Legal map in two layers
Two maps, each with a table. Map 1 shows the framework discussed in identification conversations — anti-money laundering law and identity law. Map 2 shows what applies alongside it and how it reaches us. Intended as a reference for conversations full of acronyms.
Two legal domains, two bridges
Anti-money laundering law and identity law develop separately. They meet in two places — and only there.
- EU regulation — directly applicable
- EU directive — to be transposed nationally
- Draft — not yet adopted
- German law
- Standard or supervisory practice
What the diagram answers. The two circles have nothing to do with each other, except at two points. Bridge 1: Article 22(6)(b) of the AML Regulation names electronic identification means and qualified trust services as one of two permitted ways of verification — the other is presenting an identity document. Bridge 2: The draft technical standards name the mandatory attributes using the field names from the EUDI Wallet data model. That explains why an anti-money laundering document suddenly contains terms such as
resident_postal_code. Neither bridge creates an obligation to use the wallet. The acronyms in detail
Sorted by legal domain. “When” gives the date that matters in practice, not the date the legal act entered into force.
Anti-money laundering law
| Acronym | Full name | Type | When | What it's about |
|---|---|---|---|---|
| AMLR | Anti-Money Laundering Regulation — Regulation (EU) 2024/1624 | EU regulation | applies from 10.07.2027 | The due diligence obligations themselves: which data to collect, who to identify, when to update. Directly applicable in all member states and replaces the corresponding parts of the GwG. |
| AMLD6 | Sixth Anti-Money Laundering Directive — Directive (EU) 2024/1640 | EU directive | to be transposed by 10.07.2027 | Supervisory structures, registers, powers of authorities, sanctions framework. Must be transposed into national law — much of what remains of the GwG will come from here. |
| AMLA | Anti-Money Laundering Authority — established by Regulation (EU) 2024/1620 | EU authority | operating since 01.07.2025 direct supervision from 01.01.2028 | The new EU authority based in Frankfurt. It writes the technical standards and guidelines for the AMLR. It will directly supervise only a limited selection of financial institutions — not law firms, notary offices or tax firms. |
| RTS | Regulatory Technical Standards — here: the standard on due diligence obligations under Art. 28(1) AMLR | Draft | Consultation ended 08.05.2026 final version pending | The implementing rules: order of precedence for remote identification, requirements for permitted sources, and in Annex I the list of mandatory attributes. Much of what is currently said about the AMLR is actually found here — and has therefore not yet been adopted. |
| GwG | German Anti-Money Laundering Act (Geldwäschegesetz) | German law | applies today replaced 10.07.2027 | Today's basis for due diligence obligations. From the cut-off date, the AMLR governs these obligations directly; to that extent, the GwG loses its effect without needing to be formally repealed. |
| BaFin RS 3/2017 | BaFin Circular 3/2017 (GW) on video identification | Supervisory practice | remains in effect no repeal | Sets out how the video identification procedure must work. Based on Section 13 GwG and shares its fate. BaFin most recently continued it explicitly in 2022 as a bridging technology. |
Identity law
| Acronym | Full name | Type | When | What it's about |
|---|---|---|---|---|
| eIDAS | Regulation (EU) No 910/2014 on electronic identification and trust services | EU regulation | in force | Defines electronic identification means, their assurance levels “substantial” and “high”, and qualified trust services. The AMLR refers to these terms. |
| eIDAS 2.0 | Regulation (EU) 2024/1183 — amending 910/2014 | EU regulation | 2024 | Introduces the EUDI Wallet and sets out who must accept it. There is no separate legal act — the rules appear as new Articles 5a to 5f in the eIDAS Regulation. |
| IR 2024/2977 | Implementing Regulation (EU) 2024/2977 on person identification data and electronic attestations of attributes | Implementing act | in force since 24.12.2024 | Specifies the data fields a wallet holds. Doubly important: it is the anchor for both wallet deadlines — and its field names reappear in the annex of the draft RTS. |
| EUDI Wallet (PID) | European Digital Identity Wallet; PID = Person Identification Data | An object, not a legal act | Provision 24.12.2026 Acceptance 24.12.2027 | The ID app. By the end of 2026, member states must provide at least one; from the end of 2027, certain private companies must accept it — only in specific sectors, only at the user's request and excluding micro and small enterprises. Legal and tax advisory professions are not covered. |
| DIdG | German Digital Identities Act (Digitale-Identitäten-Gesetz) | Draft | Cabinet 20.05.2026 Bundestag pending | The German omnibus act for the EUDI Wallet. Among other things, it amends the GwG, the Identity Card Act, the Passport Act and the Trust Services Act. What matters for us: the wallet becomes a permitted means of identification and the reference transfer is no longer required. |
| EBDIG | Act on the European Digital Identity Wallet — Article 1 of the DIdG (the official title; hereinafter “wallet”) | Draft | with the DIdG | The national basis for the EUDI Wallet. Two provisions matter: Section 10 — anyone who wants to use the wallet for proof of identity must register beforehand. Section 16 — federal authorities issue attestations of attributes on request 24 months after promulgation; states and municipalities, and therefore the residents' registration system, are not covered. |
| QES | Qualified electronic signature | Trust service | available | The legally binding electronic signature. It does not appear in the AMLR even once — it may be required by formal requirements, but it is not part of the due diligence obligations. |
| QEAA | Qualified Electronic Attestation of Attributes | Trust service | in Germany still no approved provider | The digitally sealed individual data point — such as an address or a tax number. The instrument that could fill gaps in mandatory attributes. Only an approved trust service provider may issue it, and it must be able to check the data against the official source. |
| QTSP | Qualified Trust Service Provider | Provider role | ongoing | A provider that a supervisory authority has audited and entered in the trusted list — in Germany, the Federal Network Agency (Bundesnetzagentur). The approval is valid EU-wide and applies per type of service. |
| ETSI TS 119 461 | Technical specification of the European Telecommunications Standards Institute | Standard | — | Describes how a trust service provider must verify an identity. Not a legal act. The acronym “ETSI” appears neither in the AMLR nor in the draft RTS. |
| PAuswG | German Identity Card Act (Personalausweisgesetz), here Section 18(3) | German law | applies | Lists the fields transmitted by the online ID function — explicitly including the address. That's why the chip in the German ID card provides more than the wallet's current data set. |
| IdNrG | German Identification Number Act (Identifikationsnummerngesetz) | German law | applies | Makes the tax identification number a cross-register reference number. Whether this makes it the “national identification number” within the meaning of the AMLR is an open question — of little practical relevance, since the tax number must be collected anyway. |
The dates in order
The four dates you need to know are highlighted in blue.
- 09.07.2024 The AMLR enters into force — but it only applies three years later.
- 24.12.2024 The eIDAS implementing acts enter into force. Both wallet deadlines (24 and 36 months) run from this day.
- 01.07.2025 AMLA begins its work.
- 09.02.2026 The draft RTS on due diligence obligations is published for consultation.
- 08.05.2026 The consultation period ends. No final version has been published yet.
- 20.05.2026 The German federal cabinet adopts the draft DIdG. Bundestag and Bundesrat have yet to vote.
- 24.12.2026 Member states provide at least one wallet. An obligation for states, not for businesses.
- End of 2026 Earliest possible date for the DIdG to enter into force — it takes effect the day after promulgation. The reference transfer is then no longer required.
- 10.07.2027 The AMLR applies. For new clients from this day, the full set of obligations, with no transition period. Also the deadline for transposing AMLD6.
- 24.12.2027 The obligation to accept the wallet takes effect — only for certain sectors, only where strong online authentication is already required, only at the user's request, and excluding micro and small enterprises.
- 01.01.2028 AMLA begins direct supervision of a limited selection of financial institutions.
- by 10.07.2032 Latest date by which even the last low-risk existing client file must be brought up to date (five-year period from the date of application). For high risk, one year applies.
What applies alongside — and how it reaches us
Regulation reaches a software company in two ways: directly as a manufacturer and processor, or indirectly via its customers' contracts. The second route is regularly underestimated.
Why this second map is needed. We searched the available vendor material in full — four documents, full text, with every image-heavy slide checked individually. The only acts mentioned there are AMLR, AMLD6, AMLA, eIDAS, DIdG, EBDIG, GwG and ETSI. Not a single hit for DORA, NIS2, the AI Act, the Cyber Resilience Act, the GDPR, MiCA or supply chain law. That's not carelessness — it reflects the scope of an identification provider. For a system operated at a law firm or a bank, the framework reaches further.
The sentence that matters. The dashed boxes don't address us legally — yet the answer to them decides whether a contract is signed. DORA is the clearest example: a financial institution may only engage us if the contract contains certain provisions and we are listed in its register of information. This question comes up in procurement, not in the expert conversation — and it comes up early.
The wider framework in detail
The “Role” column says why the legal act affects us — as an addressee or via the customer.
| Acronym | Full name | Role for us | When | What it's about |
|---|---|---|---|---|
| DORA | Digital Operational Resilience Act — Regulation (EU) 2022/2554 | via the customer | applies since 17.01.2025 | Digital operational resilience in the financial sector. What matters for us is not who is addressed but the effect on the contract: mandatory contractual provisions for ICT services, inclusion in the customer's register of information, audit and access rights, defined exit scenarios. Comes up in procurement for every bank and fintech deal. |
| AI Act (KI-VO) | Regulation (EU) 2024/1689 on artificial intelligence | applies to us | phased; high-risk obligations from 02.08.2026 | Affects every AI feature in the product, especially the KYC agent. Important distinction: biometric remote identification (one face against many) is high-risk under Annex III. Biometric verification — matching a face against an ID document to confirm that someone is who they claim to be — is explicitly excluded. Standard KYC matching is therefore generally not in the high-risk category. |
| CRA | Cyber Resilience Act — Regulation (EU) 2024/2847 | applies to us | Reporting obligations 2026 main obligations end of 2027 | The actual “product law” for software: security requirements across the lifecycle, vulnerability handling, reporting obligations, CE marking. Anyone asking about product regulation for our company effectively means this regulation — not product safety law for physical goods. |
| GDPR | General Data Protection Regulation — Regulation (EU) 2016/679 | applies to us | since 25.05.2018 | Not a side issue for a KYC system: retention and deletion, data processing on behalf, data minimization in register queries. The AMLR in turn refers to data protection and explicitly requires a final human decision for reputation checks. |
| NIS2 | Directive (EU) 2022/2555; transposed in Germany in the BSI Act | via the customer | German transposition act since 06.12.2025 | Cybersecurity obligations for around 29,500 German companies, supervised by the BSI. It reaches us via the supply chain requirements of the customers covered: security evidence, reporting channels, incident handling. |
| Data Act | Regulation (EU) 2023/2854 on harmonized rules on fair access to data | applies to us | applicable since 09/2025 | Among other things, governs switching between data processing services — notice periods, portability, exit support. Of secondary importance for us, but increasingly asked about in tenders. |
| MiCA | Markets in Crypto-Assets — Regulation (EU) 2023/1114 | via the customer | since end of 2024 | Authorization and obligations for crypto-asset service providers. Only relevant for our fintech and crypto segment; there, the onboarding process is part of the authorization requirements. |
| PSD2 PSD3 | Payment Services Directive; successor package in the legislative process | via the customer | PSD2 applies PSD3 pending | Strong customer authentication and payment services supervision. Affects us where identification and authentication intersect — which is also the only point where the IDnow material goes beyond the AML framework. |
| LkSG | German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz) | related | applies; amending act in the Bundestag since 01/2026 | Human rights and environmental due diligence in the supply chain. Methodologically close to our KYB — identifying business partners, assessing risks, keeping records — but with a different protected interest and different supervision. The reporting obligation is being relaxed; the due diligence obligations remain. |
| CSDDD | Corporate Sustainability Due Diligence Directive — Directive (EU) 2024/1760 | related | Transposition by 26.07.2028 application from 2029 | The European successor set to replace the LkSG. Postponed twice by the omnibus procedure and greatly narrowed in scope — as things stand, only companies with around 5,000 or more employees and €1.5 billion in revenue. Therefore practically irrelevant for our target groups. |
Sources for this second table. Unlike Map 1, it is not based on locally available primary texts but on secondary sources as of August 2026. Two points were specifically double-checked because they have recently changed: the postponement of the CSDDD by the omnibus procedure and the exclusion of biometric verification from the AI Act's high-risk category. Before using them with customers, the dates for DORA, the CRA and the AI Act should be confirmed against the regulation text.
Four sentences that sort out the rest
The most common mix-ups in conversations — and what's actually correct.
1. Regulation or directive — the difference determines whom to ask
A regulation applies directly; there is no German law implementing it, and there won't be one. A directive must first be transposed. That's why the AMLR goes straight into the client file from 2027, while for AMLD6 we have to wait and see what the German legislator makes of it.
2. In force is not the same as applicable
The AMLR has been in force since July 2024, yet it only applies from July 2027. Confuse the two and you'll be three years off on every deadline.
3. Much of what “the AMLR requires” is in the draft RTS
The order of precedence for remote identification, the attribute lists, the obligation to close gaps — all still at draft stage. The consultation ended in May 2026, and no final version has been published. That doesn't make these points worthless, but they can only be cited with a clear label.
4. The wallet is an option, not an obligation
The AMLR does not create an obligation to use or accept the wallet. eIDAS creates an acceptance obligation only for a defined group of businesses. And anyone who wants to use it must register beforehand under the draft DIdG.
5. Not being an addressee doesn't mean you won't have to deliver
That's the lesson of Map 2. DORA and NIS2 are aimed at financial institutions and operators of important entities, not at us. Still, they decide whether a contract is signed — because the addressee can only meet its obligations if its supplier plays along. If you only check who you are addressed by, you'll miss half of the requirements actually raised in procurement.
What this map deliberately leaves out. Fine amounts — the AMLR doesn't specify any; the amounts are in AMLD6 and its national transposition. And anything that suggests a particular procedure or provider is mandatory. Article 22(6) offers two equally valid methods to choose from; the first is presenting an identity document.
Not legal advice. This overview is a guide for conversations and replaces neither a case-by-case review nor advice from the responsible compliance function.
Sources for Map 1. The regulation texts and the draft RTS are available as primary texts. The information on the DIdG comes from the cabinet version of May 20, 2026 — a draft. The eIDAS deadlines are derived from the entry into force of Implementing Regulation (EU) 2024/2977. On the approval status of attestations of attributes: information from the Federal Network Agency, retrieved on August 5, 2026.
Sources for Map 2. Secondary sources as of August 2026, not checked against the regulation text. Double-checked were the postponement of the CSDDD by the omnibus procedure, the status of the German NIS2 implementation act, the status of the LkSG amending act and the exclusion of biometric verification from the AI Act's high-risk category.