# AMLR 2027 and KYC in Lending Apps: How Remote Onboarding Changes Before 10 July 2027 Source: https://ordergroup.co/blog/amlr-kyc-lending-apps/ Last updated: 2026-10-22 > The AMLR applies from 10 July 2027. What it changes in remote identity verification in a lending app, plus a KYC readiness checklist for CTOs. ![AMLR 2027 and KYC in Lending Apps: How Remote Onboarding Changes Before 10 July 2027](https://ordergroup.co/media/images/2361_r16x9.width-2850.format-webp.webp) # AMLR 2027 and KYC in Lending Apps: How Remote Onboarding Changes Before 10 July 2027 [Mateusz Widenka](https://ordergroup.co/experts/mateusz-widenka/), Head of Delivery | October 22, 2026 | 11 min read Table of Contents The brief What is the AMLR and does it apply to lenders? When does the AMLR apply, and what is still missing? How does the AMLR change remote identity verification? What changes in a lending app's onboarding: a checklist for the CTO What KYC flows in lending apps teach us FAQ The brief The AMLR is Regulation (EU) 2024/1624 on preventing money laundering and terrorist financing, applied directly across the EU without a national act. It applies from 10 July 2027 and covers lenders, so it also reaches lending apps, including their remote onboarding. On 1 October 2026 AMLA, the EU Anti-Money Laundering Authority, sent the Commission its final report with draft technical standards on customer due diligence, and from 10 July 2027 the AMLR applies to consumer lenders in the EU. The standards are not in force yet, and the technical details of remote identity verification in a lending app wait for the Commission to adopt them. This article reads the AMLR from the product side and is not legal advice. Which rules apply to you depends on your company's status, so confirm it with your lawyer. For the terms themselves, see the glossary entries on the [AMLR](https://ordergroup.co/glossary/amlr/) and [KYC](https://ordergroup.co/glossary/kyc/). ## What is the AMLR and does it apply to lenders? The AMLR is a regulation, so it applies as written in every member state from 10 July 2027 (Article 90). A later date, 10 July 2029, applies only to the entities named in Article 3(3)(n) and (o). Lenders fall under the main date. Two companion acts complete the EU anti-money laundering package. Directive (EU) 2024/1640 (AMLD6) must be transposed by 10 July 2027. Regulation (EU) 2024/1620 sets up the authority AMLA, which writes the technical standards that fill in the AMLR. Under Article 2(6), a financial institution includes a creditor within the meaning of Directive 2008/48/EC (consumer credit) and Directive 2014/17/EU (mortgage credit), and financial institutions are obliged entities, the companies that have to apply the rules. Credit intermediaries can be covered too, when their activity exposes them to money laundering risk. When an intermediary acts on behalf of a lender, recital 22 places the requirements on the lender. The details differ for a lending institution, a bank and an intermediary. ## When does the AMLR apply, and what is still missing? The date of application is fixed, but the technical standards for remote verification are not final. The status below is as of October 2026 and changes quickly. - **10 July 2027:** the AMLR applies (Article 90) and the transposition deadline for AMLD6 runs out. - **9 February to 8 May 2026:** AMLA consulted on the draft regulatory technical standards (RTS) on customer due diligence (CDD) under Article 28(1) of the AMLR. - **1 October 2026:** AMLA published the final report with the draft RTS (the document is dated 30 September 2026) and sent it to the European Commission for adoption. The standards become binding only after the Commission adopts them and they are published in the Official Journal of the EU. - **After adoption:** under the draft, the RTS enter into force on the 20th day after publication and apply six months later. The draft covers the requirements and information for standard, simplified and enhanced due diligence, the reliable and independent sources for verifying identity, and the attributes of electronic identification means and qualified trust services. The final report keeps the check of the authenticity of identity documents. Recital 8 requires checking that the document is authentic, including that it has not been forged or altered. Article 6(1)(d) requires security features in the document that confirm its authenticity. It also leaves room in sanctions screening. Lists may be checked with automated tools, manual checks or a combination of both, depending on the nature, risk and size of the entity (Article 25(2)(a)). For the team, this means the date is known, while the technical details of remote verification wait for the Commission. Keep the order of verification methods and the risk rules in backend configuration, so a change after the Commission's decision is a configuration change and not a rebuild. ## How does the AMLR change remote identity verification? The AMLR names two ways to verify a customer's identity, and the draft RTS add a fallback for people who cannot use either. Under Article 22(6), identity is verified in one of two ways: - **On the basis of a document:** an identity document, passport or equivalent, where relevant with information from reliable and independent sources. - **With electronic identification:** electronic identification means at assurance level "substantial" or "high" under Regulation (EU) No 910/2014 (eIDAS), together with relevant qualified trust services. Recital 66 adds that obliged entities should accept electronic identification under eIDAS. Where it is not available, verification should rely on the relevant qualified trust services. The draft RTS count an electronic identification means whether or not it was notified, as long as it meets level "substantial" or "high" under Implementing Regulation (EU) 2015/1502. That includes the European Digital Identity Wallets (EUDI Wallet). Poland has a notified electronic identification scheme at levels "substantial" and "high" (notified on 19 April 2023, OJ EU 2023/C 136/02), which is reported to include the Polish government trusted profile and the electronic ID card. ### The fallback in Article 7 of the draft RTS Article 7 of the draft RTS applies when a person cannot reasonably be expected to present a document in person and has no access to electronic identification or qualified trust services under Article 22(6)(b). The obliged entity then verifies identity on the basis of a document using alternative solutions that draw on reliable and independent sources. Five safeguards apply: - the person presenting the document is checked to be its holder; - the communication is protected for integrity and confidentiality; - image, video, sound and data come in a readable format and quality that allow the person to be identified without doubt; - the process stops when there is a technical fault, an unexpected interruption of the connection, or doubt about the identity or the integrity of the process; - the verified data and documents are valid and up to date, and copies are stored with a timestamp, securely and in a form that allows verification after the fact. An entity that uses such a solution must be able to explain why the customer was not verified with the methods of Article 22(6), and to show the supervisor that the solution meets Article 7. Article 7 describes the safeguards and names no specific technique, such as a selfie, liveness detection or video. According to the recitals of the draft, entities can keep using existing remote onboarding tools that meet these requirements. Article 27 adds a step for incomplete identity data: when an electronic identification means or a qualified trust service does not carry every attribute needed, the entity obtains and verifies the missing ones with other means that Article 22(6) allows. The minimum attributes are listed in Annex I. ### Verification transfers and open banking A verification transfer (a small payment that confirms the customer owns the account) and account data obtained through open banking are not listed among the methods of identity verification, in Article 22(6) of the AMLR or in Articles 6 and 7 of the draft RTS. In our reading, they work as supporting signals: they confirm the bank account and help against fraud, and the identity itself is verified with a document or electronic identification. ### Polish lenders and the PESEL register A Polish lender has one more duty next to AML. Under Article 9b of the Consumer Credit Act, in force since 1 June 2024, the lender checks in the register of [restricted PESEL](https://ordergroup.co/glossary/pesel-restriction/) numbers (PESEL is the Polish national ID number) whether the borrower's number is restricted before it concludes the credit or loan agreement. It is a separate step from identity verification and has its own record. ### KYC vs eKYC KYC (know your customer) is the process of confirming a customer's identity at onboarding. eKYC is its digital, remote form. It usually combines a scan of the identity document with biometrics, such as comparing a selfie with the photo in the document, and screening against lists of politically exposed persons (PEP) and sanctions. eKYC is a method of performing KYC and leaves every legal duty in place. ## What changes in a lending app's onboarding: a checklist for the CTO A lending app's onboarding needs a hierarchy of verification methods set in the backend, a log of why the fallback was used, a way to stop and resume a session, a step for completing missing attributes, timestamped copies, and versioned risk rules. The checklist below is made of our engineering recommendations and has no legal force. Verification routes under the AMLR and the draft RTS, and what the app must support | Route | Legal basis | What the app must support | |---|---|---| | Electronic identification, level substantial or high | AMLR Article 22(6)(b) | Integration with the eID scheme, a record of the assurance level | | Qualified trust services | AMLR Article 22(6)(b) | Handling of the trust service result, a step that completes missing attributes (Article 27 of the draft RTS) | | Document verified remotely, with safeguards (fallback) | Article 7 of the draft RTS | Check of the document holder, image quality, a stop on doubt, timestamped copies, a recorded reason for using the fallback | Answer each question with yes or no: - Does the app have a hierarchy of KYC methods (electronic identification first, a remote document check as the fallback) that is configured in the backend? - Does the system record why the fallback was used, meaning why electronic identification was unavailable? Article 7 of the draft RTS requires the entity to be able to justify it to the supervisor. - Does the remote verification stop on a fault, a dropped connection or a doubt, and can it be resumed without losing the application? (Article 7(d) of the draft RTS; see the AvaFin notes below.) - Is there a step that completes the attributes missing from an electronic identification means? (Article 27 of the draft RTS.) - Are copies of documents, images and recordings stored with a timestamp, and can they be reproduced for a check after the fact? (Article 7(e).) - Is the customer risk assessment stored as versioned rules, so you can say which version of a rule produced which result? - Is there an audit trail of which eKYC provider verified what, and when? - Do the verification transfer and the account data serve as fraud signals next to a separate identity verification method? - Can the team change the hierarchy of methods and the rules within days of the Commission adopting the RTS, without a new release in the App Store and Google Play? KYC logic should also stay consistent with the creditworthiness assessment and human intervention under CCD2, which we cover in [CCD2 for Lending Apps](https://ordergroup.co/blog/ccd2-lending-app-loan-application-flow/), and with the logs required by the AI Act, which we cover in EU AI Act and Credit Scoring. ## What KYC flows in lending apps teach us We build lending apps and integrate external verification services. The notes below come from Aasa24, and from AvaFin for the [bank account verification](https://ordergroup.co/glossary/open-banking/) and the order of the application steps. Three things stand out: a clear status for each stage, retries, and a way back into an interrupted process. ![Loan app KYC flow – bank account verification screens on two smartphones](https://ordergroup.co/media/images/avafin_kyc_process_1x_dbKNhTV.width-800.format-webp.webp) **Aasa24** is a lending app with card features that we develop. - The online identity check for a card application runs on several levels: a KYC step with a scan of the identity document that the customer can repeat, PESEL with an SMS code, and a repeated or manual verification in difficult cases. - A customer rejected after three failed KYC attempts can start verification again on a new application. - KYC tasks are retried automatically, and the flag of a verified customer stays saved. - After the customer taps "Next" on a pending application, the app checks the status of the KYC verification. This was added in October 2025. - KYC is also part of the flow after the contract is signed. - After a positive bank account verification through open banking, the card application moves to a separate KYC status. - Releases ship every 3-4 weeks. **AvaFin** is a lending app that we also build. The customer chooses one of two ways to verify the bank account: logging in to online banking, which gives the account history (Kontomatik), or a verification transfer (Autopay). The app monitors the status of the verification and handles a failure or a timeout without dropping the application. A central system sets the order of the application steps, so changing the order or the scope of the steps does not need a new app version. The verification providers in both apps are external and belong to the clients. More of our work in this area is on the [fintech software development](https://ordergroup.co/fintech-software-development/) and [mobile app development](https://ordergroup.co/services/software-development/mobile-apps-development/) pages. ## FAQ ### What is the AMLR? The AMLR is Regulation (EU) 2024/1624 on preventing the use of the financial system for money laundering or terrorist financing. It applies directly in every EU member state from 10 July 2027, without a national act, and sets the customer due diligence rules for obliged entities, including consumer lenders. ### When does the AMLR apply? The AMLR applies from 10 July 2027. AMLA published the final report with the draft technical standards on customer due diligence on 1 October 2026 (the document is dated 30 September) and passed it to the European Commission. Once adopted, the standards apply six months after entry into force. ### Does the AMLR apply to lenders and loan apps? Yes. Under Article 2(6), creditors for consumer credit and mortgage credit are financial institutions, so they are obliged entities. The details depend on the company's status, for example a [loan institution](https://ordergroup.co/glossary/loan-institution/), a bank or an intermediary, so confirm yours with a lawyer. ### What is the difference between KYC and eKYC? KYC is the confirmation of a customer's identity at onboarding. eKYC is its digital, remote version, usually built from a scan of the identity document, biometrics such as a selfie comparison, and screening against PEP and sanctions lists. eKYC is a method of performing KYC and leaves every legal duty in place. ### Is video identification still allowed under the AMLR? The draft RTS, which the Commission has not adopted yet, allow remote verification of a document as a fallback when the customer has no access to electronic identification. Article 7 sets safeguards: checking that the person is the document holder, image and sound quality, stopping on doubt, and timestamped copies. It names no specific technique. ### What is the AMLA RTS on customer due diligence? The RTS are regulatory technical standards under Article 28(1) of the AMLR. They specify what information to collect at each level of due diligence and which sources and electronic identification means count for verifying identity. The final report dated 30 September 2026 now waits for adoption by the European Commission. ### Is a verification transfer enough for KYC under the AMLR? The identity verification methods in the AMLR and the draft RTS are a document, or electronic identification with qualified trust services. A verification transfer is not named among them, so we treat it as a supporting signal that confirms the account and helps against fraud. This is our reading of the texts. ### What changes for KYC in a lending app? A lending app needs a hierarchy of verification methods set in the backend, a log of why the fallback was used, a way to stop and resume a session, a step for completing missing attributes, timestamped copies, and versioned risk rules. The checklist above lists each of these. ### How does the AMLR relate to CCD2 and the AI Act? CCD2 regulates the credit process and consumer rights, and the AI Act covers credit scoring. The AMLR covers the identification and due diligence of the customer. In an app they meet in the application flow, so the three share data and logs. See our articles on [CCD2](https://ordergroup.co/blog/ccd2-lending-app-loan-application-flow/) and the AI Act and credit scoring. Get your KYC and onboarding flow reviewed in a free discovery workshop [Book a free review](https://ordergroup.co/contact-us/?utm_source=blog&utm_medium=referral&utm_campaign=content_marketing) ## Explore this topic further - Service [Mobile Apps](https://ordergroup.co/services/software-development/mobile-apps-development/) - Case study [Monetor - A Web Application for Analysing Business FX Risk](https://ordergroup.co/case-studies/monetor-currency-risk-management-software/) ## Related articles [October 12, 2026 | 13 min read CCD2 for Lending Apps: What Changes in Your Loan Application Flow on 20 November 2026](https://ordergroup.co/blog/ccd2-lending-app-loan-application-flow/) [Software engineering | October 20, 2026 | 8 min read MCP vs API: What We Learned Running an MCP Server in Production](https://ordergroup.co/blog/mcp-vs-api/) [Energy | October 8, 2026 | 10 min read Battery Energy Storage System (BESS): How It Works and What Software It Needs](https://ordergroup.co/blog/battery-energy-storage-system/)