TL;DR: AMLA finalised three draft regulatory technical standards (RTS) on 1 October 2026, covering customer due diligence (CDD), business relationships and linked transactions, and group-wide AML/CFT arrangements. They aren’t binding yet, because the drafts are with the European Commission for adoption. But the clock for remediating existing customers starts at entry into force, not at application. Waiting for the final text costs time you may not have.
What happened on 1st October 2026?
On 1 October 2026, AMLA announced that it had finalised three sets of draft regulatory technical standards and submitted them to the European Commission. For financial crime teams, this moves part of the EU’s new AML framework from consultation material to near-final text.
Is any of this law yet?
No. If the Commission adopts the drafts and they are published in the Official Journal, AMLA proposes that they apply six months after entry into force. The underlying AML Regulation (AMLR) applies from 10 July 2027.
The legal status matters. It just isn’t a reason to sit still. Some of the work is unlikely to be wasted whatever the final text says, and the remediation clock for existing customers runs from entry into force, not from the date the standards start to apply.
What did AMLA actually finalise?
There are three standards, each tied to a different part of the AMLR:
- Customer due diligence RTS (Article 28(1)). It sets out what information firms must collect and verify, including requirements for lower-risk situations, non-face-to-face verification, electronic identification, and screening of politically exposed persons, their family members and close associates. AMLA stresses that the framework is meant to be proportionate and risk-based, so its lists should not be read as rigid checklists.
- Business relationships and linked transactions RTS (Article 19(9)). It covers how to tell a business relationship from an occasional transaction, and how to identify linked transactions. The aim is for CDD thresholds to be applied consistently across the EU.
- Group-wide AML/CFT RTS (Articles 16(4) and 17(3)). It sets minimum requirements for group-wide arrangements, covering governance, risk management, controls and information sharing, including where subsidiaries or branches sit in third countries.
That is a lot of operational ground for three documents.
Why is this an implementation problem, not just a policy update?
A requirement becomes operational when a firm can show:
- What information it collects,
- Where it comes from,
- how it is verified,
- Which decision it supports,
- What happens when the information is missing,
- Who reviews the result, and
- What evidence is kept.
Updating a paragraph in the AML policy does none of that.
So the useful way to treat the RTS is as a list of requirements to map, not three documents to read. Mapping tends to expose gaps the policy never shows.
A hypothetical example: Imagine a firm’s CDD policy requires place of birth and all nationalities for each customer. The fields exist in the onboarding system, but the investigator’s case screen doesn’t display them, and the data was never carried over from an older platform for some customers.
When the firm tests ten recent cases against the new requirements, the policy passes. Four of the ten cases fail on evidence.
The policy was sound. The gap sat in the data and in the investigator’s view of it. That is exactly the kind of problem you want to find before a supervisor does.
Three questions to ask this week:
- Who owns each of the three RTS inside the business, and is it more than Legal and Compliance?
- Which systems actually hold the CDD, transaction and group data these standards rely on?
- Has anyone tested real cases against the draft requirements yet, or only the policy wording?
If the answers are unclear, that is your starting point.
The policy passed, but four of the ten cases didn’t. Part 2 shows where the gaps hide, and why your remediation clock may start before the new rules even apply. Read Part 2: CDD AND LINKED TRANSACTIONS.
This article is for general information and is not legal advice.
About Author:
