Frequently asked questions

KYC ATLAS is online software that guides customer due diligence (KYC) for real-estate professionals in Europe.

It covers identifying the parties, the ownership structure and beneficial owners, the source of funds, screening, supporting documents and the risk assessment. Every step, decision and document stays traceable.

Real-estate professionals: estate agencies (sales and lettings), property developers, property managers and coliving operators.

It handles natural persons as well as companies, funds, trusts and foundations, including ownership chains over several levels.

1. Party identity. 2. Structure and third parties: holdings, beneficial owners, representatives. 3. Funds and transaction type. 4. Screening: politically exposed persons, sanctions, adverse media. 5. Documentation: the documents the risk profile requires. 6. Final assessment.

Each step is validated explicitly, so no check gets forgotten.

A seven-axis matrix assesses the customer type, jurisdiction, activity, specific risks, amount, distribution channel and unacceptable criteria. It derives a suggested level: low, medium, high or unacceptable.

The suggested level is frozen once computed. The analyst then sets the final level; if it differs, the analyst must justify the decision, which enters the audit trail.

Each party is checked for politically exposed persons, sanctions lists and adverse media. The search is AI-assisted and every result cites its sources.

A sanction only counts if it was issued by the European Union, a member state, the United Nations, the United States, the United Kingdom or Switzerland. The analyst qualifies each result and justifies the conclusion.

No. The AI reads ID documents (the MRZ zone), register extracts and proofs of address, assesses the coherence of the source of funds, drafts a memo and answers questions about a file.

All its proposals stay editable and every step is validated by a person. No compliance decision is automatic.

No. They receive a personal, secure link by email, valid for 14 days by default. There they complete their identity, upload documents and fill in the relationship-entry and beneficial-ownership declaration forms online, with an electronic attestation.

Their answers go straight into the file.

A file with a high or unacceptable risk must be approved by a second person, who can never be the one who submitted it. While approval is pending, the file is frozen.

The approvers are named in your organisation's governance sheet.

Any user can open a confidential escalation. Only the agency's managers, its author and the designated person can see it; it never appears in the client portal or the memo, and every read is logged.

The report itself is still filed by your reporting officer with the competent financial intelligence unit.

Yes. When a contact's information changes, every validated file in which that person appears is reopened for review.

For rental files, a review date is set according to the risk level: one year for high risk, three years for medium risk, five years for low risk.

The file's KYC memo as a PDF, the filed documents, the history of steps and decisions, and your organisation's activity log, exportable to CSV.

Each log entry is chained to the previous one, so a change can be detected.

The interface is available in French, Dutch, English and German; each user chooses their own.

On servers we operate ourselves. The hosting provider and the country of the servers are stated in the privacy policy, together with the full list of sub-processors.

Yes. Documents, reports and screening evidence are encrypted at rest with AES-256-GCM, and every connection goes over HTTPS. Passwords are hashed with bcrypt.

Yes, for the AI tasks you use: reading documents, analysing the source of funds, drafting the memo, the assistant. These tasks are sent to Anthropic, which is on the list of sub-processors.

The results come back into your file as proposals, which you validate.

No. All data belongs to one organisation and every query is limited to yours. Within your organisation, four roles set the permissions: owner, administrator, agent, viewer.

Every action is recorded, and each entry is chained to the previous one with a SHA-256 hash, per organisation. A change or deletion breaks the chain and shows up when the chain is verified.

Every night an encrypted backup goes to a separate server that refuses deletions. We keep 14 daily, 8 weekly, 12 monthly and 6 yearly backups. Restoring checks the integrity of the audit chains.

You are. For KYC files, your organisation is the controller and KYC ATLAS acts as a processor within the meaning of Article 28 GDPR, only on your instructions and under a data processing agreement.

Regulation (EU) 2024/1624, the AMLR, applies from 10 July 2027 (Article 90). It replaces most of the due diligence rules that until now sat in the national laws transposing the directives.

Sources: Regulation (EU) 2024/1624, Art. 90

Article 3 covers, among others, estate agents and other real estate professionals acting as intermediaries, including for lettings where the monthly rent is at least EUR 10,000.

Sources: Regulation (EU) 2024/1624, Arts. 2 and 3

A company's beneficial owner is the natural person who holds, directly or indirectly, 25 % or more of the shares, voting rights or other ownership interest, or who controls it via other means. Indirect holdings are calculated by multiplying the percentages along each ownership chain.

Member States cannot lower this threshold themselves: for more exposed categories of entities, the Commission may set a lower threshold, of 15 % at most.

Sources: Regulation (EU) 2024/1624, Arts. 51 and 52

A natural person who is or has been entrusted with a prominent public function: head of state or government, minister, member of parliament, judge of a supreme or constitutional court, member of a court of auditors or of a central bank board, ambassador, senior military officer, director of a state-owned enterprise or of an international organisation, among others. Family members and close associates are treated the same way.

After the function ends, enhanced measures continue while the risk remains, and for at least twelve months.

Sources: Regulation (EU) 2024/1624, Arts. 2, 42, 45 and 46

Among other cases, when the client or the transaction is linked to a high-risk third country (Articles 29 to 31), when the client, a family member or a close associate is a politically exposed person (Articles 42 to 46), and for any complex transaction, of an unusually large amount or with an unusual pattern, whose source and destination of funds must then be examined (Article 34).

It also applies to any other higher risk the professional identifies.

Sources: Regulation (EU) 2024/1624, Arts. 29 to 46

Yes. From 10 July 2027, persons trading in goods or providing services may only accept or make a cash payment of up to EUR 10,000, in one or several linked operations. Member States may set a lower limit, and stricter national limits stay in force. The rule does not apply between private individuals.

Sources: Regulation (EU) 2024/1624, Art. 80

Under the AMLR, five years from the end of the business relationship, the date of the occasional transaction or the refusal to enter into a relationship. Authorities may require, case by case, up to five more years. Personal data must then be deleted.

Until 10 July 2027 the national periods apply: see the answers per country.

Sources: Regulation (EU) 2024/1624, Art. 77

The Anti-Money Laundering Authority (AMLA), based in Frankfurt, has been carrying out its tasks since 1 July 2025. From 2028 it will directly supervise around forty of the most exposed credit and financial institutions, selected from 1 July 2027.

It directly supervises no non-financial profession: estate agents stay with their national supervisors, whose work AMLA reviews and coordinates.

Sources: Regulation (EU) 2024/1620, Arts. 4, 13, 35 to 38 and 108

No. On 22 November 2022 the Court of Justice of the European Union invalidated general public access to information on the beneficial owners of companies, on grounds of respect for private life and data protection.

Since then, Directive (EU) 2024/1640 reserves access for authorities, for obliged entities for their customer due diligence, and for persons with a legitimate interest, such as the press or organisations fighting money laundering.

Sources: CJEU, 22 November 2022, C-37/20 and C-601/20 · Directive (EU) 2024/1640, Arts. 11 to 13 and 74

Two references count. After each plenary, the FATF publishes the list of high-risk jurisdictions subject to a call for action (the black list) and the list of jurisdictions under increased monitoring (the grey list). The European Union keeps its own list of high-risk third countries, in the annex to Delegated Regulation (EU) 2016/1675, which is amended regularly.

These lists change several times a year: always check the version in force.

Sources: FATF, black and grey lists · Delegated Regulation (EU) 2016/1675

Under the amended law of 12 November 2004, estate agents, including for lettings of at least EUR 10,000 a month, are supervised by the Administration de l'enregistrement, des domaines et de la TVA (AED).

Sources: Amended law of 12 November 2004, Arts. 2 and 2-1 · AED, fight against money laundering

The RBE, created by the law of 13 January 2019, is run by Luxembourg Business Registers (LBR). Since the law of 23 January 2025, in force since 1 February 2025, it is no longer open to the public.

Access is open to national authorities, to professionals for their customer due diligence, to self-regulatory bodies and to persons with a legitimate interest in fighting money laundering, such as journalists, whose request LBR examines.

Sources: Law of 13 January 2019 establishing an RBE · Law of 23 January 2025

The report goes to the Cellule de renseignement financier (CRF), fully electronically through the goAML application. Registration uses a LuxTrust certificate.

Sources: CRF, submitting a report · Amended law of 12 November 2004, Art. 7

Five years after the end of the business relationship or the date of the occasional transaction. Supervisory authorities may require five more years in certain cases. Personal data must then be deleted, unless another law sets a longer period.

Sources: Amended law of 12 November 2004, Art. 3

Under the law of 18 September 2017, estate agents registered with the IPI/BIV are supervised for anti-money laundering by the FPS Economy, not by the IPI/BIV.

Sources: Law of 18 September 2017, Arts. 5 and 85

The UBO register is kept by the General Administration of the Treasury of the FPS Finance. Access is open to competent authorities, to obliged entities for their customer due diligence and, since 17 February 2023, to anyone who shows a legitimate interest linked to fighting money laundering.

Obliged entities must report to the Treasury any differences they find between the register and their own information.

Sources: Law of 18 September 2017, Arts. 73 to 75 · Royal Decree of 30 July 2018

No. The price of a property sale, costs and financing included, may only be paid by bank transfer or cheque. The sale agreement and the deed state the accounts used and their holders, and the estate agent must report any breach to the CTIF-CFI immediately.

For other operations, a cash payment or gift may not exceed EUR 3,000.

Sources: Law of 18 September 2017, Arts. 66 and 67

To the Financial Intelligence Processing Unit (CTIF-CFI), as soon as the entity knows, suspects or has reasonable grounds to suspect money laundering, whatever the amount, and if possible before executing the transaction. Since 1 October 2024, goAML is the only channel accepted.

Sources: Law of 18 September 2017, Arts. 47 to 52 · CTIF-CFI, guidelines of 1 October 2024

Today, ten years from the end of the business relationship or the occasional transaction. From 10 July 2027, the EU AMLR regulation sets a period of five years, which authorities may extend by up to five years.

Sources: Law of 18 September 2017, Art. 60 · Regulation (EU) 2024/1624, Art. 77

For estate agents (makelaars), including for lettings of at least EUR 10,000 a month, and for valuers, supervision lies with the Minister of Finance, exercised in practice by the Belastingdienst: its Bureau Toezicht Wwft became the Dienst Financieel-Economische Integriteit (DFEI) on 1 January 2026.

Sources: Wwft, Arts. 1a and 1d · Belastingdienst, Bureau Toezicht Wwft

The register is kept by the KVK. Since 22 November 2022 it is no longer public. Competent authorities and the Wwft institutions the KVK can recognise have access; certain sectors obtain digitally certified extracts.

Estate agents are not yet among those sectors: they obtain a certified extract through their client and remain bound by the duty to report errors (terugmeldplicht).

Sources: KVK, who has access to UBO data

Unusual transactions (ongebruikelijke transacties), carried out or intended, without delay. They are defined by indicators set in the Uitvoeringsbesluit Wwft 2018. For real estate intermediaries there are two: a subjective indicator, as soon as there is reason to suspect money laundering, and an objective one, any payment of EUR 10,000 or more in cash or equivalent means. Reports are filed on the FIU-the Netherlands reporting portal.

Sources: Wwft, Arts. 15 and 16 · Uitvoeringsbesluit Wwft 2018

Five years after the end of the business relationship or the execution of the transaction for customer due diligence data, and five years after the report for the data of a report to FIU-the Netherlands.

Sources: Wwft, Arts. 33 and 34

Request access through the form. We talk about your activity and volume, then open your organisation with a trial period. You invite your team, complete the governance sheet and create your first file.

Every subscription gives access to the whole product. The price depends on the number of users and the support you need: we send you a proposal after a first conversation.

Yes, a trial period is included when your organisation is opened. No credit card is asked for.

It names the people holding the roles of your anti-money laundering setup: the governing body, the compliance officer, the approvers of high- and unacceptable-risk files, the people who examine and report suspicions, among others.

It must be complete before the first file is created: it decides who approves what.

Four: owner, administrator, agent and viewer. Owners and administrators manage the team and the governance; agents handle the files; viewers consult.