Is this checklist legally binding?

No — this is an opinionated engineering-and-compliance checklist that aligns with AMLD5/6, GDPR, and PSD2 baseline expectations. Treat it as a starting point, not legal advice. Validate the final policy with a qualified compliance officer.

Does this work for non-EU customers?

The compliance steps are designed for EU + UK obliged entities. Onboarding non-EU customers usually requires extra steps (FATCA / CRS for US persons, additional jurisdictional sanctions checks). Add these as Tier-2 steps after the EU baseline.

Can I skip the manual review for low-risk customers?

Yes — risk-based approach is explicitly allowed under AMLD5. Build a risk score from the registry signals + sanctions hits + sector codes, and only manually review the medium-and-above tier.

EU fintech B2B onboarding checklist

An opinionated, free 18-step onboarding checklist for EU and UK fintech compliance and engineering teams, organized into four phases. Its baseline is the 5th and 6th Anti-Money-Laundering Directives (2018/843 and 2018/1673), GDPR Article 6(1)(c) legal-obligation processing, and PSD2 where it applies. Each step notes what regulators expect, what most teams build, and what the authors recommend in 2026. It is not legal advice.

The four phases

Pre-onboarding: written risk policy and customer-acceptance criteria, GDPR privacy notice and lawful-basis flow, vendor DPAs and sub-processor register, and an immutable audit-trail spec.
At onboarding: collect and checksum-validate the corporate identifier (NIF, SIREN, Companies House, CRO, KRS, Norwegian organisation number), resolve the company in the registry, reject dissolved or insolvent statuses, gather the beneficial-ownership tree, KYC every UBO and officer, screen the entity and each person, run PEP and adverse-media checks, a director-network fraud check, and source-of-funds for high-risk cases.
Decision and post-onboarding: compute a risk score, route to auto-approve, manual review, or reject, and communicate the outcome.
Ongoing: continuous registry-event monitoring and periodic re-screening.

What Prometiam covers

Prometiam handles the company-side steps: registry resolution, status checks, director-network signals, ongoing event monitoring, and sanctions plus US export-control screening across six sources (EU, UN, OFAC, UK OFSI, French gels, and the US Consolidated Screening List including the BIS Entity List, Denied Persons, and ITAR) covering 44,000+ active entities. Natural-person KYC, PEP, and adverse-media need separate vendors; the guide names companion tools for each. Ireland and Poland are company-level only.

Frequently asked questions

Is this checklist legally binding?: No — this is an opinionated engineering-and-compliance checklist that aligns with AMLD5/6, GDPR, and PSD2 baseline expectations. Treat it as a starting point, not legal advice. Validate the final policy with a qualified compliance officer.
Does this work for non-EU customers?: The compliance steps are designed for EU + UK obliged entities. Onboarding non-EU customers usually requires extra steps (FATCA / CRS for US persons, additional jurisdictional sanctions checks). Add these as Tier-2 steps after the EU baseline.
Can I skip the manual review for low-risk customers?: Yes — risk-based approach is explicitly allowed under AMLD5. Build a risk score from the registry signals + sanctions hits + sector codes, and only manually review the medium-and-above tier.