Article 11 Understanding the ownership and control structure of the customer


This is a draft act

This text has been parsed from the AMLA final report draft as published on 30 September 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (9 February 2026)

Summary What does Article 11 of the RTS on customer due diligence say?

This article addresses how obliged entities must understand and analyse the ownership and control structures of their customers.

Building on the broader customer due diligence requirements in Article 20(1) of Regulation (EU) 2024/1624, it sets out what information must be gathered when complex structures exist between a customer and their beneficial owners.

The core thrust is that obliged entities cannot simply identify a beneficial owner in isolation — they must map and understand the full chain of entities and arrangements sitting between the customer and that owner, and assess how that structure affects money laundering and terrorist financing risk.

Important points:

  • Obtain detailed information on any intermediate legal entities or arrangements in a customer's ownership and control structure, including legal form, nominee involvement, jurisdiction, and shareholding percentages.
  • Assess how the ownership and control structure affects the money laundering and terrorist financing risks associated with the customer.
  • Evaluate whether additional information is needed when complexity factors are present, such as multiple intermediary layers, high-risk jurisdictions, legal arrangements, or nominee shareholders and directors.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. Obliged entities shall take risk-sensitive measures to ensure they understand the ownership and control structure of the customer pursuant to Article 20(1), point (b), of Regulation (EU) 2024/1624.

    1. For the purposes of the first paragraph and in situations where the customer’s ownership and control structure contain more than one legal entity or legal arrangement between the customer and their beneficial owners, obliged entities shall obtain the following information on those intermediate legal entities and/or legal arrangements:

      1. the legal form of such entities and/or arrangements;

      2. the existence of any nominee directors or shareholders;

      3. the jurisdiction of incorporation or registration of the legal person or legal arrangement;

      4. in the case of a trust, the jurisdiction of its governing law;

      5. where applicable, the shares of interest held by each legal entity or legal arrangement, its subdivision, by class or type of shares and/or voting rights expressed as a percentage of the respective total;

      6. where applicable, if a legal entity at an intermediate level of the ownership and control structure has its securities listed on a regulated market, information about the regulated market on which the securities are listed and the number and percentage of shares listed on a regulated market.

    1. Obliged entities shall ensure they understand how the ownership and control structure affect the money laundering and terrorist financing risks associated with the customer.

    1. Obliged entities shall assess whether additional information is needed to understand the ownership and control structure, having regard to elements that may increase complexity, such as:

      1. the number of intermediate layers between the customer and the beneficial owner;

      2. the presence of legal arrangements or similar legal entities in any of those layers;

      3. the fact that the customer or any legal entities present at any of these layers are registered in high-risk jurisdictions;

      4. the involvement of nominee shareholders or nominee directors in the structure.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod