AMLR enters into force on 10 July 2027 and that the technical standards specifying identity verification become binding on the same day.
ETSI TS 119 461: The standard that quietly rewrote your verification workflow ↗
What happened
- The blog states that Commission Implementing Regulation (EU) 2025/1566 makes ETSI TS 119 461 V2.1.1 the reference standard for conformity assessment from 19 August 2027.
- The blog states that the standard defines Baseline and Extended identity proofing levels, with Extended required for high-assurance trust services.
- The blog states that fully manual attended and unattended flows can now only reach the Baseline level.
- The blog states that AMLR never names ETSI TS 119 461 directly, but the eIDAS route resolves to it.
- The blog states that AMLA draft RTS on customer due diligence is still in draft form.
Why it matters to Signicat
- Extended-level proofing and injection attack detection requirements raise the bar for document-based remote onboarding, relevant to Signicat's ReadID/NFC verification line after the Inverid acquisition.
- Competitor content positions certification against ETSI TS 119 461 V2.1.1 as a procurement question, which Signicat should be ready to answer with its own assessment evidence.
Evidence from the source (7 quotes)
- “Commission Implementing Regulation (EU) 2025/1566 makes V2.1.1 the reference standard for conformity assessment, from 19 August 2027.” source ↗
- “The standard defines two levels of identity proofing: “Baseline,” which had been the goalpost in previous years, and “Extended,” which is required for anything involving high-assurance trust services, such as qualified certificates or EUDI Wallet attribute attestations.” source ↗
- “Fully manual attended and unattended flows can now only reach the “Baseline” level.” source ↗
- “AMLR never names ETSI TS 119 461 directly, but the eIDAS route resolves to it.” source ↗
- “The AMLA Regulatory Technical Standard (RTS) on customer due diligence, (currently in draft form)” source ↗
- “Extended” requires automated analysis, presentation and injection attack detection tested at the higher level, and a risk assessment that assumes attackers with high attack potential.” source ↗
- “So, the first question to ask is: have they been independently assessed, and can they show you the certification?” source ↗
EUDI wallet eIDAS 2Document IDV biometricsFraud deepfake injectionAML KYB screeningThought leadershipRegulatory commentaryGlobal
6 of 6 facts verified against the source · confidence high · claude-haiku-5-5