Anti-money laundering reform: the risk-based approach is no longer optional

The amendment to the Federal Law for the Prevention and Identification of Transactions with Illicit Funds, published on July 16, 2025, and the amendment to its Regulations, published on March 27, 2026, significantly raised the obligations of those who carry out vulnerable activities. Compliance no longer ends with filing notices: it now requires a system.

Beneficial ownership from 25%

The threshold for beneficial ownership dropped from 50% to 25%, and the concept was aligned with that of ultimate beneficial owner. Identification is limited to individuals, which requires tracing the chain of control up to them, including in structures with foreign companies. In addition, every commercial company, whether or not it carries out vulnerable activities, must register its beneficial owner and report share or equity transfers in the Ministry of Economy’s electronic system (Arts. 33 Bis and 33 Ter).

A risk-based approach

Those carrying out vulnerable activities must apply a methodology to identify, analyze and mitigate their risks and assess their clients, maintain internal manuals, provide annual training to the compliance officer and implement automated monitoring systems. They must also conduct an annual internal or external audit, keep the audit report and evidence of how findings were remediated, and provide them to the tax authority upon request.

Longer record-keeping and new cases

Information and documentation must be kept for ten years. Real estate development was added as a vulnerable activity, together with the concept of politically exposed persons. The 24-hour notice applies even if the transaction is not completed, and, for gaming, contests and raffles, transactions with the same person within 24 hours, at venues or on digital platforms, are treated as linked. Anyone who stops carrying out a vulnerable activity must request deregistration; otherwise, the obligations continue.

An incentive to come into compliance

The authority may refrain from imposing a penalty if the offender complies voluntarily, before any inspection, and acknowledges the breach. This benefit can be used only once; after that, the fine may be reduced by up to 50% under the same conditions. The General Rules, amended by an agreement published in the Official Gazette on August 7, 2026, take effect on November 30, 2026, with staggered deadlines: training during 2027; risk assessment, manual, client classification and beneficial ownership from March 1, 2027; automated mechanisms from June 1, 2027; and 2028 as the first year subject to audit. Now is the time to get in order.

What to review

• Confirm whether the company carries out any vulnerable activity, including those often overlooked, such as leasing real estate or habitually granting loans.
• Update the beneficial ownership file to the new 25% threshold.
• Prepare or update the risk assessment, the manual and the training program.
• Schedule the annual audit and keep its results.
• Assess whether to voluntarily remedy any non-compliance.

This note is for information only and does not constitute legal advice.