EU Anti-Money Laundering Authority Finalises Three Technical Standards on AML/CFT Requirements

Introduction

On 1 October 2026, the European Union Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) announced the finalisation of three sets of Regulatory Technical Standards (RTS) specifying how obliged entities must apply key anti-money laundering and countering the financing of terrorism (AML/CFT) requirements under the new EU AML/CFT framework. The final draft RTS have now been submitted to the European Commission for adoption.

This is a significant step in the rollout of the European Union’s recast AML/CFT regime: the RTS translate high-level legislative requirements into granular, binding criteria that obliged entities and supervisors must apply in practice in areas that go to the heart of day-to-day AML/CFT compliance, namely when customer due diligence (CDD) must be carried out, what CDD measures must involve, and how group-wide AML/CFT frameworks must be organised. Following their adoption by the European Commission and publication in the Official Journal of the European Union, the RTS are expected to apply six months after their entry into force. Obliged entities should therefore start preparing now, rather than waiting for the formal application date. These RTS should also be viewed in the broader context of AMLA’s objective of promoting a more consistent application of AML/CFT requirements across the European Union. By establishing detailed technical standards, AMLA seeks to reduce regulatory fragmentation and support greater convergence in supervisory expectations among national competent authorities.

This alert summarises the key takeaways from each set of RTS, the practical implications for obliged entities, and the changes or clarifications they introduce compared to current market practice.

Business Relationships, Occasional Transactions, and Linked Transactions

The first RTS set out criteria for distinguishing a “business relationship” from an “occasional transaction”, and for identifying when a series of transactions must be treated as “linked transactions” for the purposes of applying CDD thresholds.

Key Takeaways

• Sets out the criteria obliged entities must apply to determine when a customer relationship qualifies as a “business relationship” rather than a one-off “occasional transaction”.
• Establishes when separate transactions must be treated as “linked transactions” and aggregated for the purposes of applying CDD thresholds.
• Aims to ensure the consistent, EU-wide application of CDD thresholds, reducing divergence in how obliged entities currently classify customer relationships and transactions.

Practical Implications and Changes Versus Current Market Practice

Many obliged entities currently apply their own internal methodology, which can vary significantly across the market, to determine when a customer relationship is “occasional” rather than “ongoing”, and whether separate transactions should be aggregated for CDD threshold purposes. The RTS are intended to harmonise this assessment across the European Union, which means entities whose current internal criteria diverge from the RTS will need to recalibrate their business relationship and transaction-monitoring classifications, including the logic built into their transaction-monitoring and onboarding systems.

Customer Due Diligence 

The second RTS specify the information that obliged entities must collect and verify when carrying out CDD, including the documents, data, and information required to identify and verify customers and beneficial owners.

Key Takeaways

• Specifies the information obliged entities must collect and verify to identify and verify customers and beneficial owners.
• Introduces proportionate CDD measures for lower-risk situations, alongside requirements for non-face-to-face verification and electronic identification methods.
• Sets out requirements for the screening of politically exposed persons (PEPs), their family members, and close associates.

Practical Implications and Changes Versus Current Market Practice

The RTS are expected to standardise CDD information requirements that currently differ from one Member State, and even one obliged entity, to another. Entities that rely on more flexible or less formalised CDD information-gathering practices, particularly for non-face-to-face onboarding or digital identification, should expect to need to adjust their CDD policies, client onboarding journeys, and PEP screening procedures to align with the harmonised, risk-based standard set by the RTS.

Group-Wide Arrangements 

The third RTS set minimum requirements for group-wide AML/CFT frameworks, covering governance, risk management, internal controls, and secure information-sharing arrangements within a group, with particular attention to subsidiaries and branches located in third countries.

Key Takeaways

• Sets minimum requirements for group-wide AML/CFT governance, risk management, and internal controls.
• Requires secure arrangements for information-sharing within the group.
• Pays particular attention to subsidiaries and branches located in third countries, including how group standards must be applied where local AML/CFT regimes are less robust.

Practical Implications and Changes Versus Current Market Practice

Groups with subsidiaries or branches in third countries, particularly those with less equivalent AML/CFT regimes, will need to review and likely enhance their group policies, intra-group information-sharing protocols, and oversight arrangements to meet the minimum standard set by the RTS. This is an area where supervisory expectations have so far been applied unevenly across groups, and the RTS are intended to bring greater consistency. Particular attention may be required in relation to beneficial ownership identification and verification, as the RTS provide greater detail regarding the information that should be obtained and the methods that may be used to verify such information.

According to AMLA, the objective of the three RTS is to give obliged entities and supervisory authorities greater clarity and consistency in applying the new EU AML/CFT framework, while preserving a proportionate and risk-based approach. The press release announcing the finalisation of the RTS, together with links to the underlying draft standards, is available here.

What Should You Do Now?

The finalisation of the RTS, and the six-month implementation runway once they apply, warrant an early review of existing AML/CFT arrangements. You should:

• Review your current methodology for distinguishing business relationships from occasional transactions, and for aggregating linked transactions, against the criteria set out in the RTS and identify any gaps.
• Assess your CDD policies and onboarding procedures, including non-face-to-face verification, electronic identification and PEP screening, against the information-collection and verification requirements in the RTS.
• For group entities, review group-wide AML/CFT governance, risk management, internal controls, and information-sharing arrangements, with particular focus on subsidiaries and branches in third countries.
• Track the RTS through the EU adoption process and the Official Journal publication date, so that the six-month application deadline can be calculated accurately once known.
• Build an implementation plan now covering policy updates, system changes, and staff training, rather than waiting for the formal application date.

How We Can Help

Our Finance practice team advises obliged entities across the financial sector on European Union and Luxembourg AML/CFT compliance, including CDD frameworks, group-wide policies, and engagement with supervisory authorities. Please get in touch.

This alert is for general information purposes only and does not constitute legal advice.

We acknowledge the contributions to this publication from our senior compliance officer Bibiana Wasmes.