On 1 October 2026, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (herein referred to as ‘AMLA’) announced that it had finalised three sets of draft regulatory technical standards (herein referred to as ‘RTS’) under Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (herein referred to as the ‘AMLR’).
The proposed RTS seek to promote consistent compliance across the European Union (herein referred to as the ‘EU’) by clarifying when customer checks are required, how information should be collected and verified, and how compliance should operate across groups. They concern financial institutions, non-financial businesses and professionals falling within the AMLR’s scope, collectively described as ‘obliged entities’. These include specified activities undertaken by lawyers, accountants, tax advisers, real estate agents, gambling providers and crypto-asset service providers.
AMLA’s finalisation of the draft RTS does not, by itself, make them binding. The proposed standards remain subject to European Commission adoption and publication in the Official Journal of the European Union and may therefore still be amended.
Although the AMLR generally applies from 10 July 2027, the draft RTS provide for application six months after their entry into force, with a separate date of 10 July 2029 for football agents and professional football clubs. Additionally, the adopted standards would take the form of Commission Delegated Regulations, directly applicable in all Member States without national transposition.
Businesses and professionals may begin reviewing their arrangements by reference to the drafts, but the adopted texts will determine the definitive requirements and timetable.
The three sets of RTS address distinct but connected stages of the compliance process. The draft under Article 19(9) AMLR establishes criteria for distinguishing business relationships from occasional transactions and identifying linked transactions.
Once that threshold is met, the draft under Article 28(1) specifies customer due diligence (herein referred to as ‘CDD’) requirements, including identification information, verification methods, simplified and enhanced measures, and screening. Finally, the draft under Articles 16(4) and 17(3) addresses how those obligations should be supported by group-wide controls and what additional measures apply where third-country laws prevent compliance.
Together, the proposals translate the AMLR’s obligations into practical requirements, while preserving a proportionate approach to risk.
The starting point is determining whether CDD is required at all. CDD requires obliged entities to identify and verify their customers, identify beneficial owners where relevant, and understand the purpose and intended nature of the relationship or transaction. Before deciding which checks are necessary, however, an obliged entity must first determine whether the engagement is a business relationship or an occasional transaction.
This distinction is important in practice. A business relationship requires CDD and ongoing monitoring, whilst an occasional transaction generally requires CDD when it reaches the applicable threshold, usually €10,000, although lower thresholds and specific requirements apply to certain activities.
Checks remain necessary below the threshold where there is suspicion of money laundering or terrorist financing, or doubt about previously obtained identification information. Moreover, for professionals advising on or assisting with transactions, the relevant amount is the underlying transaction or asset value, rather than the professional fee. In addition, the draft introduces no additional lower thresholds beyond those established by the AMLR.
Where an engagement is not immediately identifiable as an occasional transaction, the next question is whether it constitutes a business relationship. The AMLR defines a business relationship as a professional or commercial engagement that has, or is expected to have, an element of duration or repetition. It may therefore exist even where there is no written contract.
The draft RTS provide practical guidance for assessing these elements. For example, ongoing access to a service may indicate duration. Consequently, a single instruction may still constitute a business relationship. Professional work concerning one acquisition may involve several stages over a number of months; the existence of a single underlying acquisition does not, therefore, necessarily make the engagement an occasional transaction.
Similarly, services provided at different intervals, or different services supplied to the same customer, may indicate repetition.
The draft RTS also establish sector-specific criteria. For currency exchange, money remittance and specified crypto-asset services, obliged entities must consider whether three or more transactions have taken place during the preceding 12 months. For gambling providers operating from physical premises, voluntary membership is relevant. In relation to football player transfers, conditional obligations must also be considered when assessing duration or repetition.
Even where an engagement appears to be an occasional transaction, it may still trigger CDD if related transactions are linked. Where occasional transactions are linked, their combined value must be considered when assessing whether the CDD threshold has been reached.
The assessment should consider the wider arrangement, including transactions involving the same parties or purchase, transactions dependent on earlier transactions handled by the same provider, and the use of common intermediaries or digital infrastructure. Available information concerning family relationships, business partnerships, customers acting together and common corporate connections may also be relevant.
These factors must, however, be assessed in context. A family relationship or common intermediary does not, by itself, establish linkage. Equally, transactions should not be treated as unrelated merely because they pass through different branches, agents or remote channels of the same provider.
The relevant timeframe will depend on the nature, speed and frequency of the transactions, as well as the provider’s size and business model. For currency exchange, money remittance and specified crypto-asset services, the draft RTS require consideration of a one-month period when assessing the time element of linkage. Gambling providers must also consider games supplied by the same provider when deciding whether transactions have a similar purpose.
Once the preceding analysis establishes that CDD is required, the draft RTS under Article 28(1) clarify the information that obliged entities must obtain, how it should be verified and how the measures applied may vary according to risk.
For individuals, the required information includes the customer’s name, address, place of birth and nationality. All given names and surnames shown on the relevant identity document or recognised electronic identification source must be obtained. For legal entities, obliged entities must obtain the legal name and any different trading name.
Reasonable steps should also be taken to establish whether an individual holds more than one nationality. Where several nationalities are declared, they must be recorded, although verification of one is sufficient.
Where an identity document does not contain all required information, the missing details must be obtained from a reliable and independent source. In assessing that source, obliged entities should consider its credibility, official status, accuracy, currency and susceptibility to forgery or manipulation. They must also be able to understand and assess information received in another language.
Furthermore, identifying a beneficial owner is distinct from verifying that person’s identity. In lower-risk cases, a central beneficial ownership register may assist with identification; however, the register alone is insufficient for verification. Its information must be checked against information obtained from the customer or another reliable and independent source.
The framework also reflects proportionality. Where the risk is low, an obliged entity may apply simplified due diligence rather than obtain the same level of documentation in every case. For individuals, this may involve collecting the customer’s name, date and place of birth, and nationality or, where relevant, statelessness or protection status. In such circumstances, the address need not be obtained or verified.
Similarly, the purpose and intended nature of a lower-risk relationship or occasional transaction may be established using sufficiently informative information already held by the obliged entity, such as the customer’s profile, activities, products, services or transaction history. Simplified due diligence is not automatic, however, and does not remove the obligation to identify the customer or understand the engagement.
Where an individual cannot reasonably present an identity document in person and lacks access to recognised electronic identification methods, an alternative verification method may be used, subject to appropriate safeguards.
Those safeguards must confirm that the person presenting the document is its holder, protect communications, produce clear records and retain time-stamped evidence. The obliged entity must also document why recognised methods could not be used and demonstrate that the alternative satisfies the applicable requirements.
Recognised electronic identification methods and relevant qualified trust services must be capable of providing the required identification attributes. Where any required attributes are missing, obliged entities must obtain and verify them through other means. The information obtained in each case will nevertheless depend on the customer, the risk assessment and the level of CDD required.
For higher-risk relationships, evidence supporting enhanced due diligence may include income records, investment documentation, property deeds and inheritance records. Such information assists in establishing whether the customer’s source of funds and source of wealth are lawful and consistent with the obliged entity’s knowledge of the customer.
The proposals also clarify sanctions screening and checks concerning politically exposed persons (herein referred to as ‘PEPs’), their family members and close associates. Automated tools, manual checks or both may be used, provided they are effective. Where relevant, screening should also cover aliases, trading names and listed digital wallet addresses.
Individual CDD obligations do not operate in isolation within corporate groups. The drafts under Articles 16(4) and 17(3) of the AMLR address how compliance should operate across connected entities. Their purpose is to ensure that groups adopt coherent controls while maintaining clear accountability at the level of each individual obliged entity.
An EU parent undertaking must establish clear responsibilities, reporting lines and sufficient authority for group compliance functions. The group-wide risk assessment must consider risks across entities and branches, including overseas operations, outsourcing and reliance on third parties.
Furthermore, the draft RTS address training, whistleblowing, incident reporting, periodic effectiveness reviews and timely remediation. Group arrangements must also manage conflicts between commercial interests and financial crime prevention. Accordingly, group policies should be applied consistently while taking account of each entity’s circumstances and risk exposure.
Group-wide requirements may also apply to certain networks, partnerships and franchises where at least two obliged entities operate within a continuing common business framework under common ownership, management or compliance control. Shared branding, referrals or technical tools alone would generally be insufficient. Qualifying structures would normally identify an EU entity responsible for overseeing their collective compliance arrangements, although supervisors may permit exceptions under specified conditions.
Separately, where a group headquartered outside the EU has several EU obliged entities and none acts as their EU parent, the draft provides criteria for identifying the EU undertaking responsible for group-wide compliance. These concern its operational significance, governance, oversight capacity and compliance resources, subject to supervisory assessment.
In addition, relevant information, including customer and beneficial ownership details, CDD records, transaction information and risk findings, must circulate within the group. It must be current, understandable and accessible, shared securely on a need-to-know basis and handled consistently with data protection requirements.
Information sharing must not depend on approval from the parent or another group entity. Nevertheless, each obliged entity remains responsible for its own CDD, risk assessments and decisions. The AMLR’s protections for specified information obtained by certain professionals in protected circumstances also remain applicable.
Group-wide arrangements must also function where local laws restrict the measures that an entity can take. Third-country laws may restrict customer checks, record retention or information sharing. Where an impediment is identified, the draft requires notification to the appropriate supervisor without undue delay. The notification must identify the country concerned and explain the restriction.
Where legally possible, the entity must seek the consent of the customer and, where applicable, the beneficial owner. If the obstacle remains, additional measures must be selected according to risk. These may include restricting operations to lower-risk products, conducting independent customer checks elsewhere in the group, undertaking enhanced audits, requiring senior-management approval for higher-risk dealings and applying stronger monitoring.
Where risks cannot be managed effectively, further measures may include refusing transactions, terminating relationships, closing operations or divesting activities. Supervisors may also require mitigation plans, corrective action and further restrictions.
For businesses and professionals, the principal implication is that the draft RTS provide more detailed requirements for customer checks, verification and group controls. Obliged entities should therefore review their procedures, customer records, risk assessments and governance arrangements, while remaining attentive to amendments before the standards are adopted
For any further information or assistance, please contact us at info@gtg.com.mt
Author: Alesea Azzopardi Spiteri