Real estate AML: who is an obligated entity, and what they have to do
When a real estate business becomes an AML obligated entity in the EU, the KYC, UBO and reporting duties it takes on, and how to automate them in the payment flow.
Almost any real estate business that handles client money runs into the same question sooner or later: am I an anti-money-laundering obligated entity? The answer matters more than it looks, because it separates verifying a client in minutes from facing a regulator's request, a report to the Financial Intelligence Unit, or a fine for failing to establish the source of funds in time. This guide explains when a real estate business falls inside the EU anti-money-laundering perimeter, the specific duties it takes on, and how that compliance gets automated inside the payment flow itself rather than run as a separate project.
This is an informational guide and does not replace professional advice. It maps the terrain so you can decide what to automate. The examples use Spain (the Ley 10/2010 framework and the SEPBLAC reporting body), but the structure is common across the EU.
What an obligated entity is
An obligated entity is a person or company that anti-money-laundering rules place under active duties: identify your clients, understand the source of their funds, monitor transactions, and report what looks suspicious. In the EU these duties flow from the anti-money-laundering directives, transposed by each member state, and reports go to that country's Financial Intelligence Unit. In Spain the law is the Ley 10/2010 and the body is the SEPBLAC.
The practical point is that the obligation is triggered by the activity you carry out, regardless of whether you think of yourself as a financial player. Several everyday real estate activities are expressly inside the perimeter.
When a real estate business is in scope
Three cases cover most of the sector.
Property development. Developers who build and sell property are obligated entities by the nature of what they do. They collect large amounts, often from buyers they have not dealt with before, and that combination is the textbook scenario the rules exist to watch.
Intermediation in sale and purchase. Agencies and professionals who broker the sale and purchase of property are in scope. This is where most traditional estate agents sit: if your business is bringing a buyer and a seller together on a property and you are paid for it, the duty to identify and monitor reaches you.
Letting intermediation above the threshold. The current EU framework brings letting agents into scope for transactions where the monthly rent is 10,000 euros or more (in Spain, also lettings with a total annual rent of 120,000 euros or more). The threshold is aimed at offices, commercial premises, and luxury residential rather than ordinary residential lettings, but it is worth knowing precisely, because it defines the line: below the threshold, letting intermediation sits outside, and above it, fully inside.
A fourth case is growing fast and is one many operators do not file under "real estate": crowdfunding and tokenization platforms. When a platform raises money from investors for property projects, it takes on identification and monitoring duties for each investor who enters, and often for the company the investor enters through. We cover that in the KYB business verification guide and the crowdfunding solution.
The duties, one by one
Being an obligated entity translates into a concrete list of duties you have to be able to evidence to an inspector. These are the ones that affect a real estate business day to day.
Client identification (KYC). Before the business relationship begins or the transaction executes, you identify the client with a reliable document and confirm they are who they claim to be. For a domestic buyer that is the national ID; for a foreign buyer, the passport and, where relevant, the NIE. Identification goes beyond collecting a copy: it includes verifying that the document is genuine and belongs to the person.
Beneficial owner identification (UBO). When the client is a company, you have to establish who is actually behind it: the individuals who own or control, directly or indirectly, more than 25 percent of the capital or voting rights, or who control it by other means. That means unwinding the corporate chain down to natural persons, which is exactly what business verification (KYB) covers.
Purpose of the relationship and source of funds. You have to understand why the relationship is being established and where the money comes from. In a property purchase paid by a foreign buyer, establishing the source of funds stops being a formality and becomes the core of the file.
Ongoing monitoring. The duty does not end at onboarding. You monitor the relationship over time and check that transactions fit the client profile you established at the start.
Record keeping. All identification and transaction documentation has to be kept for ten years, available to the authorities.
Examination and reporting. Transactions showing signs of money laundering have to be examined specifically and, where appropriate, reported to the Financial Intelligence Unit. In certain cases there is also a duty to refrain from executing the transaction.
Enhanced measures for high risk. If the client is a politically exposed person (PEP), resides or operates from a high-risk third country, or the transaction is high risk for other reasons, due diligence intensifies: more verification, senior approval, and closer scrutiny of the source of funds.
The foreign buyer and the source of funds
The case that generates the most files in the sector is the non-resident buyer acquiring property. Identification with passport and NIE is the first step, but the real weight falls on the source of funds: you have to document where the money comes from and that the origin is coherent and lawful. When the buyer enters through a foreign company, the chain lengthens, because you have to identify that company's beneficial owner and screen them against sanctions and politically-exposed-person lists. Resolving this well and quickly is what lets a transaction close without compliance becoming the bottleneck. We cover it in the business verification guide.
What changes with AMLR and AMLA from 2027
The EU framework is moving from a patchwork of directives, which each country transposed in its own way, to a single directly applicable regulation: the EU Anti-Money-Laundering Regulation, known as AMLR, whose main obligations apply from 10 July 2027, alongside a new European supervisory authority, AMLA, operating since July 2025. For a real estate business this means three things. The rules harmonize, so operating across several European countries no longer requires interpreting different national versions. Beneficial-owner identification tightens and standardizes, and the ownership threshold moves from more than 25 percent to 25 percent or more. And the pressure on traceability of every verification rises, because a directly applicable regulation leaves less room for interpretation than a transposed directive. The operational takeaway is plain: reach 2027 with identification and screening already automated and with an auditable trail of every check, rather than reconstructing it by hand when the first inspection under the new framework arrives. The AMLR countdown is a good reason to put compliance in order now.
How to automate this inside the payment flow
The obligation always belongs to the obligated entity and cannot be delegated: the real estate business stays responsible. What you can do is automate the mechanical parts and leave judgment to people. In practice that means building identity verification (KYC), company and beneficial-owner verification (KYB), and screening against sanctions, politically-exposed-person, and adverse-media lists into the same flow that onboards the client and initiates the payment. When a buyer or investor enters, they are identified, screened, and recorded before the money moves, and every check is stored with a timestamp for the legal retention period: ten years today under Spanish law, harmonised by the AMLR to five years from July 2027, with a duty to delete personal data when the period expires. Ongoing monitoring rests on watching transactions against the initial profile. Built this way, compliance becomes a byproduct of getting paid well rather than a separate project the finance team runs afterward. UrbanPay's identity verification covers the KYC and KYB this flow relies on.
Frequently Asked Questions
In three main cases: property development, intermediation in the sale and purchase of property, and letting intermediation when the monthly rent of the transaction is 10,000 euros or more (in Spain, also lettings with a total annual rent of 120,000 euros or more). Platforms that raise investment for property projects also take on identification duties for each investor.
The takeaway for operators
If your activity includes developing, brokering sales, or brokering lettings above the threshold, you sit inside the anti-money-laundering perimeter, and the list of duties is concrete and evidentiable. AMLR tightens it from 2027. The sensible way to handle it is to automate identification, beneficial-owner verification, and screening inside the flow you already use to onboard and collect from clients, so compliance resolves itself on each transaction and leaves an auditable trail. Start with identity and business verification, and if you work with foreign investors, with the KYB verification guide.