AMLA publishes final draft RTS on CDD, occasional transactions and groups

On 1 October 2026 AMLA announced that it has finalised the three regulatory technical standards that matter most to the day-to-day work of obliged entities: the RTS on customer due diligence under Article 28(1) AMLR, the RTS on business relationships, occasional and linked transactions and lower CDD thresholds, and the RTS on group-wide minimum requirements and additional measures for branches and subsidiaries in third countries. On the same day it published the final report on the RTS on home and host supervisory cooperation under Article 46(4) AMLD6. The press release is at amla.europa.eu, with the supervisory cooperation release here. Two days later AMLA invited sector representatives to roundtables on simplified customer due diligence. This article sets out what was published, what moved between consultation and final report, and what an obliged entity should do with it in the nine months that remain before 10 July 2027.

What exactly was published

AMLA's wording is "finalises", and the final reports do close AMLA's part of the process. Legally, however, these are final draft RTS. They have been submitted to the European Commission, which must adopt them as delegated regulations under Article 49 AMLAR, after which the European Parliament and the Council have a scrutiny period and the texts are published in the Official Journal. Only then do they bind anyone. In the AMLR Monitor tracker these three RTS were still 'Consultation closed, being finalised' as of 22 September; with the final reports out, they move to 'Final text, awaiting publication', the same status as the RTS on sanctions and the ITS on cooperation for direct supervision.

The three private-sector instruments are:

RTS on customer due diligence (Article 28(1) AMLR): the information to collect and verify on customers and beneficial owners, the reliable and independent sources, non-face-to-face verification and electronic identification, the simplified measures for lower-risk situations, enhanced measures, and screening against PEP, family member and close associate status. The consultation ran from 9 February to 8 May 2026 and drew 325 responses.
RTS on business relationships, occasional and linked transactions and lower thresholds (Article 19 AMLR): when a contact becomes a business relationship, when transactions are occasional or linked, and which lower thresholds below the EUR 10 000 default trigger CDD in higher-risk sectors and products. Consulted in the same window as the CDD RTS.
RTS on group-wide requirements (Articles 16(4) and 17(3) AMLR): the minimum content of group-wide policies, procedures and controls, governance and risk management, secure information sharing inside the group, and the additional measures where a third country does not allow the group standard to be applied. Consulted from 16 April to 15 June 2026.

The fourth text, the RTS on home and host supervisors, is addressed to supervisors rather than obliged entities. It sets a baseline for information exchange on request and on the supervisors' own initiative, cross-border supervisory inquiries and coordinated or joint supervisory activities for cross-border groups. AMLA notes that supervisors should check information already available before requesting it, and that it is developing a common supervisory methodology with Member States alongside the RTS.

What changed in the CDD RTS since the consultation

The consultation paper was criticised, among others by the accountancy and tax adviser bodies, for rigid information lists, a preference for automated screening tools and provisions that merely repeated the AMLR. Based on the final report and AMLA's accompanying factsheet, the main movements are:

Shorter and more flexible text. The draft went from 33 to 29 articles. Several lists that required at least one of the listed items to be collected, for example on the purpose and intended nature of the business relationship and on enhanced due diligence, are now illustrative. AMLA's factsheet says the purpose-and-nature information is not a checklist and should be collected to the extent the specific risk requires.
Simplified due diligence anchored in Article 1. The scope provision now refers expressly to simplified measures in low-risk situations, in line with Article 28(1)(b) AMLR. What AMLA did not do is grant automatic simplified due diligence to particular sectors; the assessment stays case-by-case under Article 33 AMLR.
Review intervals unchanged. Respondents asked for purely event-driven updates. The final report keeps the periodic updates of Article 26 AMLR: at the latest every five years, and every year for higher-risk customers, with the clock running from the entry into force of the RTS. AMLA could not create exemptions from the Level 1 text.
Sanctions screening. Requests for a generally risk-based approach to screening customers against targeted financial sanctions were rejected. Article 20(1)(d) AMLR makes the check a CDD measure, and the RTS keeps it as such.
Remote verification and eID. The RTS retains the verification route via a notified electronic identification scheme or the EU Digital Identity Wallet at substantial or high assurance level, and allows existing remote onboarding solutions that meet the requirements to continue. The EBA Guidelines on remote customer onboarding (EBA/GL/2022/15) remain in force until replaced.
Application date. The RTS is intended to apply six months after its entry into force. If the Commission adopts and publishes it in the first half of 2027, the standard will not apply before, and may apply after, 10 July 2027. Until it does, the AMLR itself applies from 10 July 2027 without the detailed specification.

AMLA has also, according to trade press reporting of the final report, declined to rewrite the definition of occasional transactions in the Article 19 RTS. Obliged entities that hoped for a looser linked-transactions test should plan on the consulted approach.

What the group-wide RTS means for cross-border groups

For a parent undertaking the RTS defines the floor of what the group programme under Article 16 AMLR must contain: a group-level business-wide risk assessment, common policies on CDD, record-keeping and reporting, a group compliance function with clear reporting lines, and secure channels for sharing customer and suspicion-related information between group entities for AML/CFT purposes, within the limits of Article 16(2) and (3) AMLR and data-protection law. Where the law of a third country blocks the group standard, Article 17 AMLR requires additional measures; the RTS lists them, and Commission Delegated Regulation (EU) 2019/758 continues to apply until the new RTS enters into application. Groups with branches or subsidiaries outside the EU should map, country by country, where the group standard cannot be applied and which additional measure they will rely on, and document that mapping for the home supervisor.

The roundtables on simplified due diligence

On 3 October AMLA invited obliged entity representatives, trade associations and other representative bodies from the financial and non-financial sectors to express interest in sectoral roundtables on the application of simplified customer due diligence. The roundtables are input to AMLA's future work on simplified measures, not a consultation on a draft; no draft guideline exists yet. According to the invitation and press coverage, expressions of interest are due by 18 October 2026 and sessions are planned for November and December. Associations that argued for sector-level simplification during the CDD consultation should use this channel, because the RTS did not deliver it.

What this means for obliged entities

The practical consequence is that the content of the EU's CDD rulebook is now known with a high degree of certainty. The Commission can still amend a draft RTS, but in the financial-sector RTS adopted so far changes at that stage have been limited. Programme managers can therefore stop treating the CDD, thresholds and group-wide RTS as moving targets and start building against the final reports. Three uncertainties remain: the exact date of application (six months after entry into force), any adjustments the Commission makes, and the guidelines that will sit on top of the RTS, in particular the AMLA Risk Factor Guidelines (status: 'EBA guideline in force, AMLA successor pending', consultation scheduled for Q3 2026, not yet published) and the ongoing monitoring guidelines ('Consultation closed, being finalised').

What to do now

Download the three final reports and the home-host final report from the AMLA document library and replace the February and April consultation drafts in your gap analysis.
Re-run the CDD data-model review against the final Article 28(1) text: which attributes are mandatory, which are risk-dependent, and where your onboarding forms over-collect or under-collect.
Confirm the periodic review cycle in your customer lifecycle tooling: five years standard, one year for higher-risk customers, event-driven triggers in between, with the start date linked to the RTS's entry into force.
Check your remote onboarding stack against the eID and wallet routes and document why existing solutions meet the RTS requirements.
For the Article 19 RTS, test your definitions of business relationship, occasional transaction and linked transactions against the final criteria and recalculate which products fall under lower thresholds.
For groups, prepare the third-country mapping under Article 17 AMLR and align group information-sharing agreements with the RTS.
Decide whether your trade association should register for the SDD roundtables before 18 October 2026.
Keep sanctions screening in the CDD workflow; do not design a risk-based opt-out.

The AMLR Monitor dashboard tracks the status of each of these RTS, including Commission adoption and Official Journal publication, alongside the guidelines that will complete the picture.