RTS on customer due diligence

Identity documents, passports or equivalent issued by a designated authority in accordance with the applicable law may not always contain all the identification information required for AML/CFT purposes. For instance, passports do not typically include a residential address. In such cases, and where verification of the address is required, obliged entities must take measures to verify such information using reliable and independent sources. However, obliged entities need not request additional documents to verify information that has already been verified through the identification documents issued by a designated authority in accordance with the applicable law, as this would entail the unnecessary duplication and processing of data.

Regulation (EU) 2024/1624 requires obliged entities to identify senior managing officials in certain situations where no beneficial owner can be identified. Recital 125 of that Regulation explains that, although identified as such, senior managing officials are not the beneficial owners. Since those persons act in their capacity as officials of the legal entity rather than for their direct personal benefit, and to minimise the processing of personal data, it should be sufficient to identify the registered office address of the legal entity rather than the residential address of those senior managing officials.

Obliged entities are expected to identify the nationalities held by a customer or beneficial owner. However, to establish whether a person holds any additional nationalities to those already identified and verified, obliged entities would, in most cases, have to rely on a declaration from the customer or beneficial owner. To this end, this Regulation only requires taking reasonable measures to identify any additional nationalities; and in the case of multiple nationalities, verifying one nationality will be sufficient. In situations where the person is stateless or has refugee or subsidiary protection status, this information should be obtained instead.

Information or data collected by obliged entities for customer due diligence purposes may not always be in the form of documents. This Regulation specifies the situations where documents should be collected.

For a document to be considered equivalent to an identity document or passport, it should give obliged entities sufficient reassurance of a person’s identity. Therefore, this Regulation sets out the minimum conditions, including the information and security features. Those security features may be based on international standards such as those set out in Part 2 of the International Civil Aviation Organization Document 9303. In order to ensure the reliability and integrity of identity verification processes, it is also appropriate for documents obtained for the purpose of verifying the identity of a natural person to be subject to checks for authenticity, including to ascertain that they have not been forged or otherwise tampered with.

Obtaining data and documents from independent and reliable sources is key to ensuring that obliged entities can be satisfied that they know who their customers are. Reliable and independent sources of information for customers that are not natural persons include, but are not limited to statutory documents of the legal entity or legal arrangement required by law, including certificates of incorporation or audited financial statements; the most recent version of the constitutive documents establishing the legal entity or legal arrangement, including a memorandum of association and articles of association, or a recent official copy or extract of these documents issued by the applicable public registers and lists or an unofficial copy thereof certified by an independent professional or a public authority. In the case of a trust or similar legal arrangement that may not be subject to registration, a recent copy of the trust deed or an extract thereof, together with any other document that determines the exercise of any powers by the trustees or similar administrators, certified by an independent professional, could qualify as a reliable and independent source of information. Obliged entities should also take into account the recency of a document and whether the passage of time has reduced the reliability of that information. It should be left to the obliged entity to determine the most appropriate method for ensuring they understand information in a foreign language.

There may be situations where the customer does not hold an identity document(s), passport(s) or equivalent that meets all the conditions set out in this Regulation. This could be the case where the customer has credible and legitimate reasons for being unable to provide traditional forms of identity documentation, for example being an asylum seeker; a refugee; a person to whom a residence permit was not granted but whose repatriation is impossible for legal or factual reasons; being homeless; or being otherwise vulnerable. Regulation (EU) 2024/1624 does not provide an exemption from the list of information obliged entities should collect for natural persons in this category. To mitigate the risk of financial exclusion and unwarranted de-risking, obliged entities should be able to obtain the requested information from these natural persons via other reliable and independent means. This could be the case where the customer is or acts on behalf of a minor who does not possess a passport or identity document. In view of the minor’s representation by a parent or legal guardian, who would themselves be subject to identification and verification, it would be appropriate to consider a birth certificate as a credible source for the purposes of identifying and verifying the identity of the minor. In situations where a verified copy of the identity document, passport or equivalent is required, it should be attested that the copy corresponds to the original document.

Regulation (EU) 2024/1624 requires obliged entities to verify identity through identity documents, passports or equivalent or through certain electronic identification solutions set out in Regulation (EU) No 910/2014. Those electronic identification solutions comprise electronic identification means as defined in Article 3(2) of Regulation (EU) No 910/2014, regardless of whether they are notified under Article 9 of that Regulation or not, as long as they comply with the requirements of either ‘substantial’ or ‘high’ assurance levels, as specified in Commission Implementing Regulation (EU) 2015/1502 of 8 September 2015 on setting out minimum technical specifications and procedures for assurance levels for electronic identification means pursuant to Article 8(3) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market(⁴). This includes European Digital Identity Wallets. Those electronic identification solutions also comprise relevant qualified trust services as defined in Article 3(17) of Regulation (EU) No 910/2014. While the electronic identification means and relevant qualified trust services described above should be used wherever possible, there may be situations where none of them can be used. This may occur where the customer cannot reasonably be expected to present identification documents in person and the customer cannot use the electronic identification solutions referred to above in Regulation (EU) No 910/2014. To ensure that such persons are not excluded and that financial or commercial services can continue to be provided, this Regulation enables the use of alternative verification measures through other means, taking advantage of developments in digital identity verification technologies. Such alternative solutions should nevertheless meet minimum requirements regarding the quality, security and confidentiality of the verification process, especially in the face of emerging technological threats. In these situations, obliged entities may continue using existing remote onboarding tools that meet those requirements. As such alternative solutions should only be used on a case-by-case basis where customers cannot be verified through either of the methods set out in Article 22(6) of Regulation (EU) 2024/1624, obliged entities should be required to justify instances of verification through such tools. Obliged entities may choose to demonstrate compliance with the minimum requirements through adherence to recognised international or European technical standards. Verification through electronic identification means or relevant qualified trust services need not be limited to non-face-to-face situations, and obliged entities should be able to use such means when verifying the customer’s identity in person.

Obtaining beneficial owner information for all customers that are not natural persons is essential for complying with AML/CFT requirements and with targeted financial sanctions obligations. For this reason, consultation of central registers for information on the beneficial owners is necessary. Central registers can be a source of information for the identification of the beneficial owner but are not sufficient on their own to fulfil the verification requirements.

The process of verifying that a person purporting to act on behalf of a customer is authorised to do so enables obliged entities to confirm that such person has legal or juridical representation of the customer or any other similar power to legally bind the customer. Where the customer is a legal entity, such persons could include the legal representatives, signatories or similar persons that seek to exercise such powers with regard to the customer. On the other hand, the authority to act on behalf of a natural person could be verified through instruments such as power of attorney or proof of legal or parental representation, including a court-appointed guardianship.

Understanding the purpose and intended nature of a business relationship or occasional transaction enables obliged entities to develop a holistic understanding of the customer. This allows them to assess whether the service or product requested is aligned with the customer’s profile and to conduct meaningful ongoing monitoring. To this end, the type and amount of information collected may vary depending on the product or service and should be proportionate to the risks sought to be mitigated. This also means that certain information will not always be relevant. Information on the source of funds, where needed, may provide reassurance that the funds to be used are derived from a legitimate source. However, the extent of information needed on the source of funds, if at all, should be commensurate to the risk to be mitigated. To avoid unnecessary processing of information, obliged entities should consider whether information already at their disposal contributes to understanding the purpose and intended nature of the business relationship or occasional transaction.

Article 20(1), point (h), of Regulation (EU) 2024/1624 requires that obliged entities identify and verify the identity of the natural person on whose behalf or for the benefit of whom a transaction or activity is being conducted. This Regulation lays down specific rules for the identification and verification of the identity of the final investors of a collective investment undertaking that distributes its shares or units through another credit or financial institution, which acts in its own name but on behalf or for the benefit of one or more final investors. To ensure the effectiveness of customer due diligence measures and the proportionality of their application, it is appropriate to allow collective investment undertakings, where the relationship with the intermediary institution is not assessed as posing a high risk, to rely on that institution for the identification and verification of the final investors, provided that strict conditions are met.

Regulation (EU) 2024/1624 requires specific measures to be applied to transactions or business relationships with politically exposed persons (PEPs). The focus of this Regulation is on measures for the identification, by obliged entities of PEPs, their family members or persons known to be close associates. PEP screening measures should apply to the customer, its beneficial owner and the person on whose behalf or for the benefit of whom a transaction or activity is being carried out. These measures are important because once a PEP, family member or person known to be close associate is identified, the obliged entity should apply specific and additional customer due diligence measures in relation to that customer.

Simplified due diligence measures should ease the administrative burden on obliged entities and on their customers and allow obliged entities to focus efforts where risks are higher.

Minimum requirements for the identification of natural persons in low-risk situations should include at least the type of information that is usually included in a passport or identity document. As such, this Regulation permits that in situations of low risk, obliged entities are not required to collect and verify the address of the natural person. This ensures that obliged entities have sufficient and verifiable information to establish the identity of their customers, while keeping the requirements proportionate to the low level of money laundering / terrorism financing risk.

This Regulation specifies the minimum information to identify the purpose and intended nature of the business relationship or occasional transaction in low-risk situations. When assessing the purpose and intended nature in such situations, there may be situations in which the risk-based approach still requires obliged entities to determine whether any additional information, such as the source of funds, is needed to mitigate specific risks.

In situations where the money laundering / terrorism financing risks are higher, Regulation (EU) 2024/1624 calls for the application of enhanced due diligence measures to manage and mitigate these risks appropriately. These measures apply in addition to the customer due diligence measures laid down in Article 20 of Regulation (EU) 2024/1624. Where obliged entities obtain additional information in relation to the measures referred to in Article 34(4) of Regulation (EU) 2024/1624, to meet these requirements and mitigate the higher risk appropriately and effectively, that information should be of sufficient quality to enable an assessment of the authenticity and accuracy of the information already held on the customer and to inform the overall assessment of the business relationship or occasional transaction.

Additional information obliged entities obtain to understand customers’ and beneficial owners’ source of funds and source of wealth in high-risk situations should enable them to satisfy themselves that the funds and assets used by the customer and beneficial owners are of legitimate origin.

There may be situations where the information to be collected under Regulation (EU) 2024/1624 and this Regulation is already available to the obliged entity or, for example, to other obliged entities within the group. This could also be the case when information is obtained, for instance, to understand the customer's investment profile, insurance needs, the nature of the engagement or as part of the audit acceptance process. Where this is the case, obliged entities should consider how such information contributes to complying with their AML/CFT requirements, such as understanding the purpose and intended nature of the business relationship or occasional transaction, before requesting similar information to avoid unnecessary duplication and reduce the regulatory burden on both the obliged entity and its customers. Where existing information is not deemed sufficient, additional information should be obtained.

Customer due diligence measures include a specific requirement for obliged entities to verify whether the customer or the beneficial owner is subject to targeted financial sanctions as defined by Article 2(49) of Regulation (EU) 2024/1624. Screening for the application of trade or economic sanctions, such as arms embargoes, trade restrictions or travel bans, falls outside the scope of Regulation (EU) 2024/1624 and, consequently, of this Regulation.

Article 19(7) of Regulation (EU) 2024/1624 provides a list of four conditions on the basis of which AML/CFT supervisors may decide to grant an exemption for electronic money issuers from the customer due diligence measures in Article 20(1), points (a), (b) and (c), of that Regulation. To enable supervisors to determine the extent of such exemption (i.e. ‘in full or in part’) in a consistent way across Member States, this Regulation provides AML/CFT supervisors with a non-exhaustive list of risk factors associated with features of electronic money instruments.

This Regulation sets out the minimum attributes that electronic identification means or qualified trust services must include to enable the identification and verification of the identity of a person for customer due diligence purposes. Some data points are only required when they are available, such as certain elements of an address, and certain data points are not relevant in all situations, for example data points concerning legal entities are not relevant when the customer is a natural person. The electronic identification means or qualified trust services used must nevertheless enable the capture of the minimum attributes specified in Annex I in structured data fields, so that obliged entities can verify a broad range of customers. This does not mean that obliged entities using electronic identification means or qualified trust services should identify and verify a larger set of data than the identification data required under this Regulation or Regulation (EU) 2024/1624.

Obliged entities need to ensure that their customer information remains up to date. The maximum periods of 1 and 5 years respectively for updating customer information in accordance with the requirements of Article 26(2) of Regulation (EU) 2024/1624 should only start with the date of entry into force of this Commission Delegated Regulation for ongoing business relationships established before that date.

To allow obliged entities sufficient time to adapt, where necessary, their systems, policies, controls and procedures, including training of staff, to the requirements laid down in this Regulation, and thereby facilitate their effective implementation, this Regulation should apply six months after its entry into force.

This Regulation is based on the draft regulatory technical standards submitted to the Commission by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (the ‘Authority’).

The Authority has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based and analysed the potential related costs and benefits,