AML/CFT 2026: regulated businesses and due diligence obligations (excluding accountants)

Are you a real estate agent, a dealer in goods, art or precious metals, a gaming operator, or a business domiciliation provider? For several years now you have been subject to anti-money-laundering and counter-terrorism-financing (AML/CFT) obligations under French law. The framework tightened with decree no. 2026-310 of 24 April 2026, which makes staff training mandatory and frames access to the beneficial owners register. In our practice, we regularly meet professionals who confuse these duties with the specific ones applying to accountants. If you are an accountant yourself, see our dedicated article on accountants' obligations: your due diligence regime differs.

Quick answer. Businesses subject to AML/CFT are professionals whose activity is exposed to money laundering: real estate agents, dealers in goods, art or precious metals, domiciliation providers, gaming and betting operators. They must identify their customers (KYC), exercise ongoing due diligence, and report suspicions to Tracfin — with no minimum amount. A suspicion report is never conditioned on a threshold.

The list of regulated persons appears in Article L561-2 of the French Monetary and Financial Code. It has widened through successive EU transpositions. Here are the main professionals outside the financial sector and outside the accounting profession.

Note: lawyers, notaries and bailiffs have obligations that depend on the nature of their work (Art. L561-3), and accountants follow their own regime.

Our reading. For dealers, what triggers regulated status is not the company's designation but the type of transaction. An antique dealer who buys a lot for EUR 8,000 is not concerned on that operation; the same dealer who sells a work for EUR 15,000 must identify the customer and apply due diligence. The threshold is assessed per transaction, not on annual turnover.

Knowing the customer is the foundational duty. It has three stages: identification, identity verification, and identification of beneficial owners.

1. Identify the customer#

You must collect and keep:

• for a natural person: surname, given names, date and place of birth, address, nature and purpose of the business relationship;
• for a legal entity: name, legal form, registration number, registered office, corporate purpose, governance structure;
• the beneficial owners: the natural person(s) who actually control the entity (more than 25% of capital or voting rights, directly or indirectly, or de facto control).

2. Verify identity#

Expected supporting documents (Art. R561-5 et seq. of the CMF):

• individuals: a valid official identity document;
• companies: registration extract, bylaws, capital breakdown;
• additionally: consultation of official registers (beneficial owners register, trade register).

Underestimated risk. Many professionals reduce verification to "looking at an ID document". For beneficial owners you must go further: who are the shareholders, who controls them, how is the capital structured, is there an interposed holding, a trust, a foundation? It is this search for the real structure that often reveals a suspicious arrangement.

After identification, Article R561-12 of the CMF requires ongoing due diligence: regular updating of information and analysis of operations against the customer profile.

In practice, you must:

1. update your knowledge of the relationship (at least every three years, more often for high-risk customers);
2. analyse operations against the known profile (activity, volumes, sector, location);
3. scale due diligence to risk: a high-risk customer (politically exposed person, high-risk third country, sensitive sector) warrants more frequent updates and enhanced monitoring.

Typical red flags:

• a customer used to small operations who suddenly makes a far larger transaction with no economic logic;
• a request to split a sale into several payments to stay under a threshold;
• a payment routed through third parties, nominees or shell companies;
• a cash payment far exceeding the legal limits.

Article L561-15 of the CMF requires reporting as soon as you know, suspect or have good reason to suspect that an operation involves sums from an offence punishable by more than one year's imprisonment (fraud, theft, trafficking…) or terrorism financing.

Key point: no minimum threshold. There is no amount below which you are exempt. A EUR 2,000 operation must be reported if a suspicion exists.

Strict confidentiality. You must not tell the customer that a report has been made: tipping off is a criminal offence (Art. L561-18 et seq. of the CMF).

The cap on cash payments is not, strictly, an AML/CFT obligation, but it intersects with traceability. The rules in force in 2026 appear in Articles L112-6 and D112-3 of the CMF.

In practice: a resident real estate agent may accept a cash deposit up to EUR 1,000; a foreign tourist paying an AML-regulated dealer may pay up to EUR 15,000 in cash, provided due diligence is fully applied.

Common pitfall. "The tax reporting threshold is EUR 10,000, so I can accept EUR 9,999 in cash." Wrong: the EUR 1,000 cap for a resident applies first, and staying under a threshold never removes the duty of due diligence.

Real estate agencies and managing agents#

• Sale: regulated with no threshold — even a modest transaction triggers the obligations.
• Rental management: regulated when the monthly rent reaches EUR 10,000.
• Condominium managing agent: due diligence targets investment or placement operations, not routine charge management.

High-value retail and antique dealers#

• Works of art: EUR 10,000 threshold per transaction.
• Jewellery, watches, precious metals: under EUR 10,000 and with no red flag, simplified due diligence may be considered after a risk analysis.
• Split lots: if a customer fragments purchases to stay under the threshold, you must reassess their risk profile ("structuring").

Gaming operators#

• Casinos: systematic identification, no threshold.
• Online gaming and betting: due diligence proportionate to the account amount.
• Large winnings: report if a suspicion arises.

Business domiciliation providers#

• systematic identification of the director and the beneficial owner;
• at least annual updating;
• enhanced due diligence if the domiciled company frequently changes director or activity.

Decree no. 2026-310 of 24 April 2026, in force since 26 April 2026 with no transitional period, transposes Articles 12 and 13 of Directive (EU) 2024/1640 of 31 May 2024 (the "sixth" AML package). It brings two main changes.

1. Mandatory, formalised training. Anyone involved in implementing AML/CFT obligations must be trained on hiring, then regularly. The duty, previously stated in principle, becomes operational and traceable: you must be able to evidence the existence, frequency and content of the training.
2. Access to the beneficial owners register. The decree sets out how regulated parties access this register for their checks.

On sanctions, for sectors not supervised by the ACPR (real estate, domiciliation, dealers…), the Commission nationale des sanctions (CNS) decides: it may issue a warning, a reprimand, a temporary practice ban and a financial penalty (Art. L561-40 of the CMF). The DGCCRF, for its part, checks that the framework — notably staff training — actually exists.

A real estate agency manager recently consulted us, fearing an inspection of 2023-2024 client files and a challenge to her professional licence. On review, her team applied the right reflexes (ID documents, register checks) but did not document them: no written record of the protocol followed, no due diligence file. To an inspector, the absence of evidence equals the absence of diligence. We set up retroactive file organisation and a training plan compliant with decree 2026-310. The situation was remediated.

Hayot Expertise advice. AML/CFT is not only about doing the right thing: you must be able to prove it. Build a due diligence file per operation (supporting documents, verification date, register-check results, updates), appoint an AML/CFT contact to run the framework, and keep evidence of training. A light annual internal review beats a last-minute remediation.

• Splitting operations to stay under thresholds. This is "structuring", unlawful and reportable to Tracfin once detected.
• Doing due diligence without recording it. This is the leading cause of non-compliance: the action is taken, but nothing is traced.
• Confusing simplified due diligence with no due diligence. Simplification is still due diligence, justified by a risk analysis.
• Failing to report for fear of losing a customer. Not reporting exposes the professional to far heavier consequences than losing a dubious customer.

• Among those regulated: real estate agents (no threshold on transactions), dealers in goods, art or metals (EUR 10,000 threshold), gaming operators, domiciliation providers.
• Three stages of due diligence: identify the customer, verify their identity, identify the beneficial owner — then update.
• Suspicious transaction reports to Tracfin with no minimum amount, via ERMES, and without telling the customer.
• Cash caps: EUR 1,000 for a resident or a professional payment; up to EUR 15,000 for a non-resident paying an AML-regulated professional.
• Decree 2026-310: mandatory, formalised training since 26 April 2026; sanctions outside the financial sector are handed down by the Commission nationale des sanctions.
• Evidence is decisive: one due diligence file per operation, kept for at least five years.

• Légifrance — Article L561-2 of the Monetary and Financial Code (regulated persons)
• Légifrance — Article L561-15 of the CMF (suspicious transaction reporting)
• Légifrance — Articles D112-3 et seq. of the CMF (cash payments)
• Tracfin — What must be reported
• Légifrance — Decree no. 2026-310 of 24 April 2026