On 1 October 2026 the EU Anti-Money Laundering Authority (AMLA) finalised three sets of regulatory technical standards and submitted them to the European Commission. One of them, the RTS on customer due diligence under Article 28(1) of the AML Regulation (Regulation (EU) 2024/1624, AMLR), specifies the information banks and other obliged entities must collect and verify on every customer. It is the closest thing the EU will have to a common KYC data standard, and it lands nine months before the AMLR applies on 10 July 2027.
Most KYC teams already use automation for document capture, data extraction, and sanctions and PEP screening, and many are piloting AI agents that assemble a whole onboarding file. This article sets out what the final standards settle, where the AMLR draws the line for automated and AI decisions, and how to design an AI-assisted KYC workflow that a supervisor can examine. It closes with the central AML/CFT database consultation AMLA opened on 7 October 2026.
What AMLA finalised
AMLA describes the three RTS as "defining key measures companies and professionals must apply to reduce money laundering and terrorist financing risks." Each one answers a mandate in the AMLR.
| Standard | Legal basis | What it covers |
|---|---|---|
| Customer due diligence | AMLR Article 28(1) | The information to collect and verify, proportionate measures for lower-risk situations, non-face-to-face verification, electronic identification, and screening for politically exposed persons (PEPs), their family members and close associates |
| Business relationships, occasional and linked transactions, lower thresholds | AMLR Article 19(9) | How to tell a business relationship from an occasional transaction and how to spot linked transactions, so CDD thresholds apply consistently |
| Group-wide minimum requirements and measures for third-country branches and subsidiaries | AMLR Articles 16(4) and 17(3) | Group governance, risk management, internal controls, and secure information sharing |
Where the standards stand
The texts are final drafts. In AMLA's words: "Once adopted and published in the Official Journal of the EU, they are proposed to apply six months after their entry into force." For football agents and professional football clubs they will apply from 10 July 2029, the date the AMLR applies to those entities. The CDD factsheet adds a caveat worth repeating to any project board: the RTS "remain subject to review and potential amendments by the European Commission."
The AMLR itself is fixed. Article 90 states that it "shall apply from 10 July 2027." Plan the KYC data model against the final draft RTS now and treat the Commission's delegated regulation as the version to reconcile against when it is published.
What the CDD standard settles for KYC data
The CDD RTS is detailed where KYC systems tend to disagree. The points below come from AMLA's factsheet on the final draft.
- Names and place of birth. For natural persons, all names and surnames appearing on the identity document or obtained through electronic identification means and relevant qualified trust services. Place of birth includes at least the country and the city, municipality, town, or village.
- Addresses. Country and city, municipality, town, or village are mandatory data points, with other elements such as postal code and street where they exist.
- Nationality. Reasonable measures to establish whether a person holds more than one nationality; where several are declared, verifying one is sufficient.
- Lower-risk customers. A reduced set of identification data: names, date and place of birth, and nationality (or statelessness, refugee or subsidiary protection status). The address is not required.
- Missing information. Where an identity document lacks required data, it must come from reliable and independent sources, and the obliged entity must be able to understand the information "irrespective of the language used."
- Electronic identification. Annex I lists the minimum attributes that electronic identification means and qualified trust services must be capable of providing for CDD.
- Alternative non-face-to-face verification. Where a person cannot present a document in person and cannot use electronic identification, alternative solutions are allowed if they use reliable and independent sources and include the safeguards in Article 7 of the RTS.
- Beneficial owners. Sources for reasonable verification include public registers, reputable data providers, and certified documents. The central beneficial ownership register alone is not sufficient for verification.
- Purpose and intended nature. Non-exhaustive examples, applied on a risk basis. In low-risk situations the purpose may be inferred from information already held.
- Sanctions and PEP screening. It "must be performed through automated screening tools or solutions, manual checks, or a combination of both," with aliases, trade names and digital wallet addresses relevant for targeted financial sanctions where available.
- Existing customers. Records are brought into line on a risk-sensitive basis, no later than one year for higher-risk customers and five years for all others.
Where the AMLR draws the line for AI
The AMLR addresses automated and AI decisions directly. Article 76(5) states that obliged entities "may adopt decisions resulting from automated processes, including profiling … or from processes involving AI systems," provided that three conditions hold:
(a) the data processed by such systems is limited to data obtained under the CDD chapter of the AMLR; (b) "any decision to enter or refuse to enter into or maintain a business relationship with a customer or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20 of this Regulation, is subject to meaningful human intervention to ensure the accuracy and appropriateness of such a decision"; and (c) the customer can obtain an explanation of the decision and challenge it, except in relation to a suspicious transaction report under Article 69.
Article 18 adds the outsourcing boundary. An obliged entity may outsource CDD tasks, remains "fully liable" for them, and must be able to show its supervisor that it understands the rationale behind the provider's activities. Some tasks may never be outsourced, including "decision on the risk profile to be attributed to the customer," the decision to enter into a business relationship, the reporting of suspicions to the FIU, and the approval of the criteria for detecting suspicious or unusual transactions.
Article 77 sets the evidence horizon: CDD documents and information, including information obtained through electronic identification means, are retained for five years from the end of the business relationship or the date of the occasional transaction, and the assessment behind every suspicion analysis is kept whether or not a report is filed.
The EU AI Act adds a separate test for one KYC component. Annex III lists remote biometric identification as high-risk but excludes "AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be." Identity verification at onboarding usually falls within that exclusion. A system used to evaluate creditworthiness stays high-risk under point 5(b), so a combined onboarding and credit decision needs its own classification.
Designing AI-assisted KYC under these rules
Read together, the RTS and Articles 18, 76 and 77 sort KYC work into three kinds. An agent may prepare: capture, extraction, screening, source gathering, and drafting. A person must decide: onboarding, refusal, exit, the risk profile, and any change in CDD intensity. Everything must leave a record a supervisor can follow for five years.
| KYC step | What an AI agent may do | Human decision required | Evidence to keep |
|---|---|---|---|
| Identity data capture | Extract names, place of birth, address and nationality into the RTS data points; flag missing fields | No, unless data is missing or inconsistent | Source document or eID attributes, extracted values, extraction confidence, gaps flagged |
| Identity verification | Run eID or document verification; route alternative non-face-to-face cases to the Article 7 safeguards | Yes, for alternative verification exceptions | Verification method, result, safeguard applied, reviewer where used |
| Beneficial ownership | Gather register and provider data, compare sources, list discrepancies | Yes, where sources conflict | Sources consulted, discrepancies, resolution |
| Sanctions and PEP screening | Screen names, aliases and wallet addresses; propose a disposition for each hit | Yes, for every potential match | Lists and versions screened, hits, proposed and final disposition, reviewer |
| Risk profile | Propose a rating with the factors behind it | Yes: Article 18 forbids outsourcing this decision, and Article 76(5)(b) requires meaningful human intervention when it changes CDD intensity | Proposed rating, factors, approved rating, approver, time |
| Onboarding decision | Assemble the file and a recommendation | Yes, always | File version reviewed, decision, reason, approver, explanation available to the customer |
| Existing-customer remediation | Find records missing RTS data points, prioritise by risk, draft outreach | Yes, for exits and CDD changes | Gap list, deadline (one or five years), outcome per customer |
What we learned building KYC and AML agents
In September 2026 we prepared a proof of concept for a payments firm's merchant onboarding. The KYC manager's real workload was re-keying. Company registry extracts and beneficial-owner data were gathered by hand and typed again into the payment provider's onboarding portal, where a rejected file could be resubmitted only twice before it went to a manual analyst. We designed the agent to assemble and pre-fill the file and to stop before submission for human validation, and we ran it on synthetic specimen documents only.
The two test cases we chose show where the human gate earns its place. In one, the company registry extract was out of date, and the right action was to chase a fresh extract before anything was submitted. In the other, the identity document had expired, and the policy blocked the file outright. Neither case is a judgment call for the agent: one needs a request to a person outside the bank, the other is a hard stop. A KYC agent is useful when it makes those two outcomes fast and explicit.
A second lesson came from an AML demo we prepared for a bank's compliance team. A tool policy required a customer or alert identifier on every call, while the tool's input schema accepted only queue and status filters. The rule and the contract contradicted each other, so the agent could never call the tool. We aligned the rule with the tool contract. Policy conditions on KYC tools should be checked against what the tool can actually receive before they are published.
Putting a checkpoint in front of the KYC agent
Article 76(5)(b) is easiest to meet when the human decision is built into the execution path. A runtime checkpoint evaluates each action the KYC agent proposes before it runs. Data capture and screening can proceed with a record (allow, or warn where a pattern needs later review). A proposed onboarding, refusal, exit, or change in CDD intensity is held for a named reviewer (require_approval). An action outside the agent's mandate, such as submitting a file with an expired identity document, is stopped (block). KLA Control Plane implements these four outcomes, and each decision record holds the proposed action, the policy version, the outcome, the reviewer's decision, and the result.
Meaningful human intervention needs more than a click. The reviewer needs the file version, the sources, the agent's proposal, and the rule that routed it, and their decision needs a reason that can be turned into the explanation Article 76(5)(c) gives the customer. A reviewer who sees only an approve button cannot ensure "the accuracy and appropriateness" of the decision.
Added 7 October 2026: the central AML/CFT database consultation
On 7 October 2026 AMLA opened a consultation on the draft RTS establishing the central AML/CFT database, under Article 11(6) of Regulation (EU) 2024/1620 (AMLAR). AMLA describes the database as a single entry point for standardised reporting and a repository of supervisory information, accessible to supervisory authorities on a confidential, need-to-know basis.
The consultation runs as a public hearing on 3 November 2026 and closes at 16:00 CET that day. AMLA notes that the rules place no direct obligations on private companies, and it welcomes responses from practitioners. For banks the practical interest is downstream: what supervisors collect centrally shapes the data they will later request from obliged entities, so KYC and AML teams should check that their own records can answer the categories in the draft.
What to do before 10 July 2027
Four tasks fit the nine months. Map your KYC data model to the RTS data points, including place of birth granularity, multiple nationalities, and the reduced lower-risk set. Inventory every automated or AI step in onboarding and CDD and mark which ones produce a decision covered by Article 76(5)(b). Put a human decision with a recorded reason in front of each of those, and confirm none of the Article 18 non-outsourceable decisions sits with a vendor. Size the existing-customer remediation against the one-year and five-year deadlines.
For the obligations beyond KYC, the AMLR 2027 readiness checklist covers the full regulation, and governing AML and payments agents covers transaction monitoring and SAR drafting.
Frequently Asked Questions
What did AMLA finalise on 1 October 2026?
Three sets of regulatory technical standards, submitted to the European Commission: customer due diligence (AMLR Article 28(1)); criteria for business relationships, occasional and linked transactions, and lower thresholds (Article 19(9)); and group-wide minimum requirements and additional measures for third-country branches and subsidiaries (Articles 16(4) and 17(3)).
When do the AMLA CDD standards apply?
They must first be adopted by the Commission and published in the Official Journal. AMLA proposes that they apply six months after entry into force; for football agents and professional football clubs they apply from 10 July 2029. The AMLR itself applies from 10 July 2027.
Can a bank use AI to make KYC decisions under the AMLR?
Article 76(5) allows decisions from automated processes and AI systems if the data is limited to CDD data, any decision to onboard, refuse, maintain a relationship, or change CDD intensity is subject to meaningful human intervention, and the customer can obtain an explanation and challenge the decision (except for suspicious transaction reports). Article 18 also forbids outsourcing the risk-profile and onboarding decisions.
Does the CDD standard allow automated sanctions and PEP screening?
Yes. According to AMLA's factsheet, screening for targeted financial sanctions and PEPs must be performed through automated screening tools or solutions, manual checks, or a combination of both. Aliases, trade names and digital wallet addresses are relevant for sanctions screening where available.
Is AI identity verification high-risk under the EU AI Act?
Annex III excludes AI systems used for biometric verification whose sole purpose is to confirm that a person is who they claim to be. Identity verification at onboarding usually falls within that exclusion. AI used to evaluate creditworthiness remains high-risk under Annex III point 5(b).
What is the central AML/CFT database consultation?
AMLA consults until 3 November 2026 (16:00 CET, with a public hearing that day) on draft RTS under Article 11(6) of Regulation (EU) 2024/1620 establishing a central AML/CFT database: a single entry point for standardised reporting and a repository of supervisory information for supervisory authorities.
Key Takeaways
AMLA's CDD standard gives KYC systems a common data target, and AMLR Article 76(5) sets the condition for automating against it: agents prepare, people decide onboarding, refusal and CDD intensity, and customers can get an explanation. Banks that build the human decision and its record into the execution path in the next nine months will have the evidence the AMLR asks for on 10 July 2027.
Sources: AMLA press release "AMLA finalises key standards for the private sector", 1 October 2026; AMLA factsheet on the RTS on customer due diligence under Article 28(1) AMLR; AMLA consultation on the draft RTS establishing a central AML/CFT database, opened 7 October 2026; Regulation (EU) 2024/1624, Articles 18, 76, 77 and 90; Regulation (EU) 2024/1689, Annex III. The proof of concept described used synthetic documents only. This article is general information and not legal advice.