Context: why this decree arrives now

Since 2001, Guatemala's anti-money-laundering framework rested primarily on two instruments:

  • Decree 67-2001, the Law Against Money Laundering and Other Assets, which imposed AML obligations on obligated persons of the financial system: banks, insurers, brokerage houses, cooperatives, money remitters.
  • Decree 58-2005, the Law to Prevent and Suppress the Financing of Terrorism, which extended the same framework to terrorist financing (CFT).

These two laws created the Special Verification Intendancy (IVE) within the Superintendency of Banks as the country's financial intelligence unit, with powers to receive suspicious transaction reports (STRs), analyze them and coordinate with the Public Prosecutor's Office in criminal investigations.

However, the international standard of the Financial Action Task Force (FATF) — to which Guatemala is subject as a member of GAFILAT — requires AML obligations also to be extended to so-called DNFBPs: Designated Non-Financial Businesses and Professions. FATF Recommendations 22, 23 and 28 cover:

  • Lawyers, notaries and other independent legal professionals.
  • External accountants and auditors.
  • Real estate agents.
  • Dealers in precious metals and stones.
  • Trust and company service providers.

Guatemala carried repeated compliance gaps in GAFILAT mutual evaluations because it had not fully extended the AML/CFT regime to these professions. Decree 15-2026 is designed to close that gap and align the national framework with the international standard.

What Decree 15-2026 establishes

The reform expands the universe of obligated entities before the IVE. In essence, it incorporates into the AML/CFT system:

Profession / activity When the duty is triggered
Lawyers and notaries When they intermediate in the purchase and sale of real estate, management of client money or securities, opening or administration of accounts, formation/administration of companies or trusts, or purchase and sale of business entities.
External accountants and auditors When they prepare client financial operations or take part in their execution under any of the scenarios above.
Real estate agents or brokers In any real estate purchase and sale transaction in which they act as intermediaries.
Dealers in precious metals and stones When the transaction exceeds the thresholds set out in the regulation.
Trust and company service providers When they act as formation agents, provide registered office services, or manage companies on behalf of third parties.

The concrete obligations

Each obligated professional must comply with a minimum core of duties, aligned with FATF recommendations and with what has applied to the financial system since 2001:

1. Customer due diligence (KYC — Know Your Customer)

Before accepting the transaction, the professional must identify and verify the client:

  • Natural person: valid DPI (national ID), physical address, economic activity, purpose of the transaction.
  • Legal person: commercial license or registry filing, DPI of the legal representative, articles of incorporation, list of shareholders or members.
  • Beneficial owner: identification of the natural person who ultimately owns or controls the client, including through corporate chains, trusts or other structures.

2. Enhanced due diligence

Applies to high-risk clients or transactions: Politically Exposed Persons (PEPs), non-cooperative jurisdictions, complex corporate structures, unusually large transactions or transactions with no apparent economic purpose.

3. Recordkeeping

The professional must keep a complete file of identification documentation and transaction records for a minimum period — typically 5 years — after the relationship with the client ends.

4. Suspicious Transaction Reports (STRs)

When the professional detects a transaction that could reasonably be linked to money laundering, terrorist financing or predicate offenses, they must file a Suspicious Transaction Report (STR) with the IVE through official channels. This report:

  • Is confidential: it must not be disclosed to the client or to third parties ("tipping-off" is prohibited).
  • Enjoys legal protection for the professional reporting in good faith.
  • Does not require certainty of the crime: reasonable suspicion is enough.

5. Internal compliance program

The firm or professional must implement a minimum program proportional to their size and risk profile:

  1. AML/CFT policy approved by the firm's management.
  2. KYC manual with operating procedures.
  3. Risk matrix by client type and transaction.
  4. Designated compliance officer (in small firms this may be the partner or professional themselves).
  5. Annual staff training.
  6. Periodic audit of the program.

Professional secrecy: how it is balanced

This is the most important question for lawyers and notaries: does the duty to report break the professional secrecy that protects the client?

The answer, aligned with the FATF standard and with Decree 15-2026 itself, is no — with clear nuances:

Lawyer's activity Does the reporting duty apply?
Legal consultation on the client's legal situation No — protected by privilege
Defense in judicial or administrative proceedings No — protected by privilege
Drafting a real estate purchase-and-sale deed Yes — covered act
Formation of a company for the client Yes — covered act
Administration of client funds or securities Yes — covered act
Purchase and sale of shares or interests in a company Yes — covered act

The logic is simple: attorney-client privilege protects the defense relationship — where the client comes to their lawyer seeking to understand their situation or defend themselves — but does not cover the professional's instrumental role when they act as a gatekeeper in an economic transaction that could facilitate money laundering.

Covered transactions: the six major acts

Following FATF Recommendation 22, Decree 15-2026 identifies six key categories of transactions that trigger the due-diligence duty when a lawyer, notary, accountant or auditor participates in them:

  1. Purchase and sale of real estate.
  2. Management of client money, securities or other assets.
  3. Management of bank, savings or securities accounts.
  4. Organization of contributions for the creation, operation or administration of companies.
  5. Creation, operation or administration of legal persons or legal arrangements (trusts, autonomous patrimonies).
  6. Purchase and sale of business entities.

Outside these scenarios, the professional operates under the ordinary regime of professional secrecy.

Sanctions for non-compliance

The sanctioning regime combines three layers:

  • Administrative sanctions from the IVE: monetary fines graduated by the severity of the breach (failure to report, deficient KYC, failure to keep records, failure to designate a compliance officer).
  • Professional sanctions: possible impact on active bar/professional-association membership, with direct consequences on the ability to practice.
  • Criminal liability in serious cases: willful failure to report may amount to concealment of the money laundering offense, with the possibility of prosecution by the Public Prosecutor's Office (MP).

Add to this the reputational risk — a firm sanctioned by the IVE rarely wins back serious corporate clients. In practice, this is the strongest deterrent for mid-sized and large legal firms.

How a small or mid-sized firm should implement the program

For boutique firms (2-15 professionals) the design can be proportional to risk. We recommend:

  1. Initial diagnosis of the service portfolio: identify how many of the firm's engagements fall into the six covered categories.
  2. Risk matrix by client type (natural person / legal person / cross-border transaction / PEP) and by transaction type.
  3. KYC manual — simple but complete: client file, list of required documents, criteria for identifying the beneficial owner, source-of-funds declaration template.
  4. Designated compliance officer — in a small firm this may be one of the partners; in mid-sized firms it is preferable to have a dedicated professional or one shared with the legal-corporate function.
  5. STR detection and filing workflow to the IVE, with an internal confidential channel.
  6. Retention policy — files kept in AML folders for at least 5 years after the relationship ends.
  7. Annual training of the team, with documented records.
  8. Internal audit of the program once a year.

The program does not need to be a huge infrastructure. In a small firm it can be designed with a 15-20 page manual, standardized templates and a simple digital workflow. What the IVE expects is consistency and evidence, not complexity.

Impact on the client relationship

The change also requires explaining to the client:

  • That their lawyer or auditor must ask for identification and source-of-funds documentation, not out of personal distrust, but as legal compliance.
  • That the firm may refuse to operate if due diligence is not fulfilled — and that doing so also protects the client from criminal risk by association.
  • That certain operational thresholds trigger automatic reports (for example, cash transactions above the set thresholds).
  • That the professional has a duty of confidentiality regarding the report itself: the client will not be notified that their transaction was reported.

Handled well, this conversation does not drive away serious clients — on the contrary, it reassures them: they know they are working with a firm that also protects them on the compliance front.

Immediate recommendations

  1. Run a diagnosis of which of your firm's engagements fall under the decree.
  2. Design and internally approve the AML/CFT manual before sanctions become fully enforceable.
  3. Update engagement letters or powers of attorney with AML due-diligence clauses.
  4. Register the firm as an obligated entity before the IVE as soon as the administrative mechanism is available.
  5. Train the team — every professional in the firm must understand the framework and their obligations.
  6. Review contracts with corporate service providers, real estate agents and other partners who are also covered.
  7. Document everything — in compliance, what is not documented does not exist in front of the authority.

Frequently asked questions

What is the IVE?

The Special Verification Intendancy of the Superintendency of Banks is Guatemala's financial intelligence unit. It receives and analyzes suspicious transaction reports and coordinates with the Public Prosecutor's Office and other authorities.

What is a DNFBP?

Designated Non-Financial Business or Profession — the FATF technical term for non-banking professions with AML duties: lawyers, notaries, accountants, auditors, real estate agents, dealers in precious metals and stones, and trust and company service providers.

Who is the beneficial owner?

The natural person who ultimately owns or controls the client, even through chains of companies, trusts or other structures. Identifying them is a core obligation of customer due diligence.

What is an STR?

Suspicious Transaction Report. It is the formal instrument by which the obligated entity notifies the IVE of a transaction that could reasonably be linked to money laundering or terrorist financing. It is confidential and must not be disclosed to the client.

Can I turn down a client for failing due diligence?

Yes — and in many cases it is the correct answer. If the client refuses to provide basic identification or source-of-funds documentation, or if the transaction makes no reasonable economic sense, the firm should seriously consider declining the engagement.

Can I delegate due diligence to a third party?

You may rely on specialized providers (KYC-as-a-service) or on due diligence carried out by another obligated entity of the financial system for the same client. However, ultimate responsibility remains with the obligated professional. Delegating the process does not delegate the sanction.

What is the threshold that triggers the report?

Exact thresholds by transaction type are defined in the decree itself and in its operating regulation. Verify the official text and the IVE's technical rules.

What if the client is a fellow lawyer?

The due-diligence duty applies equally. No profession is exempt from KYC when it acts as a client of another firm in covered transactions.

Are you a lawyer, notary, accountant or auditor?

We support you through the diagnosis, design and implementation of your firm's AML/CFT program under Decree 15-2026: KYC manual, risk matrix, STR procedures, team training and annual audit. We also advise mid-sized and boutique firms that want to get ahead of full enforceability.

Chat with compliance Book a consultation

Keep reading