Customer Due Diligence: One rulebook, many interpretations

The new EU customer due diligence framework will require significant changes to data, processes and technology. But it also gives obliged entities an opportunity to build CDD models that are more consistent, proportionate and effective.
 

Customer due diligence (CDD) is where the EU’s new anti-money laundering framework will be felt most directly and where institutions must avoid reproducing today’s fragmented CDD models under tomorrow’s rules.

The AMLR establishes directly applicable requirements across the EU, while the final draft RTS published by AMLA on 1 October 2026, detail the information to be collected and verified. They also address simplified measures in lower-risk situations, reliable and independent information sources, non-face-to-face verification, electronic identification and the screening of politically exposed persons.

This is a significant implementation challenge, but it is not simply a compliance exercise.

For many obliged entities, it is an opportunity to reassess CDD models built incrementally through regulatory change, local requirements and internal policy decisions, often resulting in repeated data requests, fragmented systems, recurring remediation and controls insufficiently differentiated by risk.

The priority is therefore not only to comply, but to build a CDD framework that is more effective, sustainable and easier to operate.

The RTS creates a more consistent baseline for the information that obliged entities must collect and verify, which is particularly important for institutions operating across EU jurisdictions where requirements and supervisory expectations have differed. The baseline is also broader: it includes data that many institutions do not hold in structured form, such as all nationalities of a customer, their relevant protection status and, where one exists, the national identification number. The operational impact nevertheless extends well beyond adding fields to a KYC form.

Institutions must determine where each data item is held, whether its quality is sufficient and how it will be maintained throughout the relationship. They must also assess when reliable and independent sources can replace repeated customer requests.

This raises practical questions:

• Which data should come directly from customers, and which can be obtained or verified through reliable external sources?
• When can information already held within the institution or its group be reused?
• How should the provenance, reliability and verification date of each data item be evidenced?

These choices directly affect customer journeys, data architecture, sourcing, operating models and first and second-line controls.

A field-by-field gap analysis will identify missing information, but institutions also need to trace the full data lifecycle, from collection and verification to storage, use and refresh.

The framework also creates an opportunity to automate CDD but not by transferring a manual questionnaire into a digital interface.

Proportionality should shape not only the customer’s overall risk rating, but also the information collected, how it is verified, the frequency and depth of reviews, and the governance of exceptions.
Product characteristics, permitted transactions, distribution channel, geographic exposure and preventive controls can all affect the required intensity of CDD.
For example, products with limited functionality, restricted payment flows or no facility for cash or value accumulation present different risks from general-purpose transactional accounts. The framework should recognise those differences while remaining consistent with legal requirements and the institution’s business-wide risk assessment.

Where the answer is unclear, institutions should assess whether the measure is required, can be better targeted or can achieve the same objective through a more reliable and efficient control.

Greater harmonisation will not remove the need for judgement.

Institutions must still determine when a change is material, how far to rely on previously verified information and what evidence complex ownership structures require.

That is inherent in a genuinely risk-based framework, which cannot prescribe every operational decision.

Material judgements must therefore be consistent, evidence-based and explainable, supported by clear methodologies, decision rights, quality assurance and documented rationales.

Implementation programmes should retain flexibility. The final draft RTS have been submitted to the European Commission and may change before adoption and publication in the Official Journal; AMLA proposes application six months after entry into force.

That uncertainty should be managed, not used to delay progress. Institutions can already map customer data and sources, identify gaps and assess where automation improves effectiveness and customer experience.

The new requirements will reshape CDD data, journeys, processes, technology and controls.

Institutions should resist reproducing today’s CDD model under tomorrow’s rules.

The strategic response is to build a consistent customer data foundation, make effective use of reliable external sources, apply more risk-sensitive controls and use automation to direct expertise towards the judgements that matter.

Success should not be measured by the number of additional data points collected, but by whether each CDD measure serves a clear risk purpose, relies on reliable information and enables action when the customer’s risk meaningfully changes.

The greater opportunity is to orchestrate information from multiple sources and reduce repeated intervention.

For example, identity can be verified through electronic identification means, including European Digital Identity Wallets or qualified trust services. Customer-provided ownership data can be compared with central registers, which the RTS require firms to consult but do not treat as sufficient on their own.

Relevant changes can also trigger timely review.

This supports faster onboarding, fewer repetitive customer requests and greater focus on cases that genuinely require judgement.

However, automation introduces its own design questions:

• Which source should prevail when reliable sources conflict?
• When should an inconsistency trigger a customer request, internal review or escalation?
• How should automated decisions be evidenced and subject to human oversight in higher-risk or complex cases?

The answers depend on the customer, product, channel and institution’s risk appetite. But the direction is clear: future CDD will rely less on static document collection and more on controlled access to reliable, reusable and traceable data.

The framework will also have a significant impact on how customer information is kept up to date.

The current draft requires customer information to be updated at least annually for higher-risk business relationships and at least every five years for other customers. The final draft RTS remain subject to European Commission review and may be amended before adoption, so institutions should not assume a definitive legal starting point for those periods until the final text is settled. Operationally, however, they should begin preparing early to identify and remediate higher-risk customer files.

For large customer populations, these cycles directly affect review volumes, remediation capacity and technology.

Simply adding review capacity is unlikely to provide a sustainable response; institutions should also redesign how reviews are initiated and performed.

A five-year cycle does not leave a low-risk customer untouched: material changes can trigger earlier review. Nor should every review require recollecting information that remains reliable and current.

The design challenge is to make periodic and event-driven reviews work as one control framework.

Institutions should consider:

• which changes in customer data are sufficiently material to trigger a review;
• how screening, transaction and behavioural indicators should interact with KYC processes;
• which information can be confirmed automatically and which requires customer contact;
• how review intensity should vary by customer and product risk.

A well-designed model moves beyond calendar-led reviews: periodic deadlines remain a minimum control point, while meaningful risk changes prompt earlier action.

The final draft RTS emphasise consistency, effectiveness and proportionality, providing clearer expectations while preserving a risk-based approach.

They also provide more flexibility than the consultation draft in some areas: certain mandatory lists are reframed as options, and information on the purpose and intended nature of a relationship is not treated as a uniform checklist.

The task is to make that principle operational.