AMLR Article 22: identifying and verifying customers

Article 22 of Regulation (EU) 2024/1624 is titled “Identification and verification of the identity of customers and beneficial owners”. It turns the first item in Article 20 into practice. It has seven paragraphs.

Paragraph 1: the minimum data

You must obtain identification data for the customer, for anyone acting on the customer’s behalf, and for the people on whose behalf or for whose benefit a transaction is carried out. Lower-risk cases under Section 3 are carved out. The minimum differs by type: natural persons, legal entities (including the names of nominee shareholders and directors), trustees of express trusts, and other organisations with legal capacity each have their own list. Check the paragraph for the exact fields rather than working from an old onboarding form.

Paragraph 2: beneficial owners and the fallback

Beneficial owner information is collected as referred to in Article 62(1), second subparagraph, point (a). If, after exhausting all possible means, you cannot identify any natural person as beneficial owner, or you doubt the persons you found, you record that no beneficial owner was identified and you identify and verify the senior managing officials instead. If verifying them could tip the customer off about your doubts, you skip that verification, record the steps taken and keep a record of the difficulties met.

Paragraphs 3 to 5: virtual IBANs and trusts

Paragraph 3: credit and financial institutions must obtain information to identify and verify the people using any virtual IBAN they issue. The institution servicing the account that a virtual IBAN redirects to must be able to get that information from the issuing institution within five working days of asking. Paragraphs 4 and 5 deal with trusts. Where beneficiaries are defined by class or characteristics, or the trust is discretionary, you need enough information to establish who the beneficiary is when the payout happens or the right is exercised.

Paragraphs 6 and 7: verification

Paragraph 6 covers the customer and anyone acting for them: an identity document, passport or equivalent, plus information from reliable and independent sources where relevant, or electronic identification meeting eIDAS “substantial” or “high” assurance. Paragraph 7 covers beneficial owners. You may use the paragraph 6 methods, or take reasonable measures to get the information from the customer or other reliable sources, including public registers other than the central registers. On top of either route, you must verify beneficial owner information by consulting the central registers.

Draft technical standards under Article 28 will say more about reliable and independent sources and what electronic identification must contain. AMLA announced the final draft on 1 October 2026; it is not yet in force.

Our view

The register requirement is the one that tends to get missed. Pulling a certified copy of the passport is easy; showing in the file that you also looked at the register, and what you did about a mismatch, takes discipline. Note also that Article 24 requires you to report discrepancies against those registers within 14 calendar days of finding them, subject to limited exceptions.

What this means for you

Compare your onboarding form and verification rules, line by line, against the seven paragraphs. If you want a second opinion on the result, use the enquiry form to schedule a no-obligation call.

General information, not legal advice. Paragraph summaries are ours; read the Official Journal for exact wording.