Portugal AML Obligations for Accountants: Lei 83/2017, the OCC and the UIF

Portugal's anti-money-laundering rules reach certified accountants directly. This guide explains, in plain language, what the Ordem dos Contabilistas Certificados (OCC) says its members must do under Lei n.º 83/2017: who they must identify, how beneficial owners are handled, when and where to report suspicions, how long records are kept and what the penalties look like. If you are new to the underlying ideas, our guides to KYC and customer due diligence for accountancy practices and ultimate beneficial ownership give the background.

Where this guide comes from

Everything below is drawn from the OCC's own practical guide on anti-money-laundering and counter-terrorist-financing duties, dated September 2026. That is regulator guidance written for members, not the statute itself. We have therefore attributed article numbers and figures to the OCC guide, and we list at the end what we could not check against the legal text. This is general information, not legal advice.

The legal framework

According to the OCC guide, the main framework is Lei n.º 83/2017 of 18 August, and the accountant's duties are set out in its article 11. Several other texts sit alongside it:

• Lei n.º 97/2017, which deals with restrictive measures (sanctions lists).
• Lei n.º 89/2017, as amended by Decreto-Lei n.º 115/2025, which governs the central beneficial owner register, the RCBE. The guide says access now requires a legitimate interest.
• Article 368.º-A of the Penal Code, which defines the crime of money laundering.
• Articles 63.º-C and 63.º-E of the Lei Geral Tributária, which cover business bank accounts and the cash payment limit.

The guide also notes that the EU anti-money-laundering package, including Regulation (EU) 2024/1624, applies from 10 July 2027. We return to that below.

Customer due diligence

The guide places the core due diligence duties in articles 23 to 26. In practice the accountant must identify and verify the client and the beneficial owner before the business relationship starts. For companies, that includes collecting identification data on shareholders holding 5% or more. Each client is then classified as low, normal or high risk, and high-risk clients require enhanced due diligence.

Article 50 sets a refusal rule. If a client will not provide identification or will not clarify who owns the business, the accountant must not start the relationship or carry out the operation. The practical lesson is to settle identification and ownership questions at onboarding, not after the first invoice.

Beneficial owners

The OCC guide defines the beneficial owner (article 30) as the natural person who ultimately owns or controls the client. The current threshold is stated as more than 25%. The guide recommends cross-checking the client's RCBE declaration against the certidão permanente and Annex L of the IES filing. If, after exhausting all means, no one can be identified, the steps taken must be recorded and the members of the board are treated as beneficial owners.

From 2027, according to the guide, article 52 of the EU Regulation lowers the ownership threshold to 25% or more. Practices with clients sitting right on the line should note the change now. Our UBO guide linked above covers the same ideas in a general setting.

Spotting and reporting suspicions

The guide describes a sequence. First comes the examination duty (article 52): suspicious operations must be analysed with special care, and the result recorded in an internal analysis note. If suspicion is confirmed, the reporting duty (articles 43 to 46) applies. The accountant reports on their own initiative and immediately to both the Unidade de Informação Financeira (UIF) and the Departamento Central de Investigação e Ação Penal (DCIAP).

The guide is explicit that the law sets no deadline in hours or days: reporting follows once the examination is complete. It also says that since April 2026 reports go through the PortalCOS platform, and that a transitional rule requiring a PDF by email to the UIF applied until 13 October 2026.

Other duties in the same family include abstention (articles 47 to 49), meaning that suspicious operations should not be executed unless abstaining is impossible or would harm an investigation, and non-disclosure (article 54). The guide also cites good-faith protection for reporters (article 56) and a separate crime for revealing a reporter's identity (article 158). Our guide to suspicious activity reports and tipping off explains why the no-disclosure rule matters in any country.

Record keeping

Article 51, as described by the guide, requires copies or records of identification documents, client files, analyses and proof of transactions to be kept for at least seven years. The period runs from the end of the relationship, not from the date of each document. Copies are sufficient. The guide suggests filing reports separately with restricted access.

Supervision and penalties

The OCC is the sectoral authority for certified accountants under article 90, paragraph 2, and supervises members' compliance with the preventive duties. The guide lists three layers of consequence:

• Administrative offences: articles 169, 169-A and 170(d), with fines the guide gives as €5,000 to €1,000,000 for legal persons and €2,500 to €1,000,000 for individuals. Ancillary sanctions under article 172 can include professional bans and publication, and injunctions under article 168 can require compliance.
• Disciplinary liability: article 183 and the OCC statute, with sanctions from a warning and a fine to suspension of up to three years or expulsion.
• Criminal liability: money laundering under the Penal Code, which the guide says carries prison terms of up to 12 years.

Practical steps (our suggestions)

These are our suggestions, not requirements from the guide:

• Add a written risk rating to every client file at onboarding and review it when the client's activity changes.
• Keep a short template for the internal analysis note so that every examination is recorded the same way.
• Diarise the retention end date for each client from the day the relationship ends.
• Ask a named partner to own the PortalCOS reporting access and to know who can file.
• Use training to keep the whole team current. Our CPD courses include compliance topics for finance teams.

What we could not confirm

We read the OCC guide, not the text of Lei n.º 83/2017 itself, so article numbers, fine ranges and the seven-year period are as the guide states them. We could not confirm the exact list of services that bring an accountant's work within the law, whether the guide reflects every amendment in force today, the detail of the PortalCOS filing process, or how the OCC applies its supervisory powers in practice. The guide also describes some review frequencies as good practice rather than legal requirements. Check the primary legislation and the OCC's current notices before relying on any figure here.

Frequently asked questions

Do Portuguese accountants report to the police or to a financial intelligence unit?

According to the OCC guide, confirmed suspicions are reported to both the UIF and the DCIAP, on the accountant's own initiative and immediately.

How long must client records be kept?

The guide says at least seven years from the end of the business relationship.

What happens if a client will not say who owns the company?

Under article 50 as described in the guide, the accountant must not start the relationship or execute the operation.

Is the 25% beneficial owner threshold changing?

The guide says the current test is more than 25%, and that from 2027 the EU Regulation lowers it to 25% or more.

Can I tell a client that I have filed a report?

No. The guide describes a non-disclosure duty in article 54, so neither the client nor third parties should be told that a report was made.

Learnsignal publishes country guides like this one so finance professionals can see how the same global standards look in different places. Browse the rest in our AML and KYC guides hub.