AMLA’s Final CDD Rules Start the Remediation Clock Before They Apply

The EU’s Anti-Money Laundering Authority (AMLA) will apply its final customer due diligence standards six months after they enter into force, but the clock for bringing existing customer files up to the new standard starts at entry into force itself. AMLA submitted the final regulatory technical standards (RTS) to the European Commission on 1 October 2026, according to an AMLA statement, under the Anti-Money Laundering Regulation (AMLR), which applies from 10 July 2027.

The six-month delay is new since the public consultation, and AMLA’s final report, dated 30 September, describes it as “further flexibility for the private sector”. Entry into force follows 20 days after publication in the Official Journal of the EU. Article 28 and recital 26 nonetheless start the AMLR’s one-year and five-year windows for updating existing customer files at entry into force, so the remediation window opens six months before the CDD standards apply. Respondents had asked for those windows to run from application, and AMLA refused requests to extend them. 

The CDD standards, which set out the information obliged entities must collect and verify, were issued under Article 28(1) of the AMLR alongside two other final draft RTS, on group-wide AML arrangements and on business relationships and linked transactions, after a consultation that drew 325 written responses between 9 February and 8 May 2026.

Both of the AMLR’s verification routes remain the default, namely the identity document or a verified copy, or electronic identification (eID) and qualified trust services under eIDAS, which Article 6 also allows face-to-face. Article 7 permits remote document checks only where a customer cannot present a document in person and has no eligible eID, and firms must justify each case and show supervisors that their solution confirms the person presenting the document is its holder. Existing remote tools that meet those safeguards can stay in use.

Under Article 5, firms must record every nationality a customer declares but need to verify only one, and Article 4 lets them capture the place of birth at whatever level the identity document prints it. Screening for sanctions and politically exposed persons may run through automated tools, manual checks or both, and the final report states that manual checks are no longer framed as an exceptional fallback. AMLA still rejected calls to make sanctions screening risk-based, stating that it must stay effective whatever money laundering risk a customer presents.

The final draft does not bind firms until the Commission adopts it. Under Article 49 of the AMLA Regulation, the Commission has three months to decide and may adopt the standards in part or with amendments, a point Luxembourg’s financial supervisor, the Commission de Surveillance du Secteur Financier, made on 7 October when it urged firms to start gap analyses.

The gap between entry into force and application matters most for remediation. Files on higher-risk customers would need updating within six months of the rules applying, and all other files within four and a half years. For the RTS to apply alongside the AMLR, they would have to enter into force by 10 January 2027, and the higher-risk deadline would then fall on 10 January 2028. Firms waiting for the Official Journal before sizing their back-book would lose part of that window.  

Onboarding flows need a parallel change. Firms that built their journeys around remote document checks as the primary route will have to justify every customer verified outside the default routes, which in practice means offering eID before any remote document check.

Compliance teams planning their onboarding and remediation work for the RTS can see how Shufti handles both on its AMLR compliance solutions page.