Compliance

AMLA's Final CDD Standards: What EMIs and PIs Must Change

Dmytro Medvid, Founder · 22 October 2026 · 10 min read

AMLA customer due diligence standards for EMIs and PIs, shown as linked onboarding checks: AMLR, CDD, eID and KYC

Key takeaways

On 1 October 2026 AMLA submitted its final draft customer due diligence standards to the European Commission; they are not law until adopted and published in the Official Journal.
The AMLR applies from 10 July 2027, while the CDD standard is proposed to apply six months after its entry into force, so the regulation will probably apply for some months before the detailed standard does.
For remote onboarding, eID at substantial or high assurance, including EU Digital Identity Wallets, is the default; document-and-selfie checks become a fallback that must be justified and evidenced case by case.
Existing customer files must be brought into line within one year for higher-risk customers and five years for all others, counted from the standard's entry into force rather than its application.
Under Article 19(7) AMLR, reloadable e-money and instruments linked to a payment account no longer qualify for the low-value CDD exemption.

On 1 October 2026 the EU's new Anti-Money Laundering Authority (AMLA) sent the European Commission its final draft standards on customer due diligence. For e-money and payment institutions they settle three practical questions: which customer data you must hold, how you may verify identity remotely, and how quickly existing customer files must be brought up to standard. The headline for onboarding teams: electronic identification becomes the default route for remote KYC, and the familiar document-plus-selfie check becomes a fallback you must justify case by case.

None of this is law yet. The Commission still has to adopt the standards, and they are proposed to apply six months after entry into force. The AMLR itself applies from 10 July 2027 regardless. This guide explains what was finalised, what changes for EMIs and PIs, and how to plan around a start date nobody can yet name.

What AMLA finalised on 1 October 2026

AMLA announced three sets of final draft regulatory technical standards (RTS) under the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 (AMLR):

Customer due diligence (Article 28(1) AMLR). What to collect and verify for standard, simplified and enhanced due diligence, which sources count as reliable and independent, the attributes electronic identification must provide, and the risk factors supervisors weigh when exempting certain e-money products. The final report is dated 30 September 2026; the consultation ran from 9 February to 8 May 2026.
Business relationships, occasional and linked transactions (Article 19(9) AMLR). When repeated activity becomes a business relationship, and when separate transactions must be added together against the CDD thresholds.
Group-wide requirements (Articles 16(4) and 17(3) AMLR). Minimum group policies and information sharing, and what to do where third-country law blocks group standards.

The CDD text shrank from 33 to 29 articles between consultation and final draft, and several mandatory lists became optional, risk-based ones (PayTechLaw). AMLA could make the standards more workable, but it could not create exemptions that the AMLR itself does not allow.

When the new CDD rules apply

Three dates matter, and only one of them is fixed.

10 July 2027. The AMLR applies directly to obliged entities, including EMIs and PIs. Until then, national laws transposing the current AML directives continue to apply.
Entry into force of the CDD RTS. Under Article 49 of the AMLA Regulation, Regulation (EU) 2024/1620, the Commission has three months to decide whether to adopt a draft RTS, and may amend it. Parliament and the Council then have three months to object, extendable by three more, unless both waive the window early (Article 51). The RTS enters into force 20 days after publication in the Official Journal.
Application of the CDD RTS: six months after entry into force (draft Article 29). Football clubs and agents get 10 July 2029; nobody else does.

Commentators expect a gap. For the RTS to apply on 10 July 2027 it would need to enter into force by 10 January 2027, which is realistic only if the Parliament and the Council waive their objection period (Zyphe). The likelier outcome is that the AMLR applies for some months before the detailed standard does (AMLR Monitor).

Model the CDD standard's dates

Official Journal publication, months after this article's date(mo)

Entry into force (remediation clock starts): May 2027
CDD standard applies to new onboarding: November 2027
Higher-risk existing customers remediated by: May 2028
All other existing customers remediated by: May 2032
Approx. months the AMLR applies without the standard: 4 months

Entry into force is rounded to one month after publication (the legal rule is 20 days). The last line counts from late October 2026, when the AMLR's 10 July 2027 start was about 8.6 months away.

Indicative planning tool, not a legal calculation.

The awkward detail is in the two remediation rows. The one-year and five-year remediation periods run from entry into force, not from application (recital 26 of the final report; AMLA factsheet; Reg Reporting Desk). Half of the year you have to refresh higher-risk files passes before the standard even applies to new customers.

Customer data: what you collect changes in the details

The RTS does not reinvent KYC data, but it sets out the fields precisely, and your onboarding schema has to match it field for field.

Names. All names: every given name and every surname (RTS Article 2).
Address. Country and city, town or village are mandatory; postal code, street, building and apartment number are collected where they exist (Article 3). For senior managing officials identified instead of a beneficial owner, the registered office address can replace a residential one.
Place of birth. As shown on the identity document or eID: the country, state, or city, town or village (Article 4). The final text accepts whichever the document gives.
Nationality. Take reasonable steps to find out whether the customer holds more than one. If several are declared, verifying one is enough.
Gaps in the document. Where an identity document lacks a required data point, fill it from reliable and independent sources, taking risk-sensitive measures to check their reliability (Article 8). Every identification data point you use must be verified.

For corporate customers, the rigid definition of a "complex structure" (three or more ownership layers plus other criteria) was dropped. Complexity is now judged on indicators such as layers, trusts, high-risk jurisdictions and nominees (PayTechLaw). For each entity between the customer and its beneficial owners you record legal form, country of registration, nominees and ownership and voting shares. In low-risk cases you may identify beneficial owners from the central register, a business register, customer information or reliable open sources, but you must verify using a different source; the central register alone is not enough (Article 19).

If your KYB flow stores ownership as a free-text note, this is the moment to turn it into structured data. We made the same argument in KYC, KYT and risk scoring built into the stack.

Remote onboarding: eID first, document checks as a justified fallback

This is the change most EMIs and neobanks will feel. Article 22(6) AMLR allows two ways to verify identity: an identity document (plus reliable sources where relevant), or electronic identification at eIDAS assurance level "substantial" or "high" together with qualified trust services. The RTS confirms that this covers European Digital Identity Wallets and that these means can also be used face to face.

Document-based remote checks, the selfie-and-ID flow most fintechs run today, become an alternative solution under RTS Article 7. You may use one only where the customer cannot reasonably present a document in person and has no access to a qualifying eID or trust service. Customer preference is not on that list. Each use must be justified, and you must be able to show your supervisor that the method complies.

Remote identity verification under the draft CDD RTS

The default route: a notified or qualifying eID at substantial or high assurance, including an EU Digital Identity Wallet.
Only if the customer cannot reasonably appear in person and has no access to a qualifying eID may you use an alternative remote solution.
Record why the default route was unavailable. You must be able to justify each case to your supervisor.
Keep time-stamped copies of the images, video, sound and data, stored securely and readable for later checks.

Simplified decision path. Articles refer to the AMLR and the final draft RTS.

Article 7(2) sets the minimum safeguards for any alternative solution: controls that confirm the person is the document holder, a secure and confidential session, images, video, sound and data clear enough to identify the person unambiguously, a hard stop on technical failures or doubts, and valid, up-to-date documents with time-stamped records kept for later verification. Existing remote onboarding tools may continue if they meet these requirements. The EBA's guidelines on remote customer onboarding (EBA/GL/2022/15) remain the benchmark until AMLA replaces them.

The wallet problem

"eID first" assumes customers have one. Under eIDAS 2.0 every member state must offer at least one EU Digital Identity Wallet by 24 December 2026, and regulated firms in sectors such as banking and financial services must accept it on request from 24 December 2027 (NicFab calendar). One October 2026 analysis expects 24 of 27 member states to miss the wallet deadline, and Germany's state wallet is planned to launch on 2 January 2027 (Masters of Privacy). National eIDs also qualify, but coverage varies widely from one country to another.

In practice, the share of customers who can use the default route will differ by market for years. A cross-border EMI onboarding customers from fifteen countries will run several routes at once. It needs routing logic that tries eID where it exists and falls back properly where it does not, and it must log the reason every time. Supervisors can ask you to justify each case.

Simplified due diligence is explicitly allowed

The final text is more risk-based than the draft. Article 1 now refers to simplified due diligence in low-risk situations, and for low-risk individuals the minimum data set is names, date and place of birth, and nationality (Article 18). The address does not have to be obtained or verified. For the purpose of the relationship, the minimum is the intended use of the product, the expected transaction value where applicable, and the customer's activity or occupation (Article 20). Source of funds is no longer part of that minimum, and purpose can be inferred from the product or past transactions (PayTechLaw).

For a payments business with a large retail base, this matters commercially. A properly documented low-risk segment can have a lighter onboarding journey, but only if your risk scoring can show why each customer sits in it. Article 33(5) AMLR lists the situations in which simplified measures must stop, including doubts about the data, monitoring that rules out lower risk, and suspicion. Your system should flag the customer for standard measures as soon as one applies.

PEP and sanctions screening: when, not just whether

The RTS fixes the screening moments:

PEPs (Article 17): before onboarding or an occasional transaction; at a risk-sensitive frequency afterwards; and without delay when relevant new information arrives or the EU list of prominent public functions under Article 43(5) AMLR is updated.
Targeted financial sanctions (Article 25): at onboarding, whenever sanctions lists change, whenever customer data changes (such as a new name, residence, nationality or beneficial owner), and without undue delay after UN listings are published. Aliases, trade names and, where relevant, crypto-wallet addresses must be screened too.

Two clarifications from the consultation: manual checks are acceptable alongside or instead of automated tools if they are effective and proportionate, and AMLA rejected a general risk-based approach to sanctions screening. Every customer gets screened on every list change.

E-money: a narrower exemption, with a published risk list

EMIs selling prepaid and gift products should read Article 19(7) AMLR closely. Today, Article 12 of the Fourth AML Directive lets member states exempt low-risk e-money from some CDD measures, including reloadable instruments with a €150 monthly limit used only domestically. The AMLR keeps the €150 cap but tightens the conditions. Supervisors decide the exemption, and all conditions must be met.

Low-value e-money exemption: AML Directive vs AMLR

Criteria
Who grants it	Member state law	Supervisor, on proven low risk
Reloadable instruments	Allowed with a €150 monthly limit, domestic use	Not allowed
Maximum stored value	€150	€150
What it can buy	Goods or services	Goods or services from the issuer or its network
Link to a payment account	Not addressed	Not allowed
Cash or crypto	Exemption lost for cash redemption or withdrawal, or remote payments, above €50	No exchange for cash or crypto-assets at all
Issuer monitoring	Required	Required

General-purpose reloadable prepaid cards fall outside the AMLR exemption. Closed-loop, non-reloadable products can still qualify.

Summary of the legal conditions. The RTS adds risk factors that set the extent of an exemption.

RTS Article 26 lists the factors supervisors weigh when deciding how far an exemption goes: low transaction limits, how risky the goods and services are, whether another obliged entity applying CDD executes the transactions, a limited period of use, direct distribution channels, limited geography, technical safeguards such as geofencing and IP tracking, monitoring of merchants that accept the instrument, and detection of suspicious bulk purchases. AMLA dropped two criteria after industry pushback: one on issuance charges and one requiring funding from EEA-regulated accounts (AMLA final report). If your product economics depend on light-touch onboarding, model them on full CDD and treat any exemption as a bonus.

Occasional and linked transactions

The Article 19(9) standard matters most for remittance and exchange businesses. The usual occasional-transaction threshold is €10,000, and credit and financial institutions must apply CDD to an occasional transfer of funds of €1,000 or more. The AMLA factsheet adds sector indicators for money remittance, currency exchange and crypto-asset exchange: three or more transactions within 12 months point towards a business relationship, and one month is the period over which to assess whether their occasional transactions are linked. Linked transactions are measured on their combined value. The final standard sets no lower thresholds than the AMLR's.

If you serve walk-in or one-off customers, your system has to recognise the same person across transactions and add up the values.

Existing customers: plan the remediation now

Draft Article 28 requires files for relationships opened before the RTS enters into force to be brought into line "on a risk-sensitive basis" within the AMLR's update periods: one year for higher-risk customers and five years for everyone else, counted from entry into force. For a hypothetical EMI with 200,000 customers of whom 4% are rated higher risk, that is 8,000 files to refresh in twelve months. Six of those months fall before the new onboarding rules even apply.

The work is mostly data engineering: map current fields to RTS Articles 2–5, 9–11 and 18–20, find the gaps per customer, and decide which ones can be closed from data you already hold and which need outreach to the customer.

Before the Commission adopts the CDD standard

Run a field-by-field gap analysis
Names, address elements, place of birth, all nationalities, legal-entity and ownership-chain data against the RTS articles.
Identify your higher-risk population today
These customers get a one-year remediation window that starts at entry into force.
Map eID coverage by market
Which national eIDs and EUDI Wallets your customers can actually use, and when.
Build fallback routing with a reason code
Every alternative remote check logs why eID was unavailable, with time-stamped evidence.
Review the e-money exemption
Check reloadable prepaid and gift products against Article 19(7) AMLR; price them on full CDD.
Wire screening triggers to data changes
Re-screen on any change to name, address, nationality or beneficial owner, and on every list update.
Define simplified due diligence segments
Document the risk rationale and the automatic exit triggers.
Track Commission adoption
Publication in the Official Journal fixes every other date in your plan.

A starting list for EMIs and PIs. Saved on this device when browser storage is available.

Our EMI technology checklist covers the wider systems baseline, and if you are also tracking payments law, see where PSD3 and the PSR stand.

This article explains AMLA's final draft standards and public commentary on them. It is not legal advice. The Commission may amend the text, so confirm your obligations with counsel and your national supervisor.

Our view

Most of the commentary on these standards has focused on eID versus video identification. For EMIs and PIs, the bigger risk is the evidence trail. Every simplified due diligence decision, every fallback onboarding and every re-screen now has to be explainable after the fact, and the remediation clock starts before the rules apply. Firms that keep KYC, risk scoring and screening in separate tools are likely to spend 2027 reconciling them by hand.

We would not wait for the Official Journal. The Commission may still amend details, but AMLA cannot go beyond the AMLR, and the data model changes take longer than the legal analysis. That is why Fyora's back office keeps onboarding data, risk scores, screening results and the audit log in one place, and why our engineering team builds the jurisdiction-specific onboarding routes around it. If you want to test your onboarding against the new standard, tell us what you're building.

FAQ

When do AMLA's customer due diligence standards apply?

They are proposed to apply six months after entry into force, which is 20 days after publication in the Official Journal. The Commission has three months to decide on adoption and Parliament and the Council then have an objection period, so no calendar date is fixed yet. The AMLR itself applies from 10 July 2027.

Can EMIs still use selfie and document checks for remote onboarding?

Yes, as an alternative solution under Article 7 of the draft standard, but only where the customer cannot reasonably appear in person and has no access to a qualifying eID or trust service. Each use must be justified, and the process must meet minimum safeguards such as liveness controls, secure sessions and time-stamped records.

How long do firms have to update existing customer files?

Under draft Article 28 and the AMLR's update periods, one year for higher-risk customers and five years for all others, counted from the standard's entry into force.

Does the low-value e-money exemption survive under the AMLR?

In a narrower form. Supervisors may exempt e-money from some CDD measures only if the instrument is not reloadable, holds no more than €150, is used for goods or services from the issuer or its network, is not linked to a payment account, cannot be exchanged for cash or crypto-assets, and is monitored by the issuer.

Do the standards apply to UK EMIs?

No. The AMLR and AMLA standards are EU law. UK firms follow the Money Laundering Regulations 2017, but UK groups with EU-licensed entities must apply the new rules in those entities.