Article 17 Identification of politically exposed persons


This is a draft act

This text has been parsed from the AMLA final report draft as published on 30 September 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (9 February 2026)

Summary What does Article 17 of the RTS on customer due diligence say?

This article sets out the practical requirements for how obliged entities must identify politically exposed persons (PEPs), their family members, and close associates.

It builds directly on Article 20(1)(g) of Regulation (EU) 2024/1624, which establishes the broader obligation to identify PEPs, and translates that obligation into concrete procedural steps.

The article covers two distinct scenarios: screening before a business relationship or transaction begins, and ongoing monitoring of existing customers to catch cases where PEP status may have changed over time.

It also specifies the triggers and frequency for that ongoing screening.

Important points:

  • Screen customers, beneficial owners, and relevant third parties for PEP status before establishing a business relationship or carrying out an occasional transaction.
  • Re-screen existing customers on a risk-sensitive basis, and without delay when new information arises or when the official list of prominent public functions is updated.
  • Put in place tools and measures — automated, manual, or a combination — that are effective and proportionate to the nature, risks, complexity, and size of your business.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. To identify a PEP, a family member, or person known to be a close associate of a PEP, pursuant to Article 20(1), point (g), of Regulation (EU) 2024/1624, obliged entities shall determine:

      1. with the exception of the situations referred to in Article 44 of Regulation (EU) 2024/1624, before establishing a business relationship or carrying out an occasional transaction, if the customer, the beneficial owner of the customer and, where relevant, the person on whose behalf or for the benefit of whom a transaction or activity is being carried out, is a PEP, a family member, or person known to be a close associate; and

      2. whether existing customers, the beneficial owner of the customer and, where relevant, the person on whose behalf or for the benefit of whom a transaction or activity is being carried out are or have become PEPs, family members or persons known to be close associates of a PEP.

    1. The determination specified in paragraph 1, point (b), shall take place:

      1. with a frequency established on the basis of a risk-sensitive approach;

      2. without delay in case of new information or changes in the information collected for the purposes of performing customer due diligence measures that may have an impact on the identification as a PEP, a family member or person known to be a close associate;

      3. without delay in case of updates to the list of prominent public functions published pursuant to Article 43(5) of Regulation (EU) 2024/1624.

    1. To comply with paragraphs 1 and 2, obliged entities shall put in place tools and measures that may consist of automated screening tools, manual checks or a combination thereof. These tools and measures shall be effective and proportionate to the nature of the obliged entity's business, including its risks and complexity, and the size of the obliged entity.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod