Anti-Money Laundering Compliance in Real Estate Services: What Should Enterprises Review?

In conducting real estate service business, enterprises must comply not only with regulations on business conditions, contracts, and transactions, but also with obligations relating to anti-money laundering (AML).
Article 77 of Decree No. 339/2026/ND-CP specifically sets out violations in this area and the corresponding sanctions, providing enterprises with a clear basis for reviewing their internal compliance systems.
1. Legal Basis
Under the Law on Anti-Money Laundering No. 14/2022/QH15, reporting entities — including enterprises providing real estate business services — are required to implement AML measures in accordance with the law. These measures include customer identification, the collection and retention of information and records relating to transactions, and the fulfilment of reporting obligations where suspicious transaction indicators arise.
Building on this framework, Article 77 of Decree No. 339/2026/ND-CP does not establish new obligations. Rather, it specifies the relevant violations and corresponding sanctions, providing enterprises with a clear and readily accessible basis for assessing their level of compliance.
2. Failure to Issue Internal AML Regulations: Fines of Up to VND 40 Million
Pursuant to Point a, Clause 1, Article 77, the failure to issue internal regulations on anti-money laundering may result in a fine ranging from VND 20 million to VND 40 million.
This should be one of the first matters to be reviewed, as the violation arises from the absence of the required internal regulations itself, without requiring a separate operational violation to have occurred. In other words, the failure to establish adequate internal AML regulations constitutes a compliance gap in its own right, which enterprises can proactively address before it is identified through inspection or enforcement.
When reviewing this matter, enterprises should consider the following questions: Have internal AML regulations been issued? If so, do they remain consistent with current legislation, or have they become outdated? Are the responsibilities of each department and individual in implementing AML measures clearly assigned to specific persons, or are they still defined in general terms? Finally, is there an effective mechanism for monitoring and supervising implementation to ensure that the regulations are not merely policies on paper?
3. Reviewing the Collection, Retention, and Security of Transaction Information and Records
Under Point b, Clause 1, Article 77, a fine ranging from VND 20 million to VND 40 million may be imposed for failure to properly or fully collect, retain, or protect transaction-related information and records as required by law.
Compared with the issuance of internal regulations, which provides the overall compliance framework, this obligation concerns day-to-day operational practices. Accordingly, the review should be conducted thoroughly across three closely interconnected areas.
First, collection: enterprises should clearly identify, for each type of transaction, the information and documents that must be collected and ensure that the collection process is carried out fully and properly.
Second, retention: the issue is not merely whether records are retained, but also how and for how long they are retained and, most importantly, whether the retention system enables prompt inspection and retrieval when required by a competent authority.
Third, security: enterprises should review access controls over transaction-related information and records, including who is authorised to access or modify such information, as well as the technical and administrative measures adopted to protect it in accordance with applicable law.
4. The Reporting Obligation: A Point Requiring Particular Attention
Whereas the two categories of violations discussed above are subject to a maximum fine of VND 40 million, Clause 2, Article 77 imposes a higher level of sanctions, ranging from VND 40 million to VND 80 million, for failure to report suspicious transactions or large-value transactions, or for providing false or misleading information or documents to a competent authority.
The higher level of sanctions reflects the stricter compliance requirements imposed on reporting obligations and the accuracy of information provided for AML purposes. While the failure to issue internal regulations or to properly collect, retain, and secure transaction-related information and records primarily indicates deficiencies in an enterprise’s internal compliance framework, failure to fulfil reporting obligations or the provision of false or misleading information or documents may reduce the effectiveness of mechanisms for monitoring, detecting, and addressing potentially high-risk transactions.
Enterprises should therefore closely review their mechanisms for identifying and handling transactions subject to reporting requirements and clearly designate the individual or department responsible for fulfilling these obligations in each specific circumstance.
Importantly, enterprises should not merely establish reporting procedures on paper. They should also ensure that such procedures are consistently implemented in practice and supported by an effective mechanism for monitoring compliance.
5. Violations of the Reporting Obligation May Lead to Suspension of Operations
In addition to monetary fines, Clause 3, Article 77 provides for an additional sanction of suspension of real estate service business operations for a period of one to three months, applicable to the violations of reporting obligations specified in Clause 2.
This is a matter that enterprises should not overlook. From a business perspective, the consequences of suspension may be considerably more serious than a monetary fine, as suspension can directly affect revenue, market reputation, and ongoing commitments to clients and business partners.
6. What Should Enterprises Review?
First, enterprises should review their internal AML regulations, ensuring that such regulations have been duly issued and are being fully implemented in accordance with Point a, Clause 1, Article 77 of Decree No. 339/2026/ND-CP. Failure to comply with this requirement may result in an administrative fine ranging from VND 20 million to VND 40 million.
Enterprises need to review their practices regarding the collection, storage, and security of customer information and transaction records, as required under Point b, Clause 1, Article 77. Violations of this provision are likewise subject to a fine of VND 20 million to VND 40 million.
Enterprises must pay particular attention to their obligation to report suspicious transactions and large-value transactions under Clause 2, Article 77. This category of violations carries a higher penalty, ranging from VND 40 million to VND 80 million.
The provision of dishonest or inaccurate information and documents to competent authorities also falls within the scope of violations under Clause 2, Article 77 and is subject to the same fine bracket of VND 40 million to VND 80 million.
For violations falling under Clause 2, Article 77 as set out above, in addition to monetary fines, enterprises may also be subject to an additional sanction in the form of suspension of real estate service business operations for a period of one to three months, pursuant to Clause 3, Article 77.
Therefore, to mitigate the legal risks outlined above, enterprises are advised to conduct periodic reviews, strengthen internal procedures, provide training to responsible personnel, and establish effective monitoring and reporting mechanisms to ensure timely and accurate transaction reporting.
The above fines and sanctions are prescribed directly in Article 77 of Decree No. 339/2026/ND-CP.
7. Conclusion
Decree No. 339/2026/ND-CP establishes specific sanctions for violations of AML requirements in the provision of real estate business services. Notably, enterprises may be subject to fines of up to VND 80 million for certain reporting-related violations and may face suspension of their real estate service business operations for a period of one to three months.
Enterprises should therefore proactively review at least three core areas: (i) internal AML regulations; (ii) procedures for collecting, retaining, and securing transaction-related information and records; and (iii) mechanisms for identifying, handling, and reporting transactions subject to reporting requirements.
This review should be conducted periodically and accompanied by regular updates to compliance procedures in line with changes in applicable legislation. By doing so, enterprises can take a proactive approach to compliance risks and reduce the likelihood of violations arising in the course of their operations.