Since AMLA published its final draft RTS on customer due diligence on 1 October 2026, two readings have spread through banks, insurers and telcos. One says non-certified methods will stay compliant. The other says the answer is simply “eID-first”.
Both are true, and both are incomplete. Remote document checks survive only as exceptions you must justify, customer by customer. And an eID alone rarely delivers the full dataset AMLR requires, or proves that the person presenting it is its holder.
Here is what a defensible onboarding strategy looks like.
Key dates
- 1 October 2026: AMLA publishes the final draft CDD RTS and sends it to the European Commission, which can still amend it.
- 24 December 2026: member states must make EUDI Wallets available under eIDAS 2.0.
- 10 July 2027: AMLR applies, including its identity verification rules in Article 22.
- Six months after entry into force: the CDD RTS applies. The exact date depends on when the Commission adopts and publishes it.
The open RTS date is no reason to wait. AMLR’s own verification rules apply from July 2027 either way.
What AMLR asks you to collect
Article 22(1)(a) of Regulation (EU) 2024/1624 (AMLR) sets a minimum dataset for every natural person you identify: the customer, anyone acting on their behalf, and anyone for whom a transaction is carried out.
- All first names and surnames
- Place and full date of birth
- Nationality (or statelessness, refugee or subsidiary protection status), plus a national identification number where applicable
- Habitual residence, or a postal address where the person has no fixed address in the Union, plus a tax identification number where available
Keep this list in mind. It is the yardstick against which every verification method below falls short in some way.
Two routes, and an order of preference
Article 22(6) AMLR gives you two ways to verify identity:
- In person: an identity document, passport or equivalent, supported where needed by reliable and independent sources.
- Remotely: electronic identification means at eIDAS assurance level substantial or high, or relevant qualified trust services.
The final draft RTS, dated 30 September 2026, sharpens this. Recital 11 says these eID means and qualified trust services should be used wherever possible, and confirms that EUDI Wallets qualify.
Two details matter for your planning:
- Notification is not required. An eID means counts whether or not it has been notified under Article 9 eIDAS, provided it meets the substantial or high requirements. In practice, supervisors are still likely to favour notified schemes, as earlier EBA guidance did.
- “Wherever possible” is a standard you will be measured against. It turns eID into your first-choice method, not one option among many.
Alternative solutions are allowed, at a price
Article 7 of the RTS opens the door to remote document-based verification, but only when the customer cannot reasonably present a document in person and has no access to qualifying eID means or qualified trust services.
That condition comes with a burden of proof. Under Article 7(3), you must be able to justify to your supervisor why the customer could not be verified through first-choice methods, and show that your alternative solution meets the RTS requirements.
Article 7(2) also sets five safeguards every alternative solution must include:
- Holder binding: controls proving the person presenting the document is its holder.
- Secure channel: integrity and confidentiality of the communication.
- Capture quality: images, video, sound and data clear enough to identify the person unambiguously.
- Stop on doubt: the process halts on technical failures, connection drops or any suspicion about identity or integrity.
- Audit-ready records: valid, current data, with copies time-stamped, stored securely and readable for later review.
Customer self-declarations are no substitute for any of this.
So the market reading is right: non-certified methods remain usable. But every time you use one, you are relying on an exception you will need to defend in an audit.
The Polish toolbox, and its gaps
In Poland, five means qualify as first-choice methods under eIDAS 2.0. Only one of them can deliver the full AMLR dataset on its own.
| Method | Assurance level | Notified | Key limitation | | Profil osobisty (e-ID card with chip + PIN) | High | Yes | Not the full AMLR dataset on its own | | EUDI Wallet (mObywatel Europa) | High | Yes (once live) | Polish data set has no habitual residence; use is voluntary | | Qualified trust service (certified) | Qualified | n/a | Can deliver the full AMLR dataset, if certified for it | | Profil zaufany | Substantial | Yes | Not the full AMLR dataset on its own | | Profil mObywatel (the eID means, not the app itself) | Substantial | No | Name, date of birth and PESEL only; no place of birth or residence |
The EUDI Wallet deserves a separate warning. Under Article 5a(15) eIDAS, using it is voluntary, and no one may make access to a service conditional on having one. Adoption across the EU may stay patchy for some time. A wallet-only onboarding journey would therefore exclude customers, and you are not allowed to require it.
Why “electronic identidcation-first” alone is not enough
Putting electronic veritication methods, like the EUDI and national Wallet, first is the right default. On its own, though, it leaves three gaps.
- The data gap. Most eID means do not carry the full AMLR dataset. Habitual residence is the usual missing field, so an eID step still needs a second step to complete the record.
- The holder gap. A valid credential proves the credential is genuine, not that the person presenting it owns it. A liveness check tied to the credential closes that gap.
- The coverage gap. Not every customer has a qualifying electronic ID, and the EUDI Wallet is voluntary. Everyone outside eID lands in a fallback you must justify.
A defensible setup closes all three:
- Several first-choice methods in one flow, so most customers can use one.
- A way to complete the AMLR dataset without sending customers on a second journey.
- A documented fallback that meets all five Article 7 safeguards, with a per-customer record of why it was used.
The pressure differs by sector, but the logic is the same:
- Banking: high volumes and close supervision make the justification burden heaviest.
- Insurance: onboarding is often occasional and remote, so drop-off from a narrow method list hurts quickly.
- Telco: mass-market onboarding means many customers will lack any single specific eID means.
How Identt closes the gaps
Available today: every route in one flow. Identt routes each customer to the strongest method available to them:
- EUDI Wallet support, IDENTT is ready for mObywatel Europa
- Physical document reading (NFC chip + PIN)
- mObywatel, with full access to the Ministry of Digital Affairs platform
- eIDAS substantial-level electronic identification methods, like mojeID
- Liveness checks that bind the credential to the person presenting it
- Document + liveness verification as the Article 7 fallback
Evidence you can defend. Article 7(3) requires you to demonstrate to your supervisor that your fallback meets every safeguard. Identt builds its document, biometric and anti-spoofing technology in-house, and its identity-proofing process is certified to ETSI TS 119 461. You get one accountable provider and one audit trail, not a chain of subcontracted checks.
Checklist before July 2027
Ask your onboarding team, or your vendor, these questions now:
- ☐ How many first-choice methods does our remote flow offer today?
- ☐ Which AMLR data fields does each method actually deliver, and how do we fill the gaps?
- ☐ Can we accept the EUDI Wallet without making it a requirement?
- ☐ Does our fallback meet all five Article 7(2) safeguards?
- ☐ Do we record, per customer, why a fallback was used?
- ☐ Are our records time-stamped, secure and readable for a supervisor’s review?
If any answer is “no” or “not sure”, there is still time. But not much.
FAQ
Does the CDD RTS already apply?
No. The Commission still has to adopt it and may amend it. It applies six months after entry into force, while AMLR itself applies from 10 July 2027.
Can we still use remote document checks?
Yes, as an Article 7 alternative solution. Only when the customer cannot reasonably present an ID in person and has no qualifying eID or qualified trust service, and you must justify each case to your supervisor.
Does an eID have to be notified under eIDAS?
No. Any eID at level substantial or high qualifies. Supervisors may still prefer notified schemes.
Is the EUDI Wallet enough on its own?
It qualifies, but you cannot require customers to use it, and the Polish data set does not include habitual residence. You still need the missing data and an alternative route.
Check your onboarding against AMLR
In a short review, Identt’s team will go through your current remote flow, show where it falls short of the RTS, and map which methods you can offer your customers. [Book your review: link to be added]
This article reflects AMLA’s final draft RTS on customer due diligence of 30 September 2026, which the European Commission still has to adopt and may amend. It is not legal advice.
