Table of Contents
- The starting point: two lawful routes to verify identity
- Change 1: eID and qualified trust services can now be used in every channel
- Change 2: remote document verification is now a narrow exception
- Change 3: missing attributes must be filled
- What else changed
- The timeline
- What to do now
- How IDnow can help
- Frequently asked questions
Ready to partner with IDnow?
Turn faces into trusted identities.
On 30 September 2026, AMLA submitted the final draft of its Regulatory Technical Standards (RTS) on Customer Due Diligence (CDD) to the European Commission. After two consultation rounds and hundreds of responses from the industry, the text now moves to adoption. And while it’s not in force yet, the direction is clear, and there are three changes in it that matter for how you onboard customers.
The RTS may not be in force yet as the Commission still needs to adopt it, followed by a non-objection period for Parliament and the Council, but it’s expected that only the wording may still change before publication in the Official Journal. The Anti-Money Laundering Regulation (AMLR) itself, however, is already law and applies from 10 July 2027. The RTS only adds detail to obligations that already exist.
Three changes in the final draft matter most for customer onboarding:
- eID and qualified trust services can now be used in every channel, both remotely and in person.
- Remote document verification is a narrow exception, and each use must be justified to your supervisor.
- eID and trust services come with a defined set of attributes, making it clear what data a compliant flow must deliver.
The starting point: two lawful routes to verify identity
Under Article 22(6) AMLR, an obliged entity must verify a natural person’s identity using one of two routes: an identity document, passport or equivalent, or an eIDAS electronic identification means at assurance level “substantial” or “high”, or a relevant qualified trust service.
The regulation treats these two routes equally. Neither is ranked above the other. The final draft RTS clarifies where each route can be used.
Change 1: eID and qualified trust services can now be used in every channel
Until now, the common assumption was that eID and trust services were methods for remote verification, while documents were used in branches. Article 6(4) of the RTS removes that distinction: eID means and relevant qualified trust services can also be used to verify identity face to face.
For banks and lenders running separate control frameworks for branch and digital onboarding, this is an important practical change. One verification flow, one evidence format and one audit trail can now serve the app, the branch, the agent and the point of sale.
One more detail worth knowing: the RTS confirms that an eID does not have to be notified under eIDAS to qualify. What matters is the assurance level, substantial or high, not whether the eID has been notified.
Change 2: remote document verification is now a narrow exception
Remote document-based verification remains possible under Article 7 of the RTS, “alternative verification measures”. However, the final draft has tightened the conditions compared with the consultation version.
Two conditions must be met for the specific customer: the person cannot reasonably be expected to submit their document in person, and they do not have access to an eID or a qualified trust service. They must also hold a valid identity document, as Article 7 relies on that document to verify their identity.
Who might realistically qualify? A third-country national outside the EU with a valid passport and no branch available in their country. A residence-permit holder in a Member State whose eID scheme only issues to nationals. Or someone whose disability prevents them from using the available eID app. The provision exists to ensure these people are not excluded from financial services. It is not a cheaper onboarding alternative.
Using this route comes with two distinct obligations under Article 7(3). First, you must be able to justify, for each customer, why the standard routes could not be used. Second, you must demonstrate to your supervisor that the alternative solution itself complies with Article 7. A general policy document is not enough for the first requirement, and individual case files do not satisfy the second. Most firms do not yet have both an eligibility rule and a process for capturing evidence in each case.
The alternative route also comes with specific safeguards: controls to confirm that the person presenting the document is its holder, integrity and confidentiality of the communication, readable image quality, stopping the process if doubts arise, and secure, time-stamped retention of records for later verification.
Change 3: missing attributes must be filled
The RTS defines the data an eID or qualified trust service must carry, and what to do when something is missing. It lists all names, place and full date of birth, nationality, the personal administrative number where applicable, usual place of residence, and the tax identification number where available.
Two practical consequences follow.
If the attributes are there, don’t ask for more. The RTS states that when you verify through an eID or a qualified trust service, no additional data points need to be obtained.
If one is missing, you must fill it. Address and tax ID are the usual gaps. Organisations must obtain and verify them through other permitted means in line with Article 22(6). A QEAA is one option, when the customer wants a qualified, reusable attestation.
Low-risk relationships need less. Where a relationship has been assessed and documented as low risk, the minimum data to identify a person is names, place and date of birth and nationality. No address and no tax ID are required. You still verify the customer, and low risk must be assessed, never assumed.
What else changed
Sanctions and PEP screening must cover customers and beneficial owners when the relationship begins, when sanctions lists change, and when due diligence data changes. Automated tools, manual checks or a combination of both are acceptable, provided they are effective and proportionate to the firm’s size and risk.
Simplified due diligence was also not made automatic for any sector, product or customer category. AMLA declined these requests because the regulation requires an individual risk assessment.
The timeline
One detail worth considering in your planning: for business relationships that already exist when the RTS enters into force, the one-year and five-year periods for updating customer information run from the entry-into-force date, not from the date the customer was onboarded.
What to do now
- Confirm your scope. If you provide consumer credit, personal finance, lending or mortgage finance, you are an obliged entity.
- Map your current verification flow against the two routes. If remote document verification accounts for most of your volume, work out how you will justify its use under Article 7 for each customer.
- Check the attributes you collect today against Annex I and decide how you will obtain and verify any missing attributes.
- Review screening and evidence retention. Screening must take place at onboarding, when lists change and when customer data changes. Records must also be retained for later verification.
- Plan for existing customers. The update period starts when the RTS enters into force, not before.
Waiting for adoption does not change what firms should be preparing for now. AMLA largely retained the EBA’s text, making amendments only where justified. The substance is therefore largely settled, even though the formal process remains.
How IDnow can help
The IDnow Trust Platform brings all these verification routes together in one flow: notified and non-notified eIDs, EUDI Wallets, qualified trust services from a certified QTSP, and document-based verification with the safeguards required under Article 7.
Where an eID or wallet is missing an attribute, the platform can help complete it through other permitted means or issue a QEAA. Screening, audit logs and evidence retention are also built in.
You can start with the flows you use today and add new methods as they become applicable, without needing new integrations.
Ready to map out what compliance looks like for your setup?
Complete our free AMLR Readiness Check to identify your biggest gaps.
Frequently asked questions
Is the RTS law now?
No. It is a final draft submitted to the European Commission. It becomes law after adoption, the non-objection period and publication in the Official Journal.
When does it apply?
Six months after it enters into force, which happens 20 days after publication in the Official Journal. AMLR itself applies from 10 July 2027 regardless.
Can we keep using remote document verification?
Yes, under Article 7, where the specific customer cannot reasonably be expected to verify in person and has no access to an eID or a qualified trust service. Each use must be justified to your supervisor, with the required safeguards and time-stamped records.
Is a QEAA mandatory when attributes are missing?
No. It is one permitted way to obtain and verify missing attributes, particularly useful when the customer wants a qualified, reusable attestation.
Do eID schemes have to be notified to qualify?
No. The test is the assurance level, substantial or high. Notification is not required.
Does the RTS require manual review of document checks?
The AMLR and the RTS do not require human involvement. However, ETSI TS 119 461 still requires a registration officer for non-NFC hybrid flows, and national AML law may introduce additional requirements.
Want to read more about AMLR?
- QEAA for AMLR: The Missing Facts in Financial Services Onboarding
- One gateway to every AMLR compliant route: why a single integration beats three separate keys
- EU AMLR 2027: The Compliance Clock Is Ticking. Here’s What the Next 18 Months Mean for Your Identity Stack
Nikita Rybová
Customer & Product Marketing Manager at IDnow
Nikita Rybova is a Customer & Product Marketing Manager with 8+ years in tech, SaaS and e-commerce. At IDnow, she specializes in customer and product marketing, turning the complexities of identity verification into compelling narratives that drive growth.
Connect with Nikita on LinkedIn