Author: Dr. László Szécsényi
1. Introduction
Hungary has had a domestic anti-money laundering framework for decades. The first national act on the prevention and combating of money laundering was adopted in 1994, and the legal profession has since become increasingly familiar with AML-related obligations. The current Act LIII of 2017 on the Prevention and Combating of Money Laundering and the Financing of Terrorism (the “AML Act”) already imposes significant duties on legal professionals, especially where they participate in transactions involving company formation, financing, real estate or the management of client assets.
However, the most important next step is not a purely domestic one. From 10 July 2027, a large part of the legal framework applicable to lawyers will no longer be shaped only by national transposition, but directly by the EU’s new anti-money laundering package. This is a major shift in both substance and practical compliance. The package is intended to create a more uniform, more effective and more consistent framework across the internal market and to reduce the fragmentation that has arisen from differing national implementation methods.
The European Union’s 2024 AML reform package includes the AMLA Regulation, the AMLR Regulation and the amended Sixth AML Directive. The central practical question for Hungarian attorneys is not whether AML obligations exist in principle, but how they will operate in specific legal services, particularly where a lawyer acts in a transactional context. In practice, the effect of the new rules will be felt in the way law firms define the scope of their AML obligations, structure internal compliance, perform customer due diligence, identify beneficial owners, assess risk and document their work.
2. Background and the Rationale of the Reform
The logic of the new EU package is rooted in the recognition that money laundering and terrorist financing are not merely criminal law issues. They also threaten the integrity of the financial system, the proper functioning of the internal market and public trust in regulated sectors. The previous AML rules were primarily built on the Sixth Anti-Money Laundering Directive, which relied on member-state transposition and therefore created varying legal standards and inconsistent enforcement practices.
The AMLR was adopted as a directly applicable regulation precisely to overcome these difficulties. Unlike directives, a regulation does not require national transposition and is therefore capable of creating a more uniform layer of EU-wide legal obligations. The aim is to harmonize the rules on obligated entities, expand and standardize customer due diligence, strengthen the regime for identifying beneficial owners, clarify the treatment of data protection and retention and reduce the opportunities for circumvention through legal or structural complexity.
For Hungarian lawyers, the practical significance of this reform is that a significant part of AML obligations will be determined by directly applicable EU-level rules. This does not mean that domestic law becomes irrelevant, but it does mean that the national legal framework will increasingly operate in the shadow of EU rules rather than simply as a stand-alone domestic model.
3. The Scope of Obligated Entities: A Business-Centred Interpretation
One of the most important changes in the AMLR is the way in which the category of “obligated entity” is defined. The legal profession is not treated as a single class automatically subject to AML obligations in all circumstances. Instead, the relevant test is narrower and more activity-based: the lawyer is obliged only in relation to activities falling within the regulated scope.
This is particularly significant because lawyers perform many services that are not AML-relevant in a strict sense. General advice, litigation, representation in court and purely advisory work may remain outside the direct scope of the AMLR. The focus shifts instead to whether the lawyer is involved in a transaction or service falling within the enumerated categories such as: real estate transactions, company formation or management, participation in financial arrangements, management of client assets, or the creation or administration of corporate or trust-type structures.
This creates a practical classification issue. The question is not whether the work is legal in form, but whether it is connected to a transaction or activity captured by the AMLR. This matters especially when a lawyer drafts documents, advises on structuring, evaluates the suitability of a transaction, or participates in the preparation of a corporate or real estate deal. The legal quality of the service does not decide the issue by itself; the functional connection to the regulated activity is critical.
The AMLR therefore focuses attention on the substance of the service rather than the formal labels used by the profession. A lawyer may be an obligated service provider not in general, but only in respect of the specific service involved. This is a significant development from an operational perspective because it requires firms to think carefully about the legal and economic nature of each mandate and the risk profile attached to it.
4. The Meaning of “Client” and the Triggering of Due Diligence
The second key issue is the moment when due diligence becomes mandatory. Under the AMLR, customer due diligence is triggered in a number of circumstances, including the establishment of a business relationship, the carrying out of an occasional transaction, or participation in a transaction involving the creation or transfer of a legal entity or similar arrangement.
This is particularly relevant for lawyers because many legal mandates begin as an engagement with a client but do not necessarily involve an immediate transaction. In real estate or corporate work, the legal mandate may be established before the transaction is finalized, or the lawyer may be engaged only for a discrete part of a structure. The AMLR therefore distinguishes between the existence of an engagement and the actual moment at which a transaction or activity creates AML obligations. This distinction is not always self-evident in legal practice, which is why the internal application of AML rules needs a careful mapping of the nature of the mandate and the transactional context.
The AMLR also clarifies that the due diligence obligation can arise not only when a business relationship is created but also when a one-off transaction is carried out. In this context, “occasional transaction” is especially relevant. For example, a single transaction may trigger enhanced vigilance even if no continuing business relationship exists. This makes the issue more operationally important than in older models, because many legal services are project-based rather than relationship-based.
From a Hungarian perspective, this is a significant departure from a model that may treat the formal engagement as the primary trigger. Under the new EU approach, the actual transaction or service activity can be decisive. In practical terms, a law firm should not wait until it has a formal, long-term client relationship before considering AML checks if the underlying transaction itself meets the threshold for due diligence.
5. The Scope of Customer Due Diligence Measures
The AMLR imposes a set of detailed customer due diligence requirements. Obliged entities must identify the customer and verify their identity; identify beneficial owners and verify their identity; understand the purpose and intended nature of the business relationship or transaction; assess whether the customer or beneficial owner is subject to financial sanctions; and monitor the transaction on an ongoing basis.
This means that AML compliance is no longer limited to identity verification at the start of the file. Ongoing monitoring is a central component of the duty. A lawyer must not simply collect documents once and then proceed without regard for the commercial reality of the matter. The service provider must assess whether the transaction is consistent with the client’s profile, the business rationale behind the arrangement and the risk assessment carried out at the beginning of the mandate.
The AMLR also imposes an obligation to assess the professional and economic profile of the customer. This may include the nature of the client’s business, whether the client is a legal entity or natural person, the origin of the funds and the expected structure of the transaction. In the context of legal practice, this is especially important in situations involving asset transfers, complex corporate structures, trust arrangements, nominee shareholders, or cross-border investments.
The so-called “source of funds” and “source of wealth” analysis is therefore not a theoretical matter. In many transactions, especially real estate or corporate acquisitions, the legal professional must be able to understand whether the transaction is consistent with the client’s economic background and whether there are signs that the funds or structures may be used to obscure the true origin of assets.
The AMLR also makes clear that where the transaction is being conducted on behalf of or for the benefit of another natural person, the obliged entity must identify and verify that person’s identity. This is significant for lawyers acting as intermediaries or carrying out services for a principal whose identity is not the same as the person actually benefiting from the transaction. The practical implication is that in transactional structures, the lawyer cannot focus only on the formal contracting party; they must be alert to the underlying economic interest and to any natural person whose position is material to the transaction.
6. The Beneficial Ownership Problem and the Need for Deeper Analysis
The AMLR places a great deal of emphasis on beneficial ownership. This is not a secondary issue in the modern AML regime. It is one of the central tools for revealing hidden economic interests, shell structures and nominee arrangements designed to avoid transparency.
The new rules require obligated entities to identify the beneficial owner and take reasonable measures to verify that the person identified is indeed the true beneficial owner. In practical terms, this means that lawyers cannot rely solely on company registers or documents provided by the client at face value. If there is a risk that the true owner is concealed behind a chain of companies, a trust, a foundation or an offshore structure, the lawyer must investigate more deeply.
This is particularly important in Hungary, where many real estate or corporate transactions involve complex ownership chains. A transaction may appear straightforward on paper while the underlying economic ownership is layered through multiple entities. The legal professional must therefore be able to trace ownership structures and evaluate whether the transaction is consistent with the economic reality of the client.
The AMLR also provides for the use of data from reliable and independent sources and, where relevant, public registers. This demonstrates that beneficial ownership analysis is expected to be substantive rather than merely documentary. It is not enough to ask whether a document exists; the question is whether the document faithfully reflects the economic reality.
In this sense, the new rules support a more realistic understanding of what a lawyer does in a transaction. Legal advice is no longer seen as something abstractly separate from AML risk. On the contrary, legal structuring, drafting and transaction planning may create or manage AML exposure. That is why beneficial ownership analysis must be integrated into the core legal review rather than left to a separate compliance function at the end of the process.
7. Risk Assessment and the Three Lines of Defense
The AMLR is organized on the premise that a risk-based approach can only function properly if the obligated service provider assesses in advance the extent to which its own services, customer base, geography, business model and transaction types expose it to money laundering or terrorist financing risks. The service provider must therefore identify, assess and document the risks arising in the course of its operations and then establish internal AML procedures adapted to those risks.
This idea is familiar to Hungarian attorneys because the current AML Act already requires internal risk assessment, but the AMLR strengthens the link between service-level risk assessment and the due diligence measures applied in individual cases. The content of simplified and enhanced due diligence, transaction monitoring and internal AML policies can all be derived from a documented risk assessment. In other words, the risk assessment is not merely a formal exercise; it becomes the foundation for operational risk management.
The reform also reflects a risk governance model based on three lines of defense. The first line is the business and management lines, which are responsible for operational activity and for implementing internal controls. The second line is the compliance function, which performs AML compliance tasks with appropriate independence. The third line is the audit function, which independently reviews the operation of the internal control system.
This structure is significant for the legal profession because it strengthens the idea that AML compliance is not merely a responsibility of individual lawyers but of the organization as a whole. In larger law firms, there should be clear separation between business execution, compliance oversight and audit. In smaller firms, the same principles may be applied proportionately, but the need for clear roles and independence remains.
8. Internal Governance: Compliance Officer and AML Officer
The AMLR introduces a more explicit governance framework than current Hungarian practice. The regulated provider must designate a member of the management body as the compliance manager, responsible for ensuring that internal AML/CFT rules, procedures and controls are aligned with the organization’s risk profile, that resources are sufficient and that the system works properly.
In addition, the service provider must designate a separate anti-money laundering officer, who is responsible for the day-to-day implementation of AML requirements and for operating the internal AML system. This officer must have appropriate organizational independence and sufficient seniority. The AML officer may not simply be a clerical or administrative function. The role is operational and central. The officer is expected to raise concerns, challenge weak compliance procedures, warn management about emerging risks and ensure that due diligence standards are actually implemented in practice.
This represents a significant new requirement, particularly for smaller or more informal practices, that may not have previously operated with a formally designated AML governance structure. The AMLR recognizes that different firms have different sizes and risk profiles, and therefore allows some flexibility. If the nature, risk profile and size of the provider warrant it, the roles of the compliance manager and AML officer may be performed by the same person. However, the larger or higher-risk the provider, the more clearly the separation between management, compliance and audit should be maintained.
The general principle is that the management body cannot simply delegate responsibility without retaining oversight. The regulation emphasizes that the management body remains accountable for AML compliance, while the AML officer is responsible for execution. This makes governance, escalation and internal reporting matters more day-to-day and more demanding.
9. Due Diligence Trigger Points Under Article 19 of the AMLR
The AMLR distinguishes between the categories of persons who are considered obligated parties and the situations in which those parties must carry out customer due diligence. This distinction is important for legal services because not every lawyer is necessarily subject to AML duties in every matter, but a lawyer who reaches a regulated activity may still have to fulfill due diligence duties when specific triggers arise.
The relevant trigger points include the establishment of a business relationship, the completion of a one-off transaction, the assistance in the formation or management of a legal entity, the acquisition or transfer of ownership interests in a legal entity, or the management of client assets. Article 19 therefore addresses two separate issues: first, whether the lawyer qualifies as an obligated entity with respect to the relevant service; second, whether that service triggers a due diligence obligation.
This logic matters because it avoids reducing the entire question to a pure threshold issue. The existence of a business relationship is not the only trigger. A lawyer can be obliged to perform due diligence even in a stand-alone transaction if the transaction falls within the specified categories and the legal professional is involved in that activity.
In addition, the AMLR treats certain cash transactions differently. For occasional transactions involving cash of EUR 3,000 or more, the service provider must apply at least basic customer due diligence measures. This does not create a completely separate trigger category, but rather establishes a stricter and more targeted rule for cash transactions that otherwise fall within the occasional transaction regime. For lawyers, this is particularly relevant in matters that may involve large cash payments or structures involving immediate transfer of funds.
10. The Client and the Beneficial Owner: Who Must Be Identified?
The AMLR also clarifies who must be treated as the customer for due diligence purposes. This is especially relevant in transactional work where there may be more than one party to the transaction. A lawyer may be engaged by one client but must also consider whether another party to the transaction should be treated as a client when the lawyer acts as an intermediary and is effectively facilitating the transaction.
The general rule is that a lawyer must identify the persons on whose behalf or for whose benefit the transaction is being carried out, and if a transaction is being conducted through a lawyer or another professional as intermediary, the lawyer must be prepared to identify the parties involved. In practical terms, the AMLR prevents a situation in which a lawyer is engaged by only one party and thereby avoids AML duties with respect to the other side of the transaction, especially when the lawyer is the only professional intermediary involved.
This question is especially relevant where a lawyer acts for a party in a real estate or corporate transaction while the opposite party is represented by another professional, or where one lawyer is involved in a transaction affected by multiple parties. It is not sufficient to say that the lawyer owes AML duties only to the immediate client. If the lawyer is involved in a transaction carried out for the benefit of another person or group, there may be an independent duty to identify that person or those persons and verify their identity.
11. Specific Due Diligence Measures Required by the AMLR
The AMLR defines a detailed list of customer due diligence measures. In summary, those measures include:
- identifying the customer and verifying their identity;
- identifying the beneficial owner and taking reasonable steps to verify their identity;
- understanding the purpose and intended nature of the business relationship or occasional transaction;
- assessing whether the customer or beneficial owner is subject to targeted financial sanctions;
- gathering information on the customer’s business or economic profile;
- conducting ongoing monitoring of the relationship and transactions;
- determining whether the customer, the beneficial owner or the person acting for the benefit of the customer is a politically exposed person, or a family member or close associate of such a person;
- identifying persons acting on behalf of the customer and verifying their authority and identity.
These are not abstract formalities. They require substantive action. Evidence has to be obtained, assessed and documented. It must be determined what constitutes reliable information, how the beneficial owner is identified and what the standard operating procedure is if the client refuses to provide the requested documents or if the information is incomplete or inconsistent.
The AMLR therefore creates a legal and operational expectation that law firms develop clear procedures for managing these tasks. The most robust firms will not rely on ad hoc lawyer judgment alone. They will have standard onboarding checks, client information forms, beneficial ownership questionnaires and escalation paths where information is incomplete or suspicious.
12. Inability to Complete Due Diligence and the Refusal to Proceed
A major practical consequence of the AMLR is that if due diligence cannot be completed properly, the service provider must not proceed. Article 21 of the AMLR sets out a “stop rule”: if the obliged entity cannot identify the customer, the beneficial owner or the background of the transaction with sufficient certainty, it may not establish the relationship or proceed with the transaction. If the relationship already exists, the service provider must consider terminating it.
This is particularly important for lawyers because many client files involve situations in which the legal structure is opaque or the source of funds cannot be explained. In such cases, the lawyer may not proceed simply because a transaction is commercially attractive or because the client wishes to keep moving. The AMLR is clear that if the legal professional cannot fulfill the required due diligence obligations, then the transaction cannot continue in the normal way.
For practitioners, this is not a theoretical obstacle. It can be highly relevant in structures involving shell companies, nominee shareholders, offshore vehicles or complex trust arrangements. In such cases, the issue is not merely that the risk is high; it is that the lawyer is unable to determine the true economic nexus of the transaction at all. The legal profession will therefore need to increase its willingness to refuse an engagement or withdraw from a transaction where AML obligations cannot be met.
13. Identification of the Customer, the Beneficial Owner and the Data Required
The AMLR also specifies the minimum content of the information to be obtained for the purposes of identification. This is significantly more detailed than many domestic regimes. For natural persons, the obligated entity must obtain details such as names, date of birth, place of residence, nationality and, where applicable, national identification numbers or similar identifiers. For legal entities, it must obtain information about the legal form, registered office, country of establishment, legal representatives and relevant registration data. For trusts and similar arrangements, it must identify the trustee or equivalent position and relevant details on the structure.
The identification of legal entities is not simply a litmus test of whether a company exists. It requires the identification of relevant persons, structures and data points that allow the service provider to form a meaningful understanding of the transaction and the ownership chain. In the legal profession, this is especially relevant because many clients in corporate or real estate transactions may operate via holding companies or layered ownership arrangements, which can obscure the person who actually benefits or controls the transaction.
In addition, the AMLR makes clear that the service provider must document its efforts to identify and verify beneficial owners. Where the provider cannot identify a natural person even after using all reasonable measures, it must record the problem and the steps taken. This is important because legal professionals are expected not just to comply with the law but to demonstrate that they did so in a traceable and defensible way.
14. Data Protection, Confidentiality and Retention
Another major element of the new rules concerns data processing and retention. The AMLR clarifies that the handling of AML-related personal data must be aligned with the relevant privacy framework, while recognizing that customer due diligence necessarily involves the collection and processing of personal data. This is a particularly sensitive issue for law firms because their obligations of confidentiality and professional secrecy are strong and must be balanced against AML duties.
The practical implication is that law firms must adopt clear internal policies on data collection, access, storage, retention and deletion. They must define which records are necessary, which are not, who may access them, how they are protected and how their retention periods align with legal requirements and professional obligations.
This has become more important because the AMLR is designed to increase transparency and improve the ability of authorities, service providers and financial institutions to assess AML risk. That requires adequate recordkeeping and a clear audit trail. Law firms can no longer rely on informal document handling or fragmented local procedures if they want to operate defensibly in the new regime.
15. Impact on Hungarian Law Firms: Practical Consequences
The AMLR will not affect all legal work in the same way. Its impact will be strongest in those areas where lawyers are directly involved in transactions with elevated AML risk, including:
- real estate transactions,
- company formation and restructuring,
- the management of client funds or securities,
- corporate acquisitions and ownership changes,
- cross-border transactions and financing structures,
- arrangements involving trusts, foundations or nominee shareholders.
For Hungarian law firms, the practical task is therefore not simply to wait for the new rules to enter into force. It is to review the firm’s current practice now and to prepare the internal systems that will be required under the EU regime. This includes reviewing client onboarding, transaction checklists, internal AML questionnaires, beneficial ownership procedures, file documentation, escalation procedures and training.
The law firm should also consider whether its internal governance structure is sufficiently robust. If the firm is larger, the compliance, AML officer and audit functions should be aligned with the three lines of defense model. If the firm is smaller, there should still be a clear allocation of AML responsibilities, and the firm should be able to demonstrate that risk is being managed consistently and with appropriate documentation.
A realistic and prudent strategy for Hungarian firms would include:
- Reviewing whether particular services fall within the scope of the AMLR;
- Mapping AML responsibilities across the firm;
- Updating onboarding and CDD systems;
- Strengthening beneficial ownership analysis;
- Clarifying data retention and confidentiality arrangements;
- Training all lawyers and support staff on the new framework;
- Defining a refusal or withdrawal policy where due diligence cannot be completed.
16. Conclusion
The EU’s anti-money laundering reform package is more than a technical legislative update. It is a fundamental change in the way legal services are regulated and in the way law firms are expected to deal with risk, client relationships and transaction documentation. For Hungarian legal practice, the main effect will be to elevate AML compliance from a compliance task at the margins of legal work to a core part of professional legal service delivery.
The most significant practical implication is that lawyers will increasingly be expected to integrate AML analysis into the transaction process itself rather than treating it as a separate administrative burden. Firms that adapt early will be better placed to manage regulatory risk, protect clients, maintain trust and preserve the integrity of the legal profession in a more closely harmonized EU framework.
