Directly applicable EU AML/CFT rules covering due diligence, beneficial ownership, internal controls and high-risk measures.

The regulation establishes a directly applicable EU framework for the preventive measures taken by obliged entities. It brings core requirements concerning customers, transactions, ownership and internal controls into a common rulebook. Its adoption is distinct from its main application date of 10 July 2027, so the new framework should be distinguished from the national AML rules applying during the transition.

The main requirements are to apply harmonised CDD, risk management, beneficial-ownership and enhanced-measure controls.

Customer due diligence builds a reliable picture of the person or organisation receiving a financial service. Collecting a name is different from verifying identity, and identifying a company's registered owner is different from understanding its ultimate beneficial owners or controllers. The purpose and expected use of the relationship provide context for assessing later transactions.

Risk-based treatment changes the depth and frequency of the work. Higher-risk circumstances can require additional information or enhanced review, while any simplified approach remains subject to the conditions of the governing framework. Customer information also changes over time: ownership, representatives, business activity and expected payment patterns can all affect the original assessment.

The operational outcome is a documented relationship between identity evidence, the risk decision and ongoing monitoring. Onboarding should feed the transaction-review process, and unusual activity should feed back into the customer assessment. Due diligence is therefore an ongoing information and decision-making process, rather than a one-time collection of documents or a name-screening result.

The instrument also addresses reporting and evidence: file suspicious-transaction reports and retain prescribed records.