AML and KYC Glossary | Due diligence, beneficial owners and remote identification under the AMLR

For related terms across Authologic's glossaries, see the Digital Identity Glossary. EUDI Wallet and eIDAS 2.0 terms are defined in the 4 parts of the EUDI Wallet & eIDAS 2.0 Glossary, and terms for multi-method verification in the Identity Orchestration Glossary. This glossary sits outside the EUDI series, next to the orchestration glossary.

What is KYC, and how does it differ from customer due diligence (CDD)?

In practice: KYC can refer narrowly to identity checks at onboarding but is also used more broadly for screening, risk assessment and ongoing checks. The AMLR does not use the term KYC. Article 20(1) lists 9 customer due diligence measures, starting with identifying and verifying the customer. CDD also covers beneficial owners, the purpose of the relationship, targeted financial sanctions, PEP checks and ongoing monitoring.

Who this applies to: Anyone comparing identity verification providers or reading AML rules, where both terms appear side by side.

Legal basis: Regulation (EU) 2024/1624 (AMLR), Article 20.

What is an obliged entity under the AMLR?

In practice: Financial institutions include payment institutions, electronic money institutions and crypto-asset service providers. The non-financial list includes, among others, auditors and accountants, notaries and lawyers when carrying out specified activities, estate agents, providers of gambling services and crowdfunding service providers. Obliged entity status is what triggers the AMLR duties. A business outside the list may still verify identity, for example for age checks or fraud prevention, but it does so under other rules.

Related: Which rules govern CASP authentication and KYC?

Who this applies to: Any business checking whether the AMLR applies to it, especially in gambling, crypto and payments.

Legal basis: AMLR, Article 3; definitions in Article 2(1).

What is the risk-based approach in AML?

In practice: As a rule, the approach starts with a business-wide risk assessment under Article 10 of the AMLR: the obliged entity assesses its money laundering and terrorist financing risks, and the risks of non-implementation and evasion of targeted financial sanctions. The assessment is documented, kept up to date and made available to supervisors on request, subject to the limited supervisory exemption in Article 10(3). At customer level, Article 20(2) requires the extent of customer due diligence to follow an individual analysis of risk: increased risk leads to enhanced due diligence, lower risk may allow simplified due diligence.

Who this applies to: Compliance teams designing onboarding flows and risk models.

Legal basis: AMLR, Article 10, Article 20(2) and Annexes I to III.

What is customer due diligence (CDD)?

In practice: Article 20(1) of the AMLR lists 9 measures. Besides identifying and verifying the customer, they cover beneficial owners, the purpose and intended nature of the business relationship, the nature of the customer's business, sanctions and PEP checks, ongoing monitoring, identifying and verifying natural persons on whose behalf or for whose benefit transactions or activities are carried out, and checking the identity and authorisation of persons acting for the customer.

CDD is required when establishing a business relationship and in other circumstances listed in Article 19, including occasional transactions of at least EUR 10,000 (whether single or linked), specified legal-entity or legal-arrangement transactions, suspicion of money laundering or terrorist financing, and doubts about identification data or whether a person is authorised to act for the customer. Specific lower thresholds also apply to certain fund transfers (EUR 1,000), occasional crypto-asset transactions (EUR 1,000) and gambling transactions when winnings are collected or stakes wagered (EUR 2,000). For occasional crypto-asset transactions below EUR 1,000, and certain occasional cash transactions of at least EUR 3,000, at least customer identification and verification are required, subject to the applicable conditions and exceptions in Article 19.

For natural persons, Article 22(1) lists the data to obtain. How to match that data with verification methods is explained in How do you choose identity verification methods for each country?

Who this applies to: Every obliged entity, at onboarding and throughout the business relationship.

Legal basis: AMLR, Articles 19, 20 and 22.

What is simplified due diligence (SDD)?

In practice: Article 33 of the AMLR allows adjustments to customer due diligence measures, based on the risk factors in Annexes II and III. An obliged entity may, for example, update customer information less often, collect less information on the purpose of the relationship or scrutinise transactions less closely. Verification of the customer and the beneficial owner may take place after the relationship starts, where the specific lower risk justifies it, but no later than 60 days after the relationship is established. Where verification is deferred, risk-management procedures must govern any services or transactions permitted before verification is completed. Simplified due diligence keeps monitoring in place: the entity must still monitor enough to detect unusual or suspicious transactions. SDD must not be used where its conditions cease to be met or where relevant suspicions arise, including suspected sanctions evasion.

Who this applies to: Obliged entities with documented low-risk products or customer segments.

Legal basis: AMLR, Article 33 and Annexes II and III.

What is enhanced due diligence (EDD)?

In practice: Article 34 of the AMLR requires enhanced due diligence in the cases it lists, including high-risk third countries and politically exposed persons, and in any other higher-risk case the obliged entity identifies. The measures must be proportionate to the risk, for example additional information on the customer and the beneficial owners, senior management approval for the business relationship and more frequent monitoring.

Who this applies to: Obliged entities onboarding higher-risk customers, such as politically exposed persons or customers linked to high-risk third countries.

Legal basis: AMLR, Article 34, with Articles 29 to 31 and 36 to 46.

What is a politically exposed person (PEP)?

In practice: Article 20(1)(g) requires checking whether the customer, its beneficial owner or, where relevant, a person on whose behalf or for whose benefit a transaction or activity is carried out is a PEP, a family member or a known close associate. For transactions or relationships involving PEPs, Article 42 requires senior management approval for occasional transactions or for establishing or continuing a business relationship, adequate measures to establish the source of wealth and source of funds, and enhanced ongoing monitoring of business relationships. When a person ceases to hold a prominent public function, Article 45 requires risk-sensitive measures for at least 12 months, and longer while the risk persists.

Who this applies to: Every obliged entity, at onboarding and during ongoing monitoring.

Legal basis: AMLR, Article 2(1), points 34 to 36, and Articles 42 to 46.

What is a beneficial owner (UBO)?

In practice: Under Article 52 of the AMLR, beneficial ownership through an ownership interest means direct or indirect ownership of 25% or more of a corporate entity's shares, voting rights or other ownership interests. A person may also qualify through control by other means under Article 53. For express trusts, Article 58 instead identifies settlors, trustees, any protectors, beneficiaries (subject to Articles 59 and 60) and other natural persons exercising ultimate control. Article 52(2) provides for possible lower ownership thresholds for specified higher-risk categories of corporate entities through future delegated acts; these do not apply automatically. CDD requires identifying the beneficial owners and taking reasonable measures to verify their identity.

Who this applies to: Obliged entities with business customers, and anyone building KYB processes.

Legal basis: AMLR, Article 2(1), point 28, Article 20(1)(b), Articles 51 to 53 and 58 to 60.

What is KYB (know your business)?

In practice: Like KYC, KYB is a market term that does not appear in the AMLR. For a legal entity, Article 22(1)(b) lists the data to obtain, including its legal form and name, registered office, legal representatives and, where available, registration number. KYB also covers identifying the beneficial owners, understanding the customer's business and verifying that the persons acting for the company are authorised.

Who this applies to: Obliged entities serving companies, such as banks, payment institutions and crypto-asset service providers.

Legal basis: AMLR, Article 20(1)(a), (b), (e) and (i), and Article 22(1)(b).

What is sanctions screening?

In practice: Article 20(1)(d) of the AMLR covers checks of customers and beneficial owners and, for a customer or a party to a legal arrangement that is a legal entity, whether sanctioned persons control it or hold more than 50% of its proprietary rights or a majority interest, individually or collectively. Screening forms part of CDD and must be repeated as required by Article 26(4), with frequency reflecting sanctions evasion or non-implementation risks. Credit and financial institutions must also recheck when new designations are made. Article 10 requires an assessment of those risks at business-wide level.

Who this applies to: Every obliged entity, at onboarding and throughout the business relationship.

Legal basis: AMLR, Article 2(1), point 49, Article 10, Article 20(1)(d) and Article 26(4).

What is ongoing monitoring?

In practice: Article 26 of the AMLR limits the interval between customer information updates to 1 year for higher-risk customers subject to enhanced due diligence and 5 years for other customers. Information must also be reviewed when the customer's relevant circumstances change or when the obliged entity becomes aware of a relevant fact about the customer. AMLA’s consultation on draft ongoing-monitoring guidelines closed on 3 September 2026.

Who this applies to: Every obliged entity with existing customers, especially those conducting periodic customer information reviews.

Legal basis: AMLR, Article 26.

What is remote identification under the AMLR?

In practice: Article 22(6) provides for (a) submitting an identity document, passport or equivalent and, where relevant, obtaining information from reliable and independent sources, or (b) using eIDAS-compliant electronic identification means at assurance level substantial or high and relevant qualified trust services as set out in eIDAS. The European Digital Identity Wallet (EUDI Wallet) may serve as an electronic identification means where the applicable requirements are met. The AMLR generally applies from 10 July 2027.

AMLA's draft CDD RTS, submitted to the European Commission on 1 October 2026, would allow alternative remote document-based verification only where a natural person cannot reasonably be expected to present an identity document face to face and has access to neither qualifying electronic identification means nor relevant qualified trust services. Such alternatives must use reliable and independent information sources and meet safeguards for matching the person to the document, secure communications, data quality and securely retained, time-stamped records. The obliged entity must be able to justify why standard methods were unavailable and demonstrate compliance to its supervisor. This remains a draft, not binding law. The Commission may amend it; if adopted unchanged, it would generally apply 6 months after its entry into force. What the draft changes is explained in How to verify customers remotely under AMLR.

Related: What is a level of assurance under eIDAS?

Who this applies to: Obliged entities onboarding customers online.

Legal basis: AMLR, Article 22(6) and Article 28(1); Regulation (EU) No 910/2014 (eIDAS), Articles 5a and 8.

What is AMLA?

In practice: AMLA is expected to begin direct supervision in 2028, with up to 40 credit and financial institutions or groups selected in its first round. Under regular selection, entities must have high residual ML/TF risk and operate in at least 6 Member States. The process begins by 1 July 2027. AMLA also drafts technical standards and guidelines under the AMLR, including the draft regulatory technical standards on customer due diligence, which it submitted to the European Commission on 1 October 2026. Obliged entities outside direct supervision remain supervised nationally.

Who this applies to: Banks, payment and e-money institutions and crypto-asset service providers operating across several Member States; all obliged entities through AMLA's standards and guidelines.

Legal basis: Regulation (EU) 2024/1620 (AMLA Regulation).

What is open banking?

In practice: In the EU, PSD2 regulates, among other services, account information services (AIS) and payment initiation services (PIS). An AIS provides consolidated information about one or more payment accounts held with other payment service providers. An AIS provider accesses account data with the user’s explicit consent but cannot initiate payments by virtue of providing AIS. Providers offering only AIS are registered under Article 33 PSD2; institutions offering other payment services may require full authorisation. A PIS provider can initiate a payment at the user’s request. Account-servicing payment service providers must allow access to eligible online payment accounts, subject to strong customer authentication requirements and applicable exemptions. The Payment Services Regulation (PSR) remains in the legislative process and is not yet applicable.

Who this applies to: Payment service providers, banks and businesses that use bank account data in onboarding.

Legal basis: Directive (EU) 2015/2366 (PSD2), Article 4, points 15 and 16, and Articles 33, 66, 67 and 97; Commission Delegated Regulation (EU) 2018/389.

How is open banking used in identity verification?

In practice: A bank may authenticate access to an account, but authentication is not by itself proof that the person’s identity has been verified for the relying business’s AMLR purposes. Depending on the bank and interface, available data may include account identifiers and some account-holder information, but not necessarily all CDD identification attributes. Open banking differs from bank-issued electronic identification (bank ID), which can constitute a separate identification method where the applicable requirements are met.

The AMLR does not recognise an AIS login as a standalone identity-verification route. Under Article 22(6)(a), bank-originated account data may, where relevant, supplement an identity document as information from a reliable and independent source, provided its provenance and reliability are properly assessed. Its use must also comply with PSD2 and applicable data-protection law. Authentication to a bank account alone does not satisfy AMLR identity verification.

Who this applies to: Obliged entities considering bank-account information as supporting evidence in an online identity-verification process.

Legal basis: PSD2, Article 67; AMLR, Article 22(6).

The glossaries so far.

How do these concepts fit together?

Customer due diligence is required in the circumstances set out in Article 19 of the AMLR, including the establishment of a business relationship. Its extent follows a risk-based approach, subject to mandatory safeguards: simplified due diligence may apply at low risk, while enhanced due diligence is required for higher risk. It covers customers, beneficial owners, sanctions and PEP checks, and ongoing monitoring of business relationships.

These concepts are AML vocabulary. The regulatory vocabulary of the EUDI Wallet - relying parties, PID, verifiers, attestations, assurance levels and signatures - lives in the EUDI Wallet & eIDAS 2.0 Glossary, part 1, part 2, part 3 and part 4, and the vocabulary of multi-method verification in the Identity Orchestration Glossary. All of it is indexed in the Digital Identity Glossary.

CDD and digital identity meet in remote verification. The AMLR recognises qualifying electronic identification and trust services; open banking may add supporting account data but is not a standalone AMLR identity-verification method. Authologic, which builds eID-native identity infrastructure for regulated businesses, connects these methods through one API. See Best AML and KYC identity verification platforms and Are you ready for July 2027? A 32-question SCA & AMLR readiness checklist.