AMLA's new CDD standards: Seven KYC developments organizations should understand

Quick summary

AMLA's final draft Regulatory Technical Standards (RTS) introduce important clarifications to customer due diligence (CDD), from identity verification and beneficial ownership to PEP screening and virtual IBANs. This article explores seven key developments, their implications for KYC technology, and how financial institutions can prepare for a more proportionate, risk-based approach to compliance.

Introduction

The final draft Regulatory Technical Standards (RTS) Article 28(1) on simplified customer due diligence gives financial institutions considerably more clarity on how the EU’s new AML framework will translate into practice.

Published by the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), the final draft RTS under Article 28(1) of the AML Regulation (AMLR) set out more detailed requirements for standard, simplified and enhanced customer due diligence, identity verification, beneficial ownership, politically exposed person (PEP) screening and other aspects of CDD.

The standards have now been submitted to the European Commission for adoption and, once adopted and published in the Official Journal, are proposed to apply six months after entering into force.

The final text is not a rewrite of the consultation draft. AMLA deliberately retained the overall policy framework while making targeted changes in response to stakeholder feedback, with a particular focus on proportionality, legal clarity and reducing unnecessary prescriptiveness.

Some changes affect how customer information should be collected and verified. Others give institutions greater discretion over how controls are applied. And some requirements that were already emerging through the AMLR and consultation process are now much clearer as financial institutions begin planning implementation.

AMLA's final CDD standards: What has changed?

The final RTS Article 28(1)  retains much of the framework set out in AMLA's consultation draft, but make a number of targeted changes and clarifications. For KYC leaders, these are some of the areas with the most relevant technology implications.

Even relatively detailed regulatory changes can have KYC technology readiness implications across the KYC data model, screening coverage, entity relationships, risk assessment and workflow.

What KYC leaders should be looking at in more detail

1. How AMLA's CDD requirements change customer identity data

One of the most immediate considerations is the customer data itself.

The final RTS states institutions should now handle further information including names, place of birth, nationality and address when identification documents do not present that information consistently.

For nationality, institutions are expected to identify the nationalities held by a customer or beneficial owner and take reasonable measures to establish additional nationalities. Where multiple nationalities exist, verification of one nationality is sufficient. Where an individual is stateless or has refugee or subsidiary protection status, that status should instead be obtained.

AMLA has also introduced greater flexibility around given names and place-of-birth information following consultation feedback. For example, place of birth can reflect the city, municipality, town, village, country or state according to the information available.

This may sound like a relatively small regulatory detail. From a technology perspective, it is not.

Many KYC environments have data models designed around fixed fields and assumptions: one nationality, one standardized address structure, one format for place of birth.

The technology question: Can your customer data model accommodate the information AMLA requires without forcing complex customer identities into rigid legacy data structures?

2. Virtual IBAN requirements: Connecting customers and accounts

Virtual IBANs receive specific treatment in the final RTS.

Credit and financial institutions must obtain and verify identification information for the natural or legal person using a virtual IBAN, together with the virtual IBAN assigned to them.

Importantly, the final RTS also require information on the associated bank or payment account to include its account number and the dates on which that account was opened and, where applicable, closed.

The February consultation draft already contained specific virtual IBAN provisions, but the final formulation makes the associated account information more explicit: the consultation text referred to opening and closing dates, while the final RTS expressly specifies the associated bank or payment account number as well.

For institutions operating at scale, the challenge is therefore not only storing another identifier. It is maintaining the relationship between the virtual IBAN, the person or entity using it, and the underlying bank or payment account.

The technology question: Can your systems reliably connect a virtual IBAN to the customer or entity using it and to the underlying account throughout the customer lifecycle?

3. AMLA beneficial ownership requirements: Why context matters

The final RTS reinforce the need for institutions to understand ownership and control structures rather than simply identify a beneficial owner.

Where there are intermediate legal entities or arrangements between a customer and its beneficial owners, the RTS specify information that may need to be understood, including legal form, nominee directors or shareholders, jurisdiction, shareholdings or voting rights, and relevant information concerning listed entities.

Crucially, however, AMLA changed its approach following consultation.

Rather than treating structural complexity as automatically indicative of higher risk and prescribing mandatory measures around it, AMLA moved toward a more proportionate approach. Institutions are given greater discretion to determine whether a particular structure is genuinely complex in context and what that means for the risk of the relationship.

This distinction matters.

A multilayered corporate structure does not automatically make a customer suspicious. What matters is whether the institution can understand the structure, identify the people and entities behind it and assess what those relationships mean for risk.

The technology question: Can your KYC environment resolve entities and ownership relationships sufficiently to give investigators a contextual view of the customer rather than a collection of disconnected records?

4. Who must be included in PEP screening under AMLA?

The final RTS make clear the population that institutions need to consider when determining PEP status.

That includes the customer, the customer’s beneficial owner and, where relevant, the person on whose behalf or for whose benefit a transaction or activity is being carried out. The requirements also cover family members and persons known to be close associates of PEPs.

This three-party scope was already included in the consultation draft, so it should not be described as a new addition made at finalization. But its presence in the final RTS is nevertheless important for institutions assessing their screening architecture.

The operational question is whether all relevant parties are consistently identified and made available to the screening process.

That becomes particularly challenging where customer, beneficial ownership, representation and transaction data sit across different systems.

The technology question: Are you screening all of the relevant parties required by the final RTS and can your systems reliably establish the relationships between them?

5. Does AMLA require automated customer and PEP screening?

One of the more significant changes following consultation concerns how screening should be performed.

Stakeholders raised concerns that the consultation draft could be interpreted as favoring automated screening, with manual checks treated primarily as an exception.

AMLA changed the final text.

The final approach is explicitly technology-neutral: institutions may use automated screening, manual checks or a combination of the two. What matters is whether the chosen approach is effective given the institution’s size, business model, risk, complexity and nature of business. AMLA makes clear that manual screening is no longer framed simply as an exceptional fallback.

For larger financial institutions processing significant customer and transaction volumes, technology will inevitably play an important role in making screening scalable and effective.

But the principle is important: automation is a means to an outcome, not the regulatory objective itself.

The technology question: Does your screening approach give you the accuracy, timeliness, coverage and evidence you need — while keeping appropriate human judgment within the process?

6. Identity verification requirements: Greater flexibility, stronger evidence

The final RTS also clarify the relationship between traditional identification documents, electronic identification and alternative verification methods.

Electronic identification solutions meeting the relevant assurance requirements – including European Digital Identity Wallets – form part of the framework. But AMLA responded to concerns that the consultation draft could be interpreted as creating an “eIDAS-first” approach.

The final text clarifies that alternative verification methods may be used where the AMLR-prescribed methods cannot be used, and that existing remote onboarding tools can continue to be used where they meet requirements around quality, security and confidentiality.

Those alternative processes also need to be defensible. The RTS require controls around matters such as verifying that the person presenting an identity document is its holder, protecting the integrity of communications and retaining relevant records securely for subsequent verification.

The technology question: Can your KYC environment integrate the appropriate identity-verification methods while retaining the information and evidence necessary to demonstrate how verification took place?

7. How AMLA reinforces risk-based customer due diligence

Perhaps the most important change is not an individual data field at all.

During consultation, respondents warned that some of the proposed information requirements could lead institutions to treat CDD as a mandatory checklist, collecting information irrespective of the actual ML/TF risk.

AMLA responded by strengthening the risk-based principle in the final RTS.

The final text makes clearer that the scope of information and supporting documentation should remain proportionate to the identified risk. AMLA also amended its enhanced due diligence provisions to reinforce institutions’ discretion to determine appropriate measures in higher-risk situations.

This is an important point. Harmonization should not mean applying every control to every customer in exactly the same way. Nor should implementation become an exercise in adding more fields, more checks and more manual steps to existing KYC processes.

The objective should remain effective, proportionate customer due diligence.

The technology question: Can your systems differentiate according to risk, applying greater scrutiny where it is warranted without unnecessarily increasing friction and operational burden elsewhere?

What AMLA's CDD standards mean for KYC technology readiness

Taken individually, some of these requirements may appear incremental.

An additional nationality. A different address treatment. Another party within the screening population. A virtual IBAN connected to an underlying account.

At scale, however, these requirements touch the underlying architecture of KYC: the customer data model, entity relationships, screening coverage, risk assessment, workflow, verification integrations and the evidence retained around decisions.

That is why I believe institutions should use the clarity provided by the final RTS to look beyond policy interpretation and ask a more practical question:

Can our existing KYC technology implement these requirements consistently across our customers, products and jurisdictions?

AMLA has deliberately maintained a technology-neutral and risk-based approach. It does not prescribe a particular technology architecture, nor should institutions interpret the new framework as a mandate simply to automate more.

Technology should instead make it easier to connect the right information, understand the customer and associated parties, apply controls proportionately to risk, adapt processes as requirements change and maintain a clear record of the decisions made.

The final CDD RTS give institutions more certainty about the destination. Now is the time to determine whether the technology foundations are ready to get there.

‍
Related resources:

EU AMLA Technology Impact Matrix  

AMLA compliance: Five technology questions financial institutions should ask

Webinar: From Regulation to Action: Getting EU AMLA-Ready

What is AMLA? A brief overview for compliance leaders

‍