EU AMLR Article 28 sets new customer due diligence rules

The EU’s Article 28 standard on customer due diligence is now due, setting up a 2027 shift to a single AML rulebook across all member states. The changes broaden who must comply, tighten beneficial ownership verification and push firms toward continuous, cross-border due diligence.

Why it matters: - The EU Anti-Money Laundering Regulation will replace national AML rulebooks with one directly applicable standard across member states. - Firms that do business across borders will need to prove how they verify customers and beneficial owners, not just rely on local registry checks. - The new rules expand the compliance burden well beyond banks and other traditional financial firms.

What happened: - Under Article 28 of Regulation (EU) 2024/1624, the Anti-Money Laundering Authority was required to finalize and submit draft Regulatory Technical Standards on customer due diligence to the European Commission by 10 July 2026. - The Article 28 standards, once adopted, will be directly binding across every EU member state. - The full AMLR becomes applicable on 10 July 2027. - AMLD6 takes effect alongside AMLR in July 2027, and existing national AML rules are repealed.

The details: - AMLR creates a single EU rulebook with no national transposition, no local variation and no grace period after the deadline. - The obliged-entity population expands to include FinTechs, crypto-asset service providers, crowdfunding platforms, holding and financial holding companies, and, from 2029, professional football clubs. - Accountants, lawyers and notaries face lower enhanced due diligence thresholds for one-off deal engagements. - The Article 28 RTS say customer due diligence must be continuous, not limited to onboarding. - Ongoing monitoring must be systematic and documented. - Central registers can help identify a beneficial owner, but they cannot verify one on their own. - Independent verification from multiple sources is required. - The politically exposed person definition expands to include heads of local authorities with 50,000-plus inhabitants, regional governors and executives of state-owned enterprises. - If a beneficial owner cannot be identified, firms must identify and verify every senior managing official to the same evidentiary standard as a beneficial owner. - The AMLR’s 25% beneficial ownership threshold will be hard to apply in layered structures involving holding companies, nominee arrangements, offshore trusts and subsidiaries across multiple jurisdictions. - Regulatory guidance says a central register may support identification, but does not satisfy the verification standard.

Between the lines: - The biggest practical shift is not the headline date. It is the move from periodic file review to a standing obligation to keep customer files current. - Professional services firms outside the financial sector now face a wider and more technical compliance burden. - Multi-source verification becomes more important as regulators push firms to prove how a beneficial ownership conclusion was reached. - Mark Hargreaves, CEO of FirstLink Solutions Ltd, said firms that combine multiple official data sources with primary registry documents will be better placed than firms that depend on a single register extract.

What's next: - Firms have about 12 months to gap-analyse current customer due diligence and beneficial ownership processes against the final standard. - From January 2028, AMLA begins direct supervision of around 40 high-risk cross-border institutions. - The EU Digital Identity Wallet becomes mandatory for identification purposes in January 2028. - FirstLink Solutions says it is working with banks, law firms, accountancy and consultancy practices, FinTechs, professional services firms, corporate service providers and SMEs to test verification approaches against the incoming standard. - FirstLink Solutions also says it is showing clients how to build a single, verifiable cross-border data source without requiring a large compliance team. - More information is available in the company’s announcement.