Splitting CDD traffic: AMLA, trust services and orchestration

From paper to wallets: trust services and AMLA's final CDD standards

On 1 October 2026, the Anti-Money Laundering Authority (AMLA) finalised three sets of regulatory technical standards (RTS), including one focused on customer due diligence (CDD) under Article 28(1) of the Anti-Money Laundering Regulation (AMLR), and sent them to the European Commission.  The CDD standard marks the first time an EU AML rulebook places digital identity and trust services alongside the classic document submission as a primary way to verify a customer.

Next year, based on this direction, financial institutions must be ready to accommodate digital identity and trust services in their verification flows. The AMLR applies from 10 July 2027, and the CDD RTS are proposed to apply six months after they enter into force. Every member state must offer a European Digital Identity (EUDI) Wallet by the end of 2026, and banks and payment firms must accept them from December 2027 under eIDAS.

Although trust services are becoming a standard primary form of identification, they won't replace existing alternative methods. Firms will need to design a verification journey that routes each customer to the best available method, fill the gaps, and record why.

1. From manual checks to trust services

Identity verification has moved in waves over the last decade, adding new methods without deprecating older ones. The CDD RTS give each a defined place.

• Manual checks. Staff inspections of passports or ID cards are still valid where the document meets Article 6 and is checked for authenticity.
• Bureaux, postal, and database checks. Electronic checks match against credit, electoral roll and address data. Under Article 22(6) of the AMLR, a natural person is verified by an identity document or by eID and qualified trust services, rather than solely through data-only matches. Rather than person verification, data checks serve to fill gaps such as address (Article 8) and verifying a business’s beneficial owners (Article 10).
• Document and biometric verification. ID capture with selfie, liveness, and face match scales digital onboarding and now sits under Article 7 as a fallback verification option, unless it counts as a verified copy of a document.
• Open banking. Consented account data is a useful source for address and for understanding funds (though not a verification route in itself).
• Trust services. eID, EUDI Wallets and qualified trust services, shared by the customer directly, have now been established by the RTS as a primary verification route, remote or face-to-face.

2. What the RTS means for trust services and e-wallets

The CDD RTS solidifies what the eIDAS Regulation (Regulation (EU) No 910/2014), the EU's legal framework for electronic identification and trust services, lays out. eIDAS sets "low," "substantial," and "high" assurance levels for national eID schemes and regulates trust services such as electronic signatures, seals, and time stamps. In 2024, eIDAS 2.0 introduced regulations for electronic attestations of attributes and EUDI Wallets. Providers that meet its strictest requirements are supervised as qualified trust service providers and placed on EU trusted lists, so what they issue is recognised in every member state. 

The final CDD RTS moved trust services from an option to a viable primary route depending on consumer uptake. Four points matter most.

Most notably, wallets sit alongside the passport. eIDs at “substantial” or “high” assurance qualify, whether or not the scheme is notified under eIDAS, as do qualified trust services and, by name, EUDI Wallets. Article 6(4) extends this to face-to-face onboarding, so a branch can accept a wallet share instead of photocopying a passport.

Document-and-selfie stays, with conditions. Remote document and biometric checks remain a workhorse of digital onboarding under the RTS. Where a customer can’t present a document in person and has no qualifying eID, Article 7 allows remote solutions that meet five safeguards: holder binding, secure communication, capture quality, stopping when in doubt, and time-stamped records. Firms should log a reason at the point of decision to be able to show their supervisor why this route was used. It is still open whether a remotely captured document can count as a “verified copy” under Article 6. If it can, document-and-selfie sits alongside eID as a primary route rather than a fallback.

Wallet supply, acceptance and regulation now pull the same way. Member states must issue wallets, firms must accept them, and the RTS give a compliance reason to prefer them.

But a wallet can't be the only option. Because wallets are voluntary, Article 5a(15) of eIDAS says providers may not refuse access solely because someone doesn't present one. Non-EU nationals and UK customers will sit outside the EUDI framework, take-up will vary by market, and fraudsters will follow the traffic, so fraud signals around the wallet share still matter.

3. Annex I: where AML meets trust services

Building on Article 22(6), which says digital identity can be used for CDD, Annex I says what it has to deliver. Article 27(1) points to Annex 1 as the list of attributes an eID or qualified trust service must be able to supply, in structured data fields, serving as a spec sheet for implementing trust services in onboarding.

AMLA took the attribute names from the person identification data rules for EUDI Wallets (Implementing Regulation (EU) 2024/2977), so that attributes like family_name or resident_postal_code mean the same thing in the AML rulebook as in the wallet. That shared vocabulary lets a wallet share drop straight into a CDD file without requiring mapping.

For CDD teams, that has four practical consequences:

• Test a scheme before you accept it. Map each wallet, eID scheme, and trust service provider against Annex I to see which customers it can fully verify, and where gaps remain.
• Expect partial credentials and be prepared to verify what’s missing. In the wallet rules, address attributes are optional, so many shares will arrive without one. Article 27(2) requires firms to obtain and verify missing attributes another way.
• Qualified attestations fill the gaps. eIDAS 2.0 introduced qualified electronic attestations of attributes issued by qualified trust service providers, which can carry a verified address or a company role with the same legal standing. 
• It covers businesses too. Annex I includes legal entity attributes, pointing to organisational credentials doing for KYB what wallets will do for KYC.

4. Lower-risk and higher-risk customers

While Annex I sets what a credential must be able to supply, what firms must collect through CDD is still decided by risk. Trust services fit within lower-risk onboarding almost perfectly, but only partly for higher-risk scenarios.

5. The takeaway: orchestrate, don't pick a winner

For the time being, CDD traffic will be split across wallets, document and biometric checks, bureau and open banking data. That calls for a variety of customer journeys, not a single funnel.

A Dutch customer with a wallet, a UK national moving to Ireland, a refugee with limited documents and a small business all need different paths to the same compliant outcome. Firms that hard-code one journey will lose customers who can't use it, or carry a justification burden every time they fall back. Firms that orchestrate can offer each customer the path that suits them, shift traffic as wallet coverage grows, and adapt as the final text lands. That is what Alloy's identity verification and orchestration engine are built for: sequencing wallet, document, biometric and data checks in one decisioning flow, with an audit trail behind every decision.

Under AMLA's rules, the supervisor’s question goes beyond “did you verify this customer?” and increasingly becomes "why did you verify them that way?" Firms that can answer from their own data will be the ones staying ahead of the game.