Covers Credit and financial institutions within scope of EU AML/CFT law.

The main requirements are to assess customer, country, product and channel risk; calibrate due diligence; document risk decisions; monitor relationships.

Customer due diligence builds a reliable picture of the person or organisation receiving a financial service. Collecting a name is different from verifying identity, and identifying a company's registered owner is different from understanding its ultimate beneficial owners or controllers. The purpose and expected use of the relationship provide context for assessing later transactions.

Risk-based treatment changes the depth and frequency of the work. Higher-risk circumstances can require additional information or enhanced review, while any simplified approach remains subject to the conditions of the governing framework. Customer information also changes over time: ownership, representatives, business activity and expected payment patterns can all affect the original assessment.

The operational outcome is a documented relationship between identity evidence, the risk decision and ongoing monitoring. Onboarding should feed the transaction-review process, and unusual activity should feed back into the customer assessment. Due diligence is therefore an ongoing information and decision-making process, rather than a one-time collection of documents or a name-screening result.

The instrument also addresses reporting and evidence: document risk assessments and controls and support suspicious-transaction reporting under applicable national law.