Lighter is not fewer

Low risk is not a discount on the file. In AMLA's draft EU standard, simplified due diligence still identifies the customer, still identifies and verifies the beneficial owner, still asks what the relationship is for, and still keeps that current. Lighter, not fewer.

The document is a consultation paper, published at Frankfurt am Main on 9 February 2026, on draft regulatory technical standards under Article 28(1) of Regulation (EU) 2024/1624. It ran for three months and comments closed on 8 May 2026. Nothing in it is law: its own last article leaves the application date as a bracketed placeholder, and AMLA says it will consider feedback when preparing the draft standards to be submitted to the Commission for adoption.

The interesting part is what AMLA looked for and did not find. AMLA sought to identify due diligence measures that could be simplified, beyond the existing reduced measures that may already be applied pursuant to Article 33 of the AMLR, and then: at this stage, AMLA did not identify opportunities to specify additional measures to simplify the simplified due diligence measures without creating exemptions from the obligations stemming from the AMLR, which would exceed AMLA's mandate. In plainer words: AMLA went looking for further relief and says it found none it could give without switching an obligation off rather than turning it down, which it says would exceed its mandate.

The paper grounds that on the Regulation's recital 78, which it says clarifies that simplified measures are not an exemption from or absence of standard due diligence measures, but are rather a reduced set of scrutiny measures that should address all components of the standard due diligence procedure. All components. It adds that Article 33 of the AMLR already provides a range of measures in which due diligence can be simplified, including for instance by delaying verification by up to 60 days or by reducing the amount of information collected to identify the purpose and intended nature, and that AMLA considers Article 33 already sufficiently flexible.

Lighter, in practice, is Section 5 of the draft: five articles. Article 20 sets a minimum identification set for low risk, introduced by shall obtain at least. Article 21 says that to identify a beneficial owner or senior managing official in low risk you consult one of three sources: the information contained in the central register, business or company register; information provided by the customer, including information you may already hold; or publicly available information in a reliable independent open source. To verify, you consult one of the last two, and specifically one that was not used for identification purposes. In low risk, the register can identify; it never verifies. Article 24 keeps the purpose alive: at least risk-sensitive measures to understand the intended use of the product or service, where applicable the estimated value of transactions, where necessary the source of funds. Article 23 is the trap. If you reduce the frequency of identification updates, you take on monitoring to satisfy yourself that nothing changed, that no event requiring an update occurred, and that no suspicious or unusual activity inconsistent with a low-risk relationship appeared. In any case, the update duty under Article 26(2), point (b), of the Regulation still bites.

The only service-specific simplification, Article 22 on pooled accounts, is for credit institutions on five conditions that must all be met.

For Cyprus firms outside banking, this is the part to notice. The paper concedes that the draft standards have not been subject to public consultation insofar as they concern the non-financial sector, and that the EBA's earlier response focused on the financial sector. Question 5 asked what other simplified due diligence measures should be included. That door closed on 8 May 2026.

So when a file says low risk, the question is not which steps you dropped. It is how much less of each one you did.

Not legal advice. Verify against the primary source before acting.

Sources

• PRIMARY.
• PRIMARY (comparison aid only).

Screen against the current lists in seconds

FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.