Old files, earlier clock

Customers you already have are not grandfathered. AMLA's final draft EU standard on customer due diligence says their files must be brought in line within set periods, and its recital starts those periods at entry into force: six months before the standard itself applies.

The document is AMLA's final report of 30 September 2026, Frankfurt am Main: draft regulatory technical standards under Article 28(1) of Regulation (EU) 2024/1624, the AMLR, with the text of a draft Commission Delegated Regulation. It is not law. AMLA's press release of 1 October 2026 says the final drafts have been submitted to the European Commission, and AMLA's factsheet says the Commission may still review and amend them; the provisions become definitive only on publication in the Official Journal.

The operative text is draft Article 28. In the case of existing business relationships established before the date of entry into force, the documents, data and information relating to those customers shall be brought in line with the requirements of the Delegated Regulation and of the AMLR on a risk-sensitive basis within the periods set out in Article 26(2) of the AMLR. In plainer words: every customer already on the books when the standard enters into force must end up with a file that meets both the new standard and the AMLR, approached according to risk, inside the AMLR's own updating periods. The target is the requirements of both, for instance the name, address, place-of-birth and nationality data the standard specifies in its Articles 2 to 5; in situations of low risk, its Article 18 sets a minimum identification set which, its recital says, need not include the natural person's address.

The article does not print the periods; it cross-refers. Recital 26 calls them the maximum periods of 1 and 5 years respectively. AMLA's factsheet reads them as no later than one year for higher risk customers and five years for all other customers, as set out in the AMLR. The factsheet itself says the standard takes precedence, so the article's cross-reference is the rule.

When does the clock start? Article 28 does not say; recital 26 does. The periods should only start with the date of entry into force of the Delegated Regulation for ongoing business relationships established before that date. Draft Article 29 has the Regulation enter into force on the twentieth day after publication in the Official Journal, and apply from six months after entry into force, except for obliged entities referred to in Article 3, points (3)(n) and (o), of the AMLR, to which it shall apply from 10 July 2029. AMLA's press release puts football agents and professional football clubs on that 2029 date.

That start date is the change from February. In the consultation paper of 9 February 2026 a single Article 33 caught relationships entered into before the publication date, left the application date as a bracketed placeholder, while its recital said the periods should only start with the application date. AMLA reports that some respondents flagged the inconsistency and asked for the deadlines to be calculated by reference to application rather than publication. The final text picks a third date: entry into force, in both the recital and the article, now split into Articles 28 and 29. AMLA also did not accept requests to extend or modify the one-year and five-year periods, saying they are established by the AMLR.

Put the two articles side by side. The clock on existing files starts at entry into force; the standard applies six months later. On this reading, and on the factsheet's one year, the window for higher-risk existing files closes six months after the standard starts to apply. How that clock runs for the two categories whose application date is 10 July 2029, the text does not say. No calendar date exists yet: that depends on the Commission adopting and publishing the text.

So for a Cyprus firm, bringing the existing book into line is not a job that starts when the new rules apply. On this draft, its clock starts six months before they do.

Not legal advice. Verify against the primary source before acting.

Sources

• PRIMARY.
• CONTEXT.
• CONTEXT.
• CONTEXT.

Screen against the current lists in seconds

FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 3 free full assessments, no card required.