Propertymark / NAEA Qualification (Level 3 Estate Agency) Legal Framework Governing Residential Estate Agency Syllabus

What is the 'grey list' under the CRA 2015?

The grey list (Schedule 2) is an indicative, non-exhaustive list of contract terms that may be regarded as unfair — for example, terms allowing the trader to vary the contract unilaterally, excessive cancellation charges, or automatic renewal with onerous notice requirements.

What is the principal aim of the Money Laundering Regulations 2017 (MLR 2017, as amended)?

To prevent the use of businesses for money laundering and terrorist financing by requiring regulated firms (including estate agency businesses) to apply a risk-based approach, conduct customer due diligence, register with a supervisor, and maintain controls, training and record keeping.

What does the MLR 2017 require as part of Customer Due Diligence (CDD)?

CDD requires identifying and verifying the customer's identity using reliable, independent sources; identifying beneficial owners; understanding the nature/purpose of the business relationship; and conducting ongoing monitoring of transactions. It must be carried out before establishing a relationship or as soon as practicable.

Under MLR 2017, when must Enhanced Due Diligence (EDD) be applied?

EDD is required where there is a higher risk of money laundering — e.g. transactions involving a Politically Exposed Person (PEP), customers from high-risk third countries, complex/unusually large transactions, or where CDD raises suspicion. EDD involves additional identity checks, source-of-funds verification, and senior management approval.

Under MLR 2017, who in the estate agency property sales transaction is treated as the 'customer' for CDD?

Since amendments (effective 2020), estate agents must conduct CDD on BOTH the seller (the client) AND the prospective buyer (purchaser) once an offer is accepted, because both parties to the transaction must be checked.

What is Simplified Due Diligence (SDD) under MLR 2017?

SDD is a reduced level of CDD applied where a risk assessment shows the business relationship or transaction presents a low risk of money laundering or terrorist financing. The firm must still monitor the relationship sufficiently to detect unusual or suspicious transactions.

Define a 'beneficial owner' under the MLR 2017 for a corporate body.

A beneficial owner is any individual who ultimately owns or controls (directly or indirectly) more than 25% of the shares or voting rights in the company, or otherwise exercises control over the management. Where no such person exists, it is the individual exercising senior managing official control.

Which government body supervises estate agency businesses for anti-money laundering compliance, and what is the registration requirement?

HMRC is the AML supervisor for estate agency businesses. Estate agents carrying out estate agency work must register with HMRC for anti-money laundering supervision before trading; failure to register is a criminal offence and can result in penalties.

What information must an estate agency business provide to register with HMRC for AML supervision?

Details of the business and its premises, the beneficial owners, officers and managers (BOOMs) — who must pass a fit-and-proper / approval test — the nominated officer (MLRO), and the nature of the business. A fee is payable per premises and annually thereafter.

What is the 'fit and proper' test under MLR 2017 for estate agency BOOMs?

HMRC must determine that beneficial owners, officers and managers are fit and proper — meaning they have not been convicted of relevant offences (e.g. money laundering, fraud, dishonesty). HMRC carries out this approval check before allowing the person to act; acting before approval is an offence.

What is the primary money laundering offence under the Proceeds of Crime Act 2002 (POCA)?

POCA creates the principal offences: concealing/disguising/converting/transferring criminal property (s.327); arranging to facilitate the acquisition/use/control of criminal property by another (s.328); and acquiring, using or possessing criminal property (s.329). 'Criminal property' is property constituting or representing a person's benefit from criminal conduct.

What is the 'failure to disclose' offence under POCA 2002 (s.330)?

A person in the regulated sector commits an offence if they know or suspect, or have reasonable grounds to know/suspect, that another is engaged in money laundering, and they fail to make the required disclosure (a SAR) to the nominated officer or the NCA as soon as practicable.

What is 'tipping off' under POCA 2002, and why does it matter for agents?

Tipping off (s.333A) is the offence of disclosing to a person that a Suspicious Activity Report has been made, or that a money laundering investigation is being or may be contemplated, where that disclosure is likely to prejudice the investigation. Agents must not alert a client/buyer that a SAR has been submitted.

What is a SAR and to whom is it submitted?

A Suspicious Activity Report (SAR) is a report of known or suspected money laundering or terrorist financing. It is submitted to the National Crime Agency (NCA). Within a firm, staff report internally to the nominated officer (MLRO), who decides whether to submit a SAR to the NCA.

What is a Defence Against Money Laundering (DAML) request under POCA?

A DAML (formerly 'consent SAR') is a request to the NCA for consent to proceed with a transaction that might otherwise be a prohibited act under POCA. If the NCA refuses, a moratorium applies; proceeding without the requested defence can constitute an offence.

State the statutory deadlines associated with a DAML / consent SAR moratorium period under POCA.

After a DAML is submitted, there is a 7-working-day notice period in which the NCA can refuse consent. If refused, a 31-calendar-day moratorium period follows during which the transaction must not proceed (extendable by court order up to 186 days total).

Define a Politically Exposed Person (PEP) under the MLR 2017.

A PEP is an individual entrusted with a prominent public function — e.g. head of state, government minister, senior judge, ambassador, senior military officer, or board member of a state-owned enterprise — together with their family members and known close associates. PEPs require Enhanced Due Diligence.

How does the MLR 2017 (as amended) treat DOMESTIC PEPs differently from foreign PEPs?

Domestic PEPs (and their family/associates) are generally to be treated as lower risk than foreign PEPs, unless other risk factors are present. EDD is still required for both, but the extent of enhanced measures should be proportionate to the (typically lower) risk of a domestic PEP.

What is sanctions screening, and which UK regime governs it?

Sanctions screening is checking customers/parties against financial sanctions lists to ensure no dealings with designated persons. In the UK it is governed by the Sanctions and Anti-Money Laundering Act 2018 and enforced by OFSI (Office of Financial Sanctions Implementation); the consolidated list of designated persons must be checked.

What must an agent do if a customer matches a name on the UK financial sanctions list?

The agent must not provide funds or economic resources to, or deal with assets of, the designated person; must freeze any relevant assets; and must report the match to OFSI. Breaching financial sanctions is a strict-liability offence regardless of whether money laundering is suspected.

What is the role of the Nominated Officer (MLRO) in an estate agency business?

The Nominated Officer / Money Laundering Reporting Officer receives internal suspicion reports from staff, evaluates them, decides whether to submit a SAR to the NCA, makes DAML requests, oversees AML policies/training, and is the firm's central point for AML compliance. Larger firms may also appoint a board-level officer responsible for compliance.

What record-keeping retention period does the MLR 2017 require for CDD and transaction records?

Records of customer due diligence and supporting transaction evidence must be retained for 5 years from the end of the business relationship or the completion of the occasional transaction. After this period, personal data must generally be deleted unless another legal basis or consent applies.

What must a firm's written AML risk assessment and policies cover under MLR 2017?

A firm must maintain a documented risk assessment (considering customers, countries, products/services, transactions, delivery channels) and written policies, controls and procedures — including CDD, ongoing monitoring, reporting, record keeping, internal controls, risk management, and staff training/screening — kept up to date and approved by senior management.

What is mandatory redress scheme membership for estate agents, and which law requires it?

Under the Consumers, Estate Agents and Redress Act 2007 (and subsequent orders), estate agents dealing with residential property must belong to a government-approved redress scheme, giving consumers access to independent complaint resolution and possible compensation. Membership is a legal requirement to trade.

Name the government-approved redress schemes that residential estate/letting agents must join.

The Property Ombudsman (TPO) and the Property Redress Scheme (PRS). Agents must belong to one of these approved schemes; failure to register can result in a penalty (up to £5,000) issued by the local weights and measures authority / NTSELAT.

What is the National Trading Standards Estate and Letting Agency Team (NTSELAT), and what are its powers?

NTSELAT (based at Powys County Council / National Trading Standards) is the lead enforcement authority for estate agency legislation. It can issue prohibition and warning orders under the EAA 1979, oversee redress scheme and material information compliance, maintain a banned list, and issue guidance on disclosure obligations.

What guidance has NTSELAT issued regarding 'material information' in property listings (Parts A, B, C)?

NTSELAT guidance (in partnership with portals) requires material information in listings: Part A — price and council tax band/rates, and tenure; Part B — utilities and similar (e.g. electricity, water, heating, broadband, parking); Part C — anything that may affect a transactional decision (e.g. flood risk, restrictions, building safety). Omission can breach the CPRs.

What are Propertymark's Codes of Practice and Conduct?

Propertymark (incorporating NAEA) Codes of Practice set the professional standards binding on member agents — covering honesty, transparency, conflicts of interest, handling clients' money, client accounting, professional indemnity insurance, and compliance with the law. Breaches can lead to disciplinary action by Propertymark's Conduct and Membership Committee.

What does Propertymark require of members regarding clients' money protection (CMP)?

Propertymark member firms holding clients' money must belong to a Client Money Protection scheme, keep client money in a separate designated client account, reconcile accounts regularly, and hold professional indemnity insurance. CMP is also a statutory requirement for letting agents in England.

What is the purpose of an AML and data audit (compliance audit) in an estate agency?

An AML/data audit independently tests whether the firm's AML controls and data-protection practices work in practice — reviewing CDD files, SAR records, training logs, the risk assessment, retention/deletion, and consent records. MLR 2017 requires an independent audit function where appropriate to the size and nature of the business.

What are the six data protection principles under the UK GDPR?

Personal data must be: (1) processed lawfully, fairly and transparently; (2) collected for specified, explicit and legitimate purposes (purpose limitation); (3) adequate, relevant and limited to what is necessary (data minimisation); (4) accurate and kept up to date; (5) kept no longer than necessary (storage limitation); (6) processed securely (integrity and confidentiality). A 7th overarching principle is accountability.

What are the lawful bases for processing personal data under UK GDPR (Article 6)?

Consent; contract; legal obligation; vital interests; public task; and legitimate interests. An estate agency typically relies on contract (to perform the agency agreement), legal obligation (AML checks), and legitimate interests (some marketing), with consent for direct electronic marketing.

What is the relationship between the UK GDPR and the Data Protection Act 2018?

The UK GDPR is the retained EU regulation forming the core data protection framework; the Data Protection Act 2018 supplements and tailors it for the UK — setting out exemptions, special category processing conditions, law-enforcement and intelligence processing, and the powers of the Information Commissioner's Office (ICO).

What rights do individuals have under the UK GDPR?

The right to be informed; of access (SAR); to rectification; to erasure ('right to be forgotten'); to restrict processing; to data portability; to object; and rights related to automated decision-making and profiling. A data subject access request must normally be answered within one month, free of charge.

What is the purpose of the Privacy and Electronic Communications Regulations (PECR)?

PECR governs electronic marketing communications and privacy in electronic communications — covering marketing calls, emails, texts, faxes, the use of cookies and similar technologies, and security of communications services. It sits alongside the UK GDPR and applies specific rules to direct electronic marketing.

Under PECR, what is the rule for sending marketing emails/texts to individuals?

Marketing by electronic mail to individuals generally requires prior consent (opt-in). The exception is the 'soft opt-in': where contact details were obtained during a sale (or negotiations) of a similar product/service, the same business may market similar products, provided the person was given a simple opt-out at collection and in every message.

Under PECR, what consent rules apply to non-essential cookies?

Non-essential cookies (e.g. analytics, advertising) require the user's informed consent before being set, with clear information about their purpose. Strictly necessary cookies (essential to provide a service the user requested) are exempt from the consent requirement.

What is the time limit and threshold for reporting a personal data breach to the ICO?

A personal data breach that is likely to result in a risk to individuals' rights and freedoms must be reported to the ICO without undue delay and not later than 72 hours after becoming aware of it. If reported late, the controller must give reasons for the delay. Breaches posing no such risk need not be reported but must be documented.

When must a data controller notify affected individuals (data subjects) of a personal data breach?

When the breach is likely to result in a HIGH risk to the rights and freedoms of individuals, the controller must inform the affected data subjects without undue delay, in clear and plain language, describing the breach and offering mitigation advice.

What is the maximum administrative fine under the UK GDPR / Data Protection Act 2018?

The higher tier maximum is £17.5 million or 4% of total annual worldwide turnover, whichever is greater. The standard (lower) tier maximum is £8.7 million or 2% of worldwide annual turnover, whichever is greater. The ICO enforces these penalties.

What must an estate agency consider for data retention, security and consent in marketing — summarised together?

Retention: keep personal data only as long as needed (e.g. AML records 5 years; otherwise per a retention schedule), then securely delete. Security: apply appropriate technical and organisational measures (encryption, access controls, staff training). Marketing consent: obtain valid opt-in (or soft opt-in) under PECR, record it, and provide an easy opt-out in every communication.