In a press release dated 1 October 2026, the Anti-Money Laundering Authority (AMLA) announced three Final Reports, dated 30 September 2026, containing three draft Regulatory Technical Standards (“RTS”) supplementing Regulation (EU) 2024/1624 (the “AMLR”) in relation to: (i) customer due diligence (Article 28(1) AMLR); (ii) criteria for identifying business relationships, occasional transactions and linked transactions, and reduced thresholds (Article 19(9) AMLR); and (iii) minimum group-wide requirements and legal impediments in third countries (Articles 16(4) and 17(3) AMLR).

AMLA’s stated approach is to establish a single, horizontal framework for both the financial and non-financial sectors, based on proportionality, a risk-based approach and simplification.

The draft standards have now been submitted to the European Commission for adoption as delegated regulations. Each regulation will enter into force on the twentieth day following its publication in the Official Journal of the European Union and will apply six months after its entry into force. For football agents and professional football clubs (Article 3(3)(n) and (o) AMLR), the application date is 10 July 2029.

Customer Due Diligence (Article 28(1) AMLR)

Article 28(1) AMLR mandated AMLA to specify the requirements and information to be collected for standard, simplified and enhanced customer due diligence; the reliable and independent sources that may be used to verify identity (Article 22(6) and (7) AMLR); the risk factors that supervisory authorities must consider when determining the extent to which certain electronic money instruments may be exempted from specific customer due diligence measures (Article 19(7) AMLR); and the attributes that electronic identification means and qualified trust services must possess.

Identification Data and Verification

• Names: All given names and surnames appearing on the identity document or resulting from electronic identification. For legal entities, the legal name and, where different, the trading name.
• Address: Country and city or municipality are mandatory; postal code, state, street and street number must also be provided where available. Place of birth must include at least the country, state, city or municipality, as stated on the identity document.
• Nationality: Reasonable measures must be taken to establish whether a person holds more than one nationality. If the person declares multiple nationalities, these must be recorded, but verifying at least one is sufficient.

Where a person cannot reasonably present an identity document in person and does not have access to compliant electronic identification means, their identity may be verified remotely using alternative solutions based on reliable and independent sources and incorporating safeguards to ensure the quality and security of the process (Article 7). The obliged entity must be able to justify the use of such solutions and demonstrate their compliance to the competent authority. Annex I lists the minimum attributes that electronic identification means and qualified trust services must be capable of providing, without requiring all of them to be collected in every case.

Beneficial Ownership and Trusts

The RTS identify additional sources that may be used alongside the central register of beneficial ownership, including public registers, reliable data providers and other obliged entities within the same group, as well as the information to be collected on intermediate entities in complex structures. Where senior managing officials must be identified in the absence of a beneficial owner, the registered or official address of the entity may be collected instead of the individual’s residential address. For trusts, the RTS specify the information required on classes of beneficiaries, together with the need for timely updates when beneficiaries become identifiable.

Simplified and Enhanced Due Diligence

In low-risk situations, the following information is sufficient for natural persons: names, place and date of birth, and nationality. An address is not required. In addition, the beneficial owner may be identified using a single source (for example, the central register) and verified against a different source.

The RTS provide a non-exhaustive list of information useful for understanding the purpose and intended nature of a business relationship or occasional transaction. This includes the reasons for the request and the intended use of products or services, expected amounts and transaction patterns, the origin and destination of funds, and the customer’s business activity or occupation (Article 16).

For the enhanced due diligence measures under Article 34(4) AMLR, the RTS identify additional information that may be collected, including illustrative examples of documents evidencing the source of funds and wealth, such as tax returns, payslips, audited financial statements, public deeds and inheritance documentation.

Politically Exposed Persons (PEPs) and Targeted Financial Sanctions

Obliged entities must implement automated, manual or combined tools that are effective and proportionate to the nature, risks, complexity and size of their activities to identify politically exposed persons, their family members and close associates. Screening must take place before establishing a business relationship and, for existing customers, at risk-based intervals.

Screening for targeted financial sanctions covers customers, beneficial owners and persons exercising control over them or meeting the relevant ownership criteria, as well as, where circumvention is suspected, persons acting on behalf of the customer. Screening must be conducted when a business relationship or transaction is initiated, when lists change, when customer due diligence data changes and periodically according to risk. It must also be carried out without undue delay following the publication of UN sanctions or the applicability of updates (Article 25). Trade or economic sanctions, such as arms embargoes, trade restrictions and travel bans, fall outside the scope of the RTS.

Existing Business Relationships

For business relationships established before the delegated regulation enters into force, documents, data and information must be updated using a risk-based approach within the time limits set out in Article 26(2) AMLR: one year for higher-risk customers and five years for all other customers.

Business Relationships, Occasional Transactions and Linked Transactions (Article 19(9) AMLR)

Article 19(9) AMLR mandated AMLA to specify the criteria for distinguishing business relationships from occasional transactions and identifying linked transactions, as well as to assess whether lower due diligence thresholds should be introduced for higher-risk sectors or transactions.

Criteria for Distinguishing Business Relationships from Occasional Transactions

Article 2 of the RTS sets out six criteria for assessing whether a customer relationship has an element of duration or repetition.

1. General criterion: Applicable to all obliged entities, the first criterion (paragraph 1) requires consideration of whether the customer has been granted ongoing access to services falling within the scope of anti-money laundering obligations, for example through a customer account, when assessing the duration of the relationship.
2. Specific criteria for certain categories of obliged entities:
   • Professionals and real estate agents (entities referred to in Article 3(3)(a) to (d) and (l) AMLR): duration arises where a service requires multiple activities carried out over a meaningful period. Repetition may be inferred where services are provided to the same customer at different times or where different types of services are provided (Article 2(2) and (3)).
   • Currency exchange providers, money transfer providers and certain crypto-asset service providers (exchanging crypto-assets for funds or other crypto-assets, and transfer services): three or more transactions in the preceding 12 months indicate repetition (paragraph 4).
   • Land-based gambling operators: participation in a voluntary membership programme is relevant to determining duration and repetition (paragraph 5).
   • Player transfer transactions: the existence of conditional obligations connected with a transfer is relevant when assessing repetition or duration (paragraph 6).

Why the Distinction Between Business Relationships, Occasional Transactions and Linked Transactions Matters for AML Compliance

Classifying the relationship is important for determining how anti-money laundering requirements apply. Depending on whether the relationship qualifies as a business relationship or an occasional transaction, customer due diligence may or may not be mandatory:

• Business relationship: A relationship with a customer that has, or is expected to acquire, an element of duration or repetition. Customer due diligence is always mandatory, and the relationship must be monitored over time through ongoing monitoring.
• Occasional transaction: Any transaction, or provision of services connected with a transaction, that does not form part of a business relationship (Article 1). Customer due diligence is mandatory only where the amount reaches the threshold under Article 19 AMLR, generally EUR 10,000, or where another circumstance specified in that Article applies.

For the purpose of calculating the threshold, where an obliged entity does not execute transactions directly but provides services connected with them (for example, real estate agents and notaries), the value of the underlying transaction is relevant, excluding fees and commissions.

To prevent the threshold from being circumvented by splitting a transaction into several smaller transactions, obliged entities must determine whether multiple occasional transactions are linked. Transactions may be linked where they have identical or similar origins, destinations or purposes, or share other common characteristics within a given period. In such cases, the threshold is calculated on the aggregate value of the transactions.

As regards thresholds, Article 19(9) AMLR required AMLA to identify any obliged entities, sectors or transactions presenting higher risks for which lower thresholds than the general EUR 10,000 threshold should apply to occasional transactions. AMLA has not introduced any additional reduced thresholds. The thresholds already provided for under Article 19 AMLR therefore remain unchanged.

Group-Wide Requirements and Third Countries (Articles 16(4) and 17(3) AMLR)

The RTS apply to groups and structures—including networks, partnerships and franchises—with common ownership, management or compliance control.

• Minimum requirements: The EU parent undertaking must establish a proportionate group-wide framework covering governance, group-wide risk assessment, uniform policies, information sharing, training and the management of deficiencies. Policies must be approved by the management body and documented in writing.
• Information sharing: The framework must allow the exchange of information on customers, beneficial owners, customer due diligence, transactions and risk assessments, in accordance with the need-to-know principle, data protection requirements and secure communication channels, without affecting the responsibility of each obliged entity. Of particular relevance to the legal profession, these obligations do not apply to information covered by Article 70(2) AMLR, which safeguards professional secrecy.
• EU parent undertaking: Where several obliged entities in the EU are linked to a head office outside the EU but are not under common control, the most suitable entity must be designated and notify the competent authority within 28 days. The authority must approve the designation within 60 days of receiving a complete notification.
• Structures other than groups: These structures must designate a “head of the structure” within the EU and apply the group-wide requirements proportionately. The competent authority may waive the designation requirement if five conditions are met, including minimum common policies and information sharing, upon request by a coordinating obliged entity.
• Legal impediments in third countries: Where local law prevents branches or subsidiaries from applying the AMLR or group-wide policies, the competent authority must be informed within 28 days. Where possible, customer consent must be sought, and additional risk-based measures must be implemented, such as offering low-risk products, conducting enhanced checks, obtaining senior management approval and applying enhanced monitoring. Where necessary, business relationships or activities in the third country must be terminated. The competent authority may require a mitigation plan and, in the most serious cases, the termination of business relationships or the closure of operations in that country.