European Union 'Article 28 Standard' - Anti-Money Laundering Regulation (AMLR)

Article 28 customer due diligence standards (10th July 2026). Full AMLR applies from 10 July 2027, for businesses too prove their cross-border verification.

UNITED KINGDOM, July 22, 2026 /EINPresswire.com/ -- 10th July deadline was a quiet one, but it starts a loud countdown. Under Article 28 of Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation (AMLR), the Anti-Money Laundering Authority (AMLA) was required to finalise and submit its draft Regulatory Technical Standards on customer due diligence to the European Commission by 10 July 2026.

Once adopted, these Article 28 standards, become directly binding across every EU Member State, fixing the precise methodology every obliged entity must follow when the AMLR becomes fully applicable on 10 July 2027.
AMLR itself is the most significant overhaul of European AML/CFT compliance in a generation. It replaces the patchwork of national directives that has governed financial crime prevention across Member States with a single, directly applicable rulebook: one regulation, no national transposition, no local variation, and no grace period once the deadline arrives.

For large banks, this has been on the radar for two years. For the professional services firms who sit outside the financial sector, but who are themselves obliged entities, the practical implications have had far less attention, and the scope of who is caught has just got considerably wider.

A materially larger obliged-entity population:
AMLR brings a substantial expansion of who must comply. Alongside the traditional obliged entities, banks, payment and investment firms, insurers, accountants, lawyers and notaries, the newly obliged now explicitly include FinTechs, crypto-asset service providers, crowdfunding platforms, holding and financial holding companies, and, from 2029, professional football clubs. For accountants, lawyers and notaries specifically, enhanced due diligence thresholds are being lowered for one-off deal engagements, meaning enhanced measures will apply to a far larger share of everyday client work than under the current regime.

What Article 28 actually changes on the ground:
The Regulatory Technical Standards (RTS) for Article 28 submitted at the end of last week translate high-level AMLR principles into operational detail, and several of the changes will require real adjustment for SME-facing advisers:
CDD becomes continuous. The old model, heavy investment at onboarding and minimal ongoing review, is no longer compliant. A file is not 'complete', it is 'current as of'; ongoing monitoring must be systematic and documented, not ad hoc.
Central registers can identify a UBO, but the RTS confirm they cannot on their own verify one. Separate, independent verification is mandatory, which makes multi-source data providers essential rather than optional.
PEP definitions expand to explicitly include heads of local authorities with 50,000+ inhabitants, regional governors and state-owned enterprise executives, well beyond most firms' current watchlist coverage.
Where a UBO cannot be identified, firms must identify and verify every Senior Managing Official to the same evidentiary standard as a UBO, a significant uplift for complex corporate clients.

The Ultimate Beneficial Owner (UBO) problem most firms will struggle with AMLR's 25% beneficial ownership threshold sounds simple. In practice, modern ownership structures rarely are. Holding companies, nominee arrangements, offshore trusts and layered subsidiaries across multiple jurisdictions routinely obscure true beneficial ownership, sometimes deliberately, and standard registry filings in jurisdictions such as the British Virgin Islands, Delaware, Seychelles or Panama offer minimal transparency by design. Regulatory guidance is explicit that a central register may support identification, but does not, on its own, satisfy the verification standard. Closing that gap is now the obliged entity's responsibility, not the register's.

"The Article 28 RTS released on 10th July confirms what many advisers have suspected for a while: no single source is sufficient. Article 28 is built on the principle that verification must be constructed from multiple independent sources, not read off a single register extract. The firms that get ahead of this will not be the ones with the biggest compliance budgets. They will be the ones who can combine multiple official data sources with primary, as-filed registry documents to build the full picture, wherever in the world their client happens to be incorporated." - Mark Hargreaves, CEO, FirstLink Solutions Ltd

Three questions for professional services firms to ask now:
Can we evidence beneficial ownership from primary, official-source data, not just a self-declared register filing, for every jurisdiction our clients touch?
Where a client's structure spans multiple countries, do we have one consistent, documented verification approach, or a different manual process for each register we happen to use?
If a supervisor asked us to demonstrate how a UBO conclusion was reached, could we show our working, source by source, or only the document the client handed us?

Twelve months is a preparation window, not a deadline in itself. The RTS submitted on 10th July 2026 starts a clock that runs to 10 July 2027, when AMLR becomes fully applicable, AMLD6 takes effect alongside it, and existing national AML rules are repealed. From January 2028, AMLA begins direct supervision of around 40 high-risk cross-border institutions and the EU Digital Identity Wallet becomes mandatory for identification purposes. Firms that use the next twelve months to gap-analyse their current CDD and UBO processes against the finalised standard will make considered, well-evidenced changes. Firms that wait will be making the same changes under active supervisory pressure.

FirstLink is working with banks, law firms, consultancy/accountancy practices, financial services, FinTech, professional services firms and corporate service providers, as well as SMEs across the EU, now to pressure-test their current verification approach against the incoming standard, and to show what a single, verifiable, cross-border data source looks like in practice, without requiring a global bank's compliance headcount to run it and source it.

About FirstLink Solutions Ltd
FirstLink Solutions is a global KYB and AML data and cross-border business verification platform, providing access to a truly international database of business entities, beneficial ownership, financial crime, resilience risk, shareholder and officer data across 243 countries; along with unrivalled access to an 'as filed' registry PDF documents service. Clients include banks, financial services, FinTech, professional services firms, crypto organisations and corporate service providers, as well as SMEs globally.

Search. Verify. Monitor.

Media contact: Mark Hargreaves | CEO | FirstLink | mhargreaves@firstlink.world | www.firstlink.world

Mark Hargreaves
FirstLink Solutions Ltd
mhargreaves@firstlink.world
Visit us on social media:
LinkedIn

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.