Opening an account from July 2027: what the new EU customer due diligence standards ask of you

Anyone who opens an account abroad soon finds that every bank asks for something different. From 10 July 2027 that should largely end within the EU. On that date the European anti-money laundering regulation applies directly in every member state, and on 1 October 2026 the new EU anti-money laundering authority AMLA presented the standards that define which details a bank must collect and verify when you open an account.

What happened on 1 October

AMLA finalised three regulatory technical standards and handed them to the European Commission. The authority says so in its press release of 1 October 2026. For you as a customer one of them matters most: the standards on customer due diligence under Article 28(1) of the anti-money laundering regulation, published together with a final report.

Legally these are still drafts. The Commission adopts them as a delegated regulation, and they only become binding once published in the Official Journal. In its accompanying factsheet AMLA points out explicitly that the Commission may still make changes. Under AMLA's proposal the standards are to apply six months after their entry into force. The regulation itself, Regulation (EU) 2024/1624, applies from 10 July 2027 under its Article 90.

For readers in Sweden, Denmark and Finland this is a change of system. Today the duties sit in national law that transposes the EU anti-money laundering directives, and each country words them its own way. From July 2027 a regulation applies that no longer needs to be transposed, together with a single rulebook for how the bank applies it. For the UK none of this applies: the UK has left the EU, and British banks stay under the Money Laundering Regulations 2017. Norway is in the EEA but not in the EU; an EU act applies there only once it has been taken into the EEA Agreement, and at the time of writing the EFTA database lists the anti-money laundering regulation as still under scrutiny for incorporation. Swiss banks stay under Swiss anti-money laundering law. For banks outside the EU the regulation does not apply either; there the law of their home country decides. Only their branches inside the EU fall under the new rules.

Which data the bank must collect

The basis is Article 22 of the regulation. For natural persons it covers all first names and surnames, place of birth and full date of birth, nationalities and habitual residence. The AMLA standards spell out most of these points.

Names. The bank must record every name that appears in the identity document, including second and third first names.

Place of birth. The place of birth is recorded as it appears in the identity document: at least the country and the city, municipality or town, and the state or province where that is relevant.

Nationalities. Here there is a change that affects dual nationals. Under Article 5 of the drafts the bank must take reasonable measures to establish whether you hold more than one nationality. Anyone who declares several is recorded with all of them. The bank only has to verify at least one, though. So you do not necessarily have to produce your second passport, but you should not keep it quiet either.

Address. The country and the city or town are mandatory, plus the postcode where there is one. Street, house number, flat number and PO box are added where they exist. This wording matters for people without a conventional registered address, because it accepts that not every address has every element.

The passport remains the yardstick, with clear minimum contents

To verify identity, Article 6 of the drafts requires an identity card, a passport or an equivalent document. A document only counts as equivalent if it is issued by an authority designated for that purpose and contains four things: name and place and date of birth, document number and expiry date, a photograph and the holder's signature, and security features against forgery. A document without a photograph or without an expiry date therefore does not count as equivalent. For stateless persons and refugees who cannot hold such a document, the drafts set lower minimum contents.

If an identity document lacks some of the required details, such as an address, the bank must obtain the missing data from reliable and independent sources. What counts as reliable is set out in Article 8: the credibility and official character of the source, how current and accurate it is, and how easily the information could be forged. A new point is that the bank must understand the documents whatever their language. In practice that can mean it asks for a translation if it cannot otherwise judge the content.

Opening an account remotely: video identification gets rules

For anyone who wants to open an account in another country, Article 7 of the drafts is the most interesting. The regulation itself names two routes for identity verification in Article 22(6): presenting a passport, identity card or equivalent document, or electronic identification at the assurance level "substantial" or "high" under the European rules on trust services. Anyone who cannot present the document in person and has no such electronic identity gets a third route under Article 7: alternative remote procedures, which in practice means video and photo identification.

The conditions are concrete. The solution must ensure that the person in front of the camera is the holder of the document. The connection must be confidential and tamper-proof. Images, video and sound must be good enough to identify the person beyond doubt. If there are technical faults, dropped connections or doubts about identity, the procedure does not continue. And everything is stored with a time stamp so that it can be checked later. The bank must be able to justify to its supervisor why it used the alternative route.

The question of purpose and source of funds

Most conversations when opening an account abroad are not about the passport but about the money. Article 20 of the regulation obliges the bank to understand the purpose and intended nature of the business relationship. Article 25 lists the information it obtains for this where necessary: purpose, estimated amount, source and destination of the funds, occupation or business activity.

Article 16 of the AMLA drafts turns this into a list of examples. For the source of funds it names, among others, salary and bonuses, pensions and state benefits, business income, capital from shareholders, loans, savings and investment income, and inheritances, gifts, sales of assets and settlements. For the destination of funds the bank asks about the type of expected recipients, the countries the money is to go to, and whether the recipient is the beneficiary. On top of that come questions about expected volume, the number and frequency of transactions, and your professional activity.

What matters is the frame AMLA puts around this. In the factsheet it makes clear that the list is not a checklist for a bank to work through mechanically. It is to be applied on a risk basis. Where the risk is low, the bank may infer the purpose and nature of the relationship from what it already knows about you, your product and your transactions.

Anyone who opens an account outside their country of residence rarely lands in the lowest risk category in practice. Banks treat non-residents more cautiously, and the reasons are set out in why banks reject non-residents. Well-prepared evidence of where your money comes from is therefore the biggest lever for a quick opening. The sale contract and bank statement for a property sale, the grant of probate and the estate accounts, the annual accounts and the dividend resolution: whatever you can document, you do not have to explain.

Simplified checks: less data when the risk is low

The standards also bring good news. In low-risk situations the bank only has to collect and verify a reduced data set. Under Article 18 of the drafts that means the core data from the passport or identity card: all names, date and place of birth, and nationality. In these cases the bank does not have to collect or verify the address at all, as the factsheet also states.

Whether your case is rated low risk is for the bank to decide under its own risk assessment. The standards give you no right to it. For people without a fixed residence the rule can still help, because it shows that a missing registered address is not automatically grounds for refusal. The regulation also provides expressly in Article 22 that, for persons without a fixed residential address and without a legitimate residence status in the Union, the postal address at which they can be reached is collected, together with the tax identification number where there is one. How to solve the address problem in daily life is shown in nomad banking: address, TIN and an account without a fixed residence.

Sanctions and politically exposed persons

From now on every customer due diligence check includes two screenings that are already common today but will now be regulated uniformly: against the lists of targeted financial sanctions and against status as a politically exposed person, family member or known close associate. The screening can be automated, manual or a combination of both, and for sanctions screening other names, aliases and wallet addresses count too where they exist.

If you have held public office or are related to an office holder, it is best to say so yourself when you open the account.

Existing customers: the duty to update

If you already hold an account today, you are affected too. For business relationships that began before the standards enter into force, banks must bring documents and data up to the new standard on a risk basis, within the deadlines of Article 26 of the regulation: at the latest after one year for higher-risk customers and after five years for everyone else. Under Article 28 of the drafts and their explanatory notes, these deadlines for existing customers only start to run once the standards enter into force.

In practice this is likely to mean that in the years after entry into force, banks will write to their existing customers and ask for documents. Anyone who does not respond risks more than a reminder. Article 21 of the regulation requires a bank that cannot complete its checks to end the business relationship and to consider filing a suspicious activity report. Take any request to update your data seriously and answer it promptly, even for an account you rarely use.

What the standards do not change

Three things stay as they are. First, the bank still decides whether it wants you as a customer. The standards say what it must check, not that it must accept you. Second, whether a bank outside the EU may serve you as a customer in the EU at all is a separate question: that is the subject of the banking directive CRD VI, explained in CRD VI: it comes down to where you live. Third, the standards change nothing about your tax duties. An account abroad is legal, and income on it stays taxable wherever you are tax-resident.

How to prepare

If you plan to open an account inside or outside the EU in the coming months, it pays to put together a folder that already anticipates the future standards:

1. A valid passport with photograph and signature that is not close to expiry, plus your national identity card if you have one.

2. All your nationalities on one sheet, with passport numbers.

3. Proof of address from an official source and as recent as possible, if you have a registered address.

4. Tax identification numbers for every country in which you are tax-resident.

5. Source of funds: the document that shows where the money you want to pay in comes from, not just the bank statement it sits on.

6. The purpose of the account in two sentences: what for, at roughly what volume, with payments to which countries.

How opening an account abroad works step by step is set out in opening a bank account abroad: how it works and the best countries.

One rulebook for everyone, with room for the bank

The core of the new standards is harmonisation. Until now every bank in every country had its own checklists; in future, banks in the EU work with the same terms. The banks do not lose their room for judgement, though: the risk assessment remains theirs, and with it the question of how much evidence they ask for in an individual case.

Anyone who puts their documents in order before the bank asks for them opens faster and keeps the account longer. If you want to know which bank and which country suit your situation and which evidence you need for them, talk to us in the free consultation. You will receive a written assessment within 48 hours, legal and clean for tax.