Simplified due diligence under the AMLR: when low risk really is low
Article 33 AMLR allows simplified measures only after a documented low-risk assessment and never where suspicion exists. What simplified means, which factors count and what the CDD RTS specifies.
21 September 2026. Correction: the RTS on customer due diligence is being finalised after AMLA's consultation (final draft scheduled for the third quarter of 2026); the EBA Risk Factors Guidelines apply until AMLA's successor appears. Statuses and dates in this article were aligned with AMLA's publications (regulatory instruments overview of 4 September 2026, Single Programming Document 2026-2028). AMLA has published no final guideline yet; where an EBA guideline exists on a topic it continues to apply until AMLA replaces it.
The risk-based approach cuts both ways. Higher risk brings enhanced measures; lower risk allows simplified ones. Article 33 of the AMLR keeps that logic but tightens the conditions, and the RTS on customer due diligence, consulted by AMLA until 8 May 2026 and scheduled for a final draft in the third quarter, will specify what simplified measures may consist of.
Conditions
Simplified due diligence is allowed only where the obliged entity has assessed the relationship or transaction as presenting a lower risk, on the basis of the risk factors in the AMLR and its own business-wide risk assessment, and has documented that assessment. It is never allowed where there is suspicion, where the customer is linked to a high-risk third country, or where enhanced measures are mandatory for another reason.
What simplified means
The RTS lists the adjustments: verifying identity after the relationship has started rather than before, reducing the frequency of periodic reviews, reducing the depth of the purpose-and-nature enquiry, and adjusting monitoring thresholds. It does not mean skipping identification, beneficial-owner identification or sanctions screening. Those apply in every case.
Lower-risk factors
The AMLR and the EBA Risk Factors Guidelines, which apply until AMLA's successor guidelines appear, name the usual candidates: public companies subject to disclosure requirements, public administrations, customers resident in lower-risk jurisdictions, products with limited functionality such as low-value e-money or certain insurance products. A factor is a starting point, not a conclusion; the assessment must consider the combination.
Where institutions go wrong
Applying simplified measures to a product category without assessing the customer; keeping a customer in the simplified category after an event that should have triggered a review; and treating "simplified" as "no monitoring".
What to do now
- List the customer segments and products currently under simplified measures and check each against Article 33 and the RTS.
- Record the low-risk assessment per segment with the factors relied on.
- Make sure the event-driven review can lift a customer out of the simplified category.
The dashboard tracks the CDD RTS under Client Acceptance; the readiness tracker has a Simplified Due Diligence block.