AMLR

The AMLR (Anti-Money Laundering Regulation) is Regulation (EU) 2024/1624, which sets the anti-money laundering rules that companies follow across the EU from July 10, 2027. It is one of three acts of the EU anti-money laundering package adopted on May 31, 2024. Directive (EU) 2024/1640 covers what Member States must put in place, such as supervisors, financial intelligence units and beneficial ownership registers. Regulation (EU) 2024/1620 sets up the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). Because the AMLR is a regulation, its customer due diligence rules apply as written in every Member State, without a national act that implements them.

The regulation calls the companies it covers obliged entities (Article 3). Credit institutions and financial institutions are on that list, and the definition of a financial institution includes a creditor under the consumer credit directive 2008/48/EC and the mortgage credit directive 2014/17/EU (Article 2(1), point (6)(g)). A consumer lender is therefore an obliged entity, whether it is a bank or a non-bank loan company. A credit intermediary is covered when it holds customer funds in connection with the credit agreement, unless it acts under the responsibility of a creditor (point (6)(h)).

Customer due diligence applies in the situations listed in Article 19(1), for example when a business relationship is established, when there is a suspicion of money laundering or terrorist financing, and when there are doubts about previously obtained identification data. A loan agreement starts a business relationship, so the checks happen at onboarding.

Article 20(1) lists the measures an obliged entity applies. Among them are identifying and verifying the customer, identifying the beneficial owner, understanding the purpose of the relationship, checking targeted financial sanctions, checking whether the customer is a politically exposed person, and ongoing monitoring. The extent of each measure depends on the risk of the customer and the relationship (Article 20(2)).

For a natural person, Article 22(1) names the minimum data: all names and surnames, place and full date of birth, nationalities and the national identification number where applicable, and the usual place of residence. Article 22(6) then allows two ways to verify identity. The first is an identity document, passport or equivalent, where relevant with information from reliable and independent sources. The second is electronic identification at assurance level "substantial" or "high" under the eIDAS Regulation (EU) No 910/2014, together with relevant qualified trust services. The KYC entry covers that check in more detail.

Verification takes place before the business relationship starts (Article 23(1)), with limited exceptions where the risk is lower. When the checks cannot be completed, the obliged entity must not establish the relationship, and it keeps a record of that decision too (Article 21(1) and (3)). Customer data has to be kept up to date, at least once a year for higher-risk customers and at least every five years for the others (Article 26(2)). Documents and information from due diligence, including those obtained through electronic identification, are kept for five years from the end of the relationship or from the refusal to enter into one (Article 77(3)).

In a lending app or a borrower portal, customer due diligence runs inside the application flow. Requirements for the system:

• The form collects the Article 22(1) data. Check that the application asks for every field the lender needs for identification, including place of birth and nationality, and that the backend stores them in a structured way.
• Identity verification offers the Article 22(6) routes. A document check and an electronic identity are two methods with different integrations, so keep the list and the order of methods in backend configuration.
• The agreement waits for verification. The application cannot move to the agreement while verification is pending or has failed, and a refusal is stored with its reason.
• Sanctions and politically exposed person checks run as their own steps, apart from identity verification. Store when each check ran, on what data and with what result.
• Records are kept for five years. Retention runs from the end of the relationship or from a refusal, so the system needs both dates.
• Data has a review date. Ongoing monitoring needs a field that says when customer data was last confirmed and a way to ask the customer for an update in the app.
• Bank account checks stay a separate step. A verification transfer or a bank login through open banking confirms the account and helps against fraud, but neither appears among the means listed in Article 22(6).

AMLA has its seat in Frankfurt am Main. It writes the regulatory technical standards that fill in the AMLR. Under Article 28(1), the standards on customer due diligence specify what information to collect at each level of due diligence (standard, simplified, enhanced). They also name the reliable and independent sources for verification and the attributes that electronic identification means must have. On October 1, 2026 AMLA announced that the final draft of these standards had been submitted to the European Commission. They become binding only after the Commission adopts them and they are published in the Official Journal, and AMLA proposes that they apply six months after entry into force.

AMLA will also supervise some institutions directly. Under Article 13 of Regulation (EU) 2024/1620 it selects credit and financial institutions with a high residual risk profile that operate in at least six Member States, starts the first selection by July 1, 2027 and begins direct supervision six months after it publishes the list. Other obliged entities stay with national supervisors. The AMLR itself applies from July 10, 2027 (Article 90); only football agents and professional football clubs get a later date, July 10, 2029.

This entry is not legal advice; which duties apply depends on the company's status.

We build the customer side of lending apps for consumer lenders supervised by the Polish Financial Supervision Authority (KNF): the application flow, KYC and integrations with the lender's core system. In those apps, KYC is a separate status in the application, with a document scan done by an external identity verification service. After a negative result the customer can try again. Checks that fail for technical reasons run again automatically, and the app asks for the result again when the customer returns to a pending application. Bank account verification, by bank login or verification transfer, runs as a separate step. We did not build the identity verification service or an AML system, and the lender decides which due diligence measures apply.