Article 23 Customer identification data updates in low-risk situations


This is a draft act

This text has been parsed from the AMLA consultation paper draft as published on 9 February 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

    1. Where, in cases with a low degree of ML/TF risk, obliged entities reduce the frequency of customer identification updates as referred to in Article 33(1), point (b), of Regulation (EU) 2024/1624, obliged entities shall monitor the relationship in order to be satisfied that:

      1. there is no change in the circumstances relevant for the assessment of the business relationshipmeans a business, professional or commercial relationship connected with the professional activities of an obliged entity, which is set up between an obliged entity and a customer, including in the absence of a written contract and which is expected to have, at the time when the contact is established, or which subsequently acquires, an element of repetition or duration; with the customer;

      2. no event took place which would require an information update; and

      3. no suspicious and/or unusual transactions or activities were identified that are inconsistent with a low-risk relationship.

    1. In any case, obliged entities shall update the customer identification data in accordance with Article 26(2), point (b), of Regulation (EU) 2024/1624.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod