First published 12 June 2026.

Updated 19 October 2026 to reflect AMLA’s final draft RTS dated 30 September 2026. 

1. AMLA’s CDD RTS: From Consultation to Final Draft

On 9 February 2026, AMLA published its consultation paper on the draft RTS under Article 28(1) of Regulation (EU) 2024/1624 (AMLR), specifying how obliged entities should apply CDD requirements in practice, including the information and documents to be collected. The consultation closed on 8 May 2026. AMLA held a public hearing on 24 March 2026. AMLA received 325 responses. On 1 October 2026 it published its final report, dated 30 September 2026, containing the final draft RTS and its consultation feedback, and confirmed that the final draft has been submitted to the European Commission. The RTS take legal effect only once the Commission adopts them as a delegated regulation and they are published in the Official Journal. 

The draft RTS builds on the EBA’s response to the European Commission’s Call for Advice, delivered on 30 October 2025, and incorporates amendments following AMLA’s review and input from the Commission’s expert group on ML/TF. The final draft keeps the policy approach and structure of the EBA’s response, with targeted amendments for legal clarity, simplification and applicability to the non-financial sector. The text has been reduced from 33 to 29 articles, with several provisions merged or renumbered.

Rationale

The AMLR, which applies from 10 July 2027 (Article 90), harmonises CDD obligations as a directly applicable regulation. The RTS will carry their own timing: under Article 29 of the final draft they enter into force 20 days after publication in the Official Journal and apply six months later, or from 10 July 2029 for football agents and professional football clubs. The RTS specify what information must be collected, from which sources and to what standard of verification, across standard, simplified and enhanced due diligence, PEP identification, targeted financial sanctions screening, ownership and control (including trusts and discretionary trusts), collective investment undertakings and the attributes of electronic identification means.

Objective

The RTS aims to ensure a proportionate, risk-based, and harmonised application of CDD across all categories of obliged entities, including new entrants under the expanded AMLR scope. These include crypto-asset service providers, high-value goods dealers and, from 2029, football agents and professional football clubs. AMLA sought non-financial sector input given limited participation in the EBA’s 2025 consultation, and the final draft keeps a single horizontal instrument for both sectors, with targeted sector-specific provisions only where justified.

Status and timeline

AMLA published the final draft and its consultation feedback on 1 October 2026 and submitted the text to the Commission. The remaining steps are adoption by the Commission as a delegated regulation, with or without amendments, and publication in the Official Journal. At the date of this update we found no Commission adoption or Official Journal publication. Implementation planning should use the 30 September 2026 text and be checked against the adopted version. 

Related instruments have also moved. AMLA published the final draft RTS on group-wide requirements (Articles 16(4) and 17(3) AMLR) on 1 October 2026, alongside the CDD RTS. Consultations on draft Guidelines on the business-wide risk assessment (Article 10(4) AMLR) and on ongoing monitoring of business relationships (Article 26(5) AMLR) have closed; the latter governs how CDD information is kept up to date. 

These workstreams are connected because the customer-level information collected under the CDD RTS feeds both the business-wide risk assessment and group-wide obligations. 

2. The proportionality question

2.1 What the consultation revealed, and what AMLA changed

AMLA presents the draft RTS as proportionate, risk-based, and workable across both the financial and non-financial sectors. The consultation tested that intent against practice, and produced a consistent message from across the financial and non-financial sectors. 

Respondents broadly supported harmonisation, but they warned that the draft RTS was more prescriptive than the AMLR it implements, and that this risked weakening the risk-based approach the Level 1 framework is built on. This is the central tension in the file, and it is the one an obliged entity has to manage. 

The final draft answered part of that concern. The information on purpose and intended nature (Article 16) and the additional EDD information (Articles 21 to 24) are now framed as options that obliged entities may draw on; the extent of information and of its verification must be commensurate with risk (Article 16(2)); and Article 1 now refers expressly to simplified measures in low-risk situations. AMLA’s factsheet states that the Article 16 examples are not a checklist to be followed systematically. Minimum lists remain where the AMLR requires them, notably identification in low-risk situations (Article 18) and the data to be screened for targeted financial sanctions (Article 25(2)(a)). 

A credible operational response is to make proportionality explicit, evidenced and reviewable, and automation can support that where it preserves risk-based judgement, rather than replacing it. 

Several provisions of the draft RTS specified the information to be collected using mandatory phrasing, requiring obliged entities to "obtain at least" defined data points. Respondents argued that, taken together, these provisions read as more prescriptive than the risk-based approach the AMLR establishes, narrowing the room for calibrated judgement. Because the draft combined both registers, the question was which specific provisions tipped from risk-based calibration into fixed obligation, not whether the instrument as a whole was prescriptive. Industry responses to the EBA's earlier consultation, carried into the AMLA process, made this point directly and asked for the text to be realigned with the proportionality principle. Accountancy Europe raised the same concern for the non-financial sector, noting that detailed CDD measures left limited room for sector-specific judgement and that short refresh timeframes for existing high-risk customers were operationally heavy for smaller firms. The European Banking Federation cautioned that requiring additional data on lower-risk clients added friction and diverted resources from higher-risk cases, and the draft RTS itself acknowledged the risk of financial exclusion and unwarranted de-risking. AMLA also stated that it could not address concerns that stem from the AMLR itself, and that it found no room to simplify SDD further without creating exemptions from the Regulation. 

CleverChain's position is that the proportionality objection is well founded and that the resolution is operational. A prescriptive standard becomes manageable when the work of collecting, sourcing and reconciling information is automated, and when the calibration decisions (what was checked, why a measure was applied or stood down, what remains outstanding) are recorded as evidence rather than left implicit. That is what turns a heavier rulebook from a cost problem into a controlled, defensible process. It is also what a supervisor will look for, meaning a demonstrable, risk-based rationale for the measures taken on each customer, rather than maximal data on every customer. The final draft confirms that direction. AMLA removed the fixed definition of a complex corporate structure and replaced it with a duty to assess, structure by structure, whether more information is needed (Article 11(4)), and it turned most information lists into options. Each change moves the work from collecting a prescribed data set to recording why the set collected was enough for that customer. A due diligence process that documents this reasoning customer by customer is aligned with the final text.

2.2 Three angles worth weighing

The burden objection is concrete and operational, and it is the strongest case for automation. In its response to the CDD RTS, the European Banking Federation objected that the complex-structure test applies a layer count rather than a risk-based assessment, that collecting detailed information on intermediary entities with which the bank has no relationship goes beyond the Level 1 requirement and is operationally heavy for banks with international corporate clients, and that the one-year window to remediate existing high-risk customers is unlikely to be feasible. The final draft drops the layer-count test; complexity is now assessed against indicators under Article 11(4). The one-year and five-year periods for bringing existing customers into line are set by Article 26(2) AMLR and remain. Under Article 28 and recital 26 of the final draft, those periods run from the RTS’s entry into force, which comes six months before the RTS apply. Even with these changes, the impact is more structured data, collected more often, across more entity types, including new obliged entities such as crypto-asset service providers and high-value goods dealers. Manual processes do not scale to that, while automation that produces a consistent, sourced, auditable record per entity in a short time is the mechanism by which an obliged entity meets a demanding standard without a proportionate increase in cost and headcount. 

Technological neutrality is widely recommended. Respondents cautioned against the RTS privileging a single solution, in particular electronic identification under eIDAS, over other secure remote verification methods, on the basis that mandating one rail would limit flexibility and innovation where other safeguards are adequate. In the final draft, electronic identification means and relevant qualified trust services remain the default route for remote verification. Alternative remote solutions are permitted under Article 7 where the customer cannot use them, subject to listed safeguards and a documented justification. AMLA states that it applied technological neutrality to remote verification, PEP identification and sanctions screening, and Articles 17(3) and 25(2)(a) allow automated tools, manual checks or a combination. The same principle supports source-agnostic due diligence. A process that draws on official registries, licensed commercial data and open sources, and that records the reliability of each source against the Article 8 criteria, is more durable than one tied to any single data rail or identity scheme. Technological neutrality is an argument supporting evidenced, multi-source diligence.

2.3 What changed in the final draft

The June version of this paper identified five provisions likely to move. The outcome was as follows. 

• Mandatory register: softened for purpose, intended nature and EDD (permissive lists); retained for low-risk identification minima and sanctions screening data. 

• Senior managing officials: the standalone article was removed; the option to record the entity’s registered office address instead of the official’s residential address remains (Article 3(2)). The scope of the residual category is set by the AMLR and was not changed. 

• Refresh timeframes for existing customers: unchanged at one and five years, because they derive from Article 26(2) AMLR; the periods run from the RTS’s entry into force. 

• Electronic identification: retained as the default, with conditional alternatives under Article 7. 

• Numbering: changed; the final draft has 29 articles and this paper now uses that numbering. In the final draft, Article 12 covers beneficiaries of trusts; ownership complexity is addressed in Article 11(4) and Article 21(d). 

• Not anticipated in June: removal of the complex corporate structure definition (Section 4). 

The Commission may still amend the text before adoption; references should be checked once the delegated regulation is published. 

Against that background, the sections that follow set out how contextual, agentic due diligence supports the obligations in the final draft. 

3. Contextual Intelligence: VERA’s Role in the CDD Control Framework

VERA is CleverChain’s autonomous AI Due Diligence Agent capable of end-to-end CDD/EDD on physical and legal entities, including in complex cases. VERA combines proprietary, internal and open-source intelligence to deliver targeted contextualized insights and screening, consistently with the user’s individual policies and procedures. It generates entity reports capturing and explaining every investigative step, surfacing key data sources, spotlighting risk outcomes and anchoring findings with verifiable links and sources. It surfaces indicators of AML, fraud, operational, financial and reputational threats to accelerate onboarding, reviews and remediation on customers, partners and suppliers. 

VERA supports rather than replaces the obliged entity’s CDD, EDD, escalation and acceptance decisions. Its function is to collect, reconcile, contextualise and evidence due diligence information and to surface risk indicators and information gaps. Its limits, and the institution’s retained accountability, are set out in Section 6. 

The following capabilities of VERA are directly relevant to the draft RTS. 

3.1 From verification to contextual KYB

A foundational distinction underlies the entire RTS: verification confirms that a legal entity exists, while KYB establishes and maintains a documented, evidence-based understanding of who a customer is, what it actually does, who controls it, and how its risk profile evolves over time. 

The RTS operationalises the four regulatory obligations that separate KYB from verification: establishing the purpose and intended nature of the relationship (Art. 16), identifying beneficial ownership and control structures (Art. 11), conducting a customer risk assessment grounded in activity intelligence, and maintaining that assessment through ongoing monitoring and updates of customer information under Article 26 AMLR, with transitional periods for existing customers under Article 28 of the final draft RTS. These obligations are codified expectations of FATF, JMLSG, BCBS, EBA, and FinCEN. VERA is built to address all four, not merely the first. 

Registry data reflects what a company is on paper at the point of its last filing, not what it does operationally, not who exercises actual control, and not how its risk profile is changing. A business that pivots into new products, onboards new counterparties, or expands into higher-risk jurisdictions may not trigger any registry event for months or years. From a verification standpoint, nothing has changed. From a risk standpoint, everything has. VERA addresses that gap by producing contextual intelligence that goes beyond static identity confirmation to deliver the business understanding the RTS requires. 

3.2 Entity identification and multi-source verification

VERA collects and cross-references entity data (legal name, trade name, aliases, registration numbers, LEI, addresses, legal form, jurisdiction, status) from official registries, commercial data sources and public directories. Each data point is sourced and cited independently, enabling obliged entities to demonstrate the reliability and independence of their verification sources as required by Art. 8 of the RTS (credibility, official status, up-to-dateness, accuracy, forgery resistance). 

3.3 Ownership, control and complex-structure intelligence

VERA traverses the full ownership chain from target entity to ultimate beneficial owners, identifying each intermediate entity, its jurisdiction, legal form, and percentage holdings. The output includes a structured organigram and a narrative description of the chain. Where no natural person meets the applicable UBO threshold, VERA identifies senior managing officials by the residual method and documents the exhaustion of identification means. 

Genuine control intelligence requires mapping more than legal ownership. VERA analyses direct and indirect shareholding, circular ownerships, trust and foundation layers, shared directorships across entities, and the informal control relationships that lie outside formal structures. For complex, multi-tier groups (such as those with holding structures spanning multiple jurisdictions, publicly listed parents with institutional and family-controlled shareholding blocks, or entities where control is exercised through family arrangements and board composition rather than majority shareholding), VERA leverages documentation of public domain beyond registry extracts, such as annual reports, audited financial statements, corporate governance disclosures, regulatory filings, and LEI data. 

VERA also identifies the complexity elements listed in Article 11(4) (number of layers, legal arrangements, entities in high-risk jurisdictions, nominee involvement) and assembles the additional information an obliged entity may need to understand the structure. Section 4 sets this out. 

3.4 Additional dimensions of risk

Address screening. VERA performs a structured assessment of registered and trading addresses against multiple checkpoints including e.g. property type and occupancy, virtual-office and mail-forwarding detection, marketing/directory presence, adverse media and legal filings linked to the address, other resident/occupant associations, telephone and domain reverse-lookups, and regional crime/risk profiling. This goes beyond confirming that an address exists (verification) and into understanding what the address reveals about the entity’s operational reality. 

Nature of business. VERA cross-references all available activity codes (SIC, NAICS, NACE, local codes) against actual observed behaviour: web presence, trading footprint, directory listings, product/service descriptions, regulatory permissions, and import/export records. Where the declared activity diverges from the evidenced activity, the gap is flagged. This supports Article 16(1)(e), whose examples include whether the customer is actively engaged in business, its geographical presence, its main sources of revenue and its key stakeholders, and, in higher-risk cases, Article 21(c) (information allowing a more comprehensive assessment of ML/TF risk). The user is systematically notified about data being verified/univocal, indeterminate, or inferred. 

Financial health and operational risk. For legal entities, VERA provides not just raw financial data but analytical indicators: liquidity and solvency ratios, profitability trends, debt and leverage, cash position, group support dynamics, and sector/market risk factors. These enable obliged entities to assess whether a customer’s financial profile is consistent with its declared activity and transaction patterns, supporting Article 16(1)(b), which allows estimates to be supplemented with sectoral benchmarks or forecasts, and Article 24(b) (consistency of transactions with the customer’s activities and turnover in EDD). rt. 28 (transaction consistency in EDD).

3.5 Risk-relevant natural persons

The RTS applies not only to legal entities but also to relevant natural persons, including beneficial owners, senior managing officials identified through the residual method, PEPs, family members and close associates, persons purporting to act on behalf of the customer, and directors where they fall into one of those categories or are otherwise risk-relevant. 

VERA’s due diligence on individuals produces structured, investigator-grade output covering, among the others, the following data blocks: 

• Identity and PEP classification. Full name (including transliterations across scripts), date of birth, nationality, jurisdiction. PEP status assessed against parliamentary, governmental, and regulatory records, with tenure dates and ongoing post-tenure risk classification per FATF guidance. 

• Source of Funds/Wealth. Career and wealth timeline, wealth drivers, corporate scale indicators, estimated wealth range. Self-reported claims are cross-referenced against corroborated evidence, reputable media and corporate filings. Information gaps and confidence levels are documented explicitly. This enables obliged entities to populate the SoF/SoW information fields the RTS specifies for both standard (Article 16(1)(c)) and enhanced due diligence (Article 23). Article 23(g) lists information from reputable media publications or reputable commercially available service providers, including analytical services, among the sources an obliged entity may use. 

• Associations map: companies, business associates, and family members. Each associated entity is identified by sector, jurisdiction, relationship type, ownership/control classification, status, and risk flags. Associated individuals are classified by role, relationship, jurisdiction, and risk indicators. Family members used as proxy asset holders are flagged with supporting evidence. 

• Corroboration and information gaps. The report explicitly distinguishes between well-corroborated findings (official records, reputable investigative journalism, multiple independent sources) and lower-confidence claims (single-source, kompromat-style publications, unverified registry matches). Where information is missing or fragmentary, the gap is documented rather than papered over. 

This structure enables obliged entities to satisfy their identification and verification obligations for beneficial owners and senior managing officials (Article 10 of the RTS; Article 22(2) AMLR for senior managing officials, with Article 3(2) of the RTS on their address), PEP identification (Article 17), and additional information on source of funds and source of wealth (Article 23). 

3.6 Network analysis and risk-relevant directorship patterns

VERA identifies links of individuals and businesses to a network of third parties globally, mapping where a person acts as director, UBO, or shareholder across jurisdictions. Each connection is validated against name and date of birth, with match status graded as positive, indeterminate, or unmatched. This surfaces hidden corporate clusters, cross-border directorship overlaps, and entity proliferation patterns that static screening cannot detect. 

VERA also detects behavioural indicators at the individual-corporate nexus: compulsory strike-off patterns, rapid entity churn, address clustering across multiple registrations, dormant or paper-capital filings, SIC mismatches between registered and actual activity, wave incorporation, and mass dissolution bursts. These patterns are relevant to understanding the ownership and control structure and how it affects risk (Article 11(1) and (3)), to information on the customer’s key business partners and associates in higher-risk cases (Article 22(c)), and to the analysis of the rationale behind a structure contemplated by Article 21(d). For instance, an individual registered as director of multiple recently incorporated, dormant entities at a single shared address, with no verifiable trading activity, represents a materially different risk profile from a director of a single operating company at its own commercial premises. VERA flags these patterns systematically, enabling the obliged entity to document its complexity assessment under Article 11(4). 

3.7 Screening, adverse media and reputational intelligence

Sanctions, PEP and adverse media screening use multi-attribute, contextual entity resolution (name, date of birth, role, geography, corporate identifiers) rather than string matching alone, which discounts false positives while reducing the false negatives that list-based screening misses. Screening covers a configurable universe of sanctions lists and major leak databases, and media is analysed across languages, transliterations and scripts (including e.g. Arabic, Cyrillic and Chinese), capturing signals that monolingual watchlists omit. This matches Article 25(2)(a) of the final draft, which requires names to be screened in their original alphabet and/or transliterated into the Latin alphabet, with other names, aliases and digital wallet addresses where available. Each finding is attributed, timestamped, and graded by type, status and confidence, with allegations, investigations, convictions, settlements, sanctions and acquittals treated as distinct events rather than equivalent ones. Positive signals such as acquittals and regulatory clearances are captured alongside adverse ones, avoiding the one-sided risk accumulation of watchlist-only approaches. 

VERA also performs behavioural consistency checks: testing the alignment between a company’s public statements (corporate governance disclosures, ESG commitments, sustainability reports, investor communications) and its evidenced behaviour. Where a company publicly commits to exiting a sanctioned or conflict jurisdiction but continues to operate there, or where declared compliance postures are contradicted by regulatory penalties, product recalls, or supply chain findings, the gap is flagged as a reputational risk indicator. Similarly, a company designated by a foreign government as a “war sponsor” while maintaining that its operations are limited to “essential goods” presents a consistency gap that requires documented assessment, not a binary screening result. This type of analysis is not typically captured by watchlists and mainstream screening approaches, as it requires the contextual reasoning that agentic due diligence provides. In higher-risk cases, Article 21(b) lists information to assess the reputation of the customer and its beneficial owners among the additional EDD measures. 

3.8 Audit trail, policy mapping and deployment

Every investigative step is explained, logged and timestamped. Reports include a detailed entity resolution methodology (exact/fuzzy matching, multi-language transliteration, alias consolidation, multi-factor validation, false positive mitigation controls) and a complete evidence appendix with source URLs and retrieval dates. This native audit trail aligns with the RTS’s requirements for demonstrating verification measures to competent authorities. Transparency, auditability, bias testing and explainability controls are core elements of the VERA testing that CleverChain is conducting as part of the UK FCA Regulatory Sandbox. 

VERA’s DD protocol, format, data blocks, and risk sensitivity are configurable by institution, product, customer segment, and jurisdiction. Obliged entities can calibrate output in line with the RTS’s risk-based proportionality principle (Art. 1), within the overarching AMLR and RTS framework. Each VERA report then concludes with a structured control checklist mapping the obliged entity’s own risk-based CDD/EDD policy against the information collected, with completion status per item (completed, partial, outstanding). The checklist is configured to the institution’s policy, so items the policy does not require for a given risk level are excluded, with the policy setting the reason. Since the final draft frames most information lists as options, the checklist shows what was judged relevant for that customer and on what basis, which is the reasoning a supervisor will test under Articles 1 and 16(2). Where items remain outstanding, the checklist makes the gap visible and actionable rather than concealed within a narrative report. 

VERA produces structured due diligence reports in minutes where source availability and case complexity permit, including for many complex corporate structures. More complex cases may still require customer outreach, additional documentation or analyst review. Deployment is available through a secure web application, with API and MCP endpoints supporting integration into onboarding, periodic review, remediation and case-management workflows. 

4. Ownership Complexity in the Final Draft: Articles 11 and 21(d)

The consultation draft defined a complex corporate structure and attached additional measures to it. The final draft removes that definition. Article 11 now requires obliged entities to take risk-sensitive measures to understand the ownership and control structure, to obtain set information on intermediate entities, to understand how the structure affects ML/TF risk, and to assess whether more information is needed having regard to elements that may increase complexity. Where complexity, or the absence of an apparent legitimate purpose, results in high risk, Article 21(d) lists an analysis or expert opinion on the rationale behind the structure among the EDD measures. 

4.1 From a defined trigger to a documented judgement (Article 11(2) to (4))

Where there is more than one legal entity or arrangement between the customer and its beneficial owners, Article 11(2) requires information on each intermediate entity. Article 11(4) then requires the obliged entity to assess whether more information is needed, having regard to elements that may increase complexity, such as: (a) the number of intermediate layers; (b) legal arrangements or similar legal entities in any layer; (c) the customer or any entity in the chain being registered in a high-risk jurisdiction; and (d) nominee shareholders or directors. These are indicators to weigh, with no numerical threshold and no requirement that several be present. The consultation draft’s condition (d), opacity with no legitimate rationale, is no longer a definitional criterion; the question reappears in Article 21(d) for high-risk cases. 

What removing the threshold means in practice. The EBA’s March 2025 draft treated two or more intermediate layers as complex; its October 2025 version required three or more layers plus more than one further condition; AMLA’s consultation draft kept that test. The final draft drops the threshold. The deliberately opaque two-layer structure that fell below the consultation-draft trigger is now caught by the general Article 11(4) assessment, and so is every other multi-entity structure: for each one, the obliged entity must decide, and be able to show, whether more information was needed. The exposure moves from a structure falling below a line to an assessment that was never recorded. 

Assessing the rationale for a structure: guidance and practice. Whether a structure has an apparent legitimate purpose cannot be read off structural facts such as layer count, legal form, jurisdiction or nominee status. It needs two stages: detecting indicators of opacity, then testing whether a legitimate economic, legal or other rationale explains what was observed. Documented as a structured record (indicators found per category; rationale identified, with reasons either way), the assessment supports the understanding required by Article 11(3) and, in high-risk cases, the analysis contemplated by Article 21(d). 

International standard-setters and supervisory authorities have developed converging indicator frameworks for detecting opacity without legitimate purpose. FATF’s updated guidance on beneficial ownership of legal persons under Recommendation 24, together with its guidance on beneficial ownership and transparency of legal arrangements under Recommendation 25, emphasises the need for adequate, accurate and up-to-date beneficial ownership information, effective access to such information, and measures addressing the misuse of complex ownership structures, nominees and legal arrangements. The joint FATF/Egmont Group report on Concealment of Beneficial Ownership remains relevant for typologies, identifying recurring concealment indicators including mass nominee arrangements, informal nominees, addresses associated with trust and company service providers, and multi-jurisdictional layering designed to frustrate tracing. The JMLSG Guidance (Part I, Chapter 4) frames the assessment as a direct question for obliged entities: if the customer's ownership and control structure is complex or opaque, is there an obvious commercial or lawful rationale? It lists bearer shares, nominee shareholders, and structures that could serve as asset-holding vehicles as relevant risk factors requiring documented assessment. Similar expectations on ownership transparency, bearer share disclosure, and related-party aggregation appear in the Wolfsberg Group's Correspondent Banking Due Diligence Questionnaire (CBDDQ v1.4, 2023). Looking at individual EU Regulators, the Bank of Italy’s Financial Intelligence Unit (UIF) published a synthetic indicator (Quaderno dell’antiriciclaggio No. 15, 2020) combining balance-sheet ratios to identify shell companies used for invoice fraud, demonstrating that shell entities leave a measurable financial footprint such as revenue-to-employee anomalies, cost structure irregularities, capital adequacy gaps, and turnover volatility that diverge systematically from operating companies in the same sector. 

For the opacity detection stage, these frameworks converge on a common set of indicator categories: 

i. Financial anomalies: e.g. revenue disproportionate to employee count, minimal operational expenditure relative to declared turnover, capital inadequacy; 

ii. Operational substance gaps: e.g. virtual offices, mail-forwarding addresses, mass-registration addresses, absence of verifiable web or commercial presence; 

iii. Director and UBO behavioural patterns: e.g. mass directorships, rapid entity churn, compulsory strike-off histories, dormancy, wave incorporation; 

iv. Offshore leak exposure: e.g. ICIJ Offshore Leaks, Panama Papers, Paradise Papers, Pandora Papers; and 

v. Activity code mismatches: e.g. declared SIC/NACE codes inconsistent with, or unsupported by, any evidenced commercial activity. 

The EU’s proposed so-called ATAD III / Unshell Directive reflected a similar analytical framework through its substance-test gateway indicators, focusing on predominantly passive income, cross-border activity, and outsourcing of administration or decision-making. In its June 2025 ECOFIN tax report, Council document 9960/25, ECOFIN recorded that the latest Unshell compromise text overlapped with DAC6 hallmarks and that many delegations considered the objectives of the Unshell proposal could be pursued through clarifications or amendments to DAC6 hallmarks, possibly in the context of a future DAC legislative proposal. The report therefore indicated that work on the standalone Unshell proposal should not continue in Council. 

For the rationale assessment stage, the obliged entity must consider whether recognised justifications exist for the observed structure. Legitimate rationales may include: tax efficiency within lawful parameters, regulatory ring-fencing (e.g. capital or licensing requirements), asset protection in jurisdictions with creditor-friendly regimes, joint venture structuring, intellectual property holding arrangements, group treasury centralisation, or political/security risk mitigation for UBOs in hostile jurisdictions. Where no such rationale is apparent from the documentation, business context, or customer explanation, and where opacity indicators are present, the obliged entity has grounds to treat the structure as raising risk under Article 11(3) and, in high-risk cases, to obtain an analysis or expert opinion under Article 21(d). VERA’s approach to this assessment is described in Section 4.3 below. 

4.2 Information on intermediate entities and the link to EDD (Articles 11(2) and 21)

Article 11(2) requires, for each intermediate entity, its legal form, any nominee directors or shareholders, its jurisdiction of incorporation or registration, the governing law of any trust, shareholdings and voting rights by class where applicable, and, for listed intermediate entities, the regulated market and the number and percentage of shares listed. The final draft no longer refers to an organigram, although an ownership chart remains a practical way to evidence the understanding required by Article 11(1) and (3). Complexity feeds the customer risk assessment; where it results in high risk, Article 21 lists additional information an obliged entity may obtain, including information to verify the ownership and control structure (21(a)) and an analysis or expert opinion on its rationale (21(d)). 

4.3 How VERA addresses Articles 11 and 21(d)

VERA supports the Article 11 ownership workflow and the Article 21(d) analysis without requiring obliged entities to build complexity detection and evidence collection from scratch. 

In fact, complexity detection, the ownership chart, complementary intelligence, and accuracy controls are embedded in the standard and advanced due diligence product. 

More specifically: 

Layer traversal and complexity indicators. VERA traverses the full ownership chain, counts intermediate layers and records, for each intermediate entity, its legal form, jurisdiction, percentage holdings and any nominee involvement. It flags the Article 11(4) elements (legal arrangements in the chain, entities registered in high-risk jurisdictions, nominee involvement) together with the opacity indicators described in Section 4.1. The obliged entity can document its Article 11(4) assessment directly from the output. 

Conversely, for widely-held listed entities with dispersed institutional shareholders, VERA identifies that no natural person meets the applicable UBO threshold, applies the residual method (naming senior managing officials with role and source citation), and traces each institutional shareholder block back through its holding chain to confirm that none individually or collectively triggers the ownership threshold. This dual capability, handling both concentrated family-controlled chains and dispersed public ownership structures, is needed to meet Article 11 across customer types. 

Ownership chart. Both standard and advanced due diligence reports include a structured ownership chart showing the full chain from target entity to UBOs, with percentage holdings, legal forms, and jurisdictions at each level. This evidences the understanding of the ownership and control structure required by Article 11(1) and (3) and presents each intermediate entity’s legal form, jurisdiction, percentage holdings and any nominee involvement in one view. 

Additional information under Article 11(4). VERA’s output goes beyond the Art. 11 baseline by adding shell company checks, residual ownership reconciliation (quantifying how the remaining unattributed ownership is composed and why it does not trigger additional UBO identification), and linkage tests (assessing whether residual holders are connected parties, state-linked, or acting in concert). These are the kinds of additional information an obliged entity may need when its Article 11(4) assessment finds the standard data insufficient, and they overlap with Article 21(a) and (c) in high-risk cases. 

Opacity assessment and shell company detection (Articles 11(3) and 21(d)). VERA addresses the assessment of a structure’s rationale through a convergence of multiple detection layers rather than a single binary indicator. Financial anomaly detection analyses filed financial statements to identify ratios inconsistent with stated sector activity, anomalous cost structures, minimal or zero operational expenditure relative to declared turnover, and capital adequacy gaps, mirroring the analytical approach of synthetic indicators such as the one developed by the Bank of Italy’s UIF for shell company identification. Operational substance verification tests for virtual offices, mail-forwarding services, mass-registration addresses, and absence of verifiable physical premises, combined with web presence analysis, directory listings, and telephone/domain reverse-lookups. Director and UBO pattern analysis identifies mass directorships, rapid entity churn, compulsory strike-off patterns, address clustering across multiple registrations, dormancy, SIC mismatches, wave incorporation, and dissolution bursts, as described in Section 3 above. Offshore leak and enforcement database cross-referencing screens against e.g. ICIJ Offshore Leaks, Panama Papers, Paradise Papers, and Pandora Papers. Nature-of-business consistency testing flags cases where declared activity codes diverge from evidenced activity or where no evidenced activity exists. Collectively, these layers enable VERA to present the evidence on both sides of the rationale assessment: opacity indicators found and potential legitimate explanations available from the documentary record. The obliged entity can then make and document its assessment, or commission the analysis or expert opinion contemplated by Article 21(d) where the risk is high. 

Residual ownership reconciliation. For dispersed ownership structures, VERA performs a full residual reconciliation: summing identified institutional blocks, quantifying treasury/self-held shares, estimating the composition of the remainder (retail, institutional sub-threshold, nominee/custodian), and testing for connected-party aggregation. Where the sum of UBO path and residual equals 100%, each exclusion is justified explicitly. This supports Article 11(1) and (3) and the accuracy criterion in Article 8(1)(d). 

Group-level risk surfacing. A verified entity at subsidiary level may present no adverse findings of its own, while the parent group in another jurisdiction has been subject to significant criminal or regulatory enforcement. VERA independently screens each entity in the chain against adverse media, enforcement databases, and regulatory filings. The subsidiary’s operational cleanliness is documented alongside the group-level risk, ensuring the obliged entity captures the full picture. This group-level intelligence is often missed by verification-only processes and by screening configurations that examine the target entity in isolation. 

Multi-source accuracy assurance. VERA’s entity resolution methodology (documented in each report) covers exact and fuzzy matching, multi-language transliteration, alias database consolidation, multi-factor validation, and false positive mitigation. Each ownership datum is cross-referenced across at least two independent sources (registry, commercial data, market data, annual reports). This addresses Article 8(1), under which obliged entities assess the reliability of sources having regard to, among other things, whether information was verified or validated or is consistent with other sources (Article 8(1)(d)). 

5. Mapping of VERA’s Capabilities and the Draft RTS

The table below maps VERA’s capabilities to the relevant obligations. It is anchored on the Level 1 obligations in the AMLR, which are settled, and uses the draft RTS article references for the technical detail. Article references follow AMLA’s final draft of 30 September 2026. The Commission may still amend the text before adoption, so references should be rechecked against the delegated regulation as published in the Official Journal. The underlying AMLR obligations, and VERA’s coverage of them, do not depend on that detail. 

6. Limitations, Governance and Control Considerations

A proportionate due diligence process must recognise the limits of the information environment in which it operates. Accordingly, VERA is designed to surface and document those limits. 

First, source availability and quality vary materially across jurisdictions, entity types and data categories. Registry filings may be delayed, incomplete, inconsistent or unavailable. Commercial data providers may differ in coverage and may sometimes rely on overlapping primary sources. Open-source information may be fragmented, outdated, duplicated, mistranslated or difficult to attribute. For that reason, VERA records the source basis for each material finding and distinguishes between verified, corroborated, inferred, indeterminate and missing information. 

Second, ownership and control analysis remains subject to structural and legal constraints. Some jurisdictions do not provide public shareholder or beneficial ownership information. Nominee arrangements, trusts, foundations, bearer-like instruments, contractual control rights, family arrangements and informal influence may not be fully visible from public or commercial sources alone. Where the available evidence does not support a definitive conclusion, VERA flags the limitation and supports escalation, customer outreach or enhanced documentary review by the obliged entity. 

Third, screening and entity resolution are probabilistic controls, not guarantees. Multi-attribute matching across names, aliases, transliterations, dates of birth, jurisdictions, addresses and corporate identifiers can reduce false positives and false negatives, but it cannot eliminate them. VERA therefore records match confidence, unresolved candidates and the basis on which matches are discounted or escalated. The final draft requires PEP and sanctions screening arrangements to be effective and proportionate to the obliged entity’s business, risks, complexity and size (Articles 17(3) and 25(2)(a)), which is the standard an automated tool will be assessed against. 

Fourth, contextual and adverse media analysis requires governance. Risk findings should be assessed by source reliability, date, jurisdiction, status, severity, relevance and corroboration. Allegations, investigations, convictions, settlements, sanctions, acquittals and regulatory clearances should not be treated as equivalent events. VERA structures these distinctions, but the obliged entity remains responsible for applying its own risk appetite, policies and escalation standards. 

Fifth, VERA supports but does not replace the obliged entity’s regulatory accountability. The institution remains responsible for customer acceptance, risk rating, EDD decisions, suspicious activity reporting, sanctions compliance, customer outreach, recordkeeping and final interpretation of applicable law and regulation. 

Finally, deployment must be governed through appropriate controls on data protection, access rights, retention, audit logs, model and prompt configuration, output review, exception handling and change management. These controls are particularly important where VERA is integrated through APIs into onboarding, periodic review, remediation or case-management workflows. 

Selected sources

The following sources inform this paper. The RTS remain a final draft pending Commission adoption. 

• AMLA, consultation on the draft RTS under Article 28(1) AMLR (customer due diligence), published 9 February 2026; public hearing 24 March 2026; consultation closed 8 May 2026. amla.europa.eu 

• AMLA, Final Report, draft RTS under Article 28(1) AMLR, 30 September 2026. amla.europa.eu 

• AMLA, press release, AMLA finalises key standards for the private sector, 1 October 2026. amla.europa.eu 

• AMLA, factsheet on the RTS under Article 28(1) AMLR. amla.europa.eu 

• AMLA, regulatory instruments register, updated 7 October 2026. amla.europa.eu 

• Regulation (EU) 2024/1624 (AMLR), Articles 20, 22, 26(2), 28(1) and 90; final draft RTS, Articles 11, 16 and 21 to 25. eur-lex.europa.eu 

• EBA, response to the European Commission’s Call for Advice on AML/CFT, 30 October 2025. eba.europa.eu 

• European Banking Federation, response to the AMLA consultation on the draft RTS under Article 28(1) AMLR. ebf.eu 

• AFME, response to the AMLA consultation on the draft RTS under Article 28(1) AMLR. afme.eu 

• Accountancy Europe, response to the AMLA consultation on customer due diligence obligations under Article 28(1) AMLR. accountancyeurope.eu 

• Herbert Smith Freehills Kramer, note on the 2026 AML/CFT consultations. hsfkramer.com 

• Loyens and Loeff, AMLR is approaching: AMLA holds first public hearings on the draft RTS, 2026. loyensloeff.com 

• ECOFIN, Report 9960/25 on the proposed ATAD III (Unshell) Directive, June 2025. consilium.europa.eu 

• FATF, Guidance on Beneficial Ownership of Legal Persons, Recommendation 24, March 2023; FATF, Guidance on Beneficial Ownership and Transparency of Legal Arrangements, Recommendation 25, March 2024; FATF and Egmont Group, Concealment of Beneficial Ownership, July 2018. fatf-gafi.org 

• Bank of Italy, UIF, Quaderni dell’antiriciclaggio, No. 15, December 2020, “A synthetic indicator for the identification of shell companies”. uif.bancaditalia.it 

© 2026 CleverChain.ai. All rights reserved. The original analysis, synthesis, structure and wording of this research are proprietary to CleverChain Limited. Public laws, regulatory materials and third-party sources cited remain the property of their respective owners. Reproduction or redistribution without prior written consent is prohibited, except for brief quotations with appropriate attribution or as otherwise permitted by law. 

This document is provided for informational purposes only and does not constitute legal or regulatory advice. This version reflects AMLA’s final draft RTS dated 30 September 2026, published on 1 October 2026 and submitted to the European Commission. At the date of this update the RTS have not been adopted or published in the Official Journal and may be amended before adoption; this paper remains anchored on the Level 1 AMLR obligations, which are settled. Obliged entities should independently assess the final adopted text and take their own legal counsel on implementation. References to VERA’s capabilities are based on the platform’s production functionality as of October 2026.