Most businesses that fall under Latvia's anti-money-laundering regime do not think of themselves as financial institutions, and several of them find out only when a supervisor writes to them. The AML Law reaches well beyond banks — and once it reaches you, it imposes a standing system, not a set of forms.
Nobody gives you this status. It just applies
Latvia's rules sit in the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing. Everything depends on one question: are you an obliged entity — one of the businesses the law covers?
You do not apply for this and nobody grants it. If what you do appears on the list in the law, the status is yours automatically, from the day you start doing it. It is not granted and cannot be declined.
So there are two questions, in this order. Are you covered? And if you are, what does that mean in practice? Most businesses answer the second by copying a policy from somewhere else, without ever properly answering the first.
Who is covered, beyond the obvious
Banks and financial firms are the cases everyone expects. The surprises are elsewhere:
Outsourced accountants, auditors and tax advisers — and the law says plainly any other person who helps with tax matters, however rarely, and whether or not they are paid for it.
Notaries, advocates and other independent legal service providers, but only when they act for a client on certain things: property or share deals, managing a client's money or assets, opening or running accounts, and setting up or running companies.
Company service providers, estate agents, gambling operators, cash collection firms, debt recovery firms and insolvency administrators.
Anyone selling vehicles, precious metals, art, antiques or goods of any kind who takes EUR 10,000 or more in cash, in one payment or in several connected ones.
Two of these catch people out. The tax-help category has no limit at all on how often you do it or whether you charge. And the trading categories depend on a number, so a business can sit outside the rules for years and fall inside them on the day it accepts a single cash payment of EUR 10,000. The status also survives insolvency and liquidation.
What being covered actually means
Assess the risk first, then build around it. The order matters and cannot be reversed. You need a written risk assessment that fits the size and nature of what you do, and then — based on it — an internal control system approved by the board. The assessment has to take account of the EU-wide risk assessment, Latvia's national one, and your own risks, covering at least clients, countries, products and the channels you work through.
Put a name to it. A company appoints one or more people responsible for compliance, including someone from senior management, with real authority to decide and answerable to the supervisor. Banks, payment and e-money firms, investment firms and crypto-asset service providers appoint at both levels. Whoever you appoint needs a clean reputation, no unspent conviction for the offences the law lists, and no penalty beyond a warning in the past year for AML or sanctions matters.
Know your client before you act. Checks have to be done before a relationship starts, and before a one-off transaction at these amounts:
| What | From |
|---|---|
| One-off transaction, or several connected ones | EUR 15,000 |
| Transfer of funds; crypto-asset transaction | EUR 1,000 |
| Currency exchange | over EUR 1,500 |
| Goods or services paid in cash | EUR 10,000 |
| Lotteries and gambling, winnings included | EUR 2,000 |
They are also required at any amount if something looks suspicious, or if you suspect the client information you already hold is not true.
A beneficial owner is a person who directly or indirectly holds more than 25 per cent of the capital or the votes, or who controls the client some other way. Deeper checks are compulsory for politically exposed people, correspondent relationships, clients you never meet in person, and transfers to or from a self-hosted crypto wallet.
If you cannot complete the checks, you do not start the relationship, do not carry out the transaction, and end an existing relationship without delay. There is no version of this where you proceed and sort the paperwork out later.
Keep watching, and report. Monitoring does not stop after onboarding. If beneficial ownership information does not match what is in the Enterprise Register, tell the Register within three working days. Suspicious transactions go to the Financial Intelligence Unit without delay — and that duty also covers money that looks suspicious before any transaction happens, and cases where there were grounds to report and nobody did because of carelessness. Through all of it you may not tell the client that a report has been made.
All the deadlines in one place
| What | When |
|---|---|
| Telling the State Revenue Service what you do, where it supervises you | 10 working days |
| Telling your supervisor who is responsible for compliance | 30 days |
| Reporting a suspicious transaction | Without delay |
| Reporting a decision not to carry out a transaction | Next working day at the latest |
| Reporting a beneficial ownership mismatch to the Register | 3 working days |
| Answering a request from the Financial Intelligence Unit | 3 working days if urgent, otherwise 7 |
| Reviewing the risk assessment | Every 3 years |
| Written check that the control system works | Every 18 months |
| Updating client information | Every 5 years |
| Keeping records after a relationship ends | 5 years, can be extended |
Who supervises you, and what a breach costs
There is no single AML regulator in Latvia. Latvijas Banka supervises banks, payment and e-money firms, investment firms, insurers and crypto-asset service providers. The State Revenue Service takes accountants, tax advisers, legal and company service providers, estate agents, traders over the cash threshold and gambling operators. Advocates, notaries, auditors and insolvency administrators answer to their professional bodies.
Whichever applies to you, the powers are much the same: inspection against the supervisor's own published method, the right to enter your premises, the right to demand original documents, and a deadline to put things right.
A breach can bring a public statement naming you and what you did, a warning, a fine, suspension or loss of a licence, and removal of the responsible person from their post.
The fine is worth reading slowly, because the law sets it out in two parts rather than as a single ceiling: twice the profit made from the breach, where that can be worked out, or a fine of up to EUR 1,000,000. How the two fit together — in particular whether the million-euro figure also caps the profit-based one — is not something the wording settles, and it is worth taking Latvian advice on rather than reading off the page. For banks and financial firms the scale is different again: up to 10 per cent of annual turnover, with a lower limit of up to EUR 5,000,000.
A case can be opened within five years of the breach, or ten if the supervisor suspects the business itself was involved. Decisions stay published for five years, which is often the consequence that costs the most commercially.
Sanctions are a separate law
Everything above is the AML Law. Sanctions are not in it, and that is the whole point — the mistake here is structural, not a technical detail.
The Law on International Sanctions and National Sanctions applies to everyone, not just to the businesses on the AML list. It has its own requirement to assess sanctions risk and to run a separate internal control system for it. A well-run AML programme does not cover that duty, and one combined policy satisfies neither law unless it genuinely deals with both.