Most businesses that fall under Latvia's anti-money-laundering regime do not think of themselves as financial institutions, and several of them find out only when a supervisor writes to them. The AML Law reaches well beyond banks — and once it reaches you, it imposes a standing system, not a set of forms.
The status attaches to you; nobody grants it
Latvia's framework sits in the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing. Everything turns on one status: whether you are an obliged entity. It is not applied for and not granted. It attaches automatically to anyone whose economic or professional activity falls within the statutory list.
Two questions follow, in this order: whether you are caught, and what that requires. Businesses tend to answer the second by copying a policy from elsewhere, having never properly answered the first.
Who is caught, beyond the obvious
Credit and financial institutions are the familiar cases. The rest are where the surprises happen:
Outsourced accountants, auditors, tax advisers — and expressly any other person providing assistance in tax matters, regardless of how often, or whether they are paid.
Notaries, advocates and other independent legal service providers, but only when acting for a client on listed activities: real estate or share transactions, managing client assets, opening or managing accounts, and founding or operating legal persons.
Company service providers, real estate agents, gambling organisers, cash collection and debt recovery providers, insolvency administrators.
Traders in vehicles, precious metals, art, antiques or goods of any kind, where payment is in cash of EUR 10,000 or more, in one operation or several linked ones.
Two features do most of the damage. The tax-assistance category has no frequency or payment filter at all; and the trading categories are threshold-based, so a business can sit outside the regime for years and fall inside it on the day it accepts one cash payment of EUR 10,000. The status survives insolvency and liquidation.
What the status requires
Assess your risk, then build the system around it. The sequence is not reversible: a documented risk assessment appropriate to the nature and scale of the activity, and on the basis of it an internal control system approved by the management board. The assessment must take in the EU supranational risk assessment, Latvia's national risk assessment, and your own risks, covering at minimum client, country, product and delivery channel risk.
Put a name to it. A legal person appoints one or more employees responsible for compliance, including from senior management, empowered to decide and answerable to the supervisor. Banks, payment and e-money institutions, investment firms and crypto-asset service providers appoint at both levels. Those appointed need an impeccable reputation, no unspent conviction for the listed offences, and no penalty beyond a warning in the past year in the AML or sanctions field.
Know the client before you act. Due diligence is required before a relationship begins, and before an occasional transaction at these thresholds:
| Trigger | Threshold |
|---|---|
| Occasional transaction, or linked ones | EUR 15,000 |
| Transfer of funds; crypto-asset transaction | EUR 1,000 |
| Currency exchange | over EUR 1,500 |
| Goods or services paid in cash | EUR 10,000 |
| Lottery and gambling, including winnings | EUR 2,000 |
It is also required at any value where there is suspicion, or suspicion that client data already held is untrue. The statutory floor for beneficial ownership is a natural person holding, directly or indirectly, more than 25 per cent of the capital or voting shares, or who controls the client. Enhanced measures are mandatory for politically exposed persons, correspondent relationships, non-face-to-face onboarding and transfers to or from a self-hosted crypto address. If due diligence cannot be completed, you do not start the relationship, do not transact, and terminate an existing one without delay.
Keep watching, and report. Monitoring is continuous. Where beneficial ownership information does not match the Enterprise Register, notify the Register within three working days. Suspicious transactions go to the Financial Intelligence Unit without delay — and the duty extends to funds that raise suspicion before any transaction, and to cases where there was ground to report and none was made through negligence. Throughout, the tipping-off prohibition applies: the client may not be told.
The clocks, in one place
| What | When |
|---|---|
| Notice of activity type to the State Revenue Service, where it supervises you | 10 working days |
| Telling your supervisor who is responsible for compliance | 30 days |
| Suspicious transaction report | Without delay |
| Reporting a decision to refrain from a transaction | Next working day at the latest |
| Beneficial ownership discrepancy to the Register | 3 working days |
| Responding to a Financial Intelligence Unit request | 3 working days if urgent, otherwise 7 |
| Reviewing the risk assessment | Every 3 years |
| Documented assessment of control system effectiveness | Every 18 months |
| Updating client due diligence information | Every 5 years |
| Retaining records after the relationship ends | 5 years, extendable |
Who supervises you, and what it costs
There is no single AML regulator. Latvijas Banka supervises banks, payment and e-money institutions, investment firms, insurers and crypto-asset service providers. The State Revenue Service takes accountants, tax advisers, legal and company service providers, real estate agents, cash-threshold traders and gambling organisers. Advocates, notaries, auditors and insolvency administrators answer to their professional bodies. Whichever applies, the powers are alike: inspection under its own published methodology, entry to premises, production of originals, and a deadline to remedy.
A breach can bring a public statement naming the person and the breach, a warning, a fine, suspension or loss of a licence, and removal of the responsible individual from office.
The fine is worth reading carefully, because the Law expresses it in two limbs rather than one ceiling: twice the profit obtained from the breach, where that can be calculated, or another fine of up to EUR 1,000,000. How the two limbs interact — in particular whether the million-euro figure also caps the profit-based limb — is not something the wording settles, and it is a point to take Latvian advice on rather than read off the text. For credit and financial institutions the scale differs again: up to 10 per cent of annual turnover, with a floor of up to EUR 5,000,000.
A case may be opened within five years of the breach, or ten where the supervisor suspects the entity was involved. Decisions stay published for five years — commercially, often the consequence that matters most.
Sanctions are a different statute
Everything above is the AML Law. Sanctions are not, and that is the point: the error here is structural rather than technical. The Law on International Sanctions and National Sanctions applies to all persons, not to a list of obliged entities, and imposes its own duty to assess sanctions risk and to run a separate internal control system for it. A well-run AML programme does not discharge that duty, and a combined policy satisfies neither statute unless it genuinely addresses both.