Szécsényi & Partnerswww.szecsenyi.com
All publications

Customer Due Diligence Obligations Relating to Real Estate Sales for Anti-Money Laundering Purposes

Published Article

1. Introduction

The fundamental purpose of the rules on the prevention and combating of money laundering1 is to prevent assets derived from criminal activity from entering the legitimate economic cycle.2 In this respect, the real estate market is of particular significance: on the one hand, real estate is suitable for the long-term "parking" of large amounts of assets; on the other hand, real estate transactions are often carried out through complex financing structures, frequently involving cross-border ownership and contractual arrangements. In such cases, the source of funds, the beneficial ownership background and the economic rationale of the transaction can often be uncovered only through careful customer due diligence.

In Hungary, Parliament first adopted an act on the prevention and combating of money laundering in 1994, and – by way of the relevant legislative amendment – in the same year the definition and sanctioning of the criminal offence of money laundering were inserted into Act IV of 1978 on the Criminal Code. The Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime, done at Strasbourg on 8 November 1990, was promulgated by Act CI of 2000. On 24 February 2003, Parliament adopted Act XV of 2003 on the prevention and combating of money laundering, and on 15 December 2007 Act CXXXVI of 2007 on the prevention and combating of money laundering and terrorist financing (the "former AML Act") entered into force, which was replaced in 2017 by the currently effective Act LIII of 2017 (the "AML Act").3 The AML Act is expressly built on a risk-based approach and imposes detailed customer due diligence obligations on service providers engaged in real estate transaction activities.4

Hungarian regulation clearly follows the development of the EU AML framework. EU legislation proceeded from the recognition that illicit financial flows are not merely of criminal law relevance, but also threaten the integrity of the financial system, the proper functioning of the internal market and public trust. The Fourth AML Directive (Directive (EU) 2015/849; AMLD4), followed by the subsequent legislative package – the AMLR, the AMLA Regulation and the Sixth AML Directive – has moved the system towards more uniform, directly applicable European rules.5 These changes will also have a significant impact on real estate market practice, even though their full effect is generally expected only from 2027.

The purpose of this article is to show how customer due diligence obligations can be interpreted and applied in the typical contractual processes of commercial real estate sales, with particular regard to the specific feature that such transactions usually involve several independent AML obliged entities acting in parallel.

2. The Money Laundering Relevance of Real Estate Transactions and the Personal Scope of the AML Act

Persons Subject to the AML Act

In the real estate transactions described above, three actors subject to the AML Act typically participate: (i) the seller, who sells its own real estate on a commercial basis6; (ii) the real estate agent, who carries out commercial brokerage activities on behalf of the seller (or the buyer); and (iii) the lawyer, who acts under a transactional mandate in connection with the preparation and conclusion of the sale and purchase (pre-)contract.

Section 1(1)(f) of the AML Act extends the scope of the Act, among others, to "persons engaged in real estate transaction activities", and point (l) to "lawyers, law firms, European Community lawyers, European Community law firms (collectively: 'lawyers'), in-house legal counsel registered with the bar, and notaries public".

This regulatory solution is based on the premise that in real estate transactions money laundering risk may be channelled not only by financial institutions but also by the legal and brokerage infrastructure. Under Section 3(17) of the AML Act, "real estate transaction activities" include, on the one hand, the commercial brokerage of the transfer of ownership of real estate and, on the other hand, the commercial sale and purchase of real estate in the provider's own ownership. It follows that a seller selling on a commercial basis (primarily real estate developers and real estate traders) may itself qualify as a service provider under the AML Act, as an independent AML obliged entity.

On the basis of the customer due diligence obligations arising as described above, (i) the seller is required to conduct due diligence on the buyer(s), (ii) the agent on the seller with whom it has a contractual relationship (as principal) and on the buyer(s), and (iii) the lawyer on its client – typically the seller who gave the mandate – on the one hand, and on the buyers on the other.

The Establishment of the Business Relationship and of Customer Status

The next question is when the given service provider must carry out customer due diligence. Under the relevant general rule of the AML Act [Section 6(1)], the service provider must apply customer due diligence "a) when establishing a business relationship". In the case of real estate transactions, however, the time of establishing the business relationship and the time at which customer status arises do not necessarily coincide, and in practice this circumstance raises significant doctrinal and compliance questions, in particular because the rules of the AML Act are not coherent.

Under Section 3(45) of the AML Act, a business relationship means a lasting legal relationship established between the customer and the service provider by a contract for the use of a service falling within the professional activities specified in Section 1(1)(a)–(e), (g)–(h) and (j)–(r), whereas in respect of a service provider specified in Section 1(1)(f) (i.e. a person engaged in real estate transaction activities) it means the legal relationship between the customer and the service provider for the use of a service falling within the service provider's scope of activities. In connection with the sale and purchase transaction, neither the agent nor the seller falls under the first limb of point 45 above; accordingly, in their case the relevant event will be the creation of the legal relationship for the use of a service falling within the given service provider's scope of activities. The following consequences ensue:

  1. The (real estate brokerage) contract between the seller and the agent engaged to sell the properties developed within a real estate development typically creates a lasting legal relationship, and the same may be true of the mandate relationship between the seller and the lawyer; in these cases, the time of establishing the business relationship is relevant. In such a case, both the agent and the lawyer must conduct due diligence on their customer (principal) upon concluding the relevant mandate agreement. The agent, as service provider, must conduct due diligence on the seller, as customer, upon concluding the (lasting) brokerage contract between them. However, the characterisation of the relationship between the agent and the buyer(s) is far less clear – having regard also to the definition under the second limb of Section 3(45) of the AML Act.

    According to the relevant guidance of the Hungarian Tax and Customs Administration (NAV),7 in the case of a real estate agent, the customer is the seller who gave the mandate, as well as the person "who makes an offer, or requests an offer, to purchase or lease the property", i.e. typically the (prospective) buyer as well. The AML Act's concept of customer is, meanwhile, confused, because point 41 of the interpretative provisions defines the customer as including (among others) a) a person who establishes a business relationship with the service provider or gives a transactional mandate to the service provider, and b) in respect of a service provider specified in Section 1(1)(f), a person who requests an offer for the purpose of selling and buying, or letting and leasing, real estate. The relationship between sub-points (a)–(e) of point 41 is uncertain: after the "and" between sub-points a) and b), the relationship of the remaining sub-points is not specified; moreover, since a given service provider either sells or buys on a commercial basis, and its status is tied to that transaction, it is unclear whether 'requesting or making' an offer is to be construed narrowly in relation to the transaction in the given direction, or extensively, irrespective thereof, also to the counterparty of the real estate transaction. Under a narrower doctrinal reading, customer status may arise earlier than the business relationship itself, which should be tied to the actual creation of the legal relationship for the use of the service, i.e. to the contractual relationship. None of this, however, alters the fact that, for prudent practice, early due diligence tied to the making of an offer is the defensible solution.

    The cited NAV position also states that "A request for an offer for the purpose of purchase/lease may be deemed to exist where, following the viewing, the customer expresses an intention to purchase/lease, i.e. makes an offer to that effect; the mere disclosure of the address of a property offered for sale/lease or the viewing of the property does not constitute a request for an offer". Simplified, the sentence reads: a request for an offer is deemed to exist when the prospective buyer makes an offer. It is impossible to tell whether this wording is simply careless drafting or the result of some particular doctrinal concept, but in our view requesting an offer to sell from the seller and making an offer to buy are not legally identical. The cited sentence does not facilitate the application of the rules of the AML Act either.

  2. In respect of the seller, only the buyer(s) qualify as customers, on whom the seller must conduct due diligence when establishing the business relationship. Under the AML Act, in the seller–buyer(s) relationship, the establishment of the business relationship means the creation of the legal relationship for the use of a service falling within the seller's scope of activities, i.e. the conclusion of the real estate sale and purchase (pre-)contract.

    By contrast, the NAV position states that "by the customer's use of the service provider's service falling within the scope of the AML Act, the service provider's customer due diligence obligation under the AML Act arises, which is at the same time a mandatory statutory condition for the establishment or maintenance of the business relationship. In the case of a service provider engaged in the commercial sale and purchase of real estate in its own ownership, the business relationship is established simultaneously with the making of the purchase offer, at which point the customer due diligence obligation already exists. This in any event precedes the lawyer's customer due diligence obligation, which takes place only upon the conclusion of the contract for the transfer of ownership of the real estate."

    In our view, although the arising of customer status is a precondition for the establishment of the business relationship, the latter is not tied to it, since the making of an offer always precedes the conclusion of the contract: the AML Act expressly ties the establishment of the business relationship to the creation of the legal relationship between the customer and the service provider for the use of a service falling within the service provider's scope of activities. The restrictive interpretation of NAV again does not assist practice, which otherwise resolves the related uncertainties by service providers in many cases fulfilling their customer due diligence obligation already at the time an offer for the property is made.

    Neither the AML Act nor the NAV position contains any rule on the legal concepts of offer and making an offer that departs from the Civil Code; therefore, the general rules of civil law apply as regards the time at which an offer is made. The law prescribes written form for final and preliminary contracts for the sale and purchase of real estate, failing which the contract is invalid [Civil Code Section 6:215(2)]. The conditions for satisfying the written form requirement are clear on the basis of the Civil Code and judicial practice.8 Relatedly, it is also indisputable that an offer to conclude a final or preliminary contract for the transfer of ownership of real estate can be made with legal effect giving rise to a genuinely binding offer only in writing. Likewise, such an offer can be accepted with the legal effect of bringing the contract into existence only in writing. In practical terms, therefore, whatever information material, or even contract text, is sent to the customer by email (without a qualified electronic signature), it cannot, as a general rule, qualify as an offer in the legal sense to conclude the sale and purchase (pre-)contract. The parties concerned generally also make this clear in practice in their communications with customers.

    In the real estate transactions under review, sellers – in order to assess demand and gather buyers – frequently conclude so-called registration agreements, which record the buyer's interest and the main terms of the planned real estate transaction and, in many cases, include an undertaking by the buyer to pay a security deposit (e.g. a cash security deposit). In the case of such registration agreements, it is advisable to state that signing the agreement does not give rise to a binding offer and merely regulates the process of offer and acceptance between the parties. In that case, in light of the Civil Code concept of offer set out above, there is in our view no reason to carry out customer due diligence before the conclusion of the sale and purchase (pre-)contract, unless a written offer complying with the Civil Code is made by the seller or the buyer.

  3. Finally, the law firm involved in the conclusion of the contract also qualifies as a service provider, which must fulfil not only the customer due diligence obligation under the AML Act but also the client identification obligation under the Act on Attorneys. In the case of a lasting mandate, the customer due diligence obligation arises in respect of the lawyer's principal, the seller, upon the establishment of the business relationship, i.e. upon the conclusion of the relevant mandate agreement, and in respect of the buyer(s) upon the conclusion of the sale and purchase (pre-)contract (provided that, pursuant to Section 73(1)(b) and Section 73(1c) of the AML Act, the purchase price of the property concerned exceeds HUF 4.5 million).

Relevant Substantive Rules of the AML Act in the Context of Real Estate Sales

Customer due diligence relating to real estate sales consists of the mandatory elements set out in Sections 6–19 of the AML Act. These include the identification of a natural person customer, the examination of the representative and beneficial owner of a legal person, the verification of politically exposed person status, and the determination of the risk level.

AML-purpose data processing covers, among others, name, birth name, place and date of birth, mother's name, nationality, type and number of identity document, address and the number of the document certifying address or residence, the identifier of the beneficial ownership register (JÜB) data disclosure, the beneficial ownership and politically exposed person declarations, and the risk classification. Certain aspects of AML-purpose data processing under the GDPR9 are discussed separately below; therefore, we make only a few observations here regarding the scope of personal data that may be processed.

By reference to the mandatory performance of AML obligations by service providers, only the personal data specified in the AML Act may be processed, and only for the purposes specified therein (Section 56 of the AML Act). The AML Act thus determines – only in respect of the personal data referred to in the AML Act – the purpose of processing (see the title of the Act), the legal basis of processing (performance of the AML obligation under the AML Act, pursuant to Article 6(1)(c) GDPR), the scope of personal data that may be processed, and the duration of processing (see Section 56(2) of the AML Act). Processing by reference to the AML Act can therefore be lawful only within the scope determined by the AML Act. Any other personal data not referred to in the AML Act may of course also be processed in the course of the transaction, but in that respect the controller must demonstrate the existence of the purpose of processing, the legal basis of processing and the other circumstances under Article 13 GDPR.

On this basis, it is particularly important that the AML Act (reading Section 7(8)–(8a) together with Section 56(1)) expressly prohibits AML actors from processing the personal identification number; i.e. no service provider – neither the seller, nor the agent, nor the lawyer – may process the personal identification number in connection with AML obligations. The personal identification number is, however, a mandatory element of the "deed serving as the basis for registration in the land register":10 under Section 42(1) of the Land Registry Act, legal representation is mandatory in land registry administrative proceedings, and such representation may be provided only by a lawyer, in-house legal counsel registered with the bar or a notary public. In addition, Section 32 of Act XX of 1996 on identification methods replacing the personal identification code and on the use of identification codes (Act XX of 1996) exhaustively lists the bodies and persons (typically performing official functions) that may process the personal identification number: the land registry appears in point 6 of the list, and lawyers and in-house legal counsel (only in connection with their tasks relating to the land register!) in point 33. It follows that the lawyer may (and indeed must) process the personal identification number in connection with drafting and countersigning the real estate sale and purchase contract and submitting it to the land registry, but this right/obligation is based not on the AML Act but on the provisions of Act XX of 1996 and the Land Registry Act. On the data subject's side, in this situation the personal identification number not only may be provided but must be provided [Act XX of 1996, Section 33(1); Land Registry Act, Section 35(1)(a)(ab)].

In our view, since Section 35(1) of the Land Registry Act refers to a deed "serving as the basis for registration in the land register", the preliminary contract may not contain the personal identification number either, because it merely concerns the conclusion of the 'final' contract at a later date and the prior determination of its essential terms, but in principle, and by virtue of its content under the Civil Code, it is not suitable to evidence the termination of the seller's ownership and its transfer to the buyer, or for the registration of the buyer's ownership in the land register [cf. Civil Code Section 6:73 and Land Registry Act Section 32(1)–(2)].

Section 35 of Act XX of 1996 does, however, create the possibility for the data subject, by prior written consent, to authorise another actor to process his or her personal identification number. In our opinion, however, this cannot be construed as allowing the seller and the agent (for example) to nevertheless create a legal basis for processing the personal identification number by means of a data request form designed for that purpose. First – assuming here that the term "consent" in the cited provision corresponds in substance to the concept of consent under Article 6(1)(a) GDPR – consent must be freely given,11 i.e. the personal identification number may not be requested where it is not connected with the performance of a contract, or its processing is not required by law for the AML actor, or its processing is not necessary for the purposes of the legitimate interests of the AML actor or a third party.12 The seller and the agent do not need the personal identification number either to carry out customer due diligence, or in the course of the legal acts leading to the conclusion of the contract, or for any enforcement of claims.13 Second, such processing of the personal identification number must have a specific purpose: it is highly doubtful what that purpose could be in light of the foregoing, since, although the lawyer does need to process the personal identification number, the seller, the agent and the lawyer act as independent AML obliged entities; they are therefore not responsible for each other's data processing and accordingly need not (more precisely: may not) obtain data for each other's benefit. Third, the principle of data minimisation under Article 5(1)(c) GDPR requires that all processing be limited to what is necessary: it would run counter to this principle, for example, if the agent obtained the personal identification number by reference to the lawyer's processing (whether with the data subject's consent or on another legal basis) on a "it will be needed anyway" basis. On the one hand, only the lawyer needs it (so the lawyer should take care of obtaining it); on the other hand, if the transaction fell through (i.e. the final sale and purchase contract is not signed), that justification would not hold either, and hypothetical/stockpiling ("nice to have"-type) data collection may not be carried out, because in such cases there is no specified and explicit purpose of processing ensuring fair processing for the data subject.14 Infringement of the requirement that consent be freely given, or of the principle of data minimisation, may in itself give rise to the controller's liability and the imposition of a sanction (at the more severe level within the GDPR's sanctions regime).15

As regards the processing of the tax identification number, it is likewise worth returning to the provisions of Act XX of 1996, Sections 18–20 of which determine which bodies may use the tax identification number and in which proceedings. As a general rule, it is used by the tax and customs authority to identify the taxpayer; accordingly, the processing of this personal data is relevant at all only once the final sale and purchase contract has been concluded in respect of the transaction, since the duty on transfers of property for consideration arises (as a general rule) on the day the contract is concluded, and the personal income tax liability (in the case of a private individual seller) is linked to the receipt of income.16 Until the day the final contract is concluded, therefore, the processing of the tax identification number by the seller and the agent is likewise not justified (or can hardly be justified under the law).

Hungarian Gold-Plating Regarding the AML Act Status of the Owner Selling Real Estate

AMLD4

Under the currently effective EU legal framework, based on the Fourth Anti-Money Laundering Directive [(EU) 2015/849; AMLD4], AML obligations relating to real estate transactions are imposed not on the owner or seller of the real estate, but essentially on the actors acting as intermediaries or gatekeepers in the transaction (real estate agents, notaries, lawyers, financial institutions). The personal scope of AMLD4 covers "estate agents" and does not distinguish between private and professional sellers; consequently, the sale of real estate from one's own assets – even in a commercial, professional form – does not in itself give rise to AML obligations on the seller's side. This approach based on the "gatekeeper model" is also followed by German, French, Dutch and Italian law, which, in implementing AMLD4, did not extend AML obligations to economic operators selling their own real estate, but instead concentrated controls on the mandatory notarial procedure, the monitoring by financial institutions and on real estate agents.

By contrast, when transposing AMLD4, the Hungarian legislator went beyond the minimum requirements (by way of 'gold-plating') and extended the personal scope of the Act on the prevention and combating of money laundering and terrorist financing to persons engaged in commercial real estate sales, even where they sell real estate in their own ownership. Hungarian regulation can thus be regarded as exceptional in an EU comparison, since – in a manner not required by AMLD4 – it treats asset-side disposals, independently of the brokerage of the transaction, as a separate AML risk point.

AMLD5

The Fifth Anti-Money Laundering Directive [(EU) 2018/843, AMLD5] did not substantively amend the personal scope of EU AML rules on real estate transactions compared with AMLD4, particularly as regards the obligations of sellers of real estate. The main aim of AMLD5 was not to redraw the circle of actors concerned, but to strengthen and fine-tune the existing system, primarily in the direction of beneficial ownership transparency, enhanced customer due diligence and the handling of higher-risk areas. With regard to the real estate sector, the Directive markedly reinforced the AML obligations of estate agents and other intermediaries and – as a novelty – clearly brought the brokerage of high-value lease relationships (above a high monthly rent) within the scope of the AML regime. However, AMLD5 did not extend AML obligations to sellers disposing of real estate from their own assets, irrespective of whether the sale is professional or commercial in nature. Accordingly, most Member States – Germany, France, the Netherlands and Italy – maintained the "gatekeeper model" known from AMLD4 when transposing AMLD5 as well, under which the management of AML risks remains concentrated on transaction intermediaries, notaries, lawyers and financial institutions, while the seller of real estate as owner does not become an independent AML obliged entity merely by virtue of the sale. AMLD5 thus confirmed the earlier regulatory logic and did not generalise at EU level the Hungarian solution – which had already brought professional sellers into the AML regime on the basis of AMLD4. The new AML regime entering into application in 2027 is discussed in Section 5.

3. Reliance on the Results of Due Diligence Performed by Another Service Provider

Under Section 22(1) of the AML Act, reliance on the results of due diligence carried out by another service provider may in principle arise between different service providers, subject to the conditions set out therein. In the cited position, NAV draws service providers' attention to the fact that lawyers primarily establish transactional mandates with their clients, for which the AML Act prescribes an identification obligation with a different data content; therefore, customer due diligence data and documents taken over from a lawyer do not fully meet the requirements of the AML Act applicable to service providers engaged in real estate transaction activities, who establish business relationships with their customers. Furthermore, transactional mandates established by lawyers – as explained above – arise a longer or shorter time after the business relationship established by service providers engaged in the commercial sale and purchase of real estate in their own ownership.

In this context, service providers face a further uncertainty. Section 24 of the AML Act provides that the provisions of Sections 22 and 23 (i.e. the rules on reliance on customer due diligence measures carried out by another service provider) need not be applied to outsourcing based on a contractual relationship or to agency activities. The interpretation of this rule is puzzling from the outset: owing to the use of the word "need", it is unclear whether this is a permissive or a prohibitive rule; and the use of the word "agent" is also problematic, particularly in the relationship between the real estate agent and the service provider selling real estate.

The source of the provision of Section 24 is Article 29 of Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC. Chapter 4 of the Directive deals with "Performance by third parties", which we transposed into Hungarian law as reliance on customer due diligence measures carried out by another service provider.17

Section 24 of the AML Act transposes Article 29 of the Directive, the official Hungarian translation of which corresponds to the English text: "This Section shall not apply to outsourcing or agency relationships where, on the basis of a contractual arrangement, the outsourcing service provider or agent is to be regarded as part of the obliged entity."

In drafting the AML Act, the legislator evidently slipped when it replaced the term corresponding to "agent" in the sense of an authorised representative (meghatalmazott) with the word "ügynök" (agent in the commercial sense), which is particularly confusing with regard to AML obligations (roles) relating to real estate transactions. Based on legal interpretation and market practice, the applicability of Article 29 in the real estate brokerage model is very limited and, in practice, mostly irrelevant. Article 29 concerns outsourcing and service providers acting as agents (authorised representatives), and regulates the conditions under which an obliged entity may transfer certain AML functions to other service providers. The provision is relevant only where there is a principal obliged entity and an engaged service provider that performs specified AML tasks in the name and on behalf of the obliged entity, while responsibility remains entirely with the principal obliged entity. This structure is functionally similar to bank–outsourcing or investment firm–outsourcing relationships, for example where a bank outsources back-office identification tasks. In the specific structure of the real estate sector, Article 29 is difficult to apply. Under EU and Member State implementing rules, the real estate agent is always an independent obliged entity, which enters into legal relationships with its own customers, carries out due diligence in its own name, files reports on its own responsibility and operates its own risk management system. Even where the agent is engaged by the seller (e.g. a developer) to find a buyer, the agent acts not in the name of the developer but as an independent actor. This model is entirely contrary to the logic of Article 29, which expressly presupposes a hierarchical and dependent relationship (obliged entity → service provider).

The business logic of real estate brokerage also supports independent obliged-entity status, since the commission-based, performance-based model (no sale, no fee) indicates that the agent typically bears risk, organises its activities independently and is not integrated into the real estate developer's AML system; i.e. there is no control mechanism of the kind that would be one of the conditions of outsourcing under Article 29. NAV's related guidance material also draws a clear distinction between cases where a service provider has customer due diligence carried out in its own name through outsourcing and cases where data is transferred between independent service providers for the purpose of relying on the due diligence carried out by the other. In the latter case, the relying service provider is responsible for supplementing missing data and for legal compliance.

When applying the statutory text (presumably distorted by mistranslation), it is therefore advisable for real estate agents also to carry out customer due diligence independently, so that the application of Section 24 and the attendant questions do not arise at all. In doing so, the contracting process can be organised administratively so that the fulfilment of parallel obligations does not place a disproportionate burden on the parties, while the lines of responsibility remain clear. In our view, therefore, Section 24 of the AML Act is not merely of limited relevance but functionally irrelevant in the real estate brokerage model.

4. Certain Data Protection Issues in Customer Due Diligence

Application of the GDPR

The GDPR must be applied in the course of any business or professional activity involving the processing of personal data and carried out (put simply) in the European Union. The seller and the agent undoubtedly carry out such activity, since the concept of 'real estate transaction activities' under the AML Act discussed above also refers to 'commercial' sale and purchase and brokerage. As regards the lawyer, Section 2 of Act LXXVIII of 2017 on the Professional Activities of Attorneys (Act on Attorneys) provides that drafting and countersigning deeds and providing legal representation in proceedings (in the present case, land registry proceedings)18 constitute attorney activities and thus business/professional activities. There is therefore no question that each of the independent AML actors is required to apply the GDPR.

The GDPR is an EU norm at the level of a regulation, which means that it applies directly, irrespective of the provisions of the AML Act (or any other domestic AML legislation), and thus in parallel with them, such that in the event of any conflict of interpretation concerning data processing, the provisions of the GDPR are of higher rank and therefore prevail over the requirements of the AML Act. It also follows from this parallel GDPR compliance that AML actors must apply it not only in connection with the fulfilment of AML obligations, but in connection with every processing operation related to the transaction. Examples for the seller and the agent include prior advertising and newsletter mailings, website data processing (contact, form filling, cookies), the conclusion of registration agreements and preliminary contracts, and satisfaction surveys following contract conclusion or handover; and for the lawyer, client identification under the Act on Attorneys, additional processing related to the land registry procedure (and possibly to legal representation before NAV) and document retention. These are all separate purposes of processing, for which the scope of personal data processed, the legal basis and duration of processing, and the identity of those involved in the processing (processors) differ (or may differ) from those relating to AML obligations. The data subject must therefore be informed in detail, transparently and intelligibly not only about the processing involved in customer due diligence, but also about these other processing operations.

Privacy Notice

With regard to providing information on data processing, in light of the above the question may arise as to whom, when and in what level of detail such information must be provided.

Recipient of the Information

Under the GDPR, the information must be provided to the data subject, i.e. the natural person whose personal data the controller processes.19 Compared with this concept, it is secondary for what specific purpose the data subject's data are processed, i.e. in connection with customer due diligence or for another transaction-related purpose. It follows that, for GDPR purposes, the data subject's 'current' legal classification – i.e. whether we regard him or her at that moment as an interested party, a person requesting an offer, an offeror, a beneficial owner (Section 3(38) of the AML Act), a customer (Section 3(41) of the AML Act), a buyer, or, in the case of a completed transaction, an owner or a contact person in a B2B transaction – is irrelevant: if the controller processes that person's personal data, he or she qualifies as a data subject, and from that point on, on the one hand, all obligations applicable to the controller must be fulfilled and, on the other hand, the data subject is entitled to the rights under the GDPR from that time.

Timing of the Information

As regards the timing of the information, the GDPR provides that it must be provided "at the time when personal data are obtained".20 This time is an objective event, meaning that the AML actor becomes a controller at the moment the personal data come under its control, irrespective of the act that led to this (for example: it collected the data itself, the data were transmitted to it, it retrieved them from a database, or the data subject provided them independently on a dedicated interface). The concept of "obtaining" should therefore – also compared with the AML Act's wording "came into possession"21 – be interpreted broadly, so as to include the situation where the personal data cannot even be found at the controller (for example in its own storage or physical repository), but are processed by its processor on the basis of the controller's decisions.22 Consequently, in the context of the AML Act it is irrelevant (i) when the 'legal relationship for the use of the service' arises between the AML actor and the given person, (ii) whether an occasional or a lasting legal relationship is created, or indeed (iii) whether customer due diligence was successfully completed or the service provider had to refuse to establish the business relationship and to execute the transaction (the GDPR must be applied even where customer due diligence fails).23 It also follows that, although under the AML Act customer due diligence must be carried out at the time specified in Section 6(1) of the AML Act, the information on the related processing must already be provided when the AML actor obtains the personal data necessary to carry out customer due diligence. The information obligation thus arises at the (earlier) time when the personal data are obtained, and not at the time when the specific AML obligation related to the processing is performed.

Finally, with regard to the timing of information, it should be mentioned that the individual AML actors obtain personal data (for the first time) at different points in the timeline of processing and in connection with different purposes of processing. Presumably, the agent obtains certain (but not all customer due diligence-related) personal data first, in connection with the promotion forming part of the real estate brokerage, before the seller and the lawyer, who join the sales process 'only' at the conclusion of the preliminary contract. It is therefore important to see which AML actor becomes a controller in the process, when, and in connection with which specific processing operation, because only with that knowledge can detailed information on processing be provided to the data subject.

Quality of the Information

A requirement of the GDPR (often given less weight) is that information on processing must be transparent and intelligible to the data subject.24 Transparency also means that, in the case of multi-actor processing, it should be clear to the data subject which actor processes his or her personal data, for what purpose, and in what relationship with the other actors (independently, jointly with them, as a processor?). Intelligibility means, on the one hand, that the details of processing must be worded in plain, everyday language; it is therefore not acceptable for the text of a privacy notice merely to repeat statutory wording. The provisions of the AML Act address many different types of service providers at the same time, and the rules of the AML Act are therefore necessarily abstract. This circumstance, together with the characteristic of legislation that it is not easily understood by laypersons, does not relieve the AML actor of the obligation to make efforts to render the processing involved in customer due diligence measures understandable. Under the GDPR this is the controller's task, for which it may use any method or medium. The requirement imposed on the controller to provide transparent and intelligible information also means, on the other side, the data subject's right to such information; therefore, infringement of this data subject right may in itself give rise to the controller's liability and the imposition of a sanction (at the more severe level within the GDPR's sanctions regime).25

Within the framework of transparent and intelligible information, it appears to be good practice for the data subject to receive, at the very first moment of contact, information in a single document on the purposes of processing arising in respect of all AML actors.

First, these notices would certainly overlap in content on certain points (for example, explaining the basic concepts of data processing, describing data subject rights, and the legal basis and data scope of customer due diligence), which would mean unnecessary information overload in an environment where the customer must in any case concentrate on processing important(er) legal documents, such as the registration agreement, the preliminary contract and the sale and purchase contract. (A single privacy notice also makes it possible for the data subject to understand why the AML actors each carry out the same customer due diligence separately, and whether there is any difference in purpose or other difference between them.)

Second, as indicated above, although the AML actors fulfil their AML obligations independently, they ultimately cooperate towards an overarching goal (the transfer of the real estate from the seller to the buyer), and in doing so appear before the data subject as controllers successively/overlapping in time. The reverse is also true: from the data subject's perspective ("I am buying a flat"), this is a single transaction/processing process, and the manner of providing information must therefore be adapted to this perception of the data subject.26

5. Expected Impact of the EU AML Package

The EU AML package adopted in 2024 – in particular the AMLR and the establishment of the AMLA – aims at the further unification of AML regulation. The AMLR implements the "single rulebook" logic, i.e. it elevates the conduct and organisational rules on the prevention of money laundering into the form of a directly applicable regulation,27 thereby leaving little room for Member State-level AML regulation.

In parallel, AMLD6 primarily serves the harmonisation of the institutional and supervisory structure, while the AMLA, operating since 2025 as a central EU authority, contributes to the unification of supervisory practice. In real estate sales practice, these developments are expected to bring about a further strengthening of internal policies, risk assessment systems and beneficial ownership transparency.

AML Obligations of Real Estate Sellers from 2027

The European Union's rules against money laundering and terrorist financing have gradually been built into a more uniform framework since 2015. AMLD4, followed by AMLD5 amending it, essentially followed a minimum harmonisation logic: they defined the minimum circle of so-called "obliged entities", while leaving Member States substantial room to bring further actors within the scope of the AML regime on the basis of their own risk assessment.28

It was in this regulatory environment that one of the distinctive solutions of Hungarian law emerged. When transposing AMLD4, the AML Act designated as independent AML obliged entities not only intermediaries in real estate transactions, but also sellers engaged in commercial real estate sales, even where the sale concerns real estate in their own ownership. This approach departs from the view – dominant in an EU comparison – that manages AML risks associated with the real estate sector primarily through actors performing a "gatekeeper" function in transactions (estate agents, notaries, lawyers, financial institutions).

It is important to emphasise that the Hungarian solution is currently not contrary to EU law. The directives did not contain a closed personal scope, and Member States were expressly authorised to bring further activities and actors within the scope of AML regulation on the basis of their national risk assessment.29 The situation, however, changes fundamentally with the mandatory application of the AMLR from 10 July 2027. The AMLR's legislative rationale expressly points out that one of the main structural problems of the AMLD era was the fragmentation of Member State implementation, which distorted the functioning of the internal market and weakened the effectiveness of AML rules.30 In response to this problem, the EU legislator chose the instrument of full harmonisation, i.e. a directly applicable regulation, instead of minimum harmonisation.

One of the central innovations of the AMLR is precisely that it defines the personal scope of AML obligations exhaustively. Article 3 of the Regulation lists in a closed enumeration the natural and legal persons that qualify as "obliged entities". As regards real estate transactions, this circle covers only estate agents and other real estate professionals to the extent that they act as intermediaries in the purchase, sale or letting of real estate.31 The text of the Regulation does not, either expressis verbis or on a broader interpretation, bring within its scope the owner or seller of real estate merely because it carries out the sale on a commercial basis or within a professional framework.

This is further reinforced by the fact that the AMLR contains no enabling clause that would allow Member States to further extend the personal scope at national level. The very purpose of the Regulation is to eliminate national divergences resulting from AMLD-based regulation and to create a uniform "single rulebook".32 It follows that, during the period of application of the AMLR, Member States' room for manoeuvre in determining the circle of obliged entities essentially ceases.

In this legal environment, the current solution of Hungarian law – which treats sellers engaged in commercial real estate sales as independent AML obliged entities – cannot be maintained in unchanged form after 10 July 2027. Such regulation could no longer be construed as a permitted national "addition", but would qualify as a national norm conflicting with the closed personal scope of the AMLR. This would not only result in a theoretical conflict under EU law, but would also entail infringement and preliminary reference risks at the level of law enforcement and sanctioning.

This does not mean, however, that the Hungarian legislator could not respond to the money laundering risks associated with real estate sales. Within the framework of the AMLR, however, such a response is conceivable not by extending independent AML obligations, but by other means – such as transparency, reporting, registration or tax law instruments – and through enhanced supervision of the intermediary and financial actors that are clearly obliged entities under the AMLR.

In conclusion, the "seller-side" AML solution of Hungarian law was legally permissible in the AMLD4–AMLD5 era, but constituted an exceptional construct in an EU comparison. With the entry into application of the AMLR, however, this distinctive feature loses its basis in EU law, and the full harmonisation of AML regulation necessarily leads to the elimination of national divergences in this area.

6. Conclusions

The system of customer due diligence obligations relating to commercial real estate sales under Hungarian law is multi-actor, layered and only partly clearly codified. Under the AML Act, the seller, the real estate agent and the acting lawyer may each become independent AML obliged entities, but on different legal grounds and at different times.

For practice, it follows that a real estate sales process that is defensible from a compliance perspective (and the related data processing) cannot rely on the AML performance (or GDPR compliance) of a single actor. The lawfulness and defensibility of the transaction can be ensured only if each obliged entity carries out customer due diligence in its own capacity, at its own time and on its own responsibility, while the process is designed coherently at both the contractual and the data processing level.

Footnotes

  1. The system of measures adopted to prevent money laundering is referred to by the abbreviation AML, customary in English. ↩︎
  2. Cf. the preamble to Directive (EU) 2015/849 of the European Parliament and of the Council on the need to protect the integrity of the financial system and the internal market. ↩︎
  3. For a more detailed overview of money laundering regulation, see Nagy Henriette: A pénzmosás magyarországi jogi szabályozásának vázlata [An Outline of the Hungarian Legal Regulation of Money Laundering], Magyar Rendészet 2020/1, pp. 93-105. ↩︎
  4. On the regulatory concept of Act LIII of 2017 and the changes compared with Act CXXXVI of 2007, see the summary of the Chamber of Hungarian Auditors of 6 July 2017 on the regulatory concept of Act LIII of 2017 on the prevention and combating of money laundering and terrorist financing, which entered into force on 26 June 2017 (…). ↩︎
  5. Since the directive-based approach applied for more than three decades led to fragmented implementation, in 2024 the European Union adopted the so-called AML package, which for the first time in its history replaces the directive logic with directly applicable regulation. Its central element is Regulation (EU) 2024/1624 (AMLR), which creates a uniform "single rulebook" for the prevention of money laundering and terrorist financing. ↩︎
  6. The AML Act defines real estate transaction activities as the commercial brokerage of the transfer of ownership of real estate, the commercial brokerage of leases of real estate where the monthly rent per transaction reaches or exceeds HUF 500,000, and the commercial sale and purchase of real estate in one's own ownership (Section 3(17)). It also follows that, owing to the own-ownership requirement, service provider status can attach only to the seller's position. ↩︎
  7. Determination of customers under the AML Act in respect of service providers engaged in real estate transaction activities ↩︎
  8. Vékás consistently emphasises that an offer is a unilateral legal declaration by which the offeror is bound, and the acceptance of which in itself brings the contract into existence. Vékás Lajos: Szerződési jog – Általános rész [Contract Law – General Part], Budapest, 2016, pp. 110-113. ↩︎
  9. Official title: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ↩︎
  10. See Section 35(1)(a)(ab) of Act C of 2021 on the Land Register (Land Registry Act). ↩︎
  11. See Article 7(4) GDPR. ↩︎
  12. See Article 6(1)(b), (c) and (f) GDPR. ↩︎
  13. None of the legislation relating to the enforcement of claims requires the personal identification number of the obligor/defendant/debtor to be stated as a condition of enforcing the claim. See Act L of 2009 on Order for Payment Procedures, Act CXXX of 2016 on the Code of Civil Procedure, and Act LIII of 1994 on Judicial Enforcement. ↩︎
  14. See Article 5(1)(a)–(b) GDPR. ↩︎
  15. See Article 83(5)(a) GDPR. ↩︎
  16. See Section 3(3)(a) of Act XCIII of 1990 on Duties and Section 9(1)–(2) of Act CXVII of 1995 on Personal Income Tax. ↩︎
  17. Article 25: Member States may permit obliged entities to rely on third parties to meet the customer due diligence requirements laid down in points (a), (b) and (c) of the first subparagraph of Article 13(1). However, the ultimate responsibility for meeting those requirements shall remain with the obliged entity which relies on the third party. ↩︎
  18. Under Section 42(1) of the Land Registry Act, legal representation is mandatory in land registry administrative proceedings, and such representation may be provided only by a lawyer, in-house legal counsel registered with the bar or a notary public. ↩︎
  19. See Article 4(1), Article 13(1) and Article 14(1) GDPR. ↩︎
  20. See Article 13(1) GDPR. ↩︎
  21. In authorising the processing of data related to the fulfilment of AML obligations and setting the retention period, Section 56(1)–(2) of the AML Act provides that the service provider may process personal data that "came into its possession in the course of fulfilling" the AML obligation until the end of the retention period specified therein. In our view, the phrase "in the course of fulfilling" may also be construed as "for the purpose of fulfilling", because, first, the AML Act does not explicitly require that the personal data necessary for customer due diligence may be obtained only when customer due diligence is carried out; second, it does not require that all steps of customer due diligence be carried out 'at once'; and third, where doubts arise (when further information-gathering steps become necessary), the steps of customer due diligence cannot be carried out in a single step. ↩︎
  22. See European Data Protection Board Guidelines 07/2020 on the concepts of controller and processor in the GDPR, page 3, paragraph 5. ↩︎
  23. See, for example, Section 13(8) of the AML Act. ↩︎
  24. See Article 12(1) GDPR. ↩︎
  25. See Article 83(5)(b) GDPR. ↩︎
  26. The difference between the approaches of the AML Act and the GDPR can perhaps be illustrated as follows: from the perspective of the AML Act, the service provider 'dictates' by requiring the customer (data subject) to participate in customer due diligence, whereas from the perspective of the GDPR, the data subject 'dictates' by expecting the service provider to inform him or her properly in this regard and to give effect to his or her rights should the data subject exercise them. ↩︎
  27. Regulation (EU) 2024/1624 of the European Parliament and of the Council (AMLR) and Directive (EU) 2024/1640 of the European Parliament and of the Council (AMLD6). ↩︎
  28. Preamble to AMLD4 (Directive (EU) 2015/849); cf. the minimum harmonisation nature of the Directive. ↩︎
  29. Article 4 AMLD4; and the role of national risk assessments of the Member States. ↩︎
  30. See recitals (1)–(2) of the preamble to the AMLR. ↩︎
  31. Article 3(d) AMLR. ↩︎
  32. The "single rulebook" objective of the AMLR; see the explanatory memorandum of the AMLR and its application objectives. ↩︎

Source: https://www.szecsenyi.com/insights/customer-due-diligence-real-estate-sales-aml/