What you are missing for July 10, 2027

What sector do you work in?

Determines the wording we use — not the legal position.

Which clients do you onboard?

Different mandatory data sets apply to individual and corporate clients. This determines which sections you see.

Do your activities fall under the list in Article 3?

For the legal and tax advisory professions, the regulation applies only to certain activities — such as acquiring shareholdings, real estate transactions, managing assets, and forming and managing companies.

Roughly how many files subject to AML checks do you maintain?

Only used to classify your existing files. A rough estimate is enough.

active files

How do you mainly identify individual clients?

In-person presentation and remote identification lead to different obligations.

Do you record all nationalities?

The regulation explicitly uses the plural. A field holding a single value is not enough.

Do you store the address in separate fields?

Country, region, city, postal code, street, house number — the attribute list is broken down, and a free-text field cannot be mapped to it.

Do you collect the tax identification number?

The regulation requires it “where available”. In Germany, every registered resident has one — and no identification means provides it.

Do you also identify the person acting on the client's behalf?

Anyone acting on behalf of another person must have their power of attorney checked and be identified themselves — this is already required by § 10(1) no. 1 GwG and, unchanged from 2027, by Art. 20(1)(i). In practice, a separate data record for them is often missing.

Do you obtain proof of registration for every new business relationship?

What is required is valid proof of registration or a current register extract — dated and filed, not just viewed (Art. 23(4)).

How do you determine the beneficial owners?

The threshold drops to “25 percent or more”. Shareholdings must be multiplied across all levels and parallel chains added together.

Do you verify the identity of all beneficial owners?

Recording the name alone will no longer be enough. The data set also includes the number of the identity document.

Do you rely solely on the Transparency Register to verify beneficial owners?

Checking against the central register is mandatory. For verification, however, the regulation refers to sources “including public registers other than the central registers”.

Do you explicitly ask about nominee arrangements?

The names of nominee shareholders and nominee directors are mandatory — including an indication of that status. No register provides them.

Do you record the LEI, register number and tax number as separate fields?

Each is required “where available” — but if available, it is mandatory.

Do you detect discrepancies between your own findings and the register?

If discrepancies are found, a 14-calendar-day reporting deadline applies. Notaries, legal, audit and tax advisory services are exempt where the finding stems from assessing the client's legal position.

Do you know for each file when it was last updated?

Without this date, no review date can be calculated.

Does your system calculate the next review date based on risk?

High risk annually, all other cases after five years at the latest — per file, not per customer.

Can you say for every field where the value came from?

Electronic identification, register, official document or customer statement — and how it was verified. This is the prerequisite for being able to prove that a gap has been closed at all.

Do you record why electronic identification was not used?

The draft technical standards make electronic identification the default for remote onboarding. Anyone who deviates from it must be able to justify this to the supervisory authority.

Do you fully document rejected and abandoned cases?

Cases that did not go ahead are also subject to record retention — and to the later obligation to delete.