A single painting sold at auction can trigger a bigger money-laundering red flag than an entire day of bank transfers, according to a new analysis from compliance advisory company PROTEGRA. The determining factor is not the size of the transaction but how difficult it is to trace and how easily it can be justified after the fact. The art market's structural features make it especially vulnerable: buyers and sellers can operate anonymously, transactions can be routed through shell companies, works can sit for years in freeports — customs-free storage zones where ownership changes hands without public record — and subjective valuations make almost any sale price defensible.

The finding challenges conventional assumptions about financial crime risk. Banks and payment applications draw the lion's share of regulatory scrutiny because they appear inherently financial. EU regulations, however, assess risk based on transaction size, frequency, and the opacity of the money trail — criteria under which a handful of six-figure paintings sold once a year can carry greater actual laundering risk than thousands of small digital transfers.

This gap in risk perception is surfacing at a critical moment. The EU's new Anti-Money Laundering Regulation becomes fully applicable across all member states in July 2027, replacing a patchwork of national rules with a single shared standard. The regulation builds on earlier EU directives that had already extended anti-money-laundering obligations to art traders and other dealers in high-value goods, but enforcement has remained uneven across countries. PROTEGRA's analysis found that a wide range of businesses — including casinos, auction houses, art dealers, jewelers, real estate brokers, and crypto exchanges — are already required to have a functioning compliance officer in place, yet most do not.

"People assume this is a banking problem," the report states. "It's not. If you're moving large sums infrequently, in a way that's hard to trace, you're exactly the kind of business a money launderer is looking for. Regulators know that. A lot of the businesses in that position don't."

PROTEGRA's analysis also found that many companies that do appoint a compliance officer treat the role as a one-time formality — typically to pass a licensing review or initial registration — rather than an ongoing operational responsibility. The report outlines the consequences when that gap is tested in practice: bank accounts freeze without warning, licensing applications stall, and investors quietly reduce their offers once they sense a company's compliance story does not hold up under direct scrutiny.

"A business with a real program answers a hard question in minutes," the report notes. "A business running on paperwork alone hesitates, or improvises, or tells a story that doesn't quite add up. That hesitation tells the other side everything they need to know."