EBA Draft RTS on Customer Due Diligence under Article 28(1) AMLR
The Draft Regulatory Technical Standard (RTS) under Article 28(1) of Regulation (EU) 2024/1624 (AMLR) defines the customer due diligence (CDD) obligations that obliged entities across the EU must meet when establishing and maintaining business relationships. It forms a key element of the new EU-wide AML/CFT framework and reinforces a risk-based, harmonised approach to customer identification, verification, and monitoring.
What Is the Purpose of This Draft RTS?
This RTS specifies what information must be collected for:
- Customer identification and verification
- Determining beneficial ownership
- Understanding the ownership structure
- Assessing the purpose and intended nature of the business relationship
It also defines acceptable verification methods, including non-face-to-face onboarding and the use of electronic identification (eIDAS) and other qualified trust services.
Standardised CDD Requirements Across Eight Sections
1. Identification and Verification (Articles 1–13)
Obliged entities must obtain and verify:
- Customer names, addresses, birth details, and nationalities
- Valid identification documents
- Information about beneficial owners and senior managing officials
- Ownership/control structures (including trusts and nominees)
- Virtual IBAN users (newly included)
2. Purpose and Intended Nature (Articles 15–16)
Entities must understand and document:
- The business relationship’s intended purpose
- Expected activities and transaction behaviour
3. Politically Exposed Persons (Article 17)
Explicit procedures are required to identify PEPs and assess associated risks.
4. Simplified Due Diligence (Articles 18–23)
Defines minimum requirements and sector-specific reliefs for:
- Pooled accounts
- Collective investment undertakings
- Customer data update cycles in low-risk contexts
5. Enhanced Due Diligence (Articles 24–27)
Outlines additional obligations in high-risk situations, including:
- Source of funds and wealth
- Transaction justification and consistency analysis
6. Targeted Financial Sanctions (Articles 28–29)
Mandates systematic screening of customers against EU sanctions lists.
7. E-Money Risk Factors (Article 30)
Introduces specific guidance for assessing the risk of electronic money products.
8. Electronic Identification (Articles 31–32)
Validates the use of secure, technology-neutral digital onboarding methods, especially under eIDAS or comparable national systems.
Why this RTS matters?
The CDD RTS is essential to building a single, risk-based AML/CFT rulebook across the EU. It ensures that:
- All obliged entities apply consistent standards for customer verification
- Digital onboarding remains legally secure and AML-compliant
- AMLA and national authorities can rely on harmonised data for risk profiling and supervision
It also supports other AMLR elements, such as residual risk classification and sanctions compliance.
What comes next?
Once adopted, this RTS will become directly applicable under the AMLR. Obliged entities are encouraged to update their onboarding processes, document templates, and AML systems to align with the new requirements—particularly in the areas of beneficial ownership verification, remote onboarding, and PEP identification.
Source: