eIDAS 2.0 and AMLR Updated Standards: What Should Regulated Businesses Do Next?

Written by:
Chad Gerhardstein | Chief Risk and Strategy Officer, Trulioo

→ How Should We Verify Customers Across EU Markets Under AMLR?
→ What If a Digital ID Doesn’t Provide All the Customer Information AMLR Requires?
→ How Do We Verify Business Customers and Ultimate Beneficial Owners Under AMLR?
→ How Should We Prepare Our Verification Process for eIDAS 2.0 and AMLR?
→ What Should We Ask Our Verification Partner About eIDAS 2.0 and AMLR?
→ How Can Trulioo Help Us Prepare for eIDAS 2.0 and AMLR?
→ FAQ: What Else Should We Know About eIDAS 2.0 and AMLR?

Businesses preparing for the Anti-Money Laundering Regulation (AMLR) now have a clearer view of what customer due diligence needs to cover. The next challenge is deciding how to meet those expectations without disrupting onboarding or asking customers to repeat checks unnecessarily.

The EU Anti-Money Laundering Authority (AMLA) provides that clarity in its final report, released September 30. The proposed regulatory technical standards (RTS) explain how eIDAS 2.0 digital identity supports customer due diligence (CDD) under AMLR, helping make remote verification more secure and consistent across EU borders.

Formal adoption is still ahead. However, teams now have a firmer basis for assessing what can continue working in their current process and where changes are needed. That assessment should start with the customers using it.

A verification method can meet the regulatory standard and still be difficult for some customers to access. Your preparation therefore needs to account for both the qualifying methods available in each market and the customers who can actually use them.

The final draft says qualifying electronic identification and relevant qualified trust services should be used wherever possible. That includes national digital IDs at substantial or high assurance and EU Digital Identity (EUDI) Wallets. For each method, assess customer adoption and the information it returns before deciding where it fits in onboarding.

Customers who cannot use a qualifying method need a clear next step. Document-based remote verification remains an option when customers cannot access a qualifying electronic method and cannot reasonably appear in person. It can also support retries, provided the conditions for using an alternative route are met. The draft’s Article 7 safeguards require firms to protect the verification process and document why the default methods could not be used.

Reliable, independent data also remains part of the process. Where permitted, it can help fill gaps in required customer information, including details a digital ID does not return. Building these checks and permitted alternatives into onboarding gives customers a next step when the initial method cannot complete the work.

Successful identity verification and a complete customer record are separate outcomes. A digital ID may establish who the customer is while leaving an address or another required attribute missing.

Standard CDD covers names, date and place of birth, nationalities, and address, as well as national identification numbers where applicable and tax identification numbers where available. Under Article 27(2) of the draft, firms must obtain and verify missing attributes through other permitted means consistent with AMLR Article 22(6).

Reliable, independent data therefore retains a role in Know Your Customer (KYC) checks alongside documents. For your onboarding process, the practical distinction is between a failed identity check and missing information. Where a permitted data check or targeted document request can complete the record, customers should not have to repeat the full identity check.

For business customers, verification needs to cover the business itself as well as the people who ultimately own or control it. Verifying a representative is one step; understanding the ownership chain requires its own evidence.

The final draft standards clarify that responsibility for multilayered structures. Firms need information about intermediate legal entities and must assess the money laundering and terrorist financing risks the structure creates. The depth of the review should reflect those risks, with enough visibility to identify and verify the ultimate beneficial owners (UBOs).

That makes the quality of your data sources particularly important. Where consultation of a beneficial ownership register is required, the register cannot be your only source. Customer-supplied information also needs corroboration from reliable, independent sources. AMLA expressly recognizes reputable data providers and other public registers as sources for UBO verification.

When reviewing your business onboarding process, look at how that evidence fits together. Your team should be able to trace ownership through intermediate entities and explain how its findings inform the risk assessment. If no UBO can be identified after all means have been exhausted, AMLR requires firms to document the outcome and identify and verify all senior managing officials.

These checks sit within a wider due diligence process that includes sanctions and politically exposed person screening. Where enhanced due diligence is required, additional measures may include source-of-funds checks, senior management approval, and closer monitoring.

For businesses handling payouts, consistent information matters further along the relationship, too. A trading name may differ from the legal name on a bank account. Verification of Payee, supporting the separate Instant Payments Regulation, checks payee details against the receiving payment provider’s records. Consider those downstream needs when deciding how business information is collected and maintained.

The implementation dates make it important to plan for several verification methods operating alongside one another. AMLR applies from July 10, 2027. EUDI wallets are due to be available by the end of 2026, while the acceptance obligation for covered private-sector businesses begins in December 2027. Wallet availability will not, by itself, tell you how quickly your customers will adopt them.

Start by confirming which obligations apply to your business and how responsibilities are shared with partners. For example, a marketplace working with a licensed payment provider needs to establish what each party is responsible for and what information must pass between them.

With that agreed, phase implementation around your markets and customer risks. Test incomplete digital ID records, permitted alternative routes, and layered business ownership before introducing changes more broadly. Include existing customer files in that plan so preparation covers the customers you already serve.

The same testing should show whether your records explain what happened. Retain the method used, assurance level where relevant, information returned, sources used to fill gaps, and timing. When an alternative route is necessary, record the reason. Building that evidence into the process helps compliance teams review decisions without reconstructing the checks later.

Bring your partner the scenarios your team needs to resolve and ask them to demonstrate the proposed process. A walkthrough of an incomplete digital ID record or a layered ownership structure should show how the necessary checks work together and what your team will need to review. 

Useful questions include:

• Which qualifying digital IDs do you support in our markets, and at what assurance levels?
• How do you obtain and verify information a digital ID does not return?
• What permitted alternatives can we configure, and what evidence does each check retain?
• How do you corroborate beneficial ownership information and investigate intermediate entities?
• What is available today, and what is planned for EUDI Wallet acceptance?

The answers should help you judge how much of your current process can carry forward and where changes are needed. They should also make clear how you can adjust the methods offered as customer adoption develops.

Trulioo is building a configurable EU verification approach to help customers manage these choices in one flow. It will bring together national digital IDs, document verification, and supplementary data checks. Customers will be able to set routes and fallbacks in Workflow Studio with little or no code, introduce changes market by market, and retain records of the checks performed. EUDI Wallet support is planned as part of that approach.

For business onboarding, Trulioo UBO Discovery and Business Insights help establish who owns and controls a business, with independent data to corroborate register findings. That supports the ownership analysis firms need to assess risk in multilayered structures. And upcoming product releases will use signals to help flag higher-risk businesses earlier.

As preparation continues, three priorities can help keep the work focused:

1. Assess which qualifying verification methods your customers can use, and build in permitted alternatives.
2. Plan how to complete missing customer information and corroborate business ownership with reliable, independent sources.
3. Make the process adaptable as adoption changes, with records that explain the checks performed and the decisions made.

Contact our team to discuss how these priorities apply to your markets and customer requirements. We’ll also explore implementation questions in upcoming webinars.

For the regulatory foundations, check out our white paper, “The eID Inflection Point,” for more on how eIDAS 2.0 and AMLR fit together.

---

Yes. The final draft provides a basis for assessing gaps and planning changes ahead of AMLR’s July 10, 2027, application date. Keep those plans adaptable while formal adoption proceeds.

Under the EU adoption procedure, the European Commission normally has three months from receiving the draft to decide on adoption. Parliament and the Council then have three months to object, extendable by another three.

The draft proposes entry into force 20 days after publication in the Official Journal, with application six months later. Depending on adoption timing, AMLR could begin applying before the technical standards do.

Yes, where a documented risk assessment supports simplified due diligence. A single customer or product characteristic does not automatically establish eligibility.

Under AMLA’s proposed requirements, firms would still collect and verify all names, date and place of birth, and nationalities or the relevant statelessness, refugee, or subsidiary protection status. For individuals, the reduced dataset can omit the national identification number, address, and tax identification number.

Updates can be phased according to customer risk. Under the draft transition rules, the maximum periods are one year for higher-risk customers and five years for others, measured from the RTS entering into force.

Changes in a customer’s circumstances or risk can require earlier action, so start by identifying which files need attention first.

The deadline is December 2027 for covered private-sector businesses required by law or contract to use strong user authentication for online identification. Under the eIDAS acceptance obligation, businesses within scope must accept compliant EUDI wallets when users voluntarily request it. This particular obligation excludes microenterprises and small enterprises.

Because AMLR applies earlier, from July 10, 2027, your implementation plan needs to account for both dates.