The language or environment (or rather the regex flavor) you're using would be helpful (always, in any regex question), but in most cases this should do:
^([A-Z0-9]{2,})[A-Z0-9]{3}$
So we match and capture 2 or more characters in group 1
, and then require exactly 3 more until the end of the string. How you access the captures depends on your environment.
If your regex flavor supports lookaheads you get away without using captures as well:
^[A-Z0-9]{2,}(?=[A-Z0-9]{3}$)
This ensures that the end of the match is followed by three characters and the end of the string, but does not include this part in the match.