EU AML and KYC testing requirements

What EU AML and KYC rules require

Directive (EU) 2015/849 sets EU customer due diligence (CDD) rules through national law until Directive (EU) 2024/1640 repeals it with effect from 10 July 2027 (Article 77). From that date, Regulation (EU) 2024/1624 (AMLR, published 19 June 2024, checked on 2026-09-16) applies directly (Article 90) to obliged entities, which include credit institutions and financial institutions such as payment institutions and crypto-asset service providers (Articles 2(1)(6) and 3). The EU Anti-Money Laundering Authority (AMLA, Regulation (EU) 2024/1620) in Frankfurt selects 40 obliged entities during 2027 and supervises them directly from 2028 (AMLA, checked on 2026-09-16). The AMLR rules that change test scope:

• When CDD applies (Article 19). CDD applies to new business relationships and to occasional transactions of EUR 10,000 or more, including linked transactions. Crypto-asset service providers apply CDD to occasional transactions from EUR 1,000 and identify and verify the customer below that value.
• CDD measures (Article 20(1)). Point (d) extends the targeted financial sanctions check to persons who control a legal entity or hold more than 50% of it, individually or collectively.
• Identity data and verification (Articles 22 and 23). Article 22(1) lists the minimum data, including place and full date of birth and nationalities. Verification uses an identity document or eIDAS identification at assurance level substantial or high (22(6)). An account may open early, but no transactions run until the customer and beneficial owners are verified (23(3)).
• Ongoing monitoring (Article 26). Customer information is updated at intervals of no more than 1 year for higher-risk customers and 5 years for others (26(2)). Credit and financial institutions repeat the sanctions check on every new designation (26(4)).
• Enhanced due diligence and PEPs (Articles 34, 42, 45). Complex, unusually large, or unusual-pattern transactions are examined (34(2)). A politically exposed person relationship needs senior management approval (42(1)), and the measures continue for at least 12 months after the person leaves office (45(2)).
• Automated decisions (Article 76(5)). An automated decision to refuse or end a relationship is subject to meaningful human intervention.
• Reporting and records (Articles 69 and 77). Suspicious transactions, including attempted ones, are reported to the FIU, and FIU requests get an answer within 5 working days (69(1)). Records are kept for 5 years after the relationship ends (77(3)).

Regulation (EU) 2023/1113, the travel rule, applies from 30 December 2024. Transfers of funds carry payer and payee information (Article 4), and the payee's provider verifies payee information above EUR 1,000 (Article 7(3)). Crypto-asset transfers carry originator and beneficiary information at any amount (Article 14), with an ownership assessment for self-hosted addresses above EUR 1,000 (14(5), 16(2)). Since 9 January 2025, Regulation (EU) 260/2012 Article 5d, inserted by Regulation (EU) 2024/886, requires instant credit transfer providers to screen all users against EU targeted sanctions at least daily and on every list change, instead of during execution.

The global baseline is the FATF Recommendations (updated June 2026, checked on 2026-09-16): Recommendation 10 on CDD, Recommendation 15 on new technologies including virtual asset service providers, and Recommendation 16 on payment transparency, revised in June 2025 with effect by the end of 2030. In the US, the FinCEN CDD rule (31 CFR 1010.230) requires identification of each individual owning 25% or more of a legal entity customer and one control person. FinCEN order FIN-2026-R001 of 13 February 2026 allows institutions to limit repeat identification to the first account opening and risk-based triggers. The US funds travel rule (31 CFR 1010.410(f)) applies from $3,000. Canada is on the FINTRAC testing requirements page.