What’s new in AML and sanctions compliance in 2025? Significant changes for letting agents

Letting agents, alongisde high value dealers, art market participants and insolvency practitioners in the UK are facing significant changes in 2025 as the government moves to tighten anti-money laundering (AML) regulations and financial sanctions reporting obligations. Starting 14 May 2025, financial sanctions reporting obligations will apply to all letting agency work, regardless of the rental value. These changes, intended to close regulatory loopholes, mark a significant shift for the industry and demand a proactive response from agents.

 

The new sanctions reporting obligations

 

Historically, letting agents have only been subject to AML supervision for lettings involving monthly rents of €10,000 or more. While the threshold for registering for AML supervision is not changing, for sanctions compliance the threshold created a significant blind spot, as smaller transactions escaped scrutiny, potentially allowing illicit activities to go undetected. Recognising this vulnerability, the government has introduced broader obligations under the Office of Financial Sanctions Implementation (OFSI) to strengthen oversight.

 

From May 2025, letting agents will be required to report suspicions of financial sanctions breaches, whether related to landlords, tenants, or other parties involved in their transactions. This includes identifying designated persons (DPs)—individuals or organisations subject to sanctions—and reporting the nature and value of any funds or economic resources held on their behalf. This change means letting agents must report any knowledge or reasonable suspicion of financial sanctions breaches or designated persons directly to the Office of Financial Sanctions Implementation (OFSI).

 

While these measures aim to safeguard the integrity of the financial system, they also introduce considerable complexity for letting agents for those who are unfamiliar with conducting sanctions checks. Under these rules, letting agents will be added to the list of “relevant firms” required to report to OFSI. This includes:

 

  • Identifying designated persons under sanction or breaches of financial sanctions regulations
  • Reporting any funds or economic resources managed for such individuals or entities
  • Ensuring compliance is integrated into their business operations

 

What are financial sanctions?

Financial sanctions serve to protect the UK’s financial system and support national security and foreign policy goals. These sanctions impose restrictions on individuals, organisations, and sectors, including freezing financial assets and limiting access to financial services.

 

For letting agents, this means heightened vigilance throughout the rental process. Agents must monitor not only the financial transactions they facilitate but also the individuals and businesses they engage with. The scope of these sanctions is vast, applying to all UK persons and businesses, whether operating domestically or internationally.

 

What this means for letting agents

The expanded scope of financial sanctions reporting represents a major shift for letting agents. Previously seen as primarily facilitators in the property market, agents must now adopt a compliance-first mindset, integrating AML practices into every aspect of their operations.

 

This includes enhanced due diligence, robust monitoring systems, and staff training to identify and report suspicious activity. For smaller agencies, the challenge will be finding cost-effective ways to meet these new demands without overburdening their operations.

 

To support letting agents, OFSI has published tailored guidance outlining the new requirements. This builds on its general financial sanctions guidance, helping agents understand how and when their reporting obligations apply. For example:

 

  • Reporting obligations will apply as soon as a letting agent is instructed by a prospective landlord or tenant
  • Agents must act if they suspect a breach of financial sanctions at any point during the letting process
  • Transactions of any value are now subject to these obligations, removing the previous €10,000 threshold

 

Changes for insolvency practitioners, high value and art dealers

In addition to letting agermts, insolvency practitioners must start to screen all parties involved in insolvency cases to ensure no transactions involve designated individuals or entities. They are required to freeze assets and report any relevant activities to OFSI. Practitioners must obtain a license for any restricted transactions. Compliance measures should include record-keeping and regular audits, as violations may result in civil penalties.



High value dealers and art market participants will also face stricter requirements. They must implement and annually review screening systems tailored to their business risk profile. Due diligence must be applied rigorously for high-risk transactions. Those businesses are required to document their system capabilities and limitations to demonstrate to regulators that their processes are appropriate and meet the necessary standards.

 

What letting agents should do now

 

Understand your obligations

  • Familiarise yourself with OFSI’s general and sector-specific guidance on financial sanctions.
  • Identify the points at which reporting obligations apply during letting transactions.

 

Implement a sanctions compliance framework

  • Ensure AML and sanctions policies include robust checks for designated persons or breaches of sanctions regulations.
  • Train staff to identify red flags and escalate concerns promptly.

 

Review your processes

  • Assess your client onboarding and transaction monitoring processes to ensure compliance.
  • Establish clear reporting channels within your organisation to manage OFSI reporting obligations.

 

Stay informed

  • Engage with HM Treasury’s updates on regulatory changes.
  • Attend industry events or webinars to understand evolving expectations.

 

Seek legal advice

  • Consult with legal experts to address any uncertainties and avoid compliance pitfalls.

 

Try VinciWorks client onboarding system and streamline your AML and sanctions checks

 

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.