Are you ready for July 2027? A 32-question SCA & AMLR readiness checklist

What is the SCA & AMLR Readiness Checklist?

The checklist turns both regimes into one practical self-assessment. Each question offers 3 answers - Yes, In progress, No - and the scoring section turns the result into next steps. It is written for compliance officers and product owners; no legal background required.

Key takeaways

• AMLR applies from July 10, 2027 - directly, with no national transposition.
• Private relying parties in mandated sectors must accept the EUDI Wallet wherever SCA is legally required from December 24, 2027.
• By December 24, 2026, every Member State must provide at least one EUDI Wallet. Adoption has already started: Denmark's AltID is live.
• SCA will be governed mainly by the Payment Services Regulation (PSR) combined with eIDAS 2.0, not by PSD2.
• Both regimes converge on the same capability: accepting many identity methods, at defined assurance levels, with evidence. That is one infrastructure project, not two.

AMLR vs eIDAS 2.0: why one checklist covers both regulations

Because the deadlines land in the same year and the requirements land on the same systems.

AMLR Article 22 defines what customer due diligence must verify - name, date of birth, nationality, address - and requires verification against reliable, independent sources. Article 22(6) explicitly recognises digital pathways: eID schemes under eIDAS at substantial or high assurance, the EUDI Wallet, and qualified trust services (QES, QEAA).

eIDAS 2.0, in turn, obliges relying parties in the Art. 5f sectoral catalog - banking, financial services, telecom, insurance, healthcare, education, energy, transport and others - to accept the EUDI Wallet wherever SCA is required.

Read those two together and the conclusion is hard to avoid: the infrastructure you build for wallet acceptance is the same infrastructure that satisfies AMLR's verification pathways. Companies that run these as parallel projects will pay for the same plumbing twice.

What has changed since our March 2026 analysis?

In our March 2026 analysis, How eIDAS 2.0 affects private relying parties and SCA, we made one point that has aged well: readiness will ultimately depend on technical implementation, not policy declarations.

4 months later, the implementation picture is sharper:

• The AMLA consultation on the Customer Due Diligence Regulatory Technical Standards closed on May 8, 2026. The final draft is due to the European Commission by July 10, 2026 - exactly one year before AMLR applies.
• Denmark shipped AltID, one of Europe's first live EUDI Wallets, ahead of the legal deadline.
• More Member States will follow before December 2026 - our analysis of how European markets are scaling in 2026 shows the trajectory, and Italy's eID paradox shows where bottlenecks remain. Every wallet launched now is a wallet your users may present to you 12 months later.

The window between "the rules are final" and "the rules apply" is closing to roughly a year. That is the window the checklist is built for.

How should organisations prepare for Strong Customer Authentication under eIDAS 2.0?

Preparation starts from the assumption that PSD2 will not be the framework you comply with. By 2027, SCA will be governed mainly by the Payment Services Regulation combined with eIDAS 2.0, which adds a new acceptance channel: wallet-based authentication with mandatory dynamic linking wherever SCA is legally required.

In practice that means three workstreams: confirming whether your sector falls under the Art. 5f catalog, testing whether your SCA flows can consume a wallet credential in remote scenarios, and verifying that authentication events leave the evidence trail AMLR supervisors will ask for. Section 3 of the checklist covers all three.

What does the SCA & AMLR Readiness Checklist cover?

The checklist has 32 questions across 7 sections. Each question offers three answers - Yes, In progress, No - and the scoring section turns the result into next steps. Each question in the PDF also carries a short "why this matters" note explaining the regulatory stake behind it.

Section 1 | Scope: do these rules apply to you at all?

Covers the Art. 5f sectoral catalog, private relying party status, registration duties, and AMLR's widened obliged-entity list - including newly in-scope categories such as crypto-asset service providers, crowdfunding platforms and traders in high-value goods.

Section 2 | Timeline: where are you against the deadlines?

Whether your roadmap accounts for the 3 hard dates: December 24, 2026 (wallet availability), July 10, 2027 (AMLR), December 24, 2027 (wallet acceptance) - and whether budget and engineering capacity are allocated for 2026, not 2027.

Section 3 | SCA architecture readiness (PSR + eIDAS 2.0)

PSR replaces PSD2 as the main SCA framework. The questions test wallet-based SCA in remote flows, mandatory dynamic linking, secure credential storage, and cross-application authentication on mobile.

Section 4 | Wallet acceptance readiness

A minimum of 27 national wallets, issued by governments and accredited private entities, all of which you must be able to verify, authenticate against, and request data from - with selective disclosure and data minimisation built in. 1 integration is a pilot; 27+ is an orchestration problem. For a deeper wallet-specific assessment, see the EUDI Wallet Readiness Checklist by Authologic.

Section 5 | AMLR / CDD readiness

Article 22 data points, recognised verification pathways, the CDD RTS timeline, new thresholds (EUR 10,000 for occasional transactions, down from EUR 15,000), and AMLR's exhaustive catalog of enhanced due diligence triggers.

Section 6 | Evidence, monitoring and audit trail

CDD as a living record, automated ongoing monitoring under Article 25, and the question supervisors will actually ask: which verification method, at which assurance level, was used for which customer?

The sections map to the 2 regimes like this - and the overlap is the point:

Half the checklist serves both regulations at once. That is the convergence argument in one table: scope, timeline and audit trail are shared infrastructure, not per-regulation work.

Who should use the checklist?

The SCA & AMLR Readiness Checklist is written for compliance officers and product owners. No legal background required - and if the terminology is new, start with our EUDI & eIDAS 2.0 glossary. It applies to any organisation that:

• operates in a sector listed in Art. 5f of eIDAS 2.0, or
• qualifies as an obliged entity under AMLR - including categories entering scope for the first time, or
• relies on electronic identification or trust services anywhere in its user flows, which makes it a relying party whether it realises it or not.

Many companies hold relying party status without knowing it - a login flow or an e-signature integration is enough.

How do you read your checklist score?

The question behind all 32 questions: build or buy?

Most of the checklist reduces to one capability: accepting many identity methods, at defined assurance levels, with evidence. That is an orchestration problem, not a series of one-off integrations.

Build or buy, the architectural question is the same: can you add the next wallet, eID scheme or attestation type without rebuilding your stack?

FAQ

Is the SCA & AMLR Readiness Checklist free?

Yes - the PDF is a direct download with no signup, form, or email gate.

When does AMLR apply?

AMLR (Regulation (EU) 2024/1624) applies from July 10, 2027, directly in all EU Member States, with no national transposition required.

When must companies accept the EUDI Wallet?

Private relying parties in the sectors listed in Art. 5f of eIDAS 2.0 must accept the EUDI Wallet from December 24, 2027, wherever Strong Customer Authentication is legally required.

Does the EUDI Wallet obligation cover in-person payments?

No - the EUDI Wallet acceptance obligation applies to remote scenarios only. In-person point-of-sale and ATM transactions are out of scope, and existing SCA methods remain applicable there.

Will PSD2 still govern SCA in 2027?

No - by 2027, SCA will be governed mainly by the Payment Services Regulation (PSR) in combination with eIDAS 2.0, not by PSD2.

How many EUDI Wallets will companies need to accept?

Companies should prepare for a minimum of 27 national EUDI Wallets - each Member State must provide at least one, and both governments and accredited private entities can issue them. Users may present any of them cross-border.

Do users have to use the EUDI Wallet?

No - users remain free to choose their authentication method. The obligation sits with the relying party: the wallet option must be available wherever SCA is legally required.

How is this different from the EUDI Wallet Readiness Checklist?

The EUDI Wallet Readiness Checklist is a 20-question assessment focused specifically on wallet acceptance - strategy, customer experience, integration, orchestration and fallback. The SCA & AMLR Readiness Checklist is broader: 32 questions covering both AMLR customer due diligence and eIDAS 2.0 wallet acceptance, including SCA architecture under PSR. Use both together: this one to map the full 2027 obligation, the EUDI checklist for the deeper wallet-specific dive.

Is the SCA & AMLR Readiness Checklist legal advice?

No - the checklist is a self-assessment tool for a high-level analysis by compliance officers and product owners, reflecting the regulatory state of play in July 2026.

Changelog

• July 30, 2026 - Full 32-question checklist published on page.
• July 29, 2026 - Initial publication (32 questions, 7 sections, scoring guide).