RegRally Insights: AML/CTF Regulation, November 2026

Your corporate client has named its beneficial owner. Could your customer file show a supervisor how that person controls the company?

The EU has set common formats for the beneficial ownership information submitted to central registers, covering ownership interests, voting rights, nominee arrangements, and other forms of control. Once they apply, registers will hold control data in the same structured fields, and obliged entities must report any discrepancy with their own customer data within 14 calendar days of detection. Customer files built today will be compared with these records. An independent anti-money laundering and counter-terrorist financing (AML/CTF) audit can test whether your customer due diligence already captures this information.

In Latvia, the new rules on unclaimed balances on closed accounts are already in force, and former clients have until April 15, 2027 to claim their funds. The Financial Action Task Force (FATF) has also removed four jurisdictions from its gray list.

EU beneficial ownership reporting formats apply from July 10, 2027

Date: October 22, 2026 | Source: Commission Implementing Regulation (EU) 2026/2354 of October 16, 2026
Link (Implementing Regulation) | Link (AML Regulation)

The European Commission adopted Implementing Regulation (EU) 2026/2354 under Article 10(6) of the Sixth Anti-Money Laundering Directive (EU) 2024/1640. It was published on October 22, 2026, and enters into force on November 11, 2026. It applies from July 10, 2027, the same date as the Anti-Money Laundering Regulation (EU) 2024/1624 (AML Regulation).

The regulation sets common formats for submitting information to central beneficial ownership registers:

• Beneficial owner details. Full names, place and date of birth, residential address, country of residence, nationalities, and the type, number, and issuing country of the identity document.
• Ownership and control. Ownership percentages must be recorded in a format allowing two decimal places. The control categories must include ownership, voting rights, appointment rights, veto rights, profit distribution, formal or informal agreements, family relationships, control of the majority of voting rights through acting in concert, and nominee arrangements. The date from which the beneficial interest has been held must also be recorded.
• Where no beneficial owner is identified. The reason must be stated, for example dispersed ownership or the inability to identify a beneficial owner after exhausting the prescribed means. Data on senior managing officials is submitted in the same formats as beneficial owner details.
• Legal entities. Information includes the entity’s name, legal form, registered office, principal place of business, and legal representatives. Where more than one entity or arrangement is involved, the ownership and control structure must be documented in accordance with Annex I, through a file upload or structured data. Entities created outside the EU must state the reason for registration, such as a business relationship with an EU obliged entity or the acquisition of real estate.
• Trusts and nominee arrangements. A trust deed or equivalent document must be uploaded. Where none exists, a general description and the specified supporting details must be provided. Other fields cover the arrangement’s purpose, asset value band, and place of administration. Nominee shareholders, nominee directors, and their nominators are also covered.
• Minimum submission requirements. Registers may accept submissions only if they meet the checklist in Article 5.

Why it matters

The formats apply to submissions to registers, but obliged entities can also use them to review the beneficial ownership information they collect during know your customer (KYC) checks.

Under Article 24 of the AML Regulation, discrepancies generally must be reported without undue delay and within 14 calendar days of detection. Certain minor inaccuracies or outdated data may first be clarified with the customer, subject to the conditions in Article 24(2). This option does not apply in higher-risk cases. For outdated data, the owners must be known from another reliable source, with no grounds to suspect concealment. If the register is incorrect, the customer must be asked to correct it without undue delay and within 14 calendar days. If the customer does not do so, the discrepancy must be reported.

Article 67 also requires certain non-EU corporate clients to register their beneficial owners before the business relationship starts. This applies where the obliged entity, or the client’s category or sector, is associated with medium-high or high risk in the EU or relevant national risk assessment. Article 23(4) requires valid registration evidence or a recent register extract.

What we recommend

• If you collect beneficial ownership information, compare your KYC fields and supporting documents with the new formats, including the basis of control, ownership percentages, and identity document details.
• If you report discrepancies to beneficial ownership registers, prepare the process for July 10, 2027, including the reporting deadline and the conditions for first seeking clarification from the customer.
• If you onboard non-EU corporate clients, check whether Article 67 requires registration and obtain the required evidence where it applies.

---

Latvia: unclaimed balances on closed accounts pass to the state after five years

Date: October 1, 2026 | Source: Law of September 17, 2026 amending the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing
Link

Latvia’s Parliament (Saeima) adopted the amendments on September 17, 2026. They were published on October 1, 2026, and the rules on closed accounts entered into force on October 15, 2026.

Accounts covered

Article 43(2.1) applies where a credit or financial institution has ended a business relationship on its own initiative in the cases specified by the law, closed and documented the accounts, and still holds a positive balance. It excludes clients who are natural persons resident in Latvia. Legal entities, whether resident or non-resident, and non-resident natural persons may therefore fall within its scope.

The rule also covers proceeds from financial instruments sold under Article 43(3) following account closure. It does not apply to funds frozen under the law, seized under criminal procedure, or subject to civil enforcement.

Five-year period and annual checks

If the client does not exercise its right under Article 43(2) to have the funds transferred within five years of the relationship ending, it loses its claim. The funds then pass to the state as ownerless property.

Institutions must check the relevant former clients once a year. Once the institution establishes that the conditions are met, it must transfer the funds within 30 days to the account specified by the State Revenue Service (VID). Credit institutions must also send VID the required account holder information.

The amendment to Article 20(3) extends liability protection to transfers made under this procedure, except where the credit institution incorrectly determined that the client met the conditions.

Transitional deadlines

The rule also covers relationships terminated before October 15, 2026. The transitional provisions require:

• VID to publish a notice in Latvijas Vēstnesis within 10 days of entry into force;
• credit and financial institutions to publish a notice on their websites within the same period and keep it available for the first six months after entry into force;
• a six-month period from entry into force for eligible former clients to exercise their right to have the funds transferred;
• the first review between April 15 and July 15, 2027, corresponding to six to nine months after entry into force;
• the first transfer within 30 days after the first review deadline of July 15, 2027.

Consumer lender supervision

From January 1, 2027, Latvijas Banka, not the Consumer Rights Protection Centre, supervises licensed consumer lenders’ compliance with this law. The Consumer Rights Protection Centre will complete proceedings it began by December 31, 2026, under the rules applicable when those proceedings started.

Why it matters

Institutions need records showing which former clients qualify, why and when each relationship ended, and whether any restrictions apply to the remaining funds. The new process also requires institutions to review account closures that predate the amendments.

What we recommend

• If your institution holds balances on closed accounts, identify the clients covered by Article 43(2.1), record when each relationship ended, and check for restrictions on the funds.
• If your institution is subject to the notice requirement, confirm that the notice was published and remains available for the required six-month period.
• If qualifying balances remain, assign responsibility for the annual review, transfers, and required reporting to VID, and schedule the first review between April 15 and July 15, 2027.

---

FATF removes four jurisdictions from its gray list

Date: October 30, 2026 | Source: Financial Action Task Force (FATF)
Link (Jurisdictions under increased monitoring) | Link (High-risk jurisdictions subject to a call for action)

The FATF removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo, and Monaco from increased monitoring. No jurisdiction was added.

The gray list now contains 18 jurisdictions: Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, the Lao People’s Democratic Republic, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK), and Yemen.

The FATF does not call for enhanced due diligence on these jurisdictions. It calls for a risk-based approach without excluding entire classes of customers. It expressed significant concern about Vietnam and expects tangible improvements by February 2027. All action plan deadlines for Cameroon, Haiti, and South Sudan have expired.

The high-risk list remains unchanged. Countermeasures continue to apply to the Democratic People’s Republic of Korea (DPRK) and Iran. For Iran, these include restrictions on branches, subsidiaries, and representative offices of financial institutions and virtual asset service providers, both from Iran and in Iran, risk-based limits on business relationships and transactions, and a prohibition on new correspondent relationships. Enhanced due diligence continues to apply to Myanmar. The FATF will consider countermeasures if Myanmar makes no further progress by February 2027.

Why it matters

Removal from increased monitoring does not automatically justify a lower country risk score. Any change should follow the firm’s documented methodology and explain which risk factors have changed.

What we recommend

• If you use FATF lists in your risk assessments, update the lists and document the reasons for any changes to country risk scores.
• If you have exposure to the DPRK, Iran, or Myanmar, continue applying the relevant measures, including to virtual asset activity.
• If you have exposure to Vietnam or Myanmar, monitor the February 2027 plenary for further decisions.

---

Our view

The EU beneficial ownership formats give institutions a practical basis for reviewing their customer files before July 2027. The review should cover how control is established, which documents support it, and who follows up when information differs from the register. Any changes to forms or systems should be reflected in the procedures used by staff.

For Latvian institutions, the immediate work concerns former clients. Institutions should confirm that the required notices are in place and establish which closed accounts fall within the new rules. The first review will depend on records of the termination decision, its date, and the status of the remaining funds.

---

How ECOVIS ProventusLaw can help

We advise financial institutions on AML/CTF requirements and help their compliance teams put them into practice. Our services include:

• Independent AML/CTF audits covering customer due diligence, transaction monitoring, reporting, and the effectiveness of policies and controls.
• Compliance support including updates to policies and procedures, compliance monitoring plans, and management reporting.
• Money laundering and terrorist financing (ML/TF) risk assessments including preparation and review of business-wide assessments and the procedures used to conduct them.
• Support during inspections and remediation including assistance with responses to supervisory findings and reviews of whether corrective measures have been implemented effectively.

Contact our AML/CTF team to discuss an independent audit, changes to your procedures, or support with identified compliance gaps.

---

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw is one of the most experienced financial regulatory law firms in the Baltics and has advised financial institutions for many years. The firm is ranked by IFLR1000, The Legal 500, and Chambers and Partners.

Our Banking and Finance & FinTech department has separate regulatory, compliance, and audit teams. Clients can obtain legal advice, practical compliance support, and independent testing, with roles defined for each engagement. Our audits test customer due diligence and KYC files, not only written policies. We issue recommendations so that improvements are made before the regulator’s visit.

We adapt AML/CTF processes to each client’s business model and operations. We have advised on full-scale AML/CTF remediation following significant Bank of Lithuania supervisory findings and carried out an independent post-inspection remediation review for an electronic money institution. We also support clients during inspections and when they respond to supervisory findings and inspection reports.

The department is led by Inga Karulaitytė. Members of our teams hold the Certified Anti-Money Laundering Specialist (CAMS) and Certified Information Privacy Professional/Europe (CIPP/E) certifications and the International Compliance Association (ICA) International Advanced Certificate in Anti-Money Laundering. Our auditors are members of the Association of Internal Auditors.

Clients can also use RegRally, our AI-assisted AML compliance tool, before an audit. They complete a questionnaire prepared by compliance experts and upload supporting documents. The tool analyzes the submitted information and typically provides initial findings and recommendations within a couple of hours.

With teams in Lithuania, Latvia, and Estonia, we provide a single point of contact for regulatory and compliance matters across the Baltics. Through the ECOVIS International network, present in more than 90 countries, we also support clients operating across several jurisdictions. We have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.