Galleries, antique dealers, art dealers and auction houses must identify their money laundering and terrorist financing risks.
This obligation is not a matter of filling in a generic template. AML/CFT risk mapping must reflect the professional’s actual activity. It is the starting point of any art market compliance programme.
What is the purpose of AML/CFT risk mapping?
The French Monetary and Financial Code (Code monétaire et financier) requires obliged entities to assess the risks presented by their activities. The texts use the term “risk classification”. In practice, the term “risk mapping” is often used instead.
This mapping identifies the most sensitive transactions. It then determines the level of vigilance to be applied.
It must not be confused with the individual risk rating of a client. Risk mapping analyses the general risks of the activity. The risk profile then analyses a particular business relationship or transaction.
The obligation stems in particular from Article L. 561-4-1 of the French Monetary and Financial Code. The French Customs Authority (Douane) also recalls that professionals must formalise a risk classification and an internal procedure suited to their organisation.
How should a gallery or auction house build its risk mapping?
The first step is to describe the activities actually carried out.
This means examining sales, purchases, consignments, fairs, remote transactions and intermediary involvement. Cross-border flows must also be taken into account.
The analysis can be organised around four areas.
| Risk area | Points to examine |
| Clients and counterparties | Individual or company, beneficial owner, intermediary, politically exposed person |
| Transactions and payments | Amount, structuring (splitting of payments), cash, third-party transfers, country of the bank account |
| Geography and channels | High-risk countries, remote sales, international fairs, free ports |
| Artworks and activity | Value, ease of resale, provenance, opacity of the chain of ownership |
Each risk can be rated low, moderate or high. Existing controls must then be identified. The residual risk level is assessed after applying these measures.
An international transaction is not automatically suspicious. Likewise, a high-value artwork does not necessarily present a high risk. Several factors must be analysed together.
The mapping must in particular incorporate the EUR 10,000 threshold and related transactions.
How does the mapping connect to the gallery’s internal procedure?
The mapping sets out the diagnosis. The internal procedure explains how to act.
Each risk level must correspond to concrete measures. This may involve verifying the client’s identity, identifying their beneficial owner, or requesting further information.
Enhanced due diligence may also involve a closer check on the source of funds, the source of wealth and the provenance of the artwork.
The gallery’s or auction house’s internal procedure must also specify:
- who carries out the checks;
- what supporting documents are required;
- how an anomaly is handled;
- when to escalate to the AML/CFT compliance officer;
- in what cases a report to Tracfin (the French financial intelligence unit) should be considered.
Asset freeze and international sanctions screening must be built into the organisation. It nonetheless follows its own rules and can apply from the first euro.
What mistakes should be avoided?
The first mistake is reusing a standard risk mapping without adapting it. A template can serve as a basis. It does not prove that the gallery’s specific risks have been examined. The French Customs Authority’s FAQ states in fact that the administration does not validate templates offered by private providers.
The second mistake is drawing up a mere list of legal obligations. A risk mapping must identify concrete situations. It must also rank them.
The third mistake is failing to connect the mapping to any controls. A risk rated as high must trigger measures that are both appropriate and traceable.
The fourth mistake is leaving the document unchanged. The mapping must be reviewed whenever the activity evolves — for instance when expanding into a new country, developing online sales, or undergoing a significant change in clientele.
Finally, small structures are not exempt. A gallery or auction house with few employees may adopt a simple framework. It must nonetheless be formalised and suited to its risks.
By Alexis Fournol, Attorney at the Paris Bar, Partner of the Firm.
Our practice
Fournol & Associés advises art market professionals, auction houses, galleries, antique dealers, expert dealers, professional numismatists and other obliged entities on their AML/CFT compliance, the drafting of internal protocols, mandatory staff training, and support during inspections conducted by the competent authorities.
Related expertise & sectors
Frequently asked questions
Is risk mapping mandatory for a small gallery?
Yes, provided the gallery falls within the scope of obliged entities. Its content can be proportionate to the size and activity of the business.
What is the difference between risk mapping and internal procedure?
Risk mapping identifies and classifies risks. The internal procedure describes the controls and decisions used to manage them.
Is a generic risk mapping template enough?
No. It must be adapted to the clients, artworks, payment methods, geographical areas and sales channels actually used.
When should the risk mapping be updated?
It must be reviewed regularly. An update is also required after any significant change in activity, clientele, or geographical risk exposure.
Does risk mapping replace client assessment?
No. It sets the general framework. Each client and each transaction must then undergo an individual assessment.
