AMLR 2027

Articles 19 to 46 of the AMLR are particularly relevant for the practical implementation of KYC processes. These include general customer due diligence obligations (Articles 19 et seq.), the identification and verification of customers and beneficial owners (Articles 22 et seq.), the requirements for determining the beneficial owner, including ownership and control structures (Articles 51 et seq.), the ongoing monitoring of business relationships (Article 26), the updating of customer data, and the requirements for simplified and enhanced due diligence (Articles 34 et seq.). For many institutions, this has concrete implications for data models, KYC questionnaires, the identification of beneficial owners, review processes, and the documentation of decisions.

The AMLR (Additional Productivity and Registration Regulation) specifies the requirements for Customer Due Diligence (CDD) much more precisely than previous regulations. Obligated entities must identify and verify customers, obtain information about the purpose and nature of the business relationship, determine and verify beneficial owners, assess risk factors, and continuously monitor the business relationship. Furthermore, the requirements for documentation, the timeliness of customer data, the traceability of decisions, and the consideration of ownership and control structures are described more precisely. For companies, this may mean that additional data fields are needed, existing KYC (Know Your Customer) and screening processes must be adapted, and review and monitoring processes must be redesigned.

For legal entities, additional information may be relevant, including details such as name, legal form, registered office, economic activity, country of incorporation, tax residence, identification numbers, governing bodies, and ownership structure. This also includes information on shareholders, intermediate companies, beneficial owners, and complex ownership structures.

Under the AMLR, the 25% threshold is an important starting point for identifying beneficial owners. A further new aspect is the requirement to examine more closely which direct and indirect shareholdings, voting rights, or other ownership interests can be attributed to a natural person.
Furthermore, a mere shareholding is not sufficient. Control, special control rights, and the interplay of ownership and control can also lead to a natural person being classified as the beneficial owner.

This increases the demands on data quality, audit logic and documentation for KYC processes, especially in the case of complex shareholding and group structures.

The AMLR (Additional Management and Monitoring Regulation) affects not only new customers but also existing business relationships. Obligated companies must review whether the information they hold for existing customers complies with the new regulatory requirements. This may require, in particular, additional information on ownership and control structures, a re-identification of the beneficial owner, adjusted risk assessments, and updated screening and monitoring processes. Furthermore, existing customer files should be reviewed and, if necessary, supplemented as part of regular reviews. Particularly high-risk business relationships should be prioritized when preparing and updating customer data.