AMLR Article 20: customer due diligence measures

Article 20 of Regulation (EU) 2024/1624 is titled “Customer due diligence measures”. It is the list. Article 19 says when you apply due diligence, Article 20 says what it consists of, and Article 22 (see identification and verification) explains how to do the first item.

The measures in paragraph 1

Obliged entities must carry out these steps, in substance:

• identify the customer and verify their identity;
• identify the beneficial owners, verify their identity, and understand the customer’s ownership and control structure;
• understand the purpose and intended nature of the relationship;
• check the customer against targeted financial sanctions;
• understand the customer’s business or occupation;
• monitor the relationship on an ongoing basis, including the source of funds where needed;
• determine whether the customer or beneficial owner is a politically exposed person, or a family member or close associate of one;
• identify and verify any natural person on whose behalf a transaction is carried out;
• check that anyone acting for the customer is authorised to do so, and identify and verify them.

Risk decides the depth (paragraph 2)

The extent of the measures depends on an individual risk analysis that takes into account your business-wide risk assessment under Article 10 and the variables and risk factors in Annexes I, II and III. Higher risk means enhanced due diligence under Section 4. Lower risk may allow simplified measures under Section 3.

Paragraph 3 required AMLA to issue guidelines on these variables and factors by 10 July 2026. We have not confirmed their publication; check AMLA’s website before relying on them.

Proving it (paragraph 4)

You must be able to show your supervisor, at any time, that your measures match the money laundering and terrorist financing risks you have identified. This is where a lot of firms are exposed. A tidy file that records a decision (“medium risk, no EDD”) without the reason will not satisfy anyone.

An example

A Maltese corporate service provider onboards a Cyprus holding company owned by a trust. The provider cannot stop at the certificate of incorporation. Article 20 expects the beneficial owners behind the structure to be identified, the reason for the structure to be understood, and sanctions and PEP checks to cover the people behind it. If the answer to “why this structure?” is thin, risk is not low.

What changes from today

Many of these steps will look familiar. The difference is that the list is now a directly applicable rule with the same wording in every Member State, and AMLA’s draft technical standards will specify the information to collect. See the technical standards tracker.

What this means for you

Map each bullet above to a section of your onboarding procedure. Wherever you cannot find the match, you have a gap. To go through yours with someone who does this daily, use the enquiry form to talk to an expert.

General information, not legal advice.