What AMLA's Rules Say About KYB Data, Documents and Sources

The EU’s Anti-Money Laundering Authority (AMLA) wants compliance teams to verify companies and the people behind them from sources they can defend, with decisions made on pillars of rock, not pillars of sand. 

The rules sit in AMLA's draft regulatory technical standards (RTS) on customer due diligence, made under Article 28(1) of the Anti-Money Laundering Regulation (AMLR). The European Commission must adopt them, though this may still change. It will then apply six months after it enters into force, or from 10 July 2029 for a few categories of firms. 

This guide covers what the rules say about the data, documents and sources behind KYB. Part 1 deals with legal entities; Part 2 with the people who own, run or act for them. Both parts show how the rules shift with risk. 

Read the full guidance here.

What is the RTS?

The RTS (regulatory technical standards) is the detailed rulebook for customer due diligence under the AMLR. Its full name is the Regulatory Technical Standards on Customer Due Diligence, and Article 28(1) of the AMLR required AMLA to write it.

• What data to collect on companies and the people behind them.

• Which documents and sources count as proof.

• How checks change for simplified and enhanced due diligence.

• How to screen for sanctions and PEPs.

It is one of three standards AMLA finalised on 1 October 2026. The other two cover linked transactions and group-wide controls. Together with the AMLR, they form part of the EU’s first attempt at a single AML rulebook: one set of rules for every Member State, in place of 27 national versions.

Once the Commission adopts it, the RTS becomes a delegated regulation, which applies directly in every Member State without national legislation.

Is it binding?

Not yet. The RTS is a final draft. AMLA submitted it to the European Commission on 1 October 2026, and the Commission must adopt it as a delegated regulation before it becomes law. The text may still change.

Once adopted, the RTS is binding in its entirety and directly applicable in every Member State.

The timeline runs thus:

• Publication in the Official Journal of the EU.

• Entry into force 20 days later.

• Application six months after that, or from 10 July 2029 for football agents and professional football clubs.

Until then, the EBA’s guidelines on ML/TF risk factors and remote onboarding still apply to financial firms. They work on a “comply or explain” basis: a national supervisor can decline to follow them if it says why.

Shall or may? How to read these rules

The AMLA’s use of verbs is a big indicator of how data, documents and sources must be treated.

• “Shall” is an obligation.

• “May” is a permission or an option.  

The recitals – the numbered notes before the articles – mostly use “should”. They explain how to read the articles but don't oblige compliance teams to follow them to the letter.

Generally, the AMLA uses “shall” for outcomes and “may” for methods. E.g., You shall understand the ownership structure. You shall make sure your sources are reliable. But the lists of sources and documents that get you there mostly say “may include”.

A few lists use “shall”. They cover the data you collect, the documents you verify a company against, the data on each link in an ownership chain, the low-risk minimums and sanctions screening. On those points, you have no discretion.

We flag the verb as we go.

Part 1: Verifying legal entities

What data must you collect?

Article 22(1)(b) of the AMLR sets the core data for a legal entity:

• Its legal form and name.

• The address of its registered or official office, its principal place of business if different, and its country of establishment.

• The names of its legal representatives.

• Its registration number, tax identification number and Legal Entity Identifier (LEI), where available.

• The names of anyone holding shares or a directorship as a nominee, and their nominee status.

The RTS add detail. You shall collect the legal name and, where it differs, the trade name (Article 2(2)). Trade names have no legal status, and you may not be able to verify them. Collect them anyway. Recital 3 says they help with screening.

Addresses come in parts (Article 3): the country, the city or town with its postcode, then the street, building number and post box where they exist.

Shall or may? Shall. These are fixed data points.

What counts as proof?

Article 6(5) is the key provision. To verify a customer that is not a natural person, you shall refer to the documents the AMLR lists and “extracts from public registers that can be used for legal purposes, whether obtained from the customer or retrieved directly by the obliged entity”.

Recital 9 gives examples of reliable and independent sources:

• Statutory documents, such as certificates of incorporation or audited financial statements.

• The latest constitutive documents, such as the memorandum and articles of association, or a recent official copy or extract from a public register, or an unofficial copy certified by an independent professional or public authority.

• For a trust that may not be registered, a recent copy or extract of the trust deed, with any document setting out the trustees' powers, certified by an independent professional.

Shall or may? Shall for Article 6(5). Recital 9's examples are, simply, guidance.

Remember: Article 6(5) doesn't make a distinction between an extract from the customer and one pulled from the registry. But Article 8, below, asks how independent a source is and how easily it could be forged. Common sense applies. A PDF the customer emails you will have passed through their hands, but an extract you pull in real time won’t have.

What makes a source "reliable"?

Article 8 covers every source you use, whether for simplified, standard or enhanced due diligence. You shall take risk-sensitive measures to make sure your sources are reliable and independent, having regard to:

• The credibility of the source, including its reputation.

• Its official status and independence.

• How up to date it is.

• How accurate it is: was it verified or validated? Does it match other sources?

• How easily someone could forge the information. 

You shall also understand the information, whatever language it's in. Recital 9 leaves you to choose how.

Shall or may? Shall, but these are factors to weigh, not tests to pass one by one. After the consultation, AMLA dropped a requirement to check every source against every factor in all cases.

How old is too old for data or documents?

There is no set benchmark. Age is just a factor that affects a source’s reliability. Article 8 asks how up to date a source is. Recital 9 asks whether “the passage of time” has made a document less reliable. Two years on, an extract is both older and weaker.

The AMLR sets the outer limits. Under its Article 26(2), you update customer information at least once a year for higher-risk customers and at least every five years for the rest. Article 28 of the RTS applies those periods to existing customers, counted from the date the RTS enter into force.

How far up the chain?

Article 11 covers every customer, whatever its risk. You shall take risk-sensitive measures to understand a customer’s ownership and control structure.

Where more than one legal entity or legal arrangement sits between the customer and its beneficial owners, you shall obtain, for each link in the chain:

• Its legal form.

• Whether it has nominee directors or shareholders.

• Its jurisdiction of incorporation or registration.

• For a trust, the jurisdiction of its governing law.

• Where applicable, the shares each entity or arrangement holds, by class or type of share or by voting rights, as a percentage of the total.

• Where applicable, if its securities are listed on a regulated market, which market, and the number and percentage of shares listed.

You shall also understand how the structure affects the risk of money laundering and terrorist financing. And you shall assess whether you need more information, having regard to things that may add complexity:

• The number of layers between the customer and its owners.

• Legal arrangements or similar legal entities in any layer.

• A customer or entity in the chain registered in a high-risk jurisdiction.

• Nominee shareholders or directors.

Shall or may? Shall, throughout. Notice the change from Article 10, on beneficial owners, which says sources “may include”. For the chain, AMLA names the data and requires it.

Complexity isn't high risk in itself. The consultation draft, published in February, defined “complex structures”, tying set measures to them. AMLA dropped that after respondents pointed out that layered structures often exist for commercial, regulatory or tax reasons.

Most of the Article 11(2) data sits in company registries. But a chain often crosses several countries, and registries don't all publish the same things. Where a registry is silent, the company's own documents fill the gap – ideally certified.

How do the rules change with risk?

Low risk

Under Article 18, you shall collect at least:

• The legal form

• The legal name and any different trade name

• The registered or official office address

• And, where available, the registration number, tax identification number or LEI.

Under Article 20, you shall understand at least the intended use of the product or service, the estimated value of transactions where relevant, and the customer's business activity. That information may come from the customer or other sources, or you may infer it from the product. 

Shall or may? Shall for the minimums. May for where the purpose information comes from.

Standard risk

Article 16 lists what you may collect to understand the purpose and nature of the relationship. For a company, that includes its sector, whether it's regulated, whether it's actively trading, where it operates, its main sources of revenue and its key stakeholders. How much you collect, and how much you verify, depends on the risk (Article 16(2)). Before you ask the customer, check what you or your group already hold (Article 16(3)).

Shall or may? You shall understand the purpose. The list says “may include”. It's a menu, and AMLA amended the article after the consultation to make that clear.

High risk

Under Article 21, extra information on the customer may include:

• information to verify the customer, its beneficial owners or its ownership and control structure

• information on its reputation

• any other information that gives a fuller view of the risk, including close relationships

• where the risk comes from a complex structure, or one with no clear legitimate purpose, an analysis or expert opinion on the reasons behind it

Article 22 adds information on the customer's key customers, business partners and associates. Under Article 23, information on the source of funds and wealth shall satisfy you that they are lawful. It may include audited financial statements, investment documents, and credit and loan agreements. 

Shall or may? May for the means, shall for the result. After the consultation, AMLA changed the enhanced due diligence articles to stress that you choose the measures. But Recital 20 says the information should be good enough to test whether what you already hold is genuine and accurate.

Screening the entity

Under Article 25, you shall establish whether the customer, its beneficial owners, and anyone who controls it or meets the ownership conditions are subject to targeted financial sanctions. For a legal entity, you shall screen its legal name and any trade names, in the original alphabet or transliterated into Latin script, plus any other names, aliases and wallet addresses where available.

You shall screen at onboarding, when sanctions lists change, when the customer's due diligence data changes in a way that could matter, and regularly after that. Where a possible match leaves you in doubt, you shall turn to every source you have, including registers of owned and controlled entities and central registers.

Shall or may? Shall. You choose automated tools, manual checks or both, sized to your business. But AMLA rejected calls for a risk-based approach to sanctions screening. Screening must work whatever the customer's risk.

Part 2: Verifying natural persons

Who are you verifying?

KYB doesn't stop at the company. You also verify:

• Its beneficial owners (or senior managing officials, where no beneficial owner can be identified)

• Anyone purporting to act on its behalf, such as legal representatives or signatories

• For trusts and similar arrangements, the beneficiaries, including those named only by class

Articles 2 to 5 set the format for names, address, place of birth and nationality, for owners and officials as well as customers. A few practical points:

• Take names as they appear on the identity document or electronic ID (Article 2(1)).

• Take the place of birth as the document gives it, whether a country, state or city (Article 4).

• Take reasonable measures to find out whether someone holds more than one nationality. If they declare several, record them all and verify at least one (Article 5).

• For senior managing officials, you may take the company's registered office address instead of their home address (Article 3(2)). Recital 5 explains why: they act for the company, not for themselves.

Shall or may? Shall for the data. May for the senior managing official's address, a rare concession that cuts the personal data you hold.

Two standards of proof

The rules verify two groups of people in two different ways.

People acting for the customer are verified the way a customer would be. You shall use an identity document, passport or equivalent, a verified copy, or electronic identification that meets the eIDAS standard, including EU Digital Identity Wallets (Article 6(3) and Recital 11). Where neither works in a remote setting, Article 7 allows other remote tools with set safeguards, and you shall be able to justify using them. You shall also obtain information that lets you verify their power to act for the customer (Article 14).

Beneficial owners are verified through “reasonable measures” (Article 22(7)(b) of the AMLR and Article 10 of the RTS). That is a lighter standard. It doesn't demand an identity document for every owner. It asks for enough from reliable sources to be confident who they are.

Which sources count for beneficial owners?

Under Article 10, the information from the customer or other reliable sources may include:

• Public registers, other than the central registers, or other reliable national systems: the business register, residence register, tax register, passport database and property register, to the extent you can access them

• Other sources, including third-party sources such as reputable data services providers (credit agencies among them), credit or financial institutions, and obliged entities in your group

• Documents from the legal entity or arrangement that name the beneficial owner, where the named person's identity is certified by someone authorised to certify documents

Shall or may? May. Notice the exclusion: the list names public registers “other than the central registers”, with the business register being its first example.

The central register problem

The central register is each member state's register of beneficial owners. Recital 12 says you must consult it, but it isn't enough on its own to verify an owner.

The low-risk rules go further. Under Article 19(1), you may identify an owner or senior managing official from one of four sources:

• The central register

• A business or company register

• Information from the customer, including its confirmation that what you or your group already hold is adequate, accurate and up to date

• Publicly available information from a reliable, independent open source

Under Article 19(2), you may then verify using one of the last three, if it's not the one you used to identify.

Shall or may? May. Article 19 is an option that lightens the load in low-risk cases. But if you take it, the central register can identify an owner and never verify one.

In short: The central register tells you who the company says owns it. A second source must confirm it.

How do the rules change with risk? 

Low risk: Article 19, above. Note that Article 18's lighter data set, which drops the home address, covers the customer and the people acting for it. It doesn't mention beneficial owners.

Standard risk: Reasonable measures, drawn from the Article 10 sources. The central register is one input, never the only one.

High risk: Under Article 21, extra information on beneficial owners may include information to verify them, to assess their reputation, and on close relationships known to you or publicly known. Article 22 adds their business partners and associates, where relevant. Under Article 23, you shall be satisfied that the owners' source of funds and source of wealth are lawful. The evidence may include tax returns, payslips, property deeds and register extracts, inheritance documents, and reputable media or commercial data.

Shall or may? May for the evidence. Shall for the result.

Trust beneficiaries

Where beneficiaries are named by class or characteristics, you shall obtain a description of the class detailed enough to tell when individual beneficiaries become ascertainable, plus documents showing the description is correct and current (Article 12). For discretionary trusts, you shall obtain details of the objects of a power and the default takers, how the trustees can use their discretion, and whether they have (Article 13). In both cases, you shall take risk-sensitive measures to make sure the trustee keeps you updated.

Shall or may? Shall.

PEPs and sanctions

Before you take on a customer, you shall determine whether the customer or its beneficial owners are politically exposed persons (PEPs), their family members or known close associates (Article 17). You shall then recheck existing customers on a risk-based schedule, and straight away when their data changes or the official list of prominent public functions is updated.

Article 25 covers sanctions screening for beneficial owners, as in Part 1. People acting for the customer are screened only where you suspect someone is trying to evade or get round sanctions.

Shall or may? Shall. For both, you may use automated tools, manual checks or both, if they work and suit your size and business. After the consultation, AMLA stopped treating manual checks as a fallback.

What not to weigh

The rules also tell you what you can leave out.

• Don't ask for more documents to prove facts an identity document has already proved (Recital 4).

• Verify one nationality, not everyone (Article 5).

• You needn't take a senior managing official's home address if the registered office will do (Article 3(2)).

• Don't treat a structure as high risk just because it's complex (Article 11).

• Don't rely on the central register alone (Recital 12).

• Where electronic ID or a qualified trust service has verified someone, don't check the same data again. Fill in only what it lacks (Article 27(2)).

• Before you ask the customer for anything, check what you or your group already hold (Article 16(3) and Recital 22).

What to do now

1. Sort each requirement into “shall” or “may”. Treat the “shalls” as fixed. For each may, record which route you chose and why.

2. Check low-risk files that verify owners from the central register. Under Article 19, that doesn't work.

3. Know which registries issue extracts usable for legal purposes and pull them directly where you can.

4. Set a rule for how old an extract on file can be, tied to the customer's risk.

5. Plan the back book now. The update periods run from the date the RTS enter into force.

Remember: AMLA wants to see that the sources you used to build the story of a company were sound in the first place.

How to verify companies at source

Article 6(5) lets you verify a company against register extracts you retrieve yourself. Kyckr does that. It links live to 300+ official company registers worldwide, so every extract is current, independent of the customer and free from document tampering: three of the factors that Article 8 asks you to weigh.