AMLA’s deadline to hand its Article 28 customer due diligence standards to the European
Commission fell on 10th July 2026. With the full AMLR applying from 10 July 2027, professional
services firms, not just banks, now have a defined and shortening runway to prove their cross-border
verification stands up to a single EU rulebook.
LONDON, 21 July 2026 — 10th July deadline was a quiet one, but it starts a loud countdown.
Under Article 28 of Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation (AMLR),
the Anti-Money Laundering Authority (AMLA) was required to finalise and submit its draft
Regulatory Technical Standards on customer due diligence to the European Commission by 10
July 2026. Once adopted, these Article 28 standards, become directly binding across every EU
Member State, fixing the precise methodology every obliged entity must follow when the AMLR
becomes fully applicable on 10 July 2027.
AMLR itself is the most significant overhaul of European AML/CFT compliance in a generation. It
replaces the patchwork of national directives that has governed financial crime prevention across
Member States with a single, directly applicable rulebook: one regulation, no national transposition,
no local variation, and no grace period once the deadline arrives.
For large banks, this has been on the radar for two years. For the professional services firms who
sit outside the financial sector, but who are themselves obliged entities, the practical implications
have had far less attention, and the scope of who is caught has just got considerably wider.
A materially larger obliged-entity population
AMLR brings a substantial expansion of who must comply. Alongside the traditional obliged entities, banks, payment and investment firms, insurers, accountants, lawyers and notaries, the newly obliged now explicitly include FinTechs, crypto-asset service providers, crowdfunding platforms, holding and financial holding companies, and, from 2029, professional football clubs. For accountants, lawyers and notaries specifically, enhanced due diligence thresholds are being lowered for one-off deal engagements, meaning enhanced measures will apply to a far larger share of everyday client work than under the current regime.
What Article 28 actually changes on the ground
The Regulatory Technical Standards (RTS) for Article 28 submitted at the end of last week translate high-level AMLR principles into operational detail, and several of the changes will require real adjustment for SME-facing advisers:
- CDD becomes continuous. The old model, heavy investment at onboarding and minimal ongoing review, is no longer compliant. A file is not ‘complete’, it is ‘current as of’; ongoing monitoring must be systematic and documented, not ad hoc.
- Central registers can identify a UBO, but the RTS confirm they cannot on their own verify one. Separate, independent verification is mandatory, which makes multi-source data providers essential rather than optional.
- PEP definitions expand to explicitly include heads of local authorities with 50,000+ inhabitants, regional governors and state-owned enterprise executives, well beyond most firms’ current watchlist coverage.
- Where a UBO cannot be identified, firms must identify and verify every Senior Managing Official to the same evidentiary standard as a UBO, a significant uplift for complex corporate clients.
- Remote identification must primarily use eIDAS-compliant electronic methods, with video identification downgraded to a fallback only.
The Ultimate Beneficial Owner (UBO) problem most firms will struggle with
AMLR’s 25% beneficial ownership threshold sounds simple. In practice, modern ownership structures rarely are. Holding companies, nominee arrangements, offshore trusts and layered subsidiaries across multiple jurisdictions routinely obscure true beneficial ownership, sometimes deliberately, and standard registry filings in jurisdictions such as the British Virgin Islands, Delaware, Seychelles or Panama offer minimal transparency by design. Regulatory guidance is explicit that a central register may support identification, but does not, on its own, satisfy the verification standard. Closing that gap is now the obliged entity’s responsibility, not the register’s.
Where FirstLink fits
FirstLink Solutions was built for exactly this standard: verified, official-source, cross-border data, structured so a compliance decision can be evidenced, not just asserted. FirstLink sources entity data directly from official government registries across 243 countries and territories, drawing on a database of over 480 million entities, and through the Financial Crime Report FirstLink traces beneficial ownership to a 10% threshold, ahead of AMLR’s 25% requirement, giving advisers a margin against future threshold changes rather than a check that only just clears the bar.
For the harder cases, ownership hidden behind secrecy-jurisdiction filings, nominee structures or multi-tier corporate trees, FirstLink’s Hidden Ownership Trace (HOT) report applies OSINT, NLP and behavioural linkage analysis to surface indirect ownership signals that a standard registry check cannot reach, while corporate tree mapping with active and inactive flags supports the multi-tier UBO calculations AMLR now demands. Screening runs across 1,600+ global sanctions, PEP and watchlist sources, updated every five minutes, with language-agnostic matching across 100+ languages, covering the newly expanded PEP categories the RTS introduce. Enhanced due diligence is supported by a dedicated suite of specialist reports covering individual reputational background, ownership, conduct and cyber exposure, and every FirstLink report is structured, dated and source-attributed, providing the audit-ready evidence trail that AMLA and national supervisors will expect to see.
“The Article 28 RTS released on 10th July confirms what many advisers have suspected for a while: no single source is sufficient. Article 28 is built on the principle that verification must be constructed from multiple independent sources, not read off a single register extract. The firms that get ahead of this will not be the ones with the biggest compliance budgets. They will be the ones who can combine multiple official data sources with primary, as-filed registry documents to build the full picture, wherever in the world their client happens to be incorporated.” – Mark Hargreaves, CEO, FirstLink Solutions Ltd
Three questions for professional services firms to ask now
- Can we evidence beneficial ownership from primary, official-source data, not just a self-declared register filing, for every jurisdiction our clients touch?
- Where a client’s structure spans multiple countries, do we have one consistent, documented verification approach, or a different manual process for each register we happen to use?
- If a supervisor asked us to demonstrate how a UBO conclusion was reached, could we show our working, source by source, or only the document the client handed us?
Twelve months is a preparation window, not a deadline in itself
The RTS submitted on 10th July 2026 starts a clock that runs to 10 July 2027, when AMLR becomes fully applicable, AMLD6 takes effect alongside it, and existing national AML rules are repealed. From January 2028, AMLA begins direct supervision of around 40 high-risk cross-border institutions and the EU Digital Identity Wallet becomes mandatory for identification purposes. Firms that use the next twelve months to gap-analyse their current CDD and UBO processes against the finalised standard will make considered, well-evidenced changes. Firms that wait will be making the same changes under active supervisory pressure.
FirstLink is working with banks, financial services, FinTech, professional services firms and corporate service providers now to pressure-test their current verification approach against the incoming standard, and to show what a single, verifiable, cross-border data source looks like in practice, without requiring a global bank’s compliance headcount to run it and source it.