KYC and AML checks for landlords
Igloo sends your tenants and other customers a short questionnaire, screens them against PEP and sanctions lists when the template includes screening, and drafts a risk assessment. You review each case and decide, and every step is logged.
- PEP and sanctions screening
- Risk assessment
- Activity log and CSV export
- ISO 27001 Certified
In short
KYC (know your customer) is the customer due diligence that obliged entities must carry out under Iceland's Act No. 140/2018 on measures against money laundering and terrorist financing. The act lists real estate companies among them, whether their business is letting property directly or selling it, and letting agents when the monthly rent is EUR 10,000 or more.
Due diligence means identifying the customer and any beneficial owners, checking for politically exposed persons and sanctions, assessing the risk and keeping the records for at least five years.
Igloo (myigloo.is), an Icelandic rental platform, runs these checks on tenants and other customers for landlords. The landlord makes the decisions and remains responsible under the act.
Who has to do KYC, and why?
Who the act covers
Article 2 of Act No. 140/2018 lists the obliged entities. Two items concern letting:
- Real estate companies (fasteignafélög), whether their business is letting property directly or selling it (item n). No rent threshold applies.
- Letting agents (leigumiðlarar), when the monthly rent amounts to EUR 10,000 or more (item o).
Individuals letting their own property are not listed. The act does not define a real estate company, so if you are unsure whether your business is covered, ask Skatturinn.
(opens in a new tab)Why the obligation exists
The act implements the EU anti-money laundering directives in Iceland. Real estate can be used to launder money, so the law expects businesses that let or sell property to know who they deal with and where the money comes from.
What non-compliance can cost
Skatturinn can demand corrections and fine the business: daily fines of ISK 10,000 to 1 million and administrative fines of ISK 500,000 to 500 million. Its decisions are published on its website.
What you need to be able to show
Skatturinn supervises real estate companies and letting agents under the act. Below are the duties it can check, and where Igloo takes on the work.
| Duty | Where it is set | Igloo's part |
|---|---|---|
| A written risk assessment of your business | Act 140/2018, Art. 5 (opens in a new tab) | Not part of Igloo. Your business writes it. |
| Documented policies, controls and procedures | Act 140/2018, Art. 5a (opens in a new tab) | Not part of Igloo. Your business sets them. |
| Customer due diligence when a business relationship, such as a lease, begins | Act 140/2018, Arts. 8 and 10 (opens in a new tab) | Igloo runs the check, tied to the customer's kennitala: questionnaire, screening, risk assessment and decision. |
| Checking whether customers and beneficial owners are politically exposed | Act 140/2018, Art. 17 (opens in a new tab) | PEP screening on every check whose template includes it, as Igloo's standard templates do, and a self-declaration in the standard questionnaires. |
| Sanctions screening when the relationship starts and regularly while it lasts | Act 68/2023, Art. 13 (opens in a new tab) | Screening runs on every check whose template includes it, as Igloo's standard templates do. A verified customer is screened again when the verification is renewed; a new check can start 30 days before it expires. |
| Ongoing monitoring of the relationship and regular updates of customer information | Act 140/2018, Art. 10(4) (opens in a new tab) | In part. A verification expires after a year, so it has to be renewed. Igloo does not monitor transactions. |
| Keeping records for at least five years after the relationship ends | Act 140/2018, Art. 28 (opens in a new tab) | Each case keeps the answers, results and decision, with an activity log you can export as CSV. |
| Reporting suspicious transactions to the Financial Intelligence Unit | Act 140/2018, Art. 21 (opens in a new tab) | Not part of Igloo. Your business reports. |
| Staff training, and a responsible person appointed from management | Act 140/2018, Arts. 33 and 34 (opens in a new tab) | Not part of Igloo. Your business arranges them. |
How KYC works in Igloo
Five steps from the first invitation to a record you can show a supervisor.
- 01
You start a check
Choose a template and start a check for one customer, or select several in your customer list and start them in one go.
- 02
The customer answers online
The customer gets a link by email, signs in to Igloo and answers a short questionnaire. It opens only for the customer's own kennitala or, for a company, its verified representatives.
- 03
Screening runs automatically
When the customer submits, Igloo screens them against PEP and sanctions lists if the template includes screening, as Igloo's standard templates do.
- 04
You review the risk and decide
Igloo drafts a risk assessment from the answers and screening results. You score each factor, then verify or reject the customer.
- 05
Everything is on record
Every step goes into the case's activity log, which you can export as CSV. A verification is valid for one year, and the case shows when it expires.
Templates, screening and a record of every step
Your templates decide what each check asks and what it screens for. Every check then sits in one list, with its own case and activity log.
Ready-made templates
Start with Igloo's standard templates for renters, for service customers and for screening only, or copy one and adapt it.
Your own questions
Add single-choice, multiple-choice, text or number questions, follow-up questions, a risk weight on each answer and a flag on answers that need review.
PEP and sanctions screening
Igloo screens each customer when they submit, unless the template turns screening off. You link a true match to the customer or rule out a false one, with a reason.
Risk assessment
Igloo suggests a score for each risk factor. You can change it, but lowering a suggested score needs a note. The total sets the risk level: low, medium, high or very high.
Work queue
Every check in one list, with its stage (awaiting customer, awaiting screening, pending review, verified, rejected or expired) and its risk level.
Activity log and CSV export
Every invitation, answer, screening, score change and decision is logged with who did it and when. Export the log as CSV when a supervisor asks for it.
By hand or with Igloo
| Task | By hand | With Igloo |
|---|---|---|
| Knowing who answered | Copies of ID documents sent by email | The questionnaire opens only for the customer's kennitala |
| PEP and sanctions screening | Manual searches of each list | Built into the template; matches are handled in the case |
| Risk assessment | A spreadsheet | A suggested score per factor that you review and submit |
| Audit trail | Scattered across email and folders | One activity log per case, exportable as CSV |
| Expiry and renewal | Calendar reminders | An expiry date on every case; a new check can start 30 days before it |
Security and data protection
ISO 27001 Certified
Leiguskjól ehf., the company behind Igloo, is certified to ISO/IEC 27001:2022 for its information security management system.
Certificate: IS-IA-2025-06-23-01
Valid until: June 2028
Personal data
Igloo processes personal data in line with GDPR and Icelandic data protection law. Each organization sees only its own customers' checks.
Privacy policyFrequently asked questions
Do landlords have to do KYC on tenants in Iceland?
Not all of them. Act No. 140/2018 lists real estate companies (fasteignafélög) as obliged entities whether they let property directly or sell it, and letting agents when the monthly rent is EUR 10,000 or more. Individuals letting their own property are not listed. Obliged entities must carry out customer due diligence when a business relationship, such as a lease, begins.
What is a PEP?
A politically exposed person (PEP) is someone in Iceland or abroad who holds or has held a prominent public function, such as a minister, member of parliament, supreme court judge, ambassador or board member of a state-owned company. Their spouse, children and parents, and their close associates, count too. Act No. 140/2018 requires enhanced due diligence for PEPs, including on the source of their funds and wealth. Igloo's standard templates screen every customer against PEP lists and ask customers to declare it.
What does the tenant have to do, and how long does it take?
The tenant opens the link in the invitation email, signs in to Igloo and answers the questionnaire on the web. Igloo's standard template for renters asks two questions: where the money for rent and deposit comes from, and whether the tenant or someone close to them holds a prominent public position. It takes a few minutes, and the questionnaire opens only for the account that carries the tenant's kennitala.
What happens if a tenant is on a sanctions list?
Igloo flags the possible match in the case, and the customer cannot be verified until it has been reviewed. If the match is real, Act No. 68/2023 on international sanctions and the freezing of funds sets out what you must do, which can include freezing funds and notifying the authorities without delay. Igloo does not freeze funds or send notifications for you.
How long are records kept?
Act No. 140/2018 requires due diligence records to be kept for at least five years after the business relationship ends, and Act No. 68/2023 sets the same period for sanctions screening records. In Igloo, each case keeps the answers, screening results, risk assessment and decision with an activity log, which you can export as CSV for your own records.
Does Igloo report suspicious activity for me?
No. Your business is the obliged entity, and the act requires its responsible person to report suspicious transactions to the Financial Intelligence Unit (skrifstofa fjármálagreininga lögreglu) in good time. Igloo does not file reports, but the case and its activity log hold the facts a report draws on.
Can I use it if I do not collect rent through Igloo?
Yes. KYC in Igloo does not depend on rent collection. Customers come from your rental contracts in Igloo, or you add them by hand, and you start their checks from the customer list.
Does Igloo decide whether a customer is accepted?
No. Igloo prepares the case: the answers, the screening results and a suggested score for each risk factor. You score the factors and verify or reject the customer, and the activity log records who decided and when.
How long is a verification valid?
A verification is valid for one year from the day the check started. Its expiry date shows on the case and in the case list, and you can start a new check on the customer once the old one is within 30 days of expiry.
How do I get KYC in Igloo?
KYC is switched on for each organization on request. Talk to us and we will set it up for your team.