How often must customer due diligence data be updated under the EU AML Regulation (AMLR)? | Customer Due Diligence Guide

What Article 26 AMLR requires, what AMLA's draft guidelines on ongoing monitoring add, and how eIDs keep customer data current.

Under Article 26 of the EU Anti-Money Laundering Regulation (AMLR), obliged entities must update customer due diligence data at least every year for higher-risk customers subject to enhanced due diligence and at least every 5 years for all other customers.

Customer information must also be reviewed when the customer's relevant circumstances change or when the obliged entity becomes aware of a relevant fact. The AMLR applies from 10 July 2027.

Written by Aleksander Wasiak (Compliance Officer) and Helena Suska (Head of Customer Success), Authologic.

Title card reading "AMLR: updating customer data" with the line "Customer Due Diligence Guide"

Key takeaways

Article 26(2) AMLR: customer information is updated at least every year for higher-risk customers and at least every 5 years for all others.
Article 26(3) AMLR: a change in relevant circumstances, a legal obligation to contact the customer in the calendar year, or becoming aware of a relevant fact triggers a review outside the cycle.
AMLA consulted on draft guidelines on ongoing monitoring until 3 September 2026; the final guidelines have not been published yet.
An eID or the EU Digital Identity Wallet (EUDI Wallet) lets the customer confirm current data with the same method used at onboarding, without a new document photo.
In Authologic's experience, when businesses add eIDs or bank IDs to verification flows that previously relied on biometrics, traffic gradually shifts to eID and fewer errors are reported.

How often must customer due diligence data be updated under the AMLR?

Article 26(2) of the AMLR requires obliged entities to keep relevant customer documents, data and information up to date: at least every year for higher-risk customers subject to enhanced due diligence, and at least every 5 years for all other customers.

Article 26(3) adds reviews outside that cycle when the customer's relevant circumstances change, when the obliged entity has a legal obligation in the calendar year to contact the customer about beneficial ownership information or under Directive 2011/16/EU, and when it becomes aware of a relevant fact about the customer.

When customer due diligence data must be updated or reviewed under Article 26 AMLR

Situation	Update or review	Legal basis
Higher-risk customer subject to enhanced due diligence	At least every year	Article 26(2) AMLR
Any other customer	At least every 5 years	Article 26(2) AMLR
Change in the customer's relevant circumstances	Review and, where relevant, update	Article 26(3) AMLR
Legal obligation in the calendar year to contact the customer (beneficial ownership information or Directive 2011/16/EU)	Review and, where relevant, update	Article 26(3) AMLR
Obliged entity becomes aware of a relevant fact about the customer	Review and, where relevant, update	Article 26(3) AMLR

Ongoing monitoring and the other customer due diligence terms are defined in the AML and KYC Glossary.

What do AMLA's draft guidelines on ongoing monitoring add?

Article 26(5) of the AMLR required AMLA to issue guidelines on ongoing monitoring of a business relationship by 10 July 2026. AMLA consulted on draft guidelines from 3 June to 3 September 2026, and the final guidelines have not been published yet.

Under AMLA's draft guidelines on ongoing monitoring, updates can be periodic or event-driven, and updated information can come from official registers, reliable commercial data providers, reliable open sources, other obliged entities or the customer. Expired identity documents are handled on a risk-based basis rather than re-collected automatically.

Where the customer does not respond to repeated requests for updated information, the draft allows transactions, activities or services to be temporarily suspended or restricted before the relationship is terminated, but only where the money laundering and terrorist financing risks can still be effectively managed. Monitoring has to be documented and explainable to supervisors.

The final text may differ from the draft.

Does an update mean verifying the customer's identity again?

Article 26 of the AMLR requires relevant customer documents, data and information to be kept up to date; it does not prescribe how the obliged entity obtains them, and it does not require a new identity verification at every update.

What the update covers depends on the customer's risk and on what has changed.

Where identity data needs to be confirmed again, the same rules as at onboarding apply, including the expectation in AMLA's draft CDD standards that customers are verified remotely with electronic identification wherever possible, explained in How to verify customers remotely under AMLR.

How can eIDs keep customer data current?

An eID or the EUDI Wallet lets the customer confirm current data with the same method used at onboarding.

The data comes signed at the source, so the obliged entity does not have to ask for a new document photo and selfie. A single eID does not always return every attribute the AMLR requires: the address, for example, is optional in some schemes and has to come from another source, as How do you choose identity verification methods for each country? explains.

Authologic supports re-verification with eIDs and bank IDs, started by the obliged entity when an update is due. The update runs through the same integration and routing as onboarding, described in What is an eID-native identity platform?

What should an obliged entity record at each update?

The AMLR does not list what to record at an update, but monitoring has to be documented and explainable to supervisors.

A record that answers a supervisor's questions usually covers 5 points:

what triggered the update: the periodic cycle or a specific event;
which method and source confirmed the data, and at which assurance level;
what changed and what stayed the same;
when the update was completed and when the next one is due;
what the obliged entity did if updated information could not be obtained.

What a verification result should record, and how to show years later why it was accepted, is covered in What does "verified" mean in identity verification?

How do regulated businesses handle re-verification today?

Most of the businesses that Helena Suska, Head of Customer Success at Authologic, works with run their own account management systems. These systems start a re-verification automatically when a stored identity document expires, when a customer's risk level changes, or as part of internal product processes.

Authologic does not require a reason for a re-verification, because the business is the controller of the personal data, and does not require a specific verification method for it.

At each re-verification, businesses typically record the customer's personal data, the start and end time of the verification, the method used, the Authologic identifier and, in some cases, the identifier from the underlying method. Authologic does not keep statistics on end users or use their data for its own analysis, so it has no figures on how end users respond to re-verification.

Adding eIDs or bank IDs to the methods a customer can choose improves data quality. Where they are added to flows that previously relied on biometrics, traffic gradually shifts to eID, and businesses report greater satisfaction with results and fewer error reports.

The hardest part is usually reconciling what customers type in themselves with the data returned by verification: customers often write their details informally, in a form that differs from the official record. Helena Suska recommends giving more weight to data in its official form. Ahead of July 2027, businesses also ask how existing methods and EUDI Wallets will work side by side, and how to present digital methods first; Authologic adjusts how methods are presented as requirements become clear.

Our advice: first versions of regulatory guidance can differ from the final ones, so it helps to use solutions that can be updated with minimal involvement from the business.

How should an obliged entity prepare for Article 26?

Map customers by risk and set the update cycle for each group: at least yearly for higher-risk customers, at least every 5 years for others.
Define the events that trigger a review outside the cycle and how your systems detect them.
Decide which updates need identity data confirmed again, and offer eIDs and the EUDI Wallet first for those.
Record each update so it can be explained to a supervisor: trigger, method, source, result and next due date.

A full self-assessment is in Are you ready for July 2027? A 32-question SCA & AMLR readiness checklist.

How identity platforms compare on AMLR requirements is covered in Best AML and KYC identity verification platforms.

Sector guides in the series cover crypto-asset service providers and gambling operators.

FAQ

How often must customer due diligence data be updated under the AMLR?

Under Article 26(2) of the AMLR, at least every year for higher-risk customers subject to enhanced due diligence and at least every 5 years for all other customers. Article 26(3) adds reviews when relevant circumstances change, when there is a legal obligation to contact the customer in the calendar year, and when the obliged entity becomes aware of a relevant fact. The AMLR applies from 10 July 2027.

Does the AMLR require customers to verify their identity again at every update?

No. Article 26 of the AMLR requires relevant customer information to be kept up to date but does not prescribe a new identity verification at every update. What the update covers depends on the customer's risk and on what has changed. Where identity data needs to be confirmed again, an eID or the EUDI Wallet can do it with the same method used at onboarding.

Have AMLA's guidelines on ongoing monitoring been published?

Not in final form. AMLA consulted on draft guidelines on ongoing monitoring of a business relationship from 3 June to 3 September 2026, under Article 26(5) of the AMLR. The final guidelines have not been published yet, and the final text may differ from the draft.

Sources

This guide is for general information and is not legal advice. Legal status reviewed on 11 November 2026: AMLA has not published the final guidelines on ongoing monitoring, and the AMLA draft standards on customer due diligence have been submitted to the European Commission and have not been adopted.