Europe’s new anti-money laundering framework is placing greater emphasis on how financial institutions assess customer risk, with firms expected to justify their due diligence decisions rather than simply collect more information. The shift could increase demand for RegTech tools that help compliance teams document assessments and demonstrate how they meet regulatory requirements.
On 1 October 2026, the Anti-Money Laundering Authority (AMLA) published its final report, dated 30 September, setting out draft regulatory technical standards (RTS) for customer due diligence under Article 28(1) of the Anti-Money Laundering Regulation (AMLR). The proposals are particularly relevant to providers such as CleverChain, whose AI due diligence agent, VERA, is designed to help institutions gather customer information, assess ownership structures and create auditable records of their decisions. The draft has been submitted to the European Commission, which must adopt it as a delegated regulation before it is published in the Official Journal. The consultation, which ran from February to May, attracted 325 responses, with the final version reduced from 33 articles to 29.
The AMLR is due to apply from 10 July 2027. The RTS will enter into force 20 days after publication and become applicable six months later. Football agents and professional clubs have until 10 July 2029 to comply. The standards cover standard, simplified and enhanced due diligence, politically exposed person (PEP) identification, sanctions screening, ownership structures and electronic identification. They apply to banks, crypto-asset service providers, high-value goods dealers and other obliged entities.
The final draft reflects concerns raised during the consultation about the level of detail firms would be required to collect. Respondents argued that repeated instructions to “obtain at least” specified customer information risked making the standards more prescriptive than the underlying regulation. The European Banking Federation warned that gathering additional information on low-risk customers could divert compliance resources, while Accountancy Europe highlighted the challenges smaller firms could face in meeting short customer information refresh deadlines.
AMLA has made several changes in response, giving institutions more discretion over the information they collect. Details about the purpose and nature of a business relationship, along with most enhanced due diligence requirements, are now framed as options rather than mandatory checklists. The amount of information gathered must also be proportionate to the level of risk identified.
A notable change concerns the assessment of complex corporate structures. The previous draft included a fixed definition based on the number of ownership layers, but this has been removed. Firms must instead evaluate multi-entity structures individually, considering indicators such as nominee involvement, legal arrangements and links to high-risk jurisdictions when deciding whether further information is needed.
The revised approach gives compliance teams greater flexibility but also places more weight on the evidence behind their decisions. Structures that might previously have fallen outside a defined ownership-layer threshold could now require closer examination if they display signs of opacity. Firms will need to show why they considered a structure sufficiently transparent or why additional checks were necessary.
Some requirements remain unchanged. The one-year and five-year deadlines for bringing existing higher-risk and other customers into line with the new requirements are established in the AMLR itself and have not been altered by the final draft.
For RegTech providers, the changes highlight the role technology could play in helping firms manage more judgement-based compliance processes. CleverChain’s autonomous AI due diligence agent, VERA, gathers and reconciles information from registries, commercial databases and open-source sources. It maps ownership chains, flags indicators of opacity and potential shell companies, and produces a timestamped audit trail.
Its reports also include a policy-mapped control checklist showing which information was considered relevant to a customer assessment and why. CleverChain says VERA is intended to support institutions’ compliance processes, rather than replace their responsibility for risk assessments and customer acceptance decisions.
The final standards put the quality of customer risk assessments and the evidence supporting them firmly in focus. For institutions, this means being able to demonstrate that due diligence measures are proportionate to each customer’s risk profile. For providers such as CleverChain, the regulatory shift creates an opportunity for AI-powered tools to help compliance teams organise information, identify potential ownership risks and maintain a clear audit trail, while leaving accountability with the institutions themselves.
Copyright © 2026 FinTech Global
Copyright © 2026 RegTech Analyst
