Asking for the Passport: Art Due Diligence Before the 2027 EU Rules

Asking a collector for a passport, and where needed for where the money comes from, is not a new imposition. Dealers in London have done it since 10 January 2020 on sales of EUR 10,000 or more, and every EU member state was required to write the same duty into national law by that same date (Directive (EU) 2018/843). What arrives on 10 July 2027 is one text, Regulation (EU) 2024/1624, applying directly in all 27 countries, with sanctions screening written into the checks and a EUR 10,000 ceiling on cash.

So the check itself is settled. How it feels to the buyer is not. A gallery that asks at the invoice, asks some clients and not others, or cannot say why it wants the document, turns a legal duty into a small insult. A gallery that asks early, asks everyone the same way and explains itself on one page is selling something collectors value: a counterparty that has been screened and a title that will hold.

What the 2027 Regulation requires, article by article

The Regulation names the trade. Article 3(3)(i) makes obliged entities of “persons trading or acting as intermediaries in the trade of cultural goods, including when this is carried out by art galleries and auction houses, where the value of the transaction or linked transactions amounts to at least EUR 10 000”. Point (j) covers storing, trading or acting as an intermediary in cultural goods and high-value goods within free zones and customs warehouses, at the same threshold. Article 90 sets the start: 10 July 2027, “directly applicable in all Member States” (Regulation (EU) 2024/1624).

The checks sit in Article 20. Identify and verify the customer. Identify the beneficial owners and understand who controls the structure. Understand the purpose of the transaction. Verify whether the customer or its beneficial owners are subject to targeted financial sanctions. Establish whether anyone involved is a politically exposed person. Identify the people on whose behalf a purchase is made. Article 25 adds the source of funds “where necessary”. Article 23 says verification, as a rule, “shall take place before” the transaction. And where the checks cannot be completed, Article 21 is blunt: the firm “shall refrain from carrying out a transaction”.

Article 80 then limits cash for anyone trading in goods to EUR 10,000, whether paid at once or in linked instalments. Member states that already set a lower cap keep it.

One point needs a lawyer before 2027. The 2018 Directive spoke of “works of art”. The Regulation speaks of “cultural goods”, defined as the goods listed in Annex I to Council Regulation (EC) No 116/2009, the EU’s export-licensing list. For paintings, drawings, prints, sculpture and photographs, that Annex covers items “more than 50 years old” that “do not belong to their originators”, and it sets value floors written for export licences (Council Regulation (EC) No 116/2009). Whether a canvas finished last year falls inside the 2027 scope is a real question. This dossier reads public texts and is not legal advice; that question belongs with counsel in each country where you sell. Planning on the narrow reading is a poor bet in any case, because sanctions law applies whatever the age of the work.

Sources: Directive (EU) 2018/843; Regulation (EU) 2024/1624; HMRC, 2024 and ECSH54525; OFSI, 2025; U.S. Congress, 2025.

London has run this for six years

HMRC’s supervision handbook records the dates. Art market participants came into scope on 10 January 2020 and had until 10 June 2021 to register, and since 30 June 2026 the trigger has been £10,000 rather than EUR 10,000 (HMRC, ECSH54525). By March 2025, 1,337 were registered, against 208 in 2020 (HM Treasury and Home Office, 2025).

The government’s 2025 National Risk Assessment lowered the sector’s money laundering rating from high to medium, crediting HMRC’s improved understanding of the risk in the sector. It did not call the job done. “Significant compliance challenges remain across much of the AMP population,” it says, and since June 2021 HMRC has acted against more than 90 firms for trading while unregistered, with penalties above £535,000. Common failings included insufficient risk assessments, policies, controls and procedures (HM Treasury and Home Office, 2025).

Sanctions came next. Since 14 May 2025, UK art market participants must tell the Office of Financial Sanctions Implementation, as soon as practicable, when information reaching them in the course of business gives them knowledge or reasonable cause to suspect that a person is a designated person or has breached sanctions. OFSI’s threat assessment, published the following month, judged that “it is highly likely that high value goods owned by DPs in the UK have not been reported to OFSI”, and that Russian designated persons and their enablers have likely dealt in such goods in breach of asset freezes. Reporting from the sector is thin: between April 2023 and March 2024, art market participants and high value dealers together filed 0.07% of all suspicious activity reports (OFSI, 2025).

The case that shows the cost came in June 2025. A London gallery owner was jailed for two years and six months after admitting eight counts of failing to make a disclosure under the Terrorism Act 2000. He had sold almost £140,000 of art between October 2020 and December 2021 to a buyer sanctioned by the United States in 2019 as a suspected Hizballah financier, and some invoices carried names other than the real buyer’s. The Crown Prosecution Service called the prosecution “believed to be the first of its kind” (CPS, 2025). The practical lesson is narrow and useful. The name on the invoice proves nothing about who is buying, which is why the EU text asks for the person on whose behalf the purchase is made.

The United States decided to wait

Washington looked at the same risk and chose a different answer. The Treasury’s February 2022 study “found some evidence of ML risk in the institutional high-value art market but found little evidence of TF risk”. It noted that the due diligence some auction houses and galleries already run is voluntary and “can be suspended or disregarded at the institution’s discretion”. Its conclusion: “the art market should not be an immediate focus for the imposition of comprehensive AML/CFT requirements” (U.S. Department of the Treasury, 2022).

A bipartisan bill, the Art Market Integrity Act (S.2400), was introduced in the Senate on 23 July 2025. It would bring dealers, advisers, galleries and auction houses under the Bank Secrecy Act, with exemptions for small traders and for artists selling their own work. Congress.gov records no action since its referral to the Banking Committee that day (U.S. Congress, 2025).

The UK risk assessment draws the consequence plainly: “Other leading markets in the world (the USA and China) do not have money laundering supervision for the art market” (HM Treasury and Home Office, 2025). For a European gallery, that means an American collector buying in London, Paris or Basel may meet the question for the first time at your desk. That buyer is the one who most needs the explanation.

When the question is asked decides how it lands

By the time an invoice is drafted, the buyer has chosen the work, told someone about it and perhaps measured the wall. A request for a passport at that point reads as doubt. If the answers do not come, Article 21 leaves one outcome, no sale, and it happens at the most visible moment. Asked at the invoice, it reads as suspicion arriving late.

The trigger can be simple. A request to hold a work, or a price enquiry above the threshold, is the moment the conversation turns from browsing to buying. That is where the page goes out.

Asked at the first serious conversation, the question reads as house procedure.

Consistency does two jobs. OFSI’s red flags include “a counterparty refusing to provide information, particularly in relation to know-your-customer (KYC) checks, without reasonable justification”, and counterparties who “rush or delay a transaction while failing to engage with KYC checks” (OFSI, 2025). Those signals only mean something against a baseline. When every buyer receives the same page at the same stage, a refusal is information. When some buyers are waved through, a refusal tells you nothing, and the buyers who were asked have every reason to feel singled out. The Regulation points the same way: recital 172 says firms should perform risk assessments in the context of customer due diligence “without discrimination”.

The long-standing client is the hardest case and the most important one. The risk assessment warns that even firms with long relationships “should monitor changes of circumstance or behaviour” (HM Treasury and Home Office, 2025). Exempting the collector you have known for fifteen years is the exception every other buyer will hear about.

What the buyer gets from the check

Present the check as protection, because it is. OFSI’s position is that high value goods “owned, held or controlled by a DP” are economic resources that should be frozen (OFSI, 2025). Dealing in a work that belongs to a designated person, including selling it, without an OFSI licence risks breaching sanctions. OFSI also cites a 2024 National Crime Agency alert describing UK police seizing works of art that belonged to a designated person and were held by a UK art business. Screening the seller as well as the buyer is what keeps a client from paying for an asset that may later be frozen or seized.

The buyer also leaves with a cleaner record: an invoice in the true buyer’s name, from a seller who was identified and screened, which matters when the work is resold, insured or lent. Anyone who has bought above the threshold at a London auction since 2020 has been through the same routine.

The data promise can be precise, because the Regulation makes it so. Article 22 lists what is collected from a person: all names, place and full date of birth, nationalities and a national identification number where applicable, and usual place of residence. Article 77 requires records to be kept for five years from the end of the relationship or the transaction, and then says firms “shall delete personal data upon expiry of the five-year period”, unless other law, or an authority in a specific case, requires longer. A gallery can put that sentence, in plain words, on its one page.