Talk to usTry the demo

The EU AML Regulation and Remote Customer Identification

Regulation and standards

For: Compliance lead of a firm that onboards customers in the European Union

How the EU AML Regulation sets out identification and verification, including electronic identification, and which details are left to technical standards.

You lead compliance at a firm that onboards customers across the European Union, and you want to know how the new EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, treats identification and verification, including when the customer is not physically present, and which details are still to be set by technical standards. This article quotes the Regulation and the Anti-Money Laundering Authority's own announcements, and states its dates, because part of the picture was still moving when the sources were fetched.

For information; not legal advice.

What the identification article requires

Article 22(1) lists the information that obliged entities shall obtain "at least" in order to identify the customer, any person purporting to act on behalf of the customer, and the natural persons on whose behalf or for the benefit of whom a transaction or activity is conducted. For a natural person this is all names and surnames, place and full date of birth, nationalities (or statelessness and refugee or subsidiary protection status where applicable) and the national identification number where applicable, and the usual place of residence or, where there is no fixed address with legitimate residence in the Union, the postal address at which the person can be reached, together with the tax identification number where available. The paragraph applies, with the exception of lower-risk cases to which simplified measures apply and irrespective of additional measures in higher-risk cases.

Verification is the subject of Article 22(6). Obliged entities shall obtain the information, documents and data necessary for the verification of the identity of the customer and of any person purporting to act on their behalf through either of two means.

  • "the submission of an identity document, passport or equivalent and, where relevant, the acquisition of information from reliable and independent sources, whether accessed directly or provided by the customer";
  • "the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels ‘substantial’ or ‘high’ and relevant qualified trust services as set out in that Regulation".

The first route is document-based and says nothing about the customer's location, which is why remote document capture sits naturally within it. The second route ties verification to the electronic identification framework and to named assurance levels. Beneficial owners are verified under Article 22(7) in accordance with paragraph 6, or by taking reasonable measures to obtain the necessary information from the customer or other reliable sources, including public registers, and by consulting the central registers.

What the recitals say about remote identification

Recital (66) states: "Technological developments and progress in digitalisation enable a secure remote or electronic identification and verification of prospective and existing customers and can facilitate the remote performance of customer due diligence." It adds that the electronic identification as set out in Regulation (EU) No 910/2014 should be taken into account and accepted by obliged entities for the customer identification process, that such means can reduce the risk level, where appropriate risk mitigation measures are in place, to standard or even low, and that where electronic identification is not available to a customer, verification should take place through relevant qualified trust services.

Recitals are an aid to reading and do not carry the force of the articles, so the operative rule is the text of Article 22(6) above.

Timing

Article 23(1) requires verification of the identity of the customer, the beneficial owner and certain other persons to take place before the establishment of a business relationship or the carrying out of an occasional transaction. In lower-risk situations verification can be postponed where the lower risk justifies it. Under Article 23(2), verification may be completed during the establishment of the relationship if necessary so as not to interrupt the normal conduct of business and where there is little risk, and in that case the procedures "shall be completed as soon as practicable after initial contact". Article 23(3) allows credit and financial institutions to open an account provided adequate safeguards ensure that transactions are not carried out until full compliance with the identification and verification measures is obtained.

What the Regulation leaves to technical standards

Article 28 tasks the Anti-Money Laundering Authority with developing draft regulatory technical standards on the information necessary for customer due diligence and submitting them to the Commission by 10 July 2026. Among the matters to be specified are the requirements and the information to be collected for standard, simplified and enhanced due diligence, "the reliable and independent sources of information that may be used to verify the identification data of natural or legal persons for the purposes of Article 22(6) and (7)", and "the list of attributes which electronic identification means and relevant qualified trust services referred to in Article 22(6), point (b), must feature in order to fulfil the requirements of Article 20(1), points (a) and (b)". The requirements are to be based on criteria that include the inherent risk of the service, the risks associated with categories of customers, the nature, amount and recurrence of the transaction, and the channels used for conducting the business relationship or the occasional transaction.

Article 50 adds that by 10 July 2027 the Authority shall issue guidelines on the conditions under which obliged entities may rely on information collected by another obliged entity, "including in the case of remote customer due diligence".

Where the Authority's process stood

The Authority announced on 9 February 2026 that it was consulting on three draft regulatory technical standards, one of which concerns customer due diligence. In its description, the draft builds on the Regulation and sets out how obliged entities verify customer identity and conduct ongoing monitoring in a risk-sensitive and proportionate way. On 26 March 2026 the Authority reported that its first public hearing, held on 24 March 2026, had brought together over 1600 stakeholders. Its afternoon session addressed customer due diligence, covering the information and documents that obliged entities should collect for standard, simplified and enhanced due diligence. Written submissions remained open until 8 May 2026, and the Authority said the input would play an essential role in shaping the final standards.

This article does not describe the content of the draft standards and does not report any step after the dates above. Because the final standards decide the details of Article 28, check the Authority's website for their current status before you design to them.

The assurance levels the Regulation points to

Regulation (EU) No 910/2014 on electronic identification and trust services is the framework behind Article 22(6), point (b). The text retrieved for this article is the version first published in the Official Journal on 28 August 2014; check the current consolidated text before relying on any detail. In that text, Article 8 provides that an electronic identification scheme shall specify assurance levels low, substantial or high. Level low provides a limited degree of confidence in the claimed identity, level substantial a substantial degree, and level high a higher degree of confidence than substantial. The minimum technical specifications are to be set by reference to the reliability and quality of six elements, including the procedure to prove and verify the identity of the applicant, the issuance procedure, the authentication mechanism and the technical and security specifications of the issued means.

Article 24(1) of the same text addresses qualified trust service providers and lets them verify identity remotely using electronic identification means for which a physical presence was ensured before issuance and that meet the requirements of Article 8 for the assurance levels substantial or high.

Questions to ask about your own flow

  1. Which of the two routes in Article 22(6) does each customer journey use, and is the choice recorded?
  2. For the document route, which independent sources are consulted, and how are the results stored?
  3. For the electronic identification route, which assurance levels do the accepted means carry?
  4. Where is verification postponed, under which Article 23 condition, and what stops transactions in the meantime?
  5. Who watches the Authority's technical standards, and how will a change reach your process?

How NeuroVision fits

A NeuroVision KYC session reads the identity document, compares the selfie with the portrait on it and runs the liveness step, all in one session. The document step reads printed and handwritten text and the machine readable zone with its checksum. Face match compares the selfie with the document portrait one-to-one. The liveness step is active: the person moves the face closer through two ovals.

To discuss your onboarding scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us