
.update(req.rawBody).digest();
const sig = Buffer.from(req.get("X-Signature") ?? "", "hex");
if (sig.length !== expected.length ||
!crypto.timingSafeEqual(sig, expected)) return res.sendStatus(401);
const { event_id, timestamp, webhook_type, vendor_data, status } = req.body;
const fresh = Math.abs(Date.now() / 1000 - timestamp) <= 300; // signed field
if (!fresh) return res.sendStatus(401);
if (webhook_type === "status.updated" || webhook_type === "data.updated") {
// event_id repeats on retries: store each event once (unique key).
if (await alreadyStored(event_id)) return res.sendStatus(200);
await saveEvidence(event_id, vendor_data, req.body); // your record
if (status === "In Review") queueForReviewer(vendor_data);
// "Approved" and "Declined" are results. You decide to onboard.
}
res.sendStatus(200);
});OK# Integrate Didit for AMLR customer due diligence
Integrate Didit into <my_stack> to run the customer checks that the EU
Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) will
require from 10 July 2027. Didit supplies the checks and the evidence. The
obliged entity keeps every decision and stays fully liable (Article 18).
This prompt is not legal advice.
## What stays with the obliged entity (never automate these away)
Article 18(3) lists six tasks that cannot be outsourced:
- proposing and approving the business-wide risk assessment
- approving internal policies, procedures and controls
- deciding the risk profile of a customer
- deciding to enter a business relationship or carry out a transaction
- reporting to the financial intelligence unit (FIU)
- approving the criteria for detecting suspicious transactions
Build the integration so that a named person takes each of these decisions.
Article 76(5) also requires meaningful human intervention on automated
decisions to accept or refuse a customer.
## Published prices used below
- Full KYC (know your customer) check: $0.33
- AML (anti-money laundering) screening: $0.20 per check
- Ongoing AML monitoring: $0.07 per person per year
For every other module, read https://didit.me/pricing. Do not invent a price.
## 1. Create the applications and the workflow
Create an account at https://business.didit.me. Live and sandbox are separate
applications. Sandbox outcomes are simulated. Store the application keys and
workflow UUIDs in server-side configuration. Never expose a key to a browser.
Build the workflow in the Console, or with
POST https://verification.didit.me/v3/workflows/.
Map the checks to the regulation:
- Identification and verification (Article 22): either a digital ID wallet
(the electronic identification route of Article 22(6)(b)) or ID
Verification with chip reading, liveness and face match (the document
route of Article 22(6)(a)). Which route a customer takes is the obliged
entity's policy. Record the route and the reason in your own system.
- Sanctions and PEP (politically exposed person) screening (Article 20):
add AML Screening.
- Purpose and source of funds (Article 25): add a Questionnaire.
- Companies and beneficial owners (Articles 51 to 62): use a KYB (know your
business) workflow and start a linked identity session for each owner.
The AMLR ownership test is 25% or more, with control assessed in parallel.
Registry tiers vary by country, and a register alone is not sufficient
verification.
Publish the draft. Existing sessions keep the workflow version they started
with.
## 2. Create a session for each customer
curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: <application-key>" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "<workflow-uuid>",
"vendor_data": "<your-customer-id>"
}'
The response contains "url". Redirect the customer to it, or embed the hosted
flow. vendor_data is your own stable reference and is returned on session
events. Within one application only one unfinished session can exist per
(workflow_id, vendor_data) pair.
## 3. Receive authenticated results
Register a webhook destination for status.updated and data.updated and store
its secret_shared_key on the server.
Verify before reading a result or changing a customer's data:
- X-Signature-V2: HMAC-SHA256 over recursively sorted, compact JSON with
Unicode preserved. This header does not sign raw bytes.
- X-Signature: HMAC-SHA256 over the exact raw request bytes, captured before
any JSON middleware.
- Check the signature format and length before a constant-time comparison.
- Validate X-Timestamp and reject a difference greater than 300 seconds.
Require it to match the timestamp in the authenticated payload. The header
is not signed, so a header checked alone can be replaced on a replay.
- Make processing idempotent before any side effect: a retry reuses the same
event_id, so key on event_id and skip an event you have already stored.
Durably queue the work before acknowledging.
Session statuses: Approved, Declined, In Review, In Progress, Not Started,
Abandoned, Expired, Kyc Expired, Resubmitted, Awaiting User.
- "Approved" and "Declined" are verification results, not onboarding
decisions. Store the result, then let the obliged entity's own process
decide.
- "In Review" goes to a human reviewer.
For reconciliation read
GET https://verification.didit.me/v3/session/{sessionId}/decision/.
## 4. Keep watching (Article 26)
Enable ongoing AML monitoring for approved customers. Didit re-screens daily
and re-screens fire the usual status.updated and data.updated events.
Store a risk class and a next review date for each customer in your own
system. Article 26(2) caps the interval between updates of customer
information at 1 year for higher-risk customers and 5 years for all others,
with event triggers on top. When a review is due, create a new session.
## 5. Keep the record (Article 77)
Records are kept for 5 years from the end of the business relationship, the
occasional transaction or the refusal, and personal data is then deleted
unless another law or an authority requires otherwise.
- Set retention in Business Console -> App Settings -> Data (1 month to 10
years). The clock that matters starts when the relationship ends, so either
size the window for that or export the evidence into the obliged entity's
own archive.
- Delete a session on demand with
DELETE https://verification.didit.me/v3/session/{session_id}/delete/.
Store the session id, the status, the workflow version, the route used and
the name of the person who took the onboarding decision.
## 6. Verify the integration
1. In the sandbox application, run one customer through the wallet route and
one through the document route. Confirm both write the same record shape.
2. Send a webhook with a wrong signature and confirm it is rejected with 401.
3. Confirm an "In Review" result reaches a reviewer and that no code path
onboards a customer without a recorded human decision.
4. Confirm sandbox and live traffic use separate applications.
Docs: https://docs.didit.me/getting-started/amlr-compliance
For building, testing, and your first users.
25+ modules, publicly priced. Automatic volume discounts.
For large volumes and regulated programs.
Volume discounts apply automatically as usage grows — no negotiation, no sales call.
Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.
One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:
The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.
AMLR is Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation: one directly applicable set of rules on customer due diligence, beneficial ownership, reporting and record keeping for every obliged entity in the EU.
The dates that matter:
Until 10 July 2027, the national laws that transpose the earlier directives still apply. Because AMLR is a regulation, it needs no national transposition, although Member States keep some options, such as lower cash limits.
Didit helps you meet the customer checks. A full know your customer (KYC) check costs $0.33, and sanctions and politically exposed person (PEP) screening costs $0.20 per check.
Last reviewed: 2 October 2026. This is not legal advice. Confirm with counsel.
They are three parts of the same 2024 package:
One trap: Directive (EU) 2018/1673, on combating money laundering by criminal law, is a different act. Give the number when it matters.
AMLA does not certify or approve vendors, and AMLR creates no vendor licence. Didit supplies the checks and the evidence, for example identity verification across 14,000+ document types and screening against 1,300+ lists. Your own programme is what a supervisor assesses.
Article 3 lists them. The main groups:
Member States can exempt some gambling services and some football clubs where the risk is proven to be low.
Whatever the category, the customer checks have the same shape, and Didit runs them in one workflow: identity checks in 220+ countries and territories, and business verification with an identity check for each owner.
If you are not sure whether you are in scope, ask counsel. This is not legal advice.
Yes, on the texts as they stand, but it is not the first choice.
What the regulation says. Article 22(6) names two ways to verify identity: an identity document, or electronic identification at eIDAS assurance level substantial or high, with qualified trust services. AMLR names no technique. The words “selfie”, “liveness” and “biometric” do not appear in it.
What the draft standards say. AMLA’s final draft technical standards, dated 30 September 2026, treat electronic ID as the default remote route. Remote document-based verification is an alternative for customers who cannot reasonably present the document in person and have no access to a qualifying electronic ID. You must be able to justify using it and show safeguards. AMLA also says firms may keep using existing remote onboarding tools that meet those requirements. This is a final draft sent to the European Commission. It is not law.
Where Didit fits. Didit runs both routes: five digital ID wallets live in production, and document verification with chip reading, liveness and face match.
Not yet. AMLA finished its final draft regulatory technical standards (RTS) on customer due diligence on 30 September 2026 and announced them on 1 October 2026. They have been sent to the European Commission.
Three things follow:
AMLR itself is fixed: it applies from 10 July 2027.
What to do now: build to the regulation and keep the workflow easy to change. In Didit’s no-code builder you can add or remove a check, or move customers from the document route to a digital ID wallet, without a redeploy. Each session records the workflow version it ran on, so you can show which rules applied.
AMLR does not say so. The acceptance duty sits in the eIDAS Regulation, not in AMLR.
A wallet does not finish due diligence either. Beneficial ownership, purpose, sanctions and PEP screening, and monitoring remain.
Didit today: five digital ID wallets are live in production: MitID (Denmark), Finnish Trust Network, Smart-ID (Estonia, Latvia, Lithuania, Belgium), Mobile-ID (Estonia, Lithuania) and BankID Sweden. The EUDI Wallet is coming soon. Document verification covers customers who have no wallet.
25% or more. Article 52(1) sets the ownership test at 25% or more of the shares, voting rights or other ownership interest, held directly or indirectly. The wording is 25% or more, not more than 25%.
Three points that are often missed:
If no beneficial owner is found, you record that and verify the senior managing officials instead. The central register must be consulted, but it is not enough on its own, and discrepancies are reported within 14 calendar days.
Didit’s Business Verification returns company registry data in three tiers (Lite, Shareholders, UBOs) and links an identity check to each owner or officer. Tier availability varies by country.
Article 26(2) sets maximum intervals between updates of customer information:
These are ceilings, not targets. Article 26(3) adds event triggers: a change in the customer’s circumstances, a legal duty to contact the customer during the year, or a relevant fact you become aware of. AMLA has said these periods cannot be extended through technical standards.
Sanctions are separate. Article 26(4) asks you to check regularly whether customers and beneficial owners are subject to targeted financial sanctions. Credit and financial institutions must also check on any new designation.
How Didit helps:
You decide each customer’s risk class and review date. Didit does not make that decision for you.
Article 18 lets obliged entities outsource tasks to service providers on conditions that include a written agreement, notification to your supervisor before the provider starts, and regular controls. You remain fully liable for the outsourced tasks.
Six tasks can never be outsourced (Article 18(3)):
What Didit can run for you: identity and document checks, digital ID wallet verification, registry look-ups and owner checks, sanctions and PEP screening, daily re-screening, transaction monitoring against rules you approved, and report preparation.
Recital 47 adds that using third-party software or screening services, where your own staff perform the requirement, is not outsourcing. Which side of that line your setup falls on is a question for counsel. AMLA’s outsourcing guidelines are due by 10 July 2027.
Five years. Article 77 will require you to keep customer due diligence records, transaction records and suspicion assessments for 5 years from the end of the business relationship, the occasional transaction or the refusal to onboard. Records must not be redacted. When the 5 years end, personal data must be deleted, unless another law applies or an authority asks for up to 5 more years in a specific case.
The duty is yours. A provider can store the records, but the obligation does not move.
How Didit handles it:
One caution: the 5 years start when the relationship ends, not when the check ran. Set the retention window with that in mind, or export the records into your own archive.
You pay per check, at published prices:
Business verification, digital ID wallets and transaction monitoring are priced per use too. See pricing for every module.
Going live is a short path:
The integration is one API call and one webhook. How long the rollout takes depends on your own policies and approvals, which stay with you under Article 18.
Start free at business.didit.me, or talk to us through the contact page.
One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.