# Anti-money-laundering and sanctions rules reshaping client onboarding
A mid-sized law firm in Miami turns away a prospective real estate client because the buyer's ownership structure runs through four shell companies in three jurisdictions and nobody can name the actual human who controls the money. Ten years ago that client would have been a routine closing. Today it's a red flag that could expose the firm's partners to personal liability. This is what "gatekeeper" regulation looks like in practice, and since 2024 it applies well beyond banks.
AML (anti-money-laundering) rules were built for banks: know your depositor, watch for suspicious transfers, file reports. Regulators eventually noticed that criminals don't launder money at the bank teller window. They launder it through lawyers setting up trusts, accountants forming companies, and consultants managing real estate deals. These professionals became known as "gatekeepers": the last line of defense before dirty money enters the legitimate economy.
The US response is the Corporate Transparency Act (CTA), passed in 2021 and phased in through 2024-2025, administered by FinCEN (Financial Crimes Enforcement Network, a bureau of the US Treasury). The CTACTAA button, link, or message that prompts users to take a specific action such as sign up, buy, download, or learn more. requires most small and mid-sized US companies to report their
Separately, FinCEN has proposed and advanced rules that would formally bring certain lawyers, accountants, and investment advisers under AML program obligations similar to those banks already follow, sometimes called the "gatekeeper rule." As of early 2026, implementation is uneven and contested in court, but the direction is clear: the compliance burden that used to stop at the bank's front door is moving into law firms, accounting practices, and corporate service providers.
KYC (Know Your Customer) used to mean checking an ID and a business license. In 2026 it means something closer to a small investigation, especially for professionals handling company formation, trusts, real estate, or large transactions.
A modern intake file for a new corporate client typically includes:
Before 2024: a paralegal files articles of organization with the state, collects a signature, done in a day.
In 2026: the firm must determine if the new LLC is a "reporting company" under the CTACTAA button, link, or message that prompts users to take a specific action such as sign up, buy, download, or learn more.Voir la définition complète →, identify beneficial owners, collect government ID numbers, screen those individuals against OFAC's Specially Designated Nationals (SDN) list, and document why the client is not, for example, a shell used to disguise a sanctioned Russian oligarch's US property purchase. Real estate transactions carry particular scrutiny because FinCEN has separately targeted them with Geographic Targeting Orders and a 2024 rule extending reporting requirements to certain non-financed residential real estate transfers.
Sanctions compliance is stricter than general AML because it's often strict liability: intent doesn't matter. If a firm does business with a sanctioned party, "we didn't know" is a weak defense, and penalties can apply even without proof of willful violation.
OFAC maintains multiple sanctions programs (country-based, like Iran and North Korea; and list-based, like the SDN list). Accounting firms doing cross-border consulting, law firms with international clients, and advisory firms with private equity or real estate practices all need screening built into intake, not bolted on afterward.
Europe runs a parallel but distinct system. The EU applies its own sanctions lists (coordinated through the Council of the European Union) plus AMLD (the Anti-Money Laundering Directive, now in its sixth iteration, AMLD6) and a newly created EU-level supervisor, AMLA (Anti-Money Laundering Authority), which began operations in Frankfurt starting 2025 and is intended to harmonize enforcement across member states by roughly 2027-2028 (estimate; rollout timeline still firming up). A US firm advising a European client, or vice versa, may need to satisfy both regimes simultaneously, and the definitions of "beneficial owner" or "politically exposed person" don't always match exactly between US and EU rules.
The operational shift for professional services firms breaks into four buckets:
1. Intake gets slower and more document-heavy. Expect government ID collection, corporate structure charts, and signed beneficial ownership certifications before engagement letters are signed.
2. Firms need screening tools, not just judgment. Manual "does this name look familiar" checks don't scale or satisfy regulators. Firms increasingly license sanctions-screening software (vendors like Refinitiv World-Check or Dow Jones Risk & Compliance are common industry names) rather than relying on Google searches.
3. Refusal to onboard becomes a compliance decision, not just a business one. Turning away revenue because a client's ownership can't be verified is now a defensible, sometimes mandatory, choice.
4. Documentation of the decision matters as much as the decision. Regulators and courts care whether the firm can show its screening process, not just whether it happened to catch a bad actor.
Vérification des acquis
1. Why did regulators extend AML-style obligations to lawyers, accountants, and consultants rather than relying on bank-focused rules alone?
2. In the Miami law firm scenario, what specifically made the prospective client a red flag under a gatekeeper compliance mindset?
3. What is the best description of the relationship between the Corporate Transparency Act (CTA) and the proposed FinCEN 'gatekeeper rule'?
4. Select ALL correct answers about why this regulatory shift creates risk specifically for professional services firms (not just their clients).
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers describing what 'beneficial owner' means in the context of the Corporate Transparency Act.
Sélectionnez toutes les réponses correctes.
Professionals sometimes assume these rules are theoretical until they aren't. Accounting firms have faced OFAC penalties for processing payments connected to sanctioned entities even when the accountant claimed ignorance of the underlying ownership. Law firms have been named (not necessarily charged, but scrutinized) in reporting like the Pandora Papers coverage from the International Consortium of Investigative Journalists, which specifically highlighted the role of Western law firms and trust companies in structuring opaque offshore vehicles. That reputational exposure, even absent a formal enforcement action, has pushed firms to tighten intake voluntarily ahead of full CTACTAA button, link, or message that prompts users to take a specific action such as sign up, buy, download, or learn more.Voir la définition complète → and gatekeeper-rule enforcement.
The practical lesson: regulators increasingly treat "the professional should have known" as a viable theory of liability, especially where a reasonable screening process would have surfaced the problem.
🎬 [VIDEO: "What Is the Corporate Transparency Act?" - youtube.com - a plain-language explainer on CTACTAA button, link, or message that prompts users to take a specific action such as sign up, buy, download, or learn more.Voir la définition complète → beneficial ownership reporting aimed at small business owners and their advisers]