One case, one workflow, from the branch to audit.

What the RTS require. For a natural person: all forenames and surnames, place and date of birth, nationality, address of residence. For a legal person: name, legal form, registration number, registered office, beneficial owners. Identification gathers; verification compares with an identity document, a passport or an equivalent, or with an official register. Without a document, reliable and independent means for the missing data.

Where ComplifyADV does it. The new case starts with data from the bank's systems or uploaded by hand; the interview gathers what is missing; the official information on the company and the individual comes from the Register with its date, and the beneficial owner from the beneficial ownership document. The case says which datum was verified against what.

What the RTS require. The information for customer due diligence comes from reliable and independent sources, and the source is assessed: credibility and reputation, official status, how up to date it is, accuracy, possibility of falsification. For a legal person, the public registers, the constitutive documents, the financial statements; for the beneficial owner, the business registers, the registers of beneficial owners and the land registers, and the central register is not enough on its own. Conflicting sources are resolved, and the resolution is kept in writing.

Where ComplifyADV does it. Every item in the case carries the source and the date to which it refers: Italian and foreign business registers, filed financial statements, land registry, registers of protesti, sanctions lists. Where two sources diverge, the document says so and the analyst notes the choice.

What the RTS require. When the customer and the obliged entity are not present, verification goes through the electronic identification means and qualified trust services of the eIDAS regulation; alternative solutions are allowed only if the customer cannot appear in person or use those means, with safeguards on actual presence, integrity, clear images and data, interruption in case of doubt, retention with a time stamp, and they must be justified to the authority.

Where ComplifyADV does it. Access is by SSO or by credentials and two-factor authentication; the case records by what means identity was verified and keeps the outcome with the date. The means of identification is the bank's choice, and the case keeps a record of it whichever it is.

What the RTS require. Verification is not a checklist that is the same for everyone: the nature, extent and intensity of the measures follow the risk. Where it is low, a natural person is identified by name, place and date of birth and nationality, and the address need not be verified; where it is high, further information on the customer, on the beneficial owner, on the ownership and control structure, on the origin of funds and of wealth. And if the obliged entity already holds useful information, including from another entity in the group, it assesses it before asking for it again.

Where ComplifyADV does it. The form of verification follows the risk profile, and the case asks the operator only for what the form requires. All the customer due diligence files for the same counterparty can be consulted online, and monitoring brings into the case what has changed, not everything from scratch.

What the RTS require. At opening, the information is gathered that explains why the customer is entering into the relationship and how it will use it: the activity it carries out, the expected operations and volumes, the origin and destination of funds. It is not the same list for everyone: the extent follows the risk, and the information the obliged entity already holds counts too. That profile becomes the yardstick for ongoing monitoring: operations that depart from it must be explained, or lead to the profile being reviewed.

Where Complify and ComplifyADV do it. The company arrives with its context already written: activity and ATECO code, financial statements and size, local units, group and countries of the associated companies. The case interview gathers what only the customer knows, and monitoring flags when the subject changes from that starting point.

What the RTS require. For the person acting in the customer's name (the esecutore, in Italian law: the legal representative, a signatory, an attorney or procuratore), identity, the existence of the power of representation and its scope in relation to the requested transaction are verified. A limited delegation is not full representation. And the person who represents should not be confused with the person who owns: the nominee is a question of beneficial ownership, not of powers.

Where Complify does it. Next to each officer the file says who can sign for the company and how, alone, separately or jointly, in three colours: verified, to be read in the text of the powers, not verifiable. Powers of attorney that the Business Register does not record remain to be requested from the customer.

What the RTS require. The status of politically exposed person is verified before the relationship is started, and then again over time, according to the risk. Sanctions screening covers the customer, the beneficial owners and those who control; it is done at the start, when the lists change, when the data of the customer or of the beneficial owner change, and periodically. For sanctions there is no graduated risk-based approach: checks are always made.

Where Complify does it. Screening against sanctions lists and politically exposed persons covers the company, the directors, the shareholders and the beneficial owners, with the matches told apart from namesakes by name and date of birth. With monitoring, the subject is re-read at the chosen frequency, and a change of shareholders or beneficial owners is flagged and, in ComplifyADV, reopens the case.