AMLR customer verification: where current identity checks fall short

TL;DR: AMLA’s draft customer due diligence standards will define how customer identity verification must work across the EU from 2027, but IDnow says the fallback pathway, vague trust-service wording and weak anti-deepfake controls could leave exploitable assurance gaps. The hard part is not only compliance scope, but proving that verification methods, monitoring and audit trails can withstand cross-border regulatory scrutiny.

Editorial analysis by NHI Mgmt Group, based on content published by IDnow: “Europe’s AML Rules are Being Rewritten. Here’s What the July 10 Deadline Means for You.”.

By the numbers:

• AMLA will submit its draft Regulatory Technical Standards on July 10, 2026.
• The standards will apply directly across all 27 member states once adopted.
• AMLA’s public hearing in March 2026 drew over 1,600 stakeholders.

Key questions

Q: What breaks when customer verification rules allow weaker fallback identity checks?

A: Weaker fallback checks create a trust gap that fraudsters can exploit with synthetic documents, deepfake overlays or manipulated biometric feeds.

Q: Why does enhanced due diligence need ongoing monitoring after onboarding?

A: Because risk does not stay fixed after the initial review.

Q: How should organisations strengthen remote identity proofing without increasing fraud or bias risk?

A: Organisations should use identity proofing methods that verify a real person remotely with high assurance, strong spoof resistance, and measurable error rates.

Practitioner guidance

• Map every verification journey to a named assurance level Classify each onboarding path against eIDAS 2.0 Low, Substantial or High so teams know which evidence is sufficient and where current methods fall short.
• Remove any implicit reliance on fallback-only verification If a customer journey can pass with remote document scanning alone, treat that as an exception that needs business approval, stricter evidence and explicit anti-spoofing controls.
• Require anti-deepfake and injection detection for remote capture Enforce presentation attack detection, liveness checks and camera-origin validation wherever remote biometric or document capture is part of the proofing chain.

Bottom line: The article’s central warning is that EU customer verification is being standardised, but a weak fallback path and vague trust-service language could undermine the assurance the regulation is meant to create.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →