Article 9 Identification and verification of the identity of the natural or legal persons using a virtual IBAN


This is a draft act

This text has been parsed from the AMLA final report draft as published on 30 September 2026. While we run a suite of validations, the automated parsing can result in errors. Also, before it is finally adopted by the Commission, its wording, numbering and references may change, and entire articles might be removed or added.

Earlier drafts: AMLA consultation paper draft (9 February 2026)

Summary What does Article 9 of the RTS on customer due diligence say?

This article sits within the broader customer due diligence framework and addresses a specific obligation for credit and financial institutions in the context of virtual IBANs.

Building on Article 22(3) of Regulation (EU) 2024/1624, it sets out what information must be collected and verified when a customer uses a virtual IBAN, and what details must be captured about the underlying bank or payment account to which that virtual IBAN is linked.

Important points:

  • Credit and financial institutions must obtain and verify the identity information of any natural or legal person using a virtual IBAN, alongside the virtual IBAN itself.
  • Obtain the associated bank or payment account number, including the dates on which that account was opened and, where applicable, closed.
  • This obligation applies specifically to credit and financial institutions — not to obliged entities more broadly.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. For the purposes of Article 22(3) of Regulation (EU) 2024/1624, credit and financial institutions shall obtain and verify the following information:

      1. in relation to the natural or legal person(s) using the virtual IBAN, the information required pursuant to Article 22(1) of Regulation (EU) 2024/1624;

      2. the virtual IBAN assigned to the natural or legal person(s).

    1. Credit and financial institutions, when obtaining information on the associated bank or payment account pursuant to Article 22(3) of Regulation (EU) 2024/1624, shall ensure that such information contains the associated bank or payment account number and the dates on which such associated bank or payment account was opened and, where applicable, closed.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod