Article 27 Electronic identification means and relevant qualified trust services


This is a draft act

This text has been parsed from the AMLA final report draft as published on 30 September 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (9 February 2026)

Summary What does Article 27 of the RTS on customer due diligence say?

This article acts as a bridging provision, connecting the requirements for electronic identification means and qualified trust services to Annex I of this Regulation and the due diligence obligations set out in Regulation (EU) 2024/1624.

It establishes that Annex I is the reference point for determining what attributes these digital tools must have, depending on whether standard, enhanced, or simplified due diligence is being applied.

It also sets out a fallback rule for situations where an electronic identification means or qualified trust service falls short of the required attributes.

Important points:

  • Refer to Annex I to determine which attributes electronic identification means and qualified trust services must have for standard, enhanced, or simplified due diligence purposes.
  • Where simplified due diligence applies, only the Annex I attributes relevant to that lower level of scrutiny are required.
  • Obliged entities must obtain and verify any missing attributes through other means where an electronic identification means or qualified trust service does not cover all requirements.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. Annex I defines the corresponding list of attributes that electronic identification means and qualified trust services are required to feature in accordance with Article 22(6), point (b), of Regulation (EU) 2024/1624, in order to fulfil the requirements of Article 20(1), points (a) and (b), and Article 22(1) of that Regulation, for the purposes of applying standard and enhanced due diligence measures. Where simplified due diligence is to be applied, the electronic identification means and relevant qualified trust services shall have the corresponding attributes laid down in Annex I that allow compliance with Section 5 of this Regulation.

    1. Where an electronic identification means or qualified trust service does not possess all attributes that allow for the identification and verification of the customer or beneficial owner, as required in Article 22 of Regulation (EU) 2024/1624 or Section 5 of this Regulation, the obliged entity shall take steps to obtain and verify the missing attributes through other means in line with Article 22(6) of Regulation (EU) 2024/1624.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod