AML Obligations for Non-Financial Businesses: Real Estate, Lawyers, Accountants, Dealers and More

AML rules are often thought of as a banking problem. But criminals don't only use banks. They buy property, use lawyers and accountants to set up companies, launder cash through high-value goods, and gamble in casinos. That's why AML laws in most countries also cover a group of businesses known as designated non-financial businesses and professions — DNFBPs.

If you work in one of these sectors, you have many of the same core obligations as a bank, but usually without a bank's compliance budget. This guide explains who is in scope, what you have to do, and how to build a program that is proportionate to a smaller business.

Who counts as a DNFBP

FATF Recommendation 22 lists the businesses and professions that should be covered, and when:

Casinos — when customers engage in financial transactions at or above USD/EUR 3,000.
Real estate agents — when involved in transactions for their clients concerning the buying and selling of real estate.
Dealers in precious metals and precious stones — when they engage in cash transactions with a customer at or above USD/EUR 15,000.
Lawyers, notaries, other independent legal professionals and accountants — when they prepare for or carry out transactions for their clients concerning:
- buying and selling real estate;
- managing client money, securities or other assets;
- managing bank, savings or securities accounts;
- organising contributions for the creation, operation or management of companies; or
- creating, operating or managing legal persons or arrangements, and buying and selling business entities.
Trust and company service providers — when they form companies, act as or arrange for someone to act as a director, nominee shareholder or trustee, or provide a registered office or business address.

Many countries go further than the FATF baseline. In the EU and UK, for example, the scope also includes letting agents for high-value rentals, art market participants and dealers in high-value goods for transactions at or above EUR 10,000 (or equivalent). The EU's new Anti-Money Laundering Regulation extends coverage further, including to professional football clubs and agents from 2029.

The key point: check your national law. Whether you are in scope can depend on the specific services you provide, not just your profession — an accountant who only prepares tax returns may be treated differently from one who also forms companies.

Your core obligations

FATF Recommendations 22 and 23 apply most of the obligations that banks have to DNFBPs as well. In practice, that means:

Risk assessment

You need a documented, business-wide risk assessment covering your customers, services, geography, transactions and delivery channels. For a small firm it can be short, but it has to be specific to your business.

Policies, procedures and controls

Written policies proportionate to your size, a nominated person responsible for AML compliance, and controls that reflect the risks you have identified. A sole practitioner's policies will look very different from a large firm's — and that is fine.

Customer due diligence

Identifying and verifying your clients and their beneficial owners, understanding the purpose of the work, and applying enhanced due diligence where the risk is higher — for example, politically exposed persons, clients from high-risk countries, or complex structures with no clear rationale.

Ongoing monitoring

Keeping client information up to date and staying alert to transactions or instructions that don't fit what you know about the client.

Suspicious activity reporting

Reporting suspicion to your national financial intelligence unit, without tipping off the client. FATF allows lawyers and other legal professionals not to report where the information is covered by legal professional privilege — but the scope of privilege is defined by national law and is often narrower than practitioners assume.

Record keeping

Keeping due diligence and transaction records for at least five years. See our guide to AML record keeping.

Training

Making sure staff understand the risks in your sector, how to spot red flags and how to raise concerns. See AML training requirements.

Supervision and registration

DNFBPs are usually supervised by a government agency, a professional body or a self-regulatory organisation. Many must register with their supervisor before doing regulated business, renew that registration periodically and pay a fee. Missing a renewal can mean you are operating without the registration you need.

Sector-specific red flags

Each sector has its own typical risks. A few examples:

Real estate: buyers using third-party funds without a clear explanation, purchases through complex structures, unexplained urgency or willingness to overpay, and cash or cryptoasset payments.
Legal and accountancy: instructions to move client money with no underlying legal work, company formations with no clear business purpose, and clients reluctant to explain ownership.
Trust and company service providers: requests for nominee directors or shareholders without a legitimate reason, and structures spanning several jurisdictions with no commercial rationale.
Dealers in high-value goods: large cash payments, payments split to stay below thresholds, and buyers uninterested in price or quality.
Casinos: buying chips with cash and cashing out with little play, and players using third parties to buy chips.

Your supervisor and national financial intelligence unit will usually publish sector-specific guidance and typologies. Use them in your risk assessment and training.

Building a proportionate program

Most DNFBPs are small or medium-sized businesses. The rules recognise that, and supervisors expect proportionality — not a scaled-down copy of a bank's program.

Confirm whether, and for which services, you are in scope, and who your supervisor is.
Register with your supervisor if required, and put the renewal date in your diary.
Nominate the person responsible for AML compliance and reporting.
Write a short, specific risk assessment using your supervisor's guidance and your own client base.
Write practical policies and procedures covering CDD, EDD, reporting and record keeping.
Train staff and keep evidence that you did.
Set up a simple compliance calendar for the recurring obligations: risk assessment review, policy review, training refreshers and registration renewal.

For a fuller walk-through of each step, see how to build a risk-based AML program.

Key takeaways

DNFBPs include casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries, accountants and trust and company service providers — and often more under national law.
Whether you are in scope can depend on the services you provide, not just your profession.
Your core obligations mirror those of banks: risk assessment, policies, CDD, monitoring, reporting, record keeping and training.
Supervisors expect a program proportionate to your size and risk — but it must be specific to your business and actually followed.

Regpin is designed for both financial institutions and non-financial businesses with AML obligations. If you need a program that fits a smaller team, get in touch.

This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.