Shufti Helps Obliged Entities Get Ready for the EU AMLR Ahead of the July 2027 Deadline

London, United Kingdom, August 17, 2026—The EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) takes effect across all 27 member states on 10 July 2027, replacing fragmented national regimes with one single harmonized anti-money laundering and counter-terrorist financing (AML/CFT) rulebook overseen by the new EU Anti-Money Laundering Authority (AMLA).

It changes not only the rules, but the standard of proof: obliged entities must be able to demonstrate that their AML controls are effective. Shufti, a Glocal identity verification and financial crime prevention platform, has mapped what the AMLR requires to the steps businesses must take, and supports each step through its single platform.

What Changes Under The AMLR

Once in force, a single AML/CFT rulebook applies in every member state, covering banks, payment and e-money institutions, fintechs, crypto-asset service providers, crowdfunding platforms and high-value-goods traders operating in the EU. The obligations also extend to certain non-EU firms operating within the AMLR’s territorial scope.

Identity verification sits at the centre of these obligations. Under Article 22, firms must rely on reliable and independent sources, and the AMLA’s draft regulatory technical standards (RTS) under Article 28(1), currently under consultation, establish eIDAS-grade verification as the reference point. This maps ‘substantial’ assurance to standard customer due diligence (CDD) and ‘high’ to enhanced due diligence (EDD). Under eIDAS 2.0, EU Digital Identity (EUDI) Wallets become available from late 2026, and firms must accept them as roll-out completes from 2027.

The AMLR also applies to existing customers. Under Article 26, firms must keep records current on a risk basis and under Articles 51 and 52 they must identify the beneficial owners holding 25% or more. This is most challenging in KYB: as company ownership and management change over time, KYB re-verification becomes an ongoing obligation rather than a one-off exercise.

The RTS also shifts firms toward continuous, risk-based due diligence, using ongoing monitoring and behavioural indicators to reassess customer risk throughout the relationship.

Accountability remains with the obliged entity. Article 18 permits outsourcing AML tasks, but responsibility and liability do not transfer: a firm must oversee every provider and sub-provider and prove to a supervisor that those controls are effective. 

How Shufti Addresses Each New Requirement

Shufti, a 100% in-house identity stack, helps organisations meet these requirements through its AMLR solutions, delivered through a single platform that combines:

• Remote Onboarding at eIDAS-grade: Shufti verifies a new user remotely, in line with the eIDAS and AMLR requirements. It reads the ID document and the NFC chip, matches the face, and confirms a live person through iBeta PAD Level 3 passive liveness, built to resist deepfakes, presentation and replay attacks, and synthetic identities. 
• Legally Binding Qualified Electronic Signatures (QES): Shufti integrates QES into the same workflow, allowing users to move from verified identity to a legally binding signature in one journey, recognised across the EU and EEA under eIDAS Article 25. Every verification is recorded as a secure, time-stamped Chain of Custody, creating an exportable audit trail for regulators and auditors.
• Business Verification and Continuous UBO Re-verification: Shufti verifies a company against official registries and identifies its ultimate beneficial owners (UBOs). It continuously re-screens entities, ownership structures, and directors across 100+ business registries, flagging significant changes without requiring full re-onboarding.
• AML Screening and Perpetual Monitoring: Perpetual KYC (pKYC) and KYB re-screen every user and beneficial owner against 4,000+ watchlists, 215+ sanctions regimes, 2.6 million politically exposed persons (PEPs) and their close associates, and adverse media across 50,000+ sources, linking each alert to a verified identity. Online, transactional, and behavioural signals detect changes in customer risk in real time, with STR/SAR-ready evidence.
• Fraud and Behavioural Monitoring: Beyond document verification and screening, Shufti’s behavioural biometrics analyse how users type, navigate, and interact with their devices, combining these behavioural insights with device intelligence and identity signals. This helps distinguish genuine users from fraudsters, detect abuse rings and duplicate registrations, and trigger additional verification only when risk indicators change, without adding friction for legitimate users.
• Remediation and Enhanced Due Diligence: Shufti re-verifies and updates existing users and businesses to meet AMLR standards using the same automated checks applied at onboarding, supporting both back-book remediation and continuous risk-based due diligence. For higher-risk users, higher-risk PEPs, and complex cases, it applies enhanced due diligence, including source-of-funds verification, adverse media checks, indirect RCA tracing, and corporate document authentication.
• Automated AML Compliance Lifecycle: A firm submits only basic user details or a business’s POCs, and Shufti automates the complete end-to-end compliance lifecycle, from collecting data and verifying identities to authenticating information, screening users, supporting risk-based decisions, and continuously monitoring and re-verifying them over time. Every step is recorded in an auditable trail, providing firms with explainable decisions and evidence-ready compliance records.

All capabilities run on Shufti’s 100% in-house technology through a single API, giving firms one accountable provider instead of multiple vendors, with full data sovereignty and a complete audit trail.

For teams with no in-house compliance function, Shufti also offers MLRO as a Service: a dedicated Money Laundering Reporting Officer with the expertise to run the entire programme on their behalf, from back-book remediation to perpetual monitoring.

Shufti’s AMLR consultancy also provides specialist support for organisations navigating the regulatory requirements and operational changes introduced by the AMLR.

The result is a single full compliance lifecycle platform spanning onboarding, KYC, KYB, AML screening, transaction monitoring, ongoing due diligence and case management, all built on Shufti’s in-house technology, rather than assembled from multiple third-party providers.

Prepare for the EU AMLR with Shufti. Read Shufti’s EU AMLR Compliance Preparation Guide to understand what is changing, identify compliance gaps, define implementation priorities, and build a roadmap ahead of the July 2027 deadline.

Request a tailored AMLR assessment and get expert guidance on your next steps.

About Shufti

Shufti is a Glocal identity verification, KYC, KYB, and AML screening platform trusted by 2,000+ enterprises worldwide. Its 100% in-house technology verifies users across 240+ countries and actively processes 10,000+ document types in 150+ languages, combining document verification, biometric authentication, business verification, and AML screening in a single API. Recognised as a G2 IDV Leader, Shufti helps regulated businesses onboard users faster, prevent fraud, and meet global compliance requirements.

Media Contact 

Aroosa Virk
Brand and Communications Manager
Shufti
[email protected]