Simplified due diligence — five measures, one 60-day cap
Simplified due diligence is not reduced due diligence — it is a closed list of five specific relaxations, one of which comes with a hard 60-day cap. Article 33 of Regulation (EU) 2024/1624 permits them where, taking into account the risk factors in Annexes II and III, the relationship or transaction presents a low degree of risk. Everything not on the list continues to apply in full.
1. The five measures
| Limb | Measure | Limit |
|---|---|---|
| (a) | Verifying the identity of the customer and beneficial owner after the relationship is established | Only where the specific lower risk justifies postponement, and in any case no later than 60 days after establishment |
| (b) | Reducing the frequency of customer identification updates | Reduced, not removed |
| (c) | Reducing the information collected on the purpose and intended nature of the relationship, or inferring it from the type of transactions or relationship | Inference must be from the transaction or relationship type |
| (d) | Reducing the frequency or degree of scrutiny of transactions | Reduced, not removed |
| (e) | Any other relevant simplified measure identified by AMLA under Article 28 | Only measures AMLA identifies |
2. The 60-day cap
Limb (a) is the only measure with a number attached, and the number is absolute: verification postponed under simplified due diligence must be completed no later than 60 days of the relationship being established. The condition on top is that the specific lower risk identified justified such postponement — the same two-part test that appears in Article 23.
Sixty days is long enough to be forgotten and short enough to be breached at scale. The practical answer is the same as for Article 23: an account state with an expiry, and a defined consequence when it expires. Article 21 supplies the consequence — refrain, terminate, and consider reporting.
3. What never reduces
Article 33(1) closes with a proviso that governs the whole regime. The measures must be proportionate to the nature and size of the business and to the specific elements of lower risk identified — however, obliged entities must carry out sufficient monitoring of the transactions and business relationships to enable the detection of unusual or suspicious transactions.
So monitoring frequency and depth may be reduced under limb (d), but the monitoring itself has to remain sufficient for detection. That is the sentence that makes “low risk, so we do not monitor” indefensible, and it is the one to quote in an internal policy.
4. Applying it defensibly
Three habits separate a simplified-due-diligence regime that survives inspection from one that does not:
- Record the low-risk determination, with the factors. Article 33 conditions the whole regime on the assessment taking into account the Annex II and Annex III factors. A category-level rule with no per-relationship record cannot show that.
- Name the measures applied. “SDD applied” is not a record. Which of the five, and why, is.
- Make the exit automatic. Simplified treatment must end when the risk picture changes. If the only route out is an analyst noticing, it will not happen at volume.
The exit condition deserves particular attention, because simplified treatment is the one regime that gets less accurate over time by default: the customer was low risk when assessed, and nothing inside a reduced-scrutiny regime is designed to notice when they stop being so. The trigger has to come from outside it.
It is also worth being explicit internally that simplified due diligence is a permission, not an obligation. Article 33 says entities may apply the measures. Where the operational cost of maintaining two regimes exceeds the saving, running full measures for everyone is a legitimate choice and a much simpler one to evidence.
FAQ
How long can verification be postponed?
No later than 60 days after the relationship is established, and only where the specific lower risk identified justified the postponement.
Can monitoring be switched off for low-risk customers?
No. Frequency or degree of scrutiny may be reduced, but sufficient monitoring must remain to enable detection of unusual or suspicious transactions.
Can we design our own simplified measures?
Only within the list. The catch-all limb covers other simplified measures identified by AMLA under Article 28, not measures a firm devises for itself.
Related: Enhanced due diligence · Timing of verification · The customer risk profile
