Italy AML Obligations for Accountants: Legislative Decree 231/2007 and the CNDCEC Technical Rules

In Italy, accountants (dottori commercialisti and esperti contabili) are covered by Legislative Decree No. 231/2007, the country's main anti-money laundering (AML) law. Their national professional body, the Consiglio Nazionale dei Dottori Commercialisti e degli Esperti Contabili (CNDCEC), issues technical rules under the decree, and the Unità di Informazione Finanziaria per l'Italia (UIF), the financial intelligence unit, receives suspicious transaction reports. This guide sets out what the CNDCEC's own January 2025 technical rules and its March 2026 operational guidance say, and is open about what we could not confirm. It is general information, not legal advice, and our reading of the Italian-language texts is ours.

The legal framework and the technical rules

The CNDCEC's technical rules were issued under article 11, paragraph 2, of Legislative Decree 231/2007, which asks professional bodies to set out how professionals should assess risk and meet their obligations. The version we read was adopted by CNDCEC deliberation No. 9 of 16 January 2025, after the Financial Security Committee gave an opinion on 27 December 2024. They apply to members of the register of dottori commercialisti and esperti contabili, with provisions for professional associations and professional companies that handle due diligence and record keeping centrally. An accompanying document of March 2026, which the CNDCEC calls operational guidance on the forms it proposes, states that it does not create new legal obligations.

A 2023 commentary notes that the decree's article 35 sets the reporting duty where there is knowledge, suspicion or reasonable grounds for suspicion, and that the report must be made before the transaction. The decree text we were able to read was an old consolidated version, so treat that point as one to confirm against the current decree. The same commentary reports that, from 15 September 2023, commercialisti can again send reports to the UIF through the CNDCEC using an application called ArSOS, alongside the UIF's own portal.

The firm's own risk self-assessment

The first technical rule requires each professional to assess inherent risk across four factors: client type, geographic area, distribution channels and services offered. They also assess vulnerabilities in training, due diligence, record keeping and suspicious-activity reporting. Residual risk is calculated with a weighted matrix of 40% inherent risk and 60% vulnerability. The duty cannot be delegated and must be documented and made available to the authorities. Sole practitioners generally act as their own AML function, associations and professional companies must appoint an AML officer unless each member handles AML individually, and firms with more than 30 professionals and 30 staff must also have an independent review function. The CNDCEC's operational guidance adds that a missing self-assessment is not directly sanctionable but is considered when sanction amounts are set.

Customer due diligence

The second technical rule combines a client risk score with an engagement risk score to produce an effective risk level, which determines the measures. Simplified checks apply to low-risk clients such as listed companies, public administrations and supervised financial entities, ordinary due diligence to medium risk, and enhanced due diligence to high risk. The rule covers identification of the client, the person acting for them and the beneficial owner, with remote identification allowed in listed cases. The operational guidance says occasional transactions trigger due diligence only when the payment instruments reach 15,000 euros or more, that low-risk clients may have a 36-month review cycle, and that politically exposed persons trigger enhanced due diligence regardless of the risk score, except when acting as public administration bodies. For the general method, see our guides to KYC and customer due diligence in accountancy practices and ultimate beneficial ownership.

The rules say public beneficial ownership registers support the check but do not replace it, and that discrepancies must be reported to the register. Professionals may rely on attestations from other professionals and some listed third parties but remain fully responsible. Services such as representation before judicial authorities and mediation or arbitration are classed as non-significant risk, where the professional mandate satisfies due diligence, and article 17(7) of the technical rules exempts pure preparation and filing of tax returns and certain payroll work.

Record keeping and suspicious transactions

The third technical rule sets out what must be kept so that transactions can be reconstructed, such as engagement dates, identity data and payment details, and accepts paper, electronic or mixed systems. The text we read refers only to the period "prescribed by the norm", so we could not confirm the retention period in years. The operational guidance cites articles 31 to 34 of the decree and a 30-day period for timely acquisition of data. The technical rules do not set reporting deadlines. The operational guidance says client files should document the reasoning for concluding that a suspicious transaction report is not required, and that communications on breaches of cash limits must be made regardless of suspicion. Our guide to suspicious activity reports and tipping off is UK-focused but explains the practical sequence of spotting, escalating and reporting.

What we could not confirm

• The current text of Legislative Decree 231/2007, including the retention period, the reporting timing and the exemption for legal-assistance information, because the version available to us predates later amendments.
• Penalty amounts for failure to report, failure to carry out due diligence, and breach of confidentiality.
• Whether the direct UIF route remains available alongside the CNDCEC channel since September 2023.
• The effective date of the January 2025 technical rules.

Suggested next steps

These are our suggestions, not requirements. Read the CNDCEC technical rules and its operational guidance in full, and check the decree's current text for retention, reporting and penalties. Complete and date your risk self-assessment. For team training, see our CPD courses.

Frequently asked questions

Are accountants in Italy covered by AML law?

Yes. Dottori commercialisti and esperti contabili are covered by Legislative Decree 231/2007, and the CNDCEC issues technical rules for them.

Do accountants have to carry out a risk self-assessment?

Yes. The first technical rule requires one, which cannot be delegated and must be documented and made available to the authorities.

When is due diligence required for occasional transactions?

According to the CNDCEC's operational guidance, when the payment instruments involved reach 15,000 euros or more.