What AMLR Means For Your Existing Customer Book

Written by:
Isabel Hildebrandt | EMEA Regulatory Consultant, Trulioo

1. Risk sets your deadline. AMLR does not require you to remediate your existing customers all at once and immediately, instead it sets out one year for higher-risk customers, and 5 years for all other customers

2. You don’t have to redo every file. Check the details you hold, how you verified them and who owns your business customers, then fix only what falls short.

3. Start sorting now. A risk sort and a gap analysis before the RTS entry-into-force date lands mean you won’t be starting from scratch.

As organizations prepare for the EU’s Anti-Money Laundering Regulation (AMLR) to take effect on July 10, 2027, most of the focus has been on reworking verification flows for new customers. That makes sense, since changing your onboarding flow is complex and takes a lot of planning. But have you started thinking about how to bring your existing customers up to standard?

Most firms today have a customer book built under national rules, and many of those customers were checked against fewer details than this single EU-wide regulation requires, using methods that may no longer be permitted under AMLR. 

The Commission tasked the new EU-AML supervisory body Anti-Money Laundering Authority (AMLA) with writing Regulatory Technical Standards (RTS) on Customer Due Diligence (CDD) that clarify further how businesses should verify idividuals and businesses, handle low and high-risk accounts, including a plan to transition into the new single rulebook. 

To help you stay compliant, our team did a careful read of the final report— and in particular of Article 28 (transitional provisions). Below, we’ve shared our interpretation and what it means for compliance teams and operational planning.

The final draft RTS are like an instruction manual for operationalizing the regulation in regard to CDD. Alongside the CDD RTS, AMLA has also drafted guidelines on ongoing monitoring as requested through AMLR Art.26(5). These set out its proposed approach to keeping customer information up to date, including when to update identity documents and which information sources you can use.

As we walk through what this means, we follow different breadcrumbs to piece together what we know—and what we don’t know (yet). 

Here is the wording from the final draft RTS, Article 28 (Transitional provisions), as published in AMLA’s final report on September 30, 2026. “This Regulation” means the RTS.

In the case of existing business relationships established before the date of entry into force of this Regulation, the documents, data and information relating to those customers shall be brought in line with the requirements of this Regulation and Regulation (EU) 2024/1624 on a risk-sensitive basis within the periods set out in Article 26(2) of Regulation (EU) 2024/1624.

The RTS provide firms with a timeline by when their existing customer files (both people and businesses) have to meet the AMLR verification requirements. Rather than an ad-hoc remediation exercise involving all existing customers, the final RTS refer to the time frames set out for ongoing monitoring in the AMLR in Article 26(2): 

• One year for higher-risk customers 
• Five years for everyone else

But who are higher risk customers under AMLR? Article 26(2)(a) helps us out, as it includes “higher-risk customers to which measures under Section 4 of this Chapter apply.” In other words: those who are subject to Enhanced Due Diligence (EDD). 

Under AMLR, there are various factors that call for EDD, including links to high-risk jurisdictions, cross-border correspondent relationships, or a specific customer type such as politically exposed persons (PEPs).

Also consider customers you identified as higher risk through your internal customer risk assessment (CRA). You may need to add those customers to the one-year bucket as increased risk typically calls for EDD measures.

Here’s something else to keep an eye on: AMLA is working on guidelines on money laundering and terrorist financing risk factors, as required under AMLR Article 20(3). They will replace the European Banking Authority’s (EBA) current risk factor guidelines.

The AMLA guidelines will cover two things:

• which risk factors you need to consider before taking on a customer or carrying out a one-off transaction
• how much weight each factor should carry in your CRA

According to AMLA, the consultation was originally planned for Q3 2026, and the final report is expected by the end of the year. That looks unlikely, because no formal consultation paper has been released yet. Keep an eye on it, so your CRA stays in step with the AMLR once the guidelines land.

Here are some practical steps of what you can do right now:

• Compare what you verify today with the data sets the AMLR requires for individuals, businesses and beneficial owners.
• Review your sources of information used to verify your customers. Check whether documents have expired and need re-collecting. And check whether the eID schemes and data sources you allow today meet the AMLR. 
• Review your current business and beneficial ownership verification process to see where you may need to dedicate resources on mapping and documenting the ownership structure of your business customers. 
• Review how you identify beneficial owners today to spot gaps against AMLR’s requirement to assess both beneficial ownership through ownership interest and control.

There are still a few practical questions to work through. The final draft RTS requires existing customer files to meet the new standards, but they do not expressly settle when a customer originally verified through a method outside AMLR’s permitted routes must undergo fresh identity verification. 

Some missing details can be obtained and verified through reliable, independent sources without asking the customer to provide them. Filling those gaps does not, by itself, resolve any shortcomings in the original verification. 

For now, differentiate missing information from potentially inadequate verification, assess when you need customer input, and document the basis for your approach. Keep those decisions under review while the RTS and AMLA’s ongoing monitoring guidelines are finalized.

Once you’ve sorted your book and found the gaps, the next problem is volume. Working through thousands of existing files by hand isn’t realistic inside a one-year or five-year window, so it helps to build a routine you can repeat. 

With Trulioo’s Adaptive Identity Verification you can configure the same routes you’d use for new customers, including the fallback from eID to document verification and supplementary data checks for missing attributes, with little or no code, and apply them to your existing customers segment by segment. 

Start with a small group, test the route, and phase in more of your book as you go. Each result shows the method used, its outcome, and any supplementary checks, so you keep a record of how every file was brought up to standard. Data checks can fill in missing information, but whether a file also needs fresh verification is a call for your team to make and document.

See how Trulioo’s Adaptive Identity Verification fills the data gaps eID and documents leave behind, so you can prepare for new requirements while keeping customers moving seamlessly.