AMLA final draft RTS on customer due diligence (AMLR Article 28(1)): what to prepare

On 1 October 2026 AMLA announced three final draft RTS for the private sector: on customer due diligence (Article 28(1) AMLR), on telling business relationships apart from occasional and linked transactions (Article 19(9)), and on group-wide requirements, including for branches and subsidiaries in third countries (Articles 16(4) and 17(3)). The final report on the CDD standards is dated 30 September 2026.

The CDD work builds on advice the EBA delivered to the Commission on 30 October 2025 and on an AMLA public consultation that ran from 9 February to 8 May 2026.

In our summary, the draft RTS specify the identification data firms must obtain and verify for customers, beneficial owners and people acting for them, including how names, places of birth, addresses and nationalities are recorded. In low-risk cases a smaller data set is enough; for an individual, the address can be left out.

They also allow alternative ways of verifying identity remotely when a customer can neither present a document in person nor use electronic identification, list the attributes that electronic identification means must support, and name the sources firms may use to verify beneficial owners. A central register entry alone does not count as verification. Firms must screen customers and beneficial owners for targeted financial sanctions and for PEP status, by automated tools, manual checks or both.

For a refresher on the current Cyprus rules, see our study note on customer due diligence.

The drafts are now with the European Commission. After the Commission adopts them and they appear in the Official Journal, the regulation enters into force on the twentieth day after publication and is proposed to apply six months later; for professional football clubs and agents, from 10 July 2029. Existing customer files must be brought into line on a risk-sensitive basis within the AMLR's updating periods (one year for higher-risk customers, five years for others), counted from entry into force. The AMLR itself applies from 10 July 2027. Until then, the CDD rules of Law 188(I)/2007 and the supervisors' AML directives continue to apply.

CySEC has been passing AMLA material to Cyprus firms by circular. C796 (14 August 2026) relayed AMLA's final report on implementing technical standards under Article 15(3) of Regulation (EU) 2024/1620, which govern cooperation between AMLA and national supervisors in selecting firms for AMLA's direct supervision from 2028. C800 (8 September 2026), addressed to administrative service providers and crowdfunding service providers, relayed AMLA's 10 September public hearing on draft RTS under Article 40(2) of Directive (EU) 2024/1640 on assessing the risk profile of non-financial obliged entities. A CySEC circular on the CDD standards may follow; firms need not wait for it to start a gap analysis.