AMLA publishes RTS for the private sector under the AMLAR

On 1 October 2026, the Anti-Money Laundering Authority (“AMLA”) published a package of final reports containing three draft regulatory technical standards (“RTS”) under the Anti-Money Laundering Authority Regulation (“AMLAR”). The package includes the following:

• Final report on customer due diligence (“CDD”);
• Final report on the identification of business relationships, occasional transactions and linked transactions; and
• Final report on group-wide anti-money laundering and countering the financing of terrorism (“AML/CFT”) requirements.

Each RTS will be submitted to the European Commission for adoption before publication in the Official Journal of the European Union.

Background

The AMLAR forms the core of the EU’s new single rulebook for AML/CFT, moving the substantive obligations of obliged entities from divergent national transpositions under the Fourth Money Laundering Directive ((EU) 2015/849) (“MLD4”) into a directly applicable regulation. The AMLAR mandates AMLA to develop a substantial body of RTS to operationalise this framework.

These RTS form part of the wider implementation of the EU’s new AML/CFT architecture and mark an important step in AMLA’s exercise of its rulemaking responsibilities. The draft standards build on earlier EBA advice to the European Commission (see further here), which AMLA has used as the starting point for its own work. AMLA has since run public consultations on each of the three draft RTS, engaging national supervisors across the financial and non-financial sectors, private sector stakeholders and the European Data Protection Supervisor.

Across all three final reports, AMLA describes its approach as centred on simplification and proportionality: establishing, wherever possible, a single horizontal framework applicable to both the financial and non-financial sectors, minimising sector-specific carve-outs, and limiting departures from the EBA’s original advice to cases where justified, while avoiding requirements that go beyond, or derogate from, the AMLAR itself.

Draft RTS on customer due diligence

Purpose

AMLA's final report (accompanied by a factsheet) sets out draft RTS specifying the information and requirements necessary for obliged entities to perform CDD, covering standard due diligence, simplified due diligence (“SDD”) and enhanced due diligence (“EDD”) under Article 28(1) AMLAR. The draft RTS cover:

• the risk factors supervisors must consider when deciding whether, and to what extent, certain electronic money instruments may be exempted from some CDD measures;
• the reliable and independent sources obliged entities may use to verify identity; and
• the attributes that electronic identification means and qualified trust services must include to satisfy the AMLAR’s identification and verification requirements.

Customer identification and verification

The draft RTS specify, among other things, the information to be obtained in relation to a customer’s name, address, place of birth and nationality, the documents that may be used to verify identity, including in cases of statelessness, refugee or subsidiary protection status, and alternative verification measures for non-face-to-face situations where neither an identity document nor a qualifying electronic identification solution can reasonably be used. They also address reliable and independent sources of information generally, identification requirements for persons using a virtual IBAN, and reasonable measures for verifying beneficial owners.

Beneficial ownership and complex ownership structures

Further provisions cover understanding a customer’s ownership and control structure, identification of beneficiaries of trusts, discretionary trusts and similar arrangements, verification of persons purporting to act on behalf of a customer, and a dedicated regime allowing collective investment undertakings that distribute through an intermediary institution to rely on that institution to identify final investors, subject to conditions.

Business relationships, PEPs, SDD and EDD

The draft RTS also specify the information to be obtained in relation to: a business relationship or occasional transaction; the identification of politically exposed persons, their family members and close associates; minimum identification requirements in low-risk situations for the purposes of SDD; and the additional information obliged entities must obtain on the customer, the beneficial owners, the intended nature of the business relationship and the source of funds and wealth in high-risk situations for the purposes of EDD.

Application

The draft RTS will apply six months after they enter into force, save that the one and five-year periods for updating customer information under Article 26(2) AMLAR will only start running, for existing business relationships, from the date of entry into force of the final Delegated Regulation.

Draft RTS on business relationships, occasional transactions and linked transactions

Purpose

AMLA's final report (accompanied by a factsheet) addresses Article 19(9) AMLAR, under which AMLA must specify criteria for identifying business relationships, occasional transactions and linked transactions, and identify any higher-risk obliged entities, sectors or transactions that warrant a lower threshold for the application of CDD measures than the general EUR 10,000 threshold for occasional transactions.

Occasional transactions and business relationships

As occasional transactions and business relationships are mutually exclusive under the AMLAR, the draft RTS define an occasional transaction negatively, as a transaction, or the provision of services connected to a transaction, that is not carried out as part of a business relationship.

Article 2 of the draft RTS sets out the criteria to be used when assessing whether a business relationship exists. For all obliged entities, a key factor is whether the customer has been granted ongoing access to services within the scope of the AML/CFT framework, as an indicator of the element of duration inherent in a business relationship. For certain categories of obliged entities, the RTS also provide additional indicators of duration and repetition, including whether a service requires multiple actions over a substantial period of time or is provided at different intervals or in different forms. Currency exchange offices, money remitters and certain crypto-asset service providers must, in addition, treat three or more transactions within a 12-month period as a relevant criterion, reflecting the heightened ML/TF risks associated with these activities and the divergent approaches historically taken across Member States in identifying business relationships. A bespoke criterion also applies to obliged entities involved in football player transfers, reflecting the existence of conditional obligations associated with such transfers.

Linked transactions

Article 3 of the draft RTS sets out the criteria relevant to identifying linked transactions, to be assessed collectively as part of an overall evaluation of the facts and circumstances, with no single criterion being treated as decisive or disregarded in isolation. These include, where the information is available to the obliged entity, whether customers are family members, business partners, operate in concert, are subsidiaries or beneficial owners of a common parent, or use the same digital infrastructure or intermediaries; whether transactions relate to the same underlying purchase; and whether transactions share other common characteristics, such as circular fund flows or participation in a loyalty programme. For the specific period element, obliged entities must generally consider transactions carried out within a short period calibrated to the nature of their business, save that currency exchange offices, money remitters and certain crypto-asset service providers must apply a fixed period of one month, and gambling service providers must additionally consider games provided by the same operator.

CDD thresholds

AMLA has not introduced any additional lower CDD thresholds beyond those already set out in Article 19(2) to (5) AMLAR, having concluded that there is no evidence to justify doing so at this time; it has indicated that it will keep this position under review and may propose amendments if required.

Application

The draft RTS will apply six months after they enter into force, save that, for obliged entities involved in football transfers, application is deferred to 10 July 2029.

Draft RTS on group-wide requirements and measures for subsidiaries and third country branches

Purpose

AMLA's final report (and accompanying factsheets here and here) combines AMLA’s mandates under Articles 16(4) and 17(3) AMLAR into a single instrument, reflecting the close interlinkage between the two provisions. Article 16 AMLAR requires parent undertakings to implement group-wide AML/CFT policies, procedures and controls, including a group compliance function and effective information sharing; Article 17 AMLAR addresses situations where local law in a third country prevents branches or subsidiaries from implementing those group-wide requirements.

Group-wide policies, procedures and controls

On group-wide policies, procedures and controls, the draft RTS require the parent undertaking in the Union to put in place a documented governance and coordination framework with sufficient decision-making powers for the group compliance manager, to carry out a group-wide risk assessment proportionate to the group’s complexity, and to ensure that group compliance functions exchange information regularly with the management body, commercial functions and internal control and audit functions. Group-wide policies, procedures and controls must, among other things, address whistleblowing, incident reporting, training, and ensuring that non-obliged entities within the group do not prevent compliance with the AMLAR or the effective implementation of group-wide AML/CFT arrangements.

Group-wide information sharing

On information sharing, the draft RTS set out a broad, non-exhaustive list of categories of information (in Annex I) that may be shared within a group where relevant for AML/CFT purposes, taking into account the availability and quality of the information, on a need-to-know basis through secure channels and in compliance with data protection law, without this affecting each obliged entity’s individual responsibility for its own compliance and risk-based decisions (including CDD, risk assessments and other risk-related decisions). Specific provisions address the assessment and notification to supervisors of restrictions or prohibitions on sharing information to or from third countries.

Third-country legal impediments

On third-country legal impediments, where local law prevents or restricts a branch or subsidiary from applying group-wide AML/CFT requirements, the parent undertaking or obliged entity must notify its supervisor within 28 calendar days and, where feasible, obtain customer consent to overcome the impediment. Where this is not feasible, or does not sufficiently manage the risk, the parent undertaking or obliged entity must apply one or more additional measures, which may include restricting the products and services offered, withholding reliance on the branch or subsidiary’s CDD, enhanced reviews including on-site checks, senior management pre-approval of higher-risk relationships, enhanced ongoing monitoring, and, at the most severe end, termination of relationships or closure of the affected operations. Supervisors who consider the measures taken insufficient may require a risk mitigation plan or other corrective measures, and ultimately apply the additional supervisory actions available under Article 17(2) AMLAR.

Identifying the parent undertaking in the Union

The draft RTS also introduce criteria for identifying the parent undertaking in the Union where two or more obliged entities established in the Union share a common head office outside the Union but are not in a parent / subsidiary relationship with each other. The assessment takes into account quantitative and qualitative criteria relating to the entity's prominence within the group (including cross-border establishments, customer numbers and transaction values, and, as a fallback, turnover, balance sheet size and staff numbers) and its understanding of, and influence over, the group's operations (including decision-making powers over strategy, transactions and internal controls, and, as a fallback, compliance function staffing). The identified entity must notify its role to its supervisor and the other group entities within 28 calendar days, with supervisory approval to follow within 60 calendar days of a complete notification.

Networks, partnerships and franchises

Finally, the draft RTS extend group-wide requirements, in a more limited form, to structures other than groups that share common ownership, management or compliance control – such as networks, partnerships and franchises common in the non-financial sector – and set out criteria for identifying the head of such a structure, together with a mechanism allowing obliged entities to seek supervisory permission not to identify a head of structure in duly justified circumstances, subject to a reduced set of minimum group-wide requirements applying instead.

Application

The draft RTS will apply six months after they enter into force.

What this means for firms

Taken together, the three final reports represent a significant part of the detailed rulebook that will sit under the AMLAR, and obliged entities across both the financial and non-financial sectors should begin preparing for their implementation now, notwithstanding that each must still be adopted by the European Commission and published in the Official Journal before entry into force. In particular, firms should:

1. review existing CDD policies, procedures and onboarding systems against the detailed information and verification requirements in the Article 28(1) RTS, including the treatment of electronic identification means, alternative verification measures, and the enhanced information required for high-risk customers and PEPs;

2. reassess how business relationships, occasional transactions and linked transactions are currently classified, particularly in sectors such as currency exchange, money remittance, crypto-asset services, real estate and gambling that are singled out for sector-specific criteria under the Article 19(9) RTS; and

3. for groups, revisit group-wide AML/CFT policies, procedures, controls and information-sharing arrangements against the Article 16(4) and 17(3) RTS, paying particular attention to any branches or subsidiaries in third countries where local law may restrict compliance, and to whether the group’s structure requires identification of a parent undertaking or head of structure under the new criteria.

Given that all three instruments are expected to apply six months after entry into force (save for a deferral for football transfers under the Article 19(9) RTS), firms have a limited window to assess the gaps between current practice and the requirements once the final texts are adopted and published.

If you would like to discuss how the RTS may affect your business, please get in touch with your usual Simmons & Simmons contact or any member of our Financial Services Regulatory team.