According to international anti-money laundering regulations, customer due diligence is a mandatory step for banks and financial institutions. Before establishing a business relationship or authorizing a suspicious transaction, obliged entities must assess the money laundering risk by verifying the client’s identity and collecting information to determine the customer’s profile and the nature of the transactions.

If the customer is a company or another type of legal entity, the risk assessment must be carried out on the beneficial owner, i.e., the natural person who owns or controls the entity and therefore is its ultimate beneficiary.

Anti-money laundering due diligence: how it works

Customer due diligence is a tool provided by anti-money laundering regulations that allows banks, professionals, and other obliged entities to identify their customers in order to prevent unlawful activities connected to money laundering.

The subject is governed by Legislative Decree No. 231 of November 21, 2007, which assigns to the Bank of Italy the task of issuing provisions on customer due diligence. According to the document, last updated in July 2025, customer due diligence for combating money laundering and terrorist financing consists of the following activities:

• Identification of the customer and any executor;
• Identification of the beneficial owner;
• Verification of the identity of the customer, executor, and beneficial owner “on the basis of documents, data, or information obtained from a reliable and independent source”;
• Assessment of the purpose of the relationship and, in the case of high risk, of the nature of the transactions;
• Carrying out of ongoing monitoring for the entire duration of the business relationship.

Under Italian regulations, when due diligence obligations cannot be fulfilled, no new business relationship may be established with a client, nor may transactions be executed. If this occurs within an existing relationship, the relationship must be terminated.

In these cases, obliged entities must also assess whether to file a suspicious transaction report for money laundering.

AML due diligence: when is it required?

The customer due diligence activities required by the Bank of Italy must be carried out (at least) in the following cases:

• When a new business relationship is established;
• When a client makes a payment exceeding €15,000;
• When funds are transferred for an amount exceeding €1,000;
• For occasional transactions carried out as payment services or for the issuance and

distribution of electronic money through agents or affiliated entities;

• Whenever there is a suspicion of money laundering or financing of unlawful activities, regardless of any exemption or threshold applied;
• When doubts arise about the completeness or accuracy of the information provided by the client or of the documentation obtained.

These activities must be carried out with greater care and frequency whenever a relationship or transaction is assessed as high risk, for example, when high-risk third countries are involved, Politically Exposed Persons (PEPs), or unusually large amounts.

AML obligations: who must carry out customer due diligence?

The provisions on due diligence apply to:

• Banks;
• Securities brokerage firms;
• Asset management companies;
• Investment companies with variable or fixed capital (securities and real estate);
• Financial intermediaries;
• Electronic money institutions;
• Payment institutions;
• Trust companies and credit consortia (confidi);
• Micro-credit providers;
• Poste Italiane (for its bancoposta activities);
• Cassa Depositi e Prestiti;
• Crypto-asset service providers (category added with the update published on July 23, 2025).

The obligations also apply to payment institutions and electronic money institutions with registered offices in another EU country and operating in Italy through affiliated entities and agents, as well as to branches of banking and financial intermediaries with registered offices in Europe or in third countries.

Anti-money laundering: the beneficial owner and risk assessment

As seen above, identifying the beneficial owner of a company is one of the key activities of customer due diligence. When assessing the risk factors associated with a client, it is necessary to consider the scope of activity, behavior, and significant relationships of the entity, regardless of whether it is a natural or legal person.

The beneficial owner, as we will see later, is the natural person (or persons) who can be identified as having the ultimate control of the company. When the client is a company, it is therefore necessary to trace back to the individual who makes decisions on behalf of the company and perform a risk assessment on that person.

Once the beneficial owner has been identified, further checks must be carried out, considering aspects such as possible involvement in money laundering-related crimes, being a PEP, or being subject to sanctions and measures.

Anti-money laundering regulations: how to determine who the beneficial owner is

The beneficial owner, in the context of anti-money laundering, is the natural person to whom ownership (direct or indirect) of the company can be attributed and who therefore exercises control. Ownership and control are the key criteria that, under Legislative Decree 231/2007, must be applied to identify beneficial owners.

The criteria to be applied, in hierarchical order, are:

• Ownership (direct and indirect): direct ownership means holding more than 25% of the company’s capital, while indirect ownership refers to the same stake held through controlled companies or intermediaries;
• Control: if it is not possible to identify a beneficial owner on the basis of ownership, then it coincides with the individual who controls the company (by contract or because they control the majority of votes—or a sufficient amount to exercise decisive influence—at the shareholders’ meeting. In this context, control exercised through family relationships or various interests must also be considered;
• Residual criterion: if even the control criterion does not provide a result, then the beneficial owner is the individual who holds legal representation, administration, or management powers of the company.

The beneficial owner of an SRL or any other capital company must therefore be identified as the person who holds ownership and control, regardless of whether these are exercised directly or through others.

Companies with legal personality required to register with the Business Register would be obliged to report beneficial ownership to the Chamber of Commerce through a specific online filing, which would result in registration in the Register of Beneficial Owners. Due to a complex legal case, however, the reporting obligation, as well as the possibility to consult or register with it, are currently suspended.