What Customer Due Diligence Consists Of Under the EU AML Regulation

You are a compliance officer, and you have to describe your customer due diligence procedure to a supervisor, or audit it against the new EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624. This article answers one question: what, according to the text, does customer due diligence actually consist of, how does risk set its extent, and what has to happen when it cannot be completed? It quotes the Regulation where wording matters, and leaves the detail of remote identification to a separate article.

For information; not legal advice.

Why the text exists

The recitals open the topic with a statement of purpose. Customer due diligence requirements are essential to ensure that obliged entities identify, verify and monitor their business relationships with their clients in relation to the money laundering and terrorist financing risks that those clients pose. Accurate identification and verification of data of prospective and existing customers are essential for understanding the risks associated with clients, whether natural or legal persons.

The Regulation also states why it lays down detailed rules: the earlier directive harmonised customer identification obligations to a degree, but did not lay down detailed rules on the procedures to be followed, and in view of the crucial importance of that aspect the Regulation introduces more specific and detailed provisions on identification and verification.

The measures in Article 20

Article 20(1) lists the measures that obliged entities "shall apply" for the purpose of customer due diligence. In summary form, and following the order of the text:

identifying the customer and verifying the customer's identity;
identifying the beneficial owners and taking reasonable measures to verify their identity, so that the entity is satisfied that it knows who the beneficial owner is and understands the ownership and control structure of the customer;
assessing and, as appropriate, obtaining information on the purpose and intended nature of the business relationship or the occasional transactions;
verifying whether the customer or the beneficial owners are subject to targeted financial sanctions, including whether persons subject to such sanctions control a legal entity or have more than 50 % of its proprietary rights or a majority interest in it;
assessing and, as appropriate, obtaining information on the nature of the customer's business, or of their employment or occupation;
conducting ongoing monitoring of the business relationship, including scrutiny of transactions to ensure they are consistent with the entity's knowledge of the customer, the business and risk profile, including where necessary the source of funds;
determining whether the customer, the beneficial owner and, where relevant, the person on whose behalf a transaction is carried out is a politically exposed person, a family member or a person known to be a close associate;
identifying and verifying the identity of natural persons other than the customer on whose behalf or for whose benefit a transaction or activity is conducted;
verifying that any person purporting to act on behalf of the customer is so authorised, and identifying and verifying their identity.

Nine measures, then, and only the first is about the identity document. The others concern ownership, purpose, sanctions, the nature of the business, monitoring, political exposure and representation. A procedure that ends after the identity check is not a procedure for these measures.

Risk sets the extent

Article 20(2) says that obliged entities determine the extent of the measures "on the basis of an individual analysis of the risks of money laundering and terrorist financing", having regard to the specific characteristics of the client and of the relationship or transaction and taking into account the business-wide risk assessment and the variables and factors in the annexes. Where an increased risk is identified, enhanced due diligence applies; where lower risk is identified, simplified due diligence may be applied.

Article 20(3) tasks the Anti-Money Laundering Authority with issuing, by 10 July 2026, guidelines on the risk variables and risk factors to be taken into account. Article 20(4) closes the loop: obliged entities shall at all times be able to demonstrate to their supervisors that the measures taken are appropriate in view of the identified risks.

For a compliance officer, the last point shapes documentation. It is not enough to apply a measure; the file must show why the extent chosen fitted the risk.

Purpose and intended nature

Article 25 requires that, before entering into a business relationship or performing an occasional transaction, the obliged entity assures itself that it understands its purpose and intended nature. To that end it obtains, where necessary, information on the purpose and economic rationale of the relationship or transaction, the estimated amount of the envisaged activities, the source of funds, the destination of funds, and the business activity or occupation of the customer.

When due diligence cannot be completed

Article 21(1) provides that where an obliged entity is unable to comply with the Article 20(1) measures, it "shall refrain from carrying out a transaction or establishing a business relationship, and shall terminate the business relationship and consider reporting a suspicious transaction to the FIU in relation to the customer". The Article adds that terminating a relationship does not prohibit the receipt of funds due to the obliged entity, and that where an entity has a duty to protect its customer's assets, termination is not to be understood as requiring the disposal of those assets. For life insurance contracts, refraining from performing transactions may be an alternative to terminating.

Article 21(2) disapplies this for certain legal professionals to the extent that they ascertain the legal position of a client or perform the task of defending or representing that client in judicial proceedings, with stated exceptions.

Records

Article 21(3) requires obliged entities to keep a record of the actions taken to comply with the customer due diligence requirements, "including records of the decisions taken and the relevant supporting documents and justifications". The documents, data or information held must be updated whenever the customer due diligence is reviewed, and the record-keeping obligation also applies where the entity refuses to enter into a business relationship, terminates a relationship or applies alternative measures.

Staying current: ongoing monitoring

Article 26 turns the monitoring measure into rules for the life of the relationship. Entities conduct ongoing monitoring of the relationship, including the transactions undertaken, to ensure they are consistent with their knowledge of the customer and risk profile and to detect transactions that need a more thorough assessment. Customer information must be kept up to date, and the period between updates depends on the risk and shall not in any case exceed 1 year for higher-risk customers to which enhanced due diligence applies, and 5 years for all other customers. In addition, entities review and, where relevant, update customer information when there is a change in the relevant circumstances of a customer, when they have a legal obligation in the calendar year to contact the customer to review information on beneficial owners, or when they become aware of a relevant fact that pertains to the customer. The Authority has to issue guidelines on ongoing monitoring by 10 July 2026.

When the rules apply

The Regulation applies from 10 July 2027, with a later date for certain categories of obliged entity listed in the text. Several of the guidelines and technical standards mentioned above are due on or before that date, so a procedure designed now should include a way to take them in. On 9 February 2026 the Anti-Money Laundering Authority announced a public consultation on draft technical standards on customer due diligence, which it describes as building on the framework of the Regulation.

A self-audit list

Does the procedure cover all nine measures, or only identification?
Where is the individual risk analysis recorded, and which factors does it use?
How does the procedure handle the case where a measure cannot be completed: who decides, and who considers the report to the financial intelligence unit?
Does the record show decisions, supporting documents and justifications, including for refusals?
What are the update intervals for higher-risk customers and for all other customers, and what triggers an earlier review?

How NeuroVision fits

NeuroVision KYC gathers the identity part of the process in one session: document, selfie, liveness and face match, with the scenario built in an editor. The dashboard provides a session log, reports and export, manual decision, roles and a user list. International AML screening, with sanctions, politically exposed person and adverse media checks, is available through a licensed data provider.

To talk through your procedure, contact the team.

Sources

All sources were fetched on 27 October 2026.

AMLA consults on key mandates for the private sector and harmonized supervision, Authority for Anti-Money Laundering and Countering the Financing of Terrorism.
Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, Official Journal text, European Union. The text was retrieved from the Publications Office of the European Union.