AMLR

AMLR for firms that onboard clients

The EU Anti-Money Laundering Regulation replaces national AML rules on 10 July 2027. It sets how you verify a client, how often you refresh their data and how long you keep the record. Trust Circle covers identity, the KYC questionnaire, renewals and the record, from a provider on the EU Trusted List.

KYC add-on for Professional, €100 a month · Identity verification included, no fee per check

J. Novak · client recordKYC valid
IdentityVerified by a QTSP
QuestionnaireStandard KYC, version 3
Risk levelMedium · 34 points
Answers valid until12 Oct 2027
RenewalAutomatic, 30 days before

AMLR ART 22, 26(2) AND 77

Key dates

Three dates that matter for your firm

You are here: November 2026
10 Jul 2027

AMLR applies directly in every EU country, with no national transposition law. It replaces the national rules that implemented the AML directives.

Until then, your national AML law applies, and for banks and other financial firms, the EBA guidelines on remote onboarding. KYC and due diligence in Trust Circle →

What AMLR asks

AMLR turns a client file into a running obligation

What AMLR asks of your firm

  • Identify the client and verify their identity Art 20(1)(a), 22
  • Understand the purpose of the relationship and the client's occupation Art 20(1)(c), (e), 25
  • Find out whether the client is a PEP, and check for targeted financial sanctions Art 20(1)(d), (g)
  • Update client information at least every year for higher-risk clients, and every 5 years for the rest Art 26(2)
  • Keep due diligence records for 5 years after the relationship ends, then delete them Art 77

Two ways to verify a client remotely

a

An identity document.

A passport or national ID, plus information from reliable and independent sources where relevant. Art 22(6)(a)

b

Electronic identification.

eID at assurance level substantial or high under eIDAS, with relevant qualified trust services. Art 22(6)(b)

Before and after

What changes on 10 July 2027

Until 10 July 2027
From 10 July 2027
The rulebook
Your national AML law, which implements the EU AML directives
One regulation, applied directly in every EU country
Remote verification
National rules, plus EBA guidelines for financial firms
Two routes in Art 22(6), with AMLA's rules on the details
Refreshing client data
Timing set by national rules and your risk policy
At least every 1 year (higher risk) or 5 years (Art 26(2))
Keeping records
5 years after the relationship ends, under national law
5 years, then delete (Art 77)

What AMLR requires from small firms before July 2027 →

AMLR, article by article

Where Trust Circle covers your due diligence steps

AMLR article
What it asks of you
What Trust Circle does
22(1)(a)
Collect names, date and place of birth, nationality and usual residence
Shares the client's verified identity data, ID document picture and biometric picture, with the client's consent. Residence and tax details come from your questionnaire
22(6)
Verify the client's identity, including remotely
Clients verify once with an ID document and a liveness check, done by ZealiD, a QTSP on the EU Trusted List. Valid for 2 years
20(1)(c), 25
Understand the purpose and intended nature of the relationship
A questionnaire section on the purpose of the relationship
20(1)(e)
Understand the client's occupation or business
Occupation and source of funds questions
20(1)(g)
Find out whether the client is a PEP, a family member or a close associate
PEP questions for all three, with follow-ups only when the client answers yes
20(1)(d)
Check for targeted financial sanctions
Sanctions declarations from the client, plus a staff-only section to record your screening result. A sanctions answer can stop onboarding
20(2), 29
Scale measures to risk, with extra care for high-risk third countries
Points per answer and per country list give Low, Medium, High or Do not proceed, with a recommended action
26(2)
Update client information at least every 1 year (higher risk) or 5 years
A renewal period per questionnaire, with automatic renewal 30 days before expiry
77
Keep due diligence records for 5 years
Every answer stays tied to its questionnaire version and date, in a per-person history you can download

Article numbers refer to Regulation (EU) 2024/1624. Your firm's AML policy and risk decisions remain your own.

AMLA's draft rules

What AMLA's draft rules on client checks say

01

eID comes first.

AMLA's final draft of 30 Sep 2026 makes eID and relevant qualified trust services the default way to verify a client remotely.

02

Document and selfie need a reason.

Remote checks with an ID document and a selfie stay allowed as an alternative, but your firm must record why it could not use the default route.

03

It is still a draft.

The European Commission adopts the final rules. They apply six months after they enter into force, so the details can still change.

Where Trust Circle stands: ZealiD is a Qualified Trust Service Provider on the EU Trusted List. We'll publish how Trust Circle maps to the final rules once the Commission adopts them.

eIDAS and eIDAS 2 →

What stays with your firm

Live list screening

Sanctions and PEP screening against live lists runs in your screening tool. You record the provider, the lists checked and the result in Trust Circle.

The risk decision

Trust Circle gives a score and a recommended action. AMLR doesn't let you hand over the client's risk profile or the decision to onboard (Art 18(3)).

Company ownership

The questionnaire is built for natural persons. Beneficial ownership checks on legal entities follow your own process.

Trusted by banks, law firms and platforms

Customer KYCDocuSign

Meets German AML rules (GwG)

DocuSign resells ZealiD's qualified signature, with ID document data, to its customers in German finance for remote identification.

Read the case study →
LawDLA Piper

€20 saved

per signature

QES for lawyers, employees and clients.

Read the case study →
We are building a future-proof bank, digital by design… Our business clients can now sign their credit and guarantee documentation digitally with ZealID, a provider of qualified electronic signatures and a partner of ABN AMRO.
Robert SwaakCEO, ABN AMRO · Q2 2022 report

Qualified Trust Service Provider

Check us on the EU Trusted List, not on our word

  • Listed on the EU Trusted List (Sweden): qualified certificates for electronic signatures, qualified timestamps and remote qualified signature creation
  • Supervised by PTS, the Swedish Post and Telecom Authority
  • Audited every year by TÜViT
  • Identity checks certified against ETSI TS 119 461
  • Client consent recorded for every KYC request
  • Documents stored in Stockholm, EU

ZealiD AB

QUALIFIED TRUST SERVICE PROVIDER

LISTED SERVICES · SWEDEN

Qualified certificates for e-signaturesSince 9 Sep 2020
Qualified timestampsSince 10 Oct 2022
Remote qualified signature creationSince 20 Aug 2026
SupervisorPTS, Sweden

Pricing

KYC in the Professional plan

Professional + KYC add-on

€119.20a month, billed yearly

+ €100 a month for KYC

  • Up to 10 users
  • 75 QES a month
  • KYC questionnaires, risk scoring and automatic renewal
Try Trust Circle

Enterprise

Custom

  • 11 or more users
  • KYC as part of a custom plan
  • Custom contract
Talk to sales

Identity verification is included in every plan, with no fee per check. See all plans →

Get your client files ready before AMLR applies

Verify once, send your questionnaire, and let renewals run on schedule.

Questions about AMLR

When does the AML Regulation apply?

From 10 July 2027, under Article 90 of Regulation (EU) 2024/1624. Football clubs and agents follow on 10 July 2029.

Does AMLR replace our national AML law?

Yes, for the due diligence rules. It applies directly in every EU country, with no national transposition law. Until 10 July 2027, your national law still applies.

How often must we update client information?

At least every year for higher-risk clients and every 5 years for everyone else, under Article 26(2). Trust Circle sends the renewal request 30 days before the answers expire.

How long do we keep due diligence records?

5 years after the relationship ends, then the personal data must be deleted, under Article 77.

Can we verify clients remotely under AMLR?

Yes. Article 22(6) allows an identity document checked against reliable sources, or eID at assurance level substantial or high with relevant qualified trust services. AMLA's draft rules make eID the default route.

Does Trust Circle screen clients against sanctions lists?

Not itself. The client answers sanctions declarations, and your staff record the screening provider, lists checked, match result and reviewer in a section the client never sees.

Can we hand the risk decision to a provider?

No. Under Article 18(3), the client's risk profile and the decision to onboard stay with your firm. Trust Circle gives a score and a recommended action to support that decision.

Which plans include KYC?

The Professional plan, with the KYC add-on at €100 a month. On Enterprise, KYC is part of a custom plan. See plans.

Does identity verification cost extra?

No. It's included in every plan, with no fee per check.