Customer Due Diligence under AMLR: What changes in customer verification?

Customer Due Diligence (CDD) is the cornerstone of any anti-money laundering (AML) strategy. It is here that a company determines whether it truly knows its customers and their beneficial owners, assesses risks accurately, and responds promptly when in doubt. With the implementation of the AMLR on July 10, 2027, a uniform, directly applicable standard will apply to all obligated entities within the EU. This blog outlines the specific changes in customer verification and highlights key implementation considerations. For more foundational information on AMLR, AMLA, and other related topics, please refer to our previous blog posts.

Specific Changes in Customer Verification

1. A Unified, Risk-Based Framework: “Risk-based” means that not every customer will undergo the same level of scrutiny; instead, the depth of verification will depend on the assessed money laundering risk associated with each individual case. This assessment will be based on customer type, geographical risk, product or service risk, and distribution channel. Consequently, one of the three internationally recognized levels of scrutiny will apply: Simplified Due Diligence (SDD) for demonstrably low risk, standard Customer Due Diligence (CDD) for typical cases, or Enhanced Due Diligence (EDD) requiring additional documentation, closer monitoring, and approval from senior management when a risk factor is significantly elevated. Notably, the AMLR allows for much less interpretative flexibility than before, meaning historically established, proprietary risk classifications must now align with this harmonized standard.
2. Stricter Verification of Beneficial Owners (UBOs): Obligated entities will now be required to actively identify and report discrepancies between the information recorded in the national UBO register and the information obtained during their own customer verification processes (Art. 24). A one-time check at the beginning of the business relationship will no longer suffice. A repeatable, documented verification process must be implemented that remains effective throughout the business relationship.
3. Expanded PEP Verification Beyond Traditional Frameworks: For disbursements from life insurance policies, it will now be necessary to verify whether the beneficiary is a politically exposed person (PEP) (Art. 44). This is a new verification point that has not been included in many existing disbursement processes.
4. A Broader Scope of Entities Subject to Verification: Industries that have previously benefited from national exemptions, such as online gambling providers, must now fully implement customer verification.
5. Increased Documentation Requirements: As the AMLA coordinates supervisory practices across the EU, the need for documentation becomes even more critical: a customer verification that is correctly conducted but not thoroughly documented is hardly distinguishable from a failure to conduct the verification at all in serious cases.

Implications for Existing Processes

The real challenge lies not in the “whether,” but in the “how robust.” Many CDD processes have evolved historically, are manually driven, and are not designed to actively identify discrepancies in UBO data or to automatically trigger PEP checks at new process points, such as insurance payouts. An insurer that only conducts PEP checks at the contract’s inception now has a gap under the AMLR. The verification obligation at payout is now an independent, additional trigger in the process. The same applies to UBO verification. If UBO data is recorded once and not systematically reconciled with the register thereafter, the new reporting obligation for discrepancies will not be met.

First Steps to Adjust Customer Verification

1. Align Existing Risk Classification with AMLR: Assess whether your current classification into simplified, standard, and enhanced due diligence aligns with the new, EU-wide uniform standard.
2. Establish UBO Reconciliation as a Recurring Process: A one-time check at the start of the contract must evolve into a repeatable, documented reconciliation process with the UBO register, including a clear escalation procedure for identified discrepancies.
3. Identify New Verification Points: Review your processes throughout the entire customer relationship, not only at account opening but also for disbursements, contract changes, and other events where verification must apply.
4. Ensure Data Quality as a Foundation: A robust customer verification process hinges on the quality of the underlying reference data. Outdated or incomplete PEP and sanctions lists can lead to false alarms as well as missed hits. Duplicates in the data can also result in increased workload or critical oversights, such as changes in UBOs.
5. Incorporate Documentation from the Start: Integrate the documentation process directly into the verification workflow rather than adding it retrospectively. In the event of scrutiny, what can be substantiated is what counts.

If you are interested in a roadmap for AMLR 2027, please read this blog post: (Roadmap AMLR).

Conclusion

The AMLR does not fundamentally reinvent customer verification but makes it significantly more demanding. It establishes a uniform standard and imposes stricter documentation requirements. This is precisely where the TOLERANT Compliance Suite comes into play: it integrates UBO verification, PEP and sanctions list checks, and the associated documentation into a cohesive workflow, supported by reliable data quality as the foundation for every verification. If you would like to review your existing CDD processes in light of the AMLR requirements, please feel free to contact us.