AMLA's October RTS Package: Three Standards, One Deadline

On October 1, 2026, AMLA transmitted three sets of Regulatory Technical Standards to the European Commission. This is not a consultation, a draft, or a guidance note. It is the formal submission step that begins the adoption process under Article 27 of Regulation (EU) 2024/1620. Once the Commission adopts them and they are published in the Official Journal, they become binding law across all 27 EU member states.

The three standards — on customer due diligence, business relationships and linked transactions, and group-wide controls — together form the operational spine of the AMLR, which applies from 10 July 2027. Understanding what each one requires is now a primary compliance planning task for every obliged entity operating in the EU.

What Changed on October 1

The CDD consultation closed in May 2026, with standards due at the European Commission by July 10. Submission happened on October 1, alongside two additional standard sets that had not been through the same public consultation window.

What AMLA finalized on that date:

• RTS on business relationships and linked transactions — under Article 19(9) of the AMLR
• RTS on customer due diligence — under Article 28(1) of the AMLR
• RTS on group-wide policies and controls — under Articles 16(4) and 17(3) of the AMLR

Three separate legal instruments submitted in one package. Each addresses a gap that the current patchwork of national AML transpositions has handled inconsistently across EU member states.

RTS 1: Business Relationships vs. Occasional Transactions

The question sounds administrative. In practice, the classification decides which due diligence regime applies to a given customer.

Under the AMLR, business relationships trigger ongoing CDD obligations — periodic review, risk rescoring, continuous monitoring. Occasional transactions below the relevant threshold (€10,000 for cash) do not. Whether a customer contact is classified as a business relationship or an occasional transaction determines whether an obliged entity must maintain a continuous risk profile for that customer.

The Article 19(9) standard sets out:

• Criteria for determining when a series of transactions constitutes a business relationship
• How linked transactions should be identified — specifically, how to connect transactions that are structurally separated but functionally unified for threshold-avoidance purposes

The second element is the substantive change. Structuring — breaking a single high-value transaction into multiple smaller ones — is a classic money laundering technique. The new standard requires obliged entities to build detection logic capable of identifying linked transactions across time windows and counterparties. This implies threshold-avoidance detection built into the CDD layer itself, not only in transaction monitoring downstream.

RTS 2: Customer Due Diligence — The Identity Verification Details

The AMLA CDD consultation in May 2026 established the general framework. The October 1 finalization locks in specific requirements that directly affect how identity verification must work.

Non-Face-to-Face Verification

The finalized RTS enumerates acceptable methods for non-face-to-face identity verification. Not all digital identity checks are equal under the finalized standard. Electronic identification schemes that meet eIDAS notified levels — substantial or high — and equivalent schemes from third-country supervisors on AMLA's recognition list are the primary path.

Video-based verification without qualified electronic signature falls into a category requiring documented compensating controls. Liveness detection, document authenticity verification, and device binding are referenced as elements that compensate for the absence of eIDAS-notified status. The burden of documenting those compensating controls falls on the obliged entity, not the verification vendor.

For identity verification providers, this creates a two-tier world. eIDAS-qualified providers and those with recognized third-country equivalence sit in the top tier. Providers outside that framework can still be used, but the obliged entity must document why the compensating controls are sufficient and maintain evidence of their ongoing effectiveness over time.

Simplified Due Diligence

The finalized standard sets specific conditions for applying simplified CDD. Low-risk categorization based solely on customer type — for example, "regulated financial institution" — is not by itself sufficient. The risk factors specified in Annex I of the AMLR must be assessed in each case, and the simplified CDD decision must be documented and periodically reviewed.

Transitional Provisions for Existing Customers

Remediation of existing customers follows a two-track timeline built into the finalized text:

• Higher-risk customers: within one year of entry into force
• All other customers: within five years of entry into force

The five-year track sounds comfortable. For firms with large existing customer bases, completing remediation within five years while managing ongoing onboarding at scale is a systems capacity question. Manual review processes will not survive the arithmetic.

RTS 3: Group-Wide Controls — The Cross-Border Complexity

The third standard introduces requirements with no equivalent in current national AML frameworks. This is the area likely to create the most significant structural compliance work for financial groups.

Under Articles 16(4) and 17(3), groups must implement:

Unified governance frameworks applicable across all EU group entities, requiring consistent risk appetite definitions, escalation procedures, and senior management accountability structures. A group cannot have materially different CDD standards in its German subsidiary and its Spanish subsidiary.

Secure information-sharing arrangements within the group. AML-relevant information — customer risk profiles, suspicious activity indicators, adverse media findings — must be shareable across group entities while complying with GDPR. The standard sets technical and organizational safeguards for this intra-group sharing.

Third-country branch and subsidiary rules. Where a group subsidiary or branch operates in a jurisdiction with AML standards weaker than the AMLR, the group must apply AMLR standards regardless of local law. If local law prevents AMLR-standard compliance, the subsidiary may be required to exit that market.

Requirement	Scope	Operational implication
Unified governance	All EU group entities	Single AML policy framework required
Information sharing	Intra-group AML data	Technical infrastructure and GDPR controls
Third-country parity	Branches in weaker jurisdictions	Potential legal restructuring or exit
Remediation: higher-risk	Within 1 year	System capacity planning starts now
Remediation: other customers	Within 5 years	Workflow automation at scale

The third-country provision has significant operational implications for groups with branches across Southeast Asia, the Gulf region, or parts of Latin America, where local law frequently restricts cross-border data sharing. Some groups will face a direct compliance conflict requiring legal restructuring of the relationship between EU parent and local entity.

The Timeline That Actually Matters

The October 1 submission is step one of a four-step process before these standards have legal effect:

1. AMLA submission — completed October 1, 2026
2. European Commission review and adoption — no fixed date; typically 3–6 months
3. Official Journal publication — triggers the entry into force period
4. Entry into force — six months after publication, as proposed by AMLA

After entry into force, the AMLR's July 10, 2027 application date also applies. The specific RTS standards do not override the AMLR's main application date. What they do is add precise operational requirements on top of the AMLR's existing obligations.

Realistic planning assumption: if the Commission adopts the standards by Q1 2027, entry into force falls around mid-2027. But the AMLR itself is live on July 10. Entities waiting for the RTS to achieve formal legal effect before beginning implementation will not be ready.

AMLA's direct supervision process already named the first cohort of directly supervised firms in September 2026. Those entities are examined against these very standards. The proposed grace period is not available to them.

What This Requires From Identity Verification Systems

The October package translates into concrete system requirements. Compliance teams need to assess whether their current identity verification infrastructure can deliver:

Transaction linkage detection. The business relationships RTS requires linked transaction identification across time and counterparties. If the KYC system and the transaction monitoring system are separate, this is a data architecture problem that now has a regulatory deadline.

eIDAS-alignment documentation. The CDD RTS places the documentation burden on obliged entities using non-eIDAS-qualified verification methods. The KYC vendor's technical approach — liveness detection methodology, document verification logic, injection-attack resistance — needs documented assessment against the compensating controls standard.

Group data architecture. Group-wide information sharing under a single governance framework requires a technical solution that satisfies both AML and GDPR requirements simultaneously. Siloed identity databases by jurisdiction will not meet the group-wide controls requirement.

Automated remediation workflows. Remediating existing customers at scale within the transitional timelines is not manually feasible for any organization of meaningful size. A system capable of identifying customers requiring remediation, triaging them by risk tier, and executing re-verification workflows automatically is what the operational requirement implies.

These are not aspirational capabilities. They are the output of reading what the October 2026 RTS package actually requires. Joinble's autonomous AI agent platform is designed for this operational model: continuous identity maintenance, automated risk rescoring, audit-trail generation, and group-compatible data architecture built for the AMLR environment.

Preparing Before the RTS Enter into Force

The AMLR's non-financial obliged entity extension and the ongoing monitoring guidelines published in June 2026 were preparatory building blocks. The October package is the load-bearing structure of the post-2027 EU compliance framework.

Practical steps for compliance teams now:

• Map current CDD methods against the non-face-to-face enumeration in the finalized RTS. Identify where compensating controls will need formal documentation.
• Audit linked transaction detection in current systems. Does monitoring logic span a 30-day window for structuring detection? Does it cross product lines?
• Inventory group entities by jurisdiction and assess the third-country standard risk. Identify subsidiaries or branches where local law may conflict with AMLR group-wide requirements.
• Size the remediation task. Pull a sample of the existing customer base, segment by risk tier, and estimate the volume requiring remediation within one year versus five years.

July 10, 2027 was already visible from a distance. October 1, 2026 made the obligation specific.

---

Frequently Asked Questions

What are the three AMLA RTS submitted on October 1, 2026? AMLA submitted three final draft regulatory technical standards to the European Commission: one on classifying and identifying business relationships and linked transactions; one on customer due diligence including non-face-to-face verification and electronic identification; and one on group-wide AML policies and internal controls.

When do the October 2026 AMLA RTS become legally binding? They are not yet law. After European Commission adoption and publication in the Official Journal, they enter into force. AMLA has proposed that application begin six months after entry into force. The underlying AMLR applies from 10 July 2027 regardless.

Does the CDD RTS change how digital identity verification works in practice? Yes. The finalized text enumerates acceptable non-face-to-face verification methods. eIDAS-notified electronic identification and recognized equivalents are the primary path. Other methods require the obliged entity to document specific compensating controls — liveness detection, document forensics, device binding — and maintain evidence of their effectiveness over time.

What is the group-wide controls RTS and who does it affect? It applies to regulated groups with multiple EU entities. It requires unified AML governance, secure intra-group information sharing, and — critically — the application of AMLR standards to subsidiaries and branches in third countries with weaker AML rules. Groups with global footprints face the most significant structural compliance work.

How long do firms have to remediate existing customers under the new CDD RTS? The transitional provisions are two-tiered: higher-risk customers within one year of entry into force, and all other customers within five years. The five-year track requires automated remediation workflows for any organization with a large existing customer base.

How can AI agents support AMLA RTS compliance? The linked transaction detection, continuous monitoring, automated remediation, and group-wide data architecture requirements in the October 2026 package are operationally intensive at any meaningful scale. AI agent platforms built for continuous identity management — replacing periodic review cycles with real-time risk state, and generating audit-ready records automatically — are the operational architecture the AMLR environment requires.