Are you ready for July 2027? A 32-question SCA & AMLR readiness checklist

What is the SCA & AMLR Readiness Checklist?

The checklist turns both regimes into one practical self-assessment. Each question offers 3 answers - Yes, In progress, No - and the scoring section turns the result into next steps. It is written for compliance officers and product owners; no legal background required.

Key takeaways

• AMLR applies from July 10, 2027 - directly, with no national transposition.
• From December 24, 2027, private relying parties (except micro and small enterprises) must accept the EUDI Wallet wherever strong user authentication for online identification is required by law or contract.
• By December 24, 2026, every Member State must provide at least one EUDI Wallet. Adoption has already started: Denmark’s AltID is live.
• AMLA sent its final draft standards on customer due diligence to the European Commission on 1 October 2026. As a rule, the draft makes electronic identification the default route at remote onboarding.
• SCA remains governed by PSD2 and the RTS on SCA until the Payment Services Regulation (PSR) applies - not before the second half of 2028. eIDAS 2.0 does not set SCA rules. It adds an obligation to accept the EUDI Wallet.
• Both regimes converge on the same capability: accepting many identity methods, at defined assurance levels, with evidence. That is one infrastructure project, not two.

AMLR vs eIDAS 2.0: why one checklist covers both regulations

Because the deadlines land in the same year and the requirements land on the same systems.

AMLR Article 22 defines what customer due diligence must verify - name, date of birth, nationality, address - and requires verification against reliable, independent sources. Article 22(6) recognises two routes: identity documents together with information from reliable and independent sources, or electronic identification means at substantial or high assurance together with relevant qualified trust services. The EUDI Wallet is one such means, not a separate route.

eIDAS 2.0, in turn, obliges private relying parties within the scope of Art. 5f(2) - banking, financial services, telecom, health, education, energy, transport and others, except micro and small enterprises - to accept the EUDI Wallet wherever strong user authentication for online identification is required by law or contract.

Read those two together and the conclusion is hard to avoid: the infrastructure you build for wallet acceptance is the same infrastructure that satisfies AMLR’s verification pathways. Companies that run these as parallel projects will pay for the same plumbing twice.

What has changed since our March 2026 analysis?

In our March 2026 analysis, How eIDAS 2.0 affects private relying parties and SCA, we made one point that has aged well: readiness will ultimately depend on technical implementation, not policy declarations.

7 months later, the implementation picture is sharper:

• AMLA consulted on the Customer Due Diligence Regulatory Technical Standards until May 8, 2026 and sent its final draft to the European Commission on October 1, 2026. The Commission can still amend the draft, and the standards apply six months after they enter into force. As a rule, the draft makes electronic identification the default route at remote onboarding, with document checks as a fallback that the obliged entity has to justify. How to verify customers remotely under AMLR explains what the draft changes.
• Denmark shipped AltID, one of Europe’s first live EUDI Wallets, ahead of the legal deadline.
• More Member States will follow before December 2026 - our eID Adoption Race H1 2026 shows where Europe’s identity apps actually reach, and Italy’s eID paradox shows where bottlenecks remain. Every wallet launched now is a wallet your users may present to you 12 months later.

AMLR applies from July 10, 2027, and the CDD standards apply six months after their entry into force. That is the window the checklist is built for.

How should organisations prepare for EUDI Wallet acceptance in SCA flows?

The EUDI Wallet deadline (December 24, 2027) falls while PSD2 still applies, so wallet-based authentication must meet today’s SCA rules - including dynamic linking for remote payments - and be ready to migrate to the PSR later.

In practice that means three workstreams: confirming whether your organisation falls within the scope of Art. 5f(2), testing whether your SCA flows can consume a wallet credential in remote scenarios, and verifying that authentication events leave the evidence trail AMLR supervisors will ask for. Section 3 of the checklist covers all three.

What does the SCA & AMLR Readiness Checklist cover?

The checklist has 32 questions across 6 assessment sections, followed by a scoring section. Each question offers three answers - Yes, In progress, No - and the scoring section turns the result into next steps. Each question in the PDF also carries a short “why this matters” note explaining the regulatory stake behind it.

Section 1 | Scope: do these rules apply to you at all?

Covers the scope of Art. 5f(2) of eIDAS 2.0, private relying party status, registration duties, and AMLR’s widened obliged-entity list - including newly in-scope categories such as crypto-asset service providers, crowdfunding platforms and traders in high-value goods.

Section 2 | Timeline: where are you against the deadlines?

Whether your roadmap accounts for the 3 hard dates: December 24, 2026 (wallet availability), July 10, 2027 (AMLR), December 24, 2027 (wallet acceptance) - and whether budget and engineering capacity are allocated for 2026, not 2027.

Section 3 | SCA architecture readiness (PSD2, PSR and eIDAS 2.0)

SCA remains governed by PSD2 and the RTS on SCA until the PSR applies - not before the second half of 2028. eIDAS 2.0 does not set SCA rules. It adds an obligation to accept the EUDI Wallet. The questions test wallet-based SCA in remote flows, mandatory dynamic linking, secure credential storage, and cross-application authentication on mobile.

Section 4 | Wallet acceptance readiness

A minimum of 27 national wallets, issued by governments and accredited private entities, all of which you must be able to verify, authenticate against, and request data from - with selective disclosure and data minimisation built in. 1 integration is a pilot; 27+ is an orchestration problem. For a deeper wallet-specific assessment, see the EUDI Wallet Readiness Checklist by Authologic.

Section 5 | AMLR / CDD readiness

Article 22 data points, recognised verification pathways, the CDD RTS timeline, new thresholds (EUR 10,000 for occasional transactions, down from EUR 15,000), and AMLR’s enhanced due diligence triggers.

Section 6 | Evidence, monitoring and audit trail

CDD as a living record, ongoing monitoring under Article 26, and the question supervisors will actually ask: which verification method, at which assurance level, was used for which customer?

The sections map to the 2 regimes like this - and the overlap is the point:

Half the checklist serves both regulations at once. That is the convergence argument in one table: scope, timeline and audit trail are shared infrastructure, not per-regulation work.

Who should use the checklist?

The SCA & AMLR Readiness Checklist is written for compliance officers and product owners. No legal background required - and if the terminology is new, start with our Digital Identity Glossary. It applies to any organisation that:

• falls within Art. 5f(2) of eIDAS 2.0, or
• qualifies as an obliged entity under AMLR - including categories entering scope for the first time, or
• relies on electronic identification or trust services anywhere in its user flows, which makes it a relying party whether it realises it or not.

Many companies hold relying party status without knowing it. A practical first check: if your organisation is regulated under PSD2 - a banking, payment or e-money licence - the SCA-linked wallet acceptance obligation applies to you, unless you are a micro or small enterprise.

How do you read your checklist score?

The question behind all 32 questions: build or buy?

Most of the checklist reduces to one capability: accepting many identity methods, at defined assurance levels, with evidence. That is an orchestration problem, not a series of one-off integrations.

Build or buy, the architectural question is the same: can you add the next wallet, eID scheme or attestation type without rebuilding your stack?

FAQ

Is the SCA & AMLR Readiness Checklist free?

Yes - the PDF is a direct download with no signup, form, or email gate.

When does AMLR apply?

AMLR (Regulation (EU) 2024/1624) applies from July 10, 2027, directly in all EU Member States, with no national transposition required.

When must companies accept the EUDI Wallet?

From December 24, 2027, private relying parties - except micro and small enterprises - that are required by law or contract to use strong user authentication for online identification must also accept the EUDI Wallet when a user chooses to use it (Art. 5f(2) eIDAS 2.0).

Does the EUDI Wallet obligation cover in-person payments?

No - the EUDI Wallet acceptance obligation applies to remote scenarios only. In-person point-of-sale and ATM transactions are out of scope, and existing SCA methods remain applicable there.

Will PSD2 still govern SCA in 2027?

Yes. The PSR will not apply before the second half of 2028. Until then, SCA is governed by PSD2 and the RTS on SCA. eIDAS 2.0 does not replace these rules - it adds an obligation to accept the EUDI Wallet. PSD3 and the PSR were provisionally agreed on 27 November 2025 but, as of 19 October 2026, have not yet been adopted or published in the Official Journal. Under the agreed text, most PSR rules apply 21 months after entry into force.

How many EUDI Wallets will companies need to accept?

Companies should prepare for a minimum of 27 national EUDI Wallets - each Member State must provide at least one, and both governments and accredited private entities can issue them. Users may present any of them cross-border.

Do users have to use the EUDI Wallet?

No - users remain free to choose their authentication method. The obligation sits with the relying party: the wallet option must be available wherever strong user authentication for online identification is required by law or contract.

How is this different from the EUDI Wallet Readiness Checklist?

The EUDI Wallet Readiness Checklist is a 20-question assessment focused specifically on wallet acceptance - strategy, customer experience, integration, orchestration and fallback. The SCA & AMLR Readiness Checklist is broader: 32 questions covering both AMLR customer due diligence and eIDAS 2.0 wallet acceptance, including SCA architecture under PSD2 and the upcoming PSR. Use both together: this one to map the full 2027 obligation, the EUDI checklist for the deeper wallet-specific dive.

Is the SCA & AMLR Readiness Checklist legal advice?

No - the checklist is a self-assessment tool for a high-level analysis by compliance officers and product owners, reflecting the regulatory state of play on 19 October 2026.

Can Authologic help with SCA and AMLR readiness?

Yes. Authologic’s platform supports the verification pathways AMLR recognises - national eIDs and EUDI Wallets at substantial and high assurance, together with relevant qualified trust services - through a single API covering 140+ identity methods, with the audit trail per method and assurance level that supervisors expect.