AMLR 2027: New KYC Rules for Real Estate, Luxury & Football

Banks, payment firms, and crypto exchanges have absorbed nearly all of the conversation around the EU Anti-Money Laundering Regulation. That lens leaves the larger shift out of view. Full KYC and AML duties arrive on July 10, 2027 for industries that never carried formal identity verification rules at any point in their history: real estate agents, luxury goods traders, crowdfunding platforms, migration investment operators, and — after a grace period — professional football clubs.

"KYC" names infrastructure that financial-services compliance teams have spent years assembling. The same word, for a Madrid estate agency, a Paris jewellery house, or a Milan club, names a function they have never performed.

Fourteen months is a short interval in which to close that gap.

Which Sectors Fall Under the AMLR Net?

A single, directly applicable instrument — the AMLR (Regulation (EU) 2024/1624) — takes the place of the EU's patchwork of AML directives. National transposition is not required, unlike with directives; from the date it takes effect, every duty binds uniformly across all 27 member states.

"Obliged entities" now reach the non-financial sectors listed below:

Sector	Relevant Activity	Threshold	Applies from
Real estate agents	All property transactions	No minimum	10 July 2027
Luxury goods traders	Jewellery and watches	>€10,000	10 July 2027
Luxury goods traders	Vehicles	>€250,000	10 July 2027
Luxury goods traders	Aircraft and watercraft	>€7,500,000	10 July 2027
Crowdfunding platforms	Non-MiCAR platforms	All transactions	10 July 2027
Migration by investment	All operators	All transactions	10 July 2027
Football clubs and agents	Player transfers, sponsorships, investor deals	All transactions	10 July 2029

Football's two-year grace period does not mark the sector as low priority. Regulators already treat football as a lasting conduit for illicit funds. Transfer pricing opacity and multi-layered ownership structures appear in EUROPOL's sector analysis as recurring vulnerabilities.

What Status as an "Obliged Entity" Requires

Obliged-entity status under the AMLR is not a light commitment. A complete AML/KYC programme follows, built around five core requirements.

Customer Due Diligence (CDD): Identification and verification of every customer must finish before a business relationship starts or a high-value transaction is executed. Government-issued ID verification plus independent address confirmation covers individuals. For companies, every beneficial owner must be identified — any natural person exercising control or holding more than 25% of the entity.

Enhanced Due Diligence (EDD): Higher-risk customers — politically exposed persons, clients tied to high-risk third countries, or transactions lacking an apparent economic rationale — trigger mandatory extra scrutiny. Discretion does not apply here; the AMLR states that EDD must fire automatically once risk indicators are present.

Ongoing monitoring: Continuous monitoring across the customer relationship is the AMLR's most operationally demanding duty. Each transaction has to be checked against the established customer profile. A deviation — a client whose stated income cannot explain a series of high-value purchases — must prompt review.

Suspicious Transaction Reporting (STR): Activity that raises reasonable grounds to suspect money laundering or terrorist financing must be reported to the national financial intelligence unit (FIU). Member states set different clocks, though filing generally falls inside a defined window after suspicion arises.

Record keeping: CDD records, risk assessments, and transaction documentation stay on file for five years and must be produced for competent authorities on request.

A high-street estate agency or a luxury car dealership therefore has to assemble — from scratch — the procedures, technology, and internal governance that banks have spent decades refining.

The Compliance Gap When You Start at Zero

Regulatory complexity is not the only obstacle facing non-financial sectors. They also lack a baseline on which to build.

Dedicated compliance teams, technology platforms, documented procedures, and years of contact with supervisors already exist inside financial institutions. Even those mature organisations fail the standard. UBS was fined €6 million in May 2026 for AML failures — among them a suspicious transaction report left unfiled for 253 days, plus onboarding a client on partially untranslated documents — a reminder that full infrastructure does not guarantee consistent performance.

Estate agencies, luxury retailers, and football clubs start from a steeper position. Most of them have:

• No trained AML/KYC staff
• No identity verification technology infrastructure
• No documented risk classification procedures
• No established reporting relationship with their national FIU
• No culture of compliance as a core business function

All of this is required by the AMLR. By July 2027.

What Sound KYC Requires of a Luxury Goods Dealer

Take a luxury car dealership selling a €320,000 vehicle to a private buyer. Completing that sale under the AMLR means doing the following:

1. Identity verification: Collect a government-issued ID and verify its authenticity — not photocopy it, but confirm its security features, validate the MRZ or chip data, and confirm the document has not expired or been tampered with.
2. Address confirmation: Verify current residence through an independent source — a utility bill, a bank statement, or a credit bureau query.
3. Sanctions screening: Run the customer against EU consolidated, UN, OFAC, and domestic sanctions lists before proceeding.
4. Source of funds assessment: For high-value transactions, the dealer must understand where the funds originate. A large cash payment, or a wire transfer from a jurisdiction with weak AML controls, triggers enhanced scrutiny.
5. Risk scoring: Assign a formal risk classification to the customer and document the reasoning.
6. Ongoing monitoring: If the customer returns — or refers others — the profile must be updated and the pattern reviewed.

A corporate buyer — a holding company purchasing vehicles or acquiring property — lengthens the chain. Every beneficial owner behind the corporate structure must be identified and verified, including tracing through layers of intermediate entities.

Hours per customer is a realistic duration if this is done by hand. Minutes is the duration with modern AI-powered identity verification.

Technical Standards Cut-Off: July 10, 2026

Final draft Regulatory Technical Standards (RTS) must go from AMLA to the European Commission by July 10, 2026 — less than seven weeks from now. Those standards will state exactly which CDD measures satisfy the AMLR, which identity documents are acceptable for each risk category, and how ongoing monitoring must be documented.

Our analysis of AMLA's CDD RTS and what identity systems must deliver walks through what the draft CDD standards currently require of identity verification systems. Until the full AMLR applies in July 2027, the final RTS will shape compliance requirements — and will decide whether automated AI-based identity verification clears the regulatory bar.

Teams in newly obliged sectors that join the consultation process now sit in a better position to implement systems that already match the final standard, instead of retrofitting later.

How AI-Powered KYC Alters the Cost Structure

Manual document review, paper customer files, and periodic spot-checks — the traditional compliance stack — move too slowly and cost too much for sectors without compliance scale. Two hundred property transactions a year will not support a dedicated compliance team at a mid-sized estate agency. A jewellery house that verifies dozens of high-value customers each month needs a process that sits inside ordinary commercial operations.

AI-powered identity verification is not a luxury at that point. It is a necessity.

Document authentication, biometric face matching, sanctions screening, beneficial ownership lookup, and risk scoring run in minutes on automated systems, at a fraction of the cost of manual review. Complex files — corporate structures with multiple layers of beneficial ownership, clients from high-risk jurisdictions — get flagged and routed to a person; the routine volume is handled automatically.

Clients across financial services, real estate, and crypto have, at Joinble, cut manual KYC review time by up to 80% through AI-agent-driven verification workflows. For sectors entering compliance for the first time, that model is not a premium add-on. It is the only approach that makes the economics viable.

Football Clubs as a Distinct Case

July 10, 2029 is the date for professional football clubs and agents — two years after the general AMLR application date. Transaction structures in football explain the grace period: player transfers involve multi-jurisdiction intermediaries, image rights agreements, signing bonuses, and agent fees, all of which can create beneficial ownership ambiguity.

Deferral is not what the grace period is for. Clubs that wait until 2028 to start compliance work will meet the same structural problem as every other sector: procedures, technology, and trained staff assembled under time pressure. Starting now lets football clubs design programmes around their actual transaction types, rather than forcing general-purpose AML procedures onto sport-specific deal structures.

Transfers that hide the true fee through installment structures or image rights packages, sponsorship agreements with counterparties whose ownership chains are opaque, and investor relationships where stadium or club acquisition funding has an unclear source are the deals most likely to attract regulatory scrutiny.

Implications Across Borders

Direct, uniform application across the EU follows from the AMLR being a regulation rather than a directive. Member states cannot write lighter-touch national variants. Lisbon and Warsaw impose identical duties on a real estate agent.

The EU-based entity in the transaction carries the duty when a non-EU party is involved. A non-EU buyer acquiring real estate through a Portuguese agency must go through that agency's AMLR-compliant KYC. The buyer's home jurisdiction does not change the EU firm's compliance obligation.

Regulatory arbitrage that once existed under directive-based frameworks — structuring a cross-border deal to dodge the stricter member state's rules — loses that path.

AMLA Is Watching: EU's New AML Authority sets out a broader view of AMLA's supervisory framework and how those standards are enforced.

Little Time Remains

July 2027 sits closer than the calendar first suggests. Technical standards from AMLA, due in July 2026, will fix the exact bar compliance systems must clear. Procurement, implementation, staff training, and — where required — regulatory registration all consume time that unprepared sectors do not have in abundance.

Treating the date as a strategic priority today, rather than a compliance exercise parked until the deadline, is what will get real estate agents, luxury goods dealers, and crowdfunding platforms to the July 2027 line. Practical implementation steps for the property sector sit in our guide to KYC requirements for real estate agents and agencies.

Sectors that miss the window will share the fate of financial institutions that learned, too late, that AMLA was watching.

This push is not unique to the EU. Equivalent AML/CTF duties reach lawyers, accountants, and real estate agents under Australia's Tranche 2 reforms, which take effect on 1 July 2026 — an entire year ahead of the AMLR. What 100,000 newly regulated firms must put in place before that deadline is set out in the Australia Tranche 2 compliance guide.

---

FAQ

When exactly does the AMLR apply to real estate agents and luxury goods traders?

July 10, 2027 is the start date of the AMLR for real estate agents, luxury goods traders, crowdfunding platforms, and migration-by-investment operators. Professional football clubs and agents receive a grace period until July 10, 2029.

Does a small real estate agency need the same KYC as a bank?

Identity verification, beneficial ownership checks, risk assessment, ongoing monitoring, and STR reporting appear on both sides, so the regulatory duties are structurally similar — yet a proportionality principle sits inside the AMLR. Simplified CDD may be used by smaller entities with simpler client profiles and lower-risk transactions for lower-risk customers, with enhanced due diligence reserved for complex or high-value cases. A documented AML programme, staff training, and suspicious-activity reporting still bind every obliged entity, size notwithstanding.

What are the penalties for AMLR non-compliance?

Administrative sanctions available to AMLA and national supervisors include fines of up to €1 million or 10% of annual turnover — whichever is higher — for serious violations. Public statements, corrective orders, and temporary activity restrictions sit alongside those fines. Personal liability can also attach for natural persons.

How much does AMLR-compliant KYC cost a luxury dealer or estate agency?

Staffing and operational overhead for a mid-sized firm's manual compliance programme can run €50,000–€150,000 per year. Document verification, sanctions screening, and risk assessment automated on AI-powered platforms deliver compliance at a fraction of that cost — typically well below €15,000 annually for typical transaction volumes in real estate or luxury goods.

What happens to football clubs during the grace period until 2029?

AMLR obligations do not bind football clubs and agents until July 10, 2029. National AML legislation that may already cover certain activities still applies, and financial counterparties — banks, payment processors, sponsors with their own compliance duties — will keep running due diligence on their own. Starting compliance work by 2027 remains strongly advisable.

Do companies outside the EU need to comply with AMLR?

Non-EU entities are not directly obligated by the AMLR. However, every EU-based obliged entity they transact with — a real estate agent, a luxury goods dealer, an investment platform — is required to perform AMLR-standard KYC on that non-EU counterparty. In practice, non-EU companies transacting with EU obliged entities will be subject to full CDD regardless of their own jurisdiction's requirements.

Does the AMLR change the beneficial ownership threshold for KYB verification?

Yes. For obliged entities performing Know Your Business (KYB) checks on corporate clients, the AMLR introduces a critical technical change: the UBO ownership threshold shifts from "more than 25%" to "25% or more." This means any natural person holding exactly 25% must be identified as a UBO from July 10, 2027. The AMLR also mandates a dual assessment approach — testing ownership and control independently. For a detailed breakdown of what this means for KYB rule engines and compliance workflows, see our analysis of KYB under the AMLR's new UBO verification rules.