Portugal's anti-money laundering regime has undergone a significant legislative tightening. For international companies operating through Portuguese entities, the window to adapt is narrow – and the cost of non-compliance extends well beyond administrative fines.
Anti-money laundering compliance in Portugal is governed by financial legislation that transposes successive EU AML directives into domestic law. Obligations cover customer due diligence, beneficial owner registration, and ongoing transaction monitoring. Companies that fail to meet updated thresholds face regulatory sanctions, restrictions on bank account opening, and potential suspension of credit facilities.
This alert sets out what has changed, which business categories are affected, and the immediate steps your organisation must take.
What changed and when it takes effect
Portugal's financial legislation has been amended to align with the European Union's latest AML directive package. The revisions strengthen three core pillars of the existing regime.
First, the scope of entities classified as obliged entities has expanded. Companies that provide corporate services, manage assets on behalf of third parties, or act as intermediaries in real estate and commercial transactions are now expressly included. This brings a broader category of professional service providers within the mandatory compliance perimeter.
Second, the beneficial owner registration rules have been tightened. Under Portuguese corporate legislation (Código das Sociedades Comerciais, the CSC), companies must identify and register the natural persons who ultimately own or control them. The updated rules lower the ownership threshold that triggers enhanced due diligence obligations and impose stricter timelines for updating the Registo Central do Beneficiário Efetivo (Central Beneficial Owner Register). Any change in ownership or control structure must now be reported within a materially shorter window than previously required.
Third, know-your-customer (KYC) procedures have been overhauled. Obliged entities must apply risk-based assessments that are more granular than before. Static onboarding checks no longer satisfy the standard. Continuous monitoring of business relationships is now a formal requirement, not an optional best practice.
The revised rules have entered into force and carry an immediate compliance obligation. There is no transitional grace period for entities already subject to the regime. New entrants within the expanded scope have a defined window – measured in weeks, not months – to bring their procedures into conformity.
Who is affected and what the thresholds mean in practice
The updated obligations apply across a wide range of business categories. International companies with Portuguese subsidiaries, branches, or registered offices are directly in scope. So are foreign companies that conduct regulated activities through Portuguese counterparties.
The affected categories include:
- Credit institutions and payment service providers conducting correspondent banking relationships with Portuguese entities
- Corporate services providers, including firms that supply registered-office addresses or nominee director arrangements
- Real estate intermediaries and developers involved in transactions above the applicable monetary threshold
- Lawyers, notaries, and accountants when they execute or assist in the execution of transactions involving the transfer of ownership of real estate or business assets – including the preparation of an escritura pública (notarised public deed in Portuguese law)
- Asset managers and collective investment schemes registered or marketed in Portugal
The threshold criteria matter. Enhanced due diligence is now triggered at a lower beneficial owner ownership level than before. Any natural person holding a direct or indirect interest above the revised threshold must be identified, verified, and registered. Where no natural person meets the threshold, the senior managing official of the entity must be recorded as the beneficial owner of last resort.
For correspondent banking, the rules impose specific obligations on Portuguese credit institutions entering or continuing relationships with foreign financial institutions. Each correspondent banking relationship must be subjected to a documented risk assessment before the relationship is maintained or extended. A credit facility granted to a company with an opaque ownership structure will now face heightened scrutiny at the point of origination and at every review date.
The Supremo Tribunal de Justiça (Supreme Court of Portugal) and the Tribunal da Relação (Court of Appeal) have consistently confirmed that administrative liability for AML failures attaches to the legal entity as well as to its responsible officers. Enforcement actions by the regulator – the Banco de Portugal for credit institutions and the relevant supervisory authority for other obliged entities – have accelerated in both frequency and severity. Companies should not treat regulatory fines as a predictable operating cost: suspension of the right to open a bank account or to access a credit facility can paralyse operations far more rapidly than a monetary penalty.
For a comprehensive view of how these obligations interact with Portuguese banking regulation more broadly, the firm's practice overview of banking and finance law in Portugal provides the necessary regulatory context.
To receive an expert assessment of your company's AML exposure in Portugal, contact us at info@ferrazwhitmore.com.
Immediate actions required for international companies
The following steps should be initiated without delay.
Review your beneficial owner register. Confirm that the information held in Portugal's Central Beneficial Owner Register is accurate and current. Any change in ownership structure – including indirect changes effected through intermediate holding companies – must be reflected within the revised statutory window. Errors or omissions are independently sanctionable, regardless of whether the underlying transaction was compliant.
Update your KYC files and monitoring procedures. Static onboarding documentation is insufficient. Each business relationship must be assigned a risk rating under a written, documented methodology. Higher-risk relationships require enhanced due diligence measures, including identification of the source of funds and the source of wealth of the beneficial owner. If your company relies on a third party to perform KYC – a common arrangement in cross-border groups – the outsourcing arrangement must comply with the conditions set out in financial legislation. Liability for KYC failures does not transfer to the outsourced provider.
Map your correspondent banking exposures. If your group operates through Portuguese banking relationships that serve foreign subsidiaries or affiliates, each such relationship must be reviewed against the updated correspondent banking rules. Document the risk assessment. Confirm that the Portuguese institution has performed – and can evidence – its own enhanced due diligence on the foreign counterparty.
Train relevant personnel. Portuguese financial legislation imposes a mandatory training obligation on obliged entities. The training must be appropriate to the employee's role and must be recorded. A board decision confirming the adoption of an updated AML compliance programme is advisable and, in some regulated sectors, required.
Prepare for supervisory scrutiny. The Banco de Portugal and the relevant sectoral supervisors have signalled increased on-site and off-site inspection activity. Companies in recently expanded scope categories should expect initial contact from the regulator. Having a documented, internally approved AML policy – with clear procedures for suspicious transaction reporting to the Unidade de Informação Financeira (Financial Intelligence Unit) – is a practical prerequisite before any supervisory interaction.
For companies active in Portuguese capital markets or with securities issuance programmes, the interaction between AML obligations and capital markets regulation adds a further layer of complexity. Our analysis of capital markets law in Portugal addresses these intersecting obligations in detail.
Companies expanding or restructuring across the Iberian Peninsula should also note that Spain has implemented parallel AML changes. Our alert covering AML updates in Spain outlines the key differences between the two regimes and identifies where a unified group compliance approach is viable.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. The firm's banking and finance practice covers AML regulatory compliance, KYC structuring, beneficial owner analysis, and supervisory engagement across Portugal and the broader EU. Our team combines Portuguese civil law expertise with English common law tradition – delivering practical, cross-border solutions for international companies that need to manage regulatory exposure across multiple legal systems. Practitioners in our Lisbon office have supported clients before the Banco de Portugal and other supervisory authorities on AML enforcement and compliance programme reviews. Engaging a lawyer in Portugal with dual-tradition expertise is particularly valuable when group-level policies must be adapted to meet local regulatory requirements. As an international law firm in Portugal, Ferraz & Whitmore brings both the technical depth and the jurisdictional reach that AML compliance in an interconnected business environment demands. For a tailored strategy on AML compliance in Portugal, reach out to info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.