No more flying under the radar

The biggest change is not that real-estate professionals suddenly become subject to AML in 2027. They are already obliged entities today.

The change is that the EU is building a system in which non-compliance becomes much easier for supervisors to identify, compare, prioritise and enforce. The combination of AMLR, the new AML Directive (EU) 2024/1640 and AMLA changes the supervisory architecture behind the rules.

That makes the old situation—where an estate agency could theoretically remain an obliged entity for years while receiving little or no meaningful AML supervisory attention—much harder to sustain.

Why “flying under the radar” becomes much more difficult

Historically, AML supervision of real estate has essentially depended on the effectiveness and priorities of each Member State's national system.

That produced significant differences between countries and sectors.

AMLA now sits at the centre of an integrated European AML supervisory system.

Importantly, AMLA will not normally inspect individual estate agencies itself. Direct AMLA supervision is focused on a limited number of high-risk cross-border financial institutions.

Real estate remains principally under national supervision.

But AMLA now has an oversight and convergence role over the non-financial sector, including real estate. (AML/CFT Authority)

That distinction is crucial:

AMLA does not replace the national inspector. It increasingly influences how effectively and consistently the national inspector supervises.

This may ultimately be one of the most consequential changes for real estate.

AMLA has the power to conduct peer reviews of non-financial supervisors.

Those reviews can assess:

• whether the supervisor has sufficient powers;

• whether it has adequate human, financial and technical resources;

• how effectively it applies EU AML law;

• whether its supervisory practices are effective;

• how its enforcement compares with other Member States;

• whether sanctions and administrative measures are actually being used.

AMLA can publish the findings and subsequently conduct a follow-up review assessing what the national supervisor did in response. (EUR-Lex)

So the pressure operates in both directions:

AMLR → Real estate business

but also:

AMLA → National supervisor → Real estate business

That second relationship did not previously exist in anything like the present institutional form.

Directive (EU) 2024/1640 expressly requires supervisors to apply a risk-based approach.

They must understand the ML/TF risks in their country and assess the relevant risks associated with the customers, products and services of obliged entities.

Most importantly, the Directive says the:

frequency and intensity of on-site, off-site and thematic supervision

must be based on the risk profile of obliged entities and the relevant national ML/TF risks. (EUR-Lex)

This has a major practical consequence.

Supervision becomes less dependent on:

“Which businesses happen to get inspected?”

and moves toward:

“Which businesses or categories present sufficient risk to justify supervisory attention?”

The new Directive goes further.

National supervisors must develop annual supervisory programmes, taking account of the time and resources needed to respond rapidly where there are objective and significant indications of AMLR breaches. (EUR-Lex)

This makes supervision more structured.

For example, a national authority could determine that certain categories deserve greater attention:

high-value real estate

international property markets

corporate purchasers

foreign investment

areas with elevated ML/TF exposure

businesses with weak AML controls

That does not mean every estate agency will receive an annual inspection.

It means there should increasingly be a methodology behind who gets supervised, how frequently and how intensively.

This is another major development.

AMLA is developing Regulatory Technical Standards for assessing the inherent and residual risk profile of non-financial obliged entities.

The current consultation expressly says the purpose is to create a:

consistent, proportionate and effective framework for risk-based supervision of obliged entities in the non-financial sector across the EU. (AML/CFT Authority)

Conceptually, supervisors will increasingly look at:

INHERENT RISK

What risks does this business naturally face?

↓

CONTROLS

How effectively does it mitigate those risks?

↓

RESIDUAL RISK

What risk remains?

↓

SUPERVISORY RISK PROFILE

How much supervisory attention does the business warrant?

This mirrors what the estate agency itself is expected to do through its Business-Wide Risk Assessment.

This is particularly important for Immosurance.

An estate agency should have its own assessment:

Our business → our risks → our controls → our residual risk.

Meanwhile, the supervisor increasingly assesses:

This estate agency → its inherent risk → quality of its controls → residual risk → supervisory response.

Those two processes start to align.

Imagine an inspector asks:

“Show me your Business-Wide Risk Assessment.”

The agency says:

“We don't have one.”

That tells the supervisor something immediately about the effectiveness of its AML control environment.

Conversely, an agency that can demonstrate:

BWRA (Business-Wide Risk Assessment) → policy → procedures → KYC → UBO → PEP/sanctions → customer risk → transaction risk → CDD/EDD → monitoring → training → audit trail

can provide evidence of a structured control framework.

This is already happening.

AMLA's 2026–2028 programme specifically says it will establish effective oversight of the non-financial sector.

In 2026 AMLA is conducting a comprehensive mapping of supervisory practices across non-financial sectors and intends to combine supervisory and FIU findings to develop a common risk picture across categories of obliged entities. (AML/CFT Authority)

AMLA also reported in May 2026 that non-financial supervisory authorities across all Member States had supplied information about their supervisory landscapes and risk-assessment approaches. (AML/CFT Authority)

So this is not merely something envisaged for the distant future.

The infrastructure is currently being built.

Imagine:

Country A

actively supervises estate agencies, performs thematic reviews and imposes measures where appropriate.

Country B

has thousands of real-estate obliged entities but conducts very limited meaningful supervision.

Historically, those differences could persist largely inside national systems.

Under the new structure, AMLA can compare supervisory practices and effectiveness.

Its peer reviews expressly examine:

effectiveness

resources

application of EU law

supervisory convergence

and

enforcement outcomes. (EUR-Lex)

AMLA can then issue guidelines and recommendations and subsequently examine the response.

That creates institutional pressure on underperforming supervisory systems.

There has historically also been significant variation in how Member States respond to equivalent AML violations.

AMLA has now developed a common approach for supervisors to assess breaches.

Its July 2026 final report establishes a methodology considering factors including:

• seriousness;

• duration;

• whether the breach was repeated;

• its impact;

• and other circumstances.

AMLA describes the objective simply as:

“The same breach, the same response.”

The standards cover financial and non-financial sectors. Once adopted by the Commission, they are intended to become directly applicable across Member States. (AML/CFT Authority)

This does not mean every infringement automatically receives an identical fine. Proportionality and the circumstances still matter.

It means supervisors are being given a common framework for deciding how serious a breach is and what enforcement response is appropriate.

This may eventually make the greatest practical difference.

AMLA is building an EU-level AML information and supervisory infrastructure.

Its functions include a central AML/CFT database containing information relevant to supervision, and AMLA's peer-review framework can take information from that database into account. (EUR-Lex)

AMLA is also combining supervisory and FIU findings when developing its understanding of non-financial-sector risks. (AML/CFT Authority)

Over time, that creates a much more data-driven environment.

Instead of:

“Nobody has looked at this sector recently.”

the system increasingly asks:

“Where does the evidence tell us the risk is?”

Under the current system:

EU Directive

↓

27 national transpositions

↓

different legislation, interpretation and implementation

AMLR changes much of that:

EU Regulation

↓

directly applicable rules

↓

AMLA standards and guidelines

↓

common supervisory methodologies

↓

national supervision

This makes it more difficult for substantial differences in implementation to persist unnoticed.

What does this mean for audits of real estate businesses?

It does not mean:

“Every estate agency will automatically be audited in 2027.”

There is no legal basis for making that claim.

The new system is explicitly risk-based. (EUR-Lex)

But it does mean that the mechanisms for determining who should be inspected, how intensively and how national supervisors themselves are performing become substantially more structured.

A simplified picture is:

BEFORE

National authority

↓

Different national methodology

↓

Limited cross-EU comparison

↓

National supervisory priorities

↓

Estate agency

NEW SYSTEM

AMLA

↓

Common risk methodologies

↓

Common supervisory standards

↓

Comparison / peer review of national supervisors

↓

National supervisor

↓

Risk classification of obliged entities

↓

Annual supervisory programme

↓

On-site / off-site / thematic supervision

↓

Estate agency

That is a fundamentally different supervisory ecosystem.

And when an estate agency is inspected?

This connects directly to the articles we have been developing.

The question will increasingly not be:

“Do you know what AML is?”

Nor merely:

“Did you photocopy the customer's passport?”

A risk-based inspection can examine whether the business can demonstrate that its AML system actually works.

Can you show:

your Business-Wide Risk Assessment?

your AML policies and procedures?

how they correspond to the risks identified in your BWRA?

who performed CDD?

how the UBO was established?

when PEP and sanctions screening occurred?

how customer risk was determined?

how the transaction was assessed?

where relevant, how source of funds was established?

why EDD was or was not required?

what happened when circumstances changed?

who approved higher-risk cases?

whether employees were appropriately trained?

whether the evidence and decisions were retained?

That is where the transition from performing AML checks to demonstrable AML compliance becomes particularly important.

Why this matters especially for real estate

The real-estate sector has already been inside the EU AML framework for many years.

So the important 2027 message should not be:

“AML is coming to real estate.”

It isn't.

A much more accurate message is:

“The obligation has existed for years. What is changing is the European system surrounding supervision and enforcement.”

AMLA's own 2026–2028 priorities make this clear: complete the Single Rulebook, advance supervisory convergence, build common risk frameworks, strengthen FIU cooperation, and establish oversight of non-financial sectors. (AML/CFT Authority)

And AMLA is not replacing national authorities. National supervisors and FIUs remain central to the system. (AML/CFT Authority)

What changes is that they are increasingly operating inside a European supervisory architecture where methodologies, risk assessment, enforcement practices and supervisory performance can be compared and challenged.

That is the real reason why relying on being overlooked becomes a much less sustainable compliance strategy.

Immosurance

For years, AML compliance in real estate depended heavily on national implementation and national supervisory intensity.

AMLR changes the rules. AMLA changes the supervisory environment around them.

From 2027, real-estate AML increasingly operates within a European system built around:

one rulebook → common risk methodology → stronger supervisory convergence → national risk-based audits → comparable enforcement → demonstrable compliance.

For a real estate professional, the safest question is therefore no longer:

“What are the chances that someone checks me?”

It is:

“If they check me, can I instantly demonstrate that I comply?”