AMLA sent its final due diligence standard to the Commission on 1 October. Article 25 lets you screen by hand, but a customer's money laundering risk does not decide how often

On 1 October 2026 AMLA announced that it had finalised three sets of regulatory technical standards and submitted them to the European Commission. The final reports are dated 30 September. Each is a detailed rule that Regulation (EU) 2024/1624, the EU's AML Regulation (AMLR), tells AMLA to draft.

AMLA's own report gives the number received as 211 on one page and 209 in a footnote; 204 is the figure it says it used.

The Commission has to adopt each one as a delegated regulation. Each says it enters into force on the twentieth day after publication in the Official Journal and applies six months after that, except for football agents and clubs, which apply from 10 July 2029.

We read all three final reports, the two factsheets we cite, and the consultation draft of the due diligence standard. The rest of this post is mostly about one article in that standard.

The due diligence standard is 29 articles long. Article 25 is the one a screening team needs. It covers customers, beneficial owners, and the entities or persons that control them or meet the AMLR's ownership conditions. A person acting for the customer is screened only where there is a suspicion of circumvention or evasion.

What to screen, at a minimum:

• For a natural person, all names, in the original alphabet, in Latin transliteration, or both.
• For a legal person, the legal name and any trade names that differ from it, in the same forms.
• Where available, other names, aliases and digital wallet addresses, where the sanctions lists include them.

When to screen, at a minimum: on entering a business relationship or carrying out an occasional transaction, and when an existing sanctions listing changes. Credit and financial institutions also screen when a new designation is made under Article 26(4) AMLR. The third trigger is a change in the customer's own data. The article's examples are a change of name, residence, nationality or business operations, or a change of beneficial owner or designated beneficiary. On top of the triggers there is a regular cycle, "commensurate with the exposure" of the firm and the business relationship to the risk of non-implementation and evasion.

Then two timing duties. Screening must happen without undue delay from the moment UN financial sanctions are made public, and from the moment updated targeted financial sanctions become applicable.

When there is a match, the firm checks the screened data against everything it holds on that person. In a doubtful case it goes to other sources, including registers of owned and controlled entities and central registers.

Respondents from the gambling, real estate, notary, legal and accounting sectors said the consultation draft favoured automated tools. AMLA agreed in part. The final article lets firms use automated tools, manual checks or both, depending on size and risk. AMLA names the firms it has in mind: small ones, ones with few customers, ones whose business is occasional or low-volume.

AMLA qualified that in the same breath. Manual checks "should not be understood as a lower standard of compliance", and the firm must still detect matches in a timely and effective way. Proposals for a general risk-based approach to sanctions screening were rejected outright. The report's reason: compliance with targeted financial sanctions "cannot be made dependent on the level of ML/TF risk". Screening still scales, but by the exposure of the firm and the relationship to sanctions evasion, not by the customer's money laundering risk level. That is the distinction AMLA drew.

The same choice applies to politically exposed persons under Article 17: tools may be automated, manual or both, and must be effective. Existing customers are re-checked on a risk-sensitive schedule, without delay when information changes, and without delay when the list of prominent public functions is updated.

Recital 23 draws a boundary: screening for arms embargoes, trade restrictions and travel bans is outside this standard.

Two rows matter in a screening file. First, place of birth is now recorded as the document shows it, and where a person declares several nationalities only one has to be verified. The data you hold for disambiguating a match will therefore be thinner and more uneven than the consultation draft implied. The final recitals say a firm that collects only a city of birth should consider whether it also needs the country, for instance where the city name is not unique. Second, the update periods did not move. AMLA declined to stretch the one-year and five-year limits for existing customers.

For a natural person, firms collect all names as they feature on the identity document, passport or electronic identification, the place of birth and the nationalities. The address is made of the country, the city or village with a postal code where one is issued, and the street and building number where they exist. In low-risk situations the set shrinks: names, place and date of birth and nationality, with no address.

The standard also names reliable sources for verifying beneficial owners: public registers other than the central register, national systems such as business, tax, residence and property registers, reputable data providers including credit agencies, banks, group entities, and certified company documents. AMLA's factsheet repeats the AMLR rule that the central beneficial ownership register alone is not enough for verification.

The second standard defines when an engagement is a business relationship and when it is an occasional transaction. AMLA's factsheet gives the usual occasional-transaction threshold as EUR 10 000. The report says AMLA found no additional higher risks that justify extra lower thresholds and added none.

For currency exchange, money remittance and the crypto-asset services the text lists, three or more transactions in 12 months is a factor pointing to a business relationship. Two or more occasional transactions inside one month must at least be considered as candidates for linking. Providers who sell services connected to a transaction use the value of the transaction, not their fee, against the threshold. And AMLA narrowed the registration test. What counts is ongoing access to services within the scope of the EU's anti-money laundering rules, including through a customer account. A registration that grants such access may still indicate duration; a newsletter subscription does not.

The third standard covers groups and structures that share common ownership, management or compliance control, such as networks or partnerships. Its Annex I lists what a group must be able to share when relevant, and two items are sanctions data. One is whether a customer or beneficial owner is subject to targeted financial sanctions, including whether listed persons control a legal entity or hold more than 50 percent of it, individually or collectively. The other is the restrictive measures applied to customers, their transactions and assets. The standard also repeals Commission Delegated Regulation (EU) 2019/758 with effect from 10 July 2027.

1. Write down your screening method. Automated, manual or both, and why it is effective for your size. Article 25 leaves the choice to you.
2. List what you screen. Check that aliases, trade names and transliterated names go into the check, not only the registered name.
3. Name your re-screening triggers. Onboarding, a list change, and a change in customer data such as a new name, residence, nationality or beneficial owner, plus a regular cycle you can justify.
4. Time your reaction to UN listings. "Without undue delay" has no number in the text. Decide what yours is.
5. Extend screening to the people who control the customer. Beneficial owners and those who control or own the customer are in scope, not only the contract party.

ScreenVeritAI is a screening tool. A check compares a name against sanctions, PEP and criminal watchlist sources and returns candidate matches with the source list attached, and a batch run re-checks a whole customer file. It does not verify identities, map ownership or decide which candidate is your customer; that stays with your due diligence process.

This post reports what AMLA published on 1 October 2026 (the press release, three final reports and two factsheets), read against the February 2026 consultation draft of the due diligence standard. It is not legal advice. The standards are drafts and the Commission may change them. We did not read the AMLR text itself in this review, so any article of the Regulation named above is as AMLA's documents cite it. The consultation for the second standard is given as ending on 8 May in one place and 9 May in another. We have not checked whether the Commission has adopted or published anything since 1 October, and the reports give no calendar date for application. The group-wide report is covered only for the points above, not article by article.