Three dates in 2026 changed the Spanish rulebook. On 22 March, Royal Decree Law 7/2026 rewrote article 42 of Law 10/2010: EU financial sanctions, and UN Security Council freezes on terrorism and proliferation, bind every person from designation, and obliged entities must assess sanctions evasion risk. On 1 October, Royal Decree Law 25/2026 tied the crypto entry, article 2.1 z), to MiCA. On 28 October, Royal Decree 813/2026 amended the law's Regulation.
Which texts make up the AML laws in Spain?
Spain's anti money laundering act is Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing. Its latest update is 30 September 2026. Spain writes each EU AML directive into it, so its duties follow the EU model behind AML rules in other jurisdictions, while several euro lines sit below the EU's.
In Spain (España) the field is prevención del blanqueo de capitales y de la financiación del terrorismo (PBC/FT); in English, anti money laundering (AML) and counter terrorist financing. Five texts carry most of the Spain AML regulations.
- Law 10/2010 holds the preventive duties; Royal Decree Law 11/2018 wrote the fourth EU AML directive into it, and Royal Decree Law 7/2021 the fifth.
- Royal Decree 304/2014 is the Regulation of the law and holds most euro lines.
- Criminal Code articles 301 to 304 define the offense of laundering (blanqueo de capitales); article 301 was amended in 2003, 2010 and 2021.
- Law 7/2012, article 7, sets the cash payment limit.
- Royal Decree 609/2023 created the central register of beneficial owners, in force since 19 September 2023.
A missed report is an administrative breach of Law 10/2010. A person who launders, knowingly or through gross negligence, faces a criminal court under article 301.
Which bodies run AML in Spain? SEPBLAC, the Commission and the financial regulation
| Body (as of November 2026) | Role in AML | Legal basis |
|---|---|---|
| SEPBLAC (Servicio Ejecutivo de la Comisión) | Financial intelligence unit: receives suspicious transaction reports and the monthly systematic report. Supervises and inspects every obliged entity, sanctions compliance included; for financial entities it works within the agreements signed under art. 44 | Law 10/2010 arts. 18, 20, 42.4, 47 |
| Commission for the Prevention of Money Laundering and Monetary Offences (CPBCIM) | Directs AML policy, approves the annual inspection plan and issues requirements; its Standing Committee opens sanction proceedings and its Secretariat investigates them | arts. 44, 61.1, 61.2 |
| Council of Ministers | Fines very serious breaches, on the Minister's proposal | art. 61.3 |
| Minister of Economy, Trade and Business | Fines serious breaches, on the Commission's proposal; art. 61.3 still names the former Ministry of Economy and Finance | art. 61.3 |
| Directorate General of the Treasury and Financial Policy (Tesoro) | Fines minor breaches and cash declaration cases; decides whether a UN freeze continues past one month when the EU has not adopted the designation | arts. 61.3, 42.1 |
| Bank of Spain, CNMV, DGSFP | Prudential supervisors of banks, securities firms and insurers; under agreements with the Commission they may supervise the AML duties of financial entities and propose requirements | art. 44.2 m) |
SEPBLAC is both the FIU and, under article 47, the supervisor of every obliged entity. For financial entities it shares supervision with the Bank of Spain, the CNMV and the DGSFP under the article 44 agreements.
SEPBLAC does not fine. Its inspection report goes to the Commission's Secretariat, the Standing Committee decides whether to open proceedings, and the fine comes from the Council of Ministers, the Minister or the Director General, by the breach's seriousness.
Which firms are obliged entities under Law 10/2010?
Article 2.1 lists the obliged entities (sujetos obligados) in letters a) to z); article 2.4 treats a) to i) and z) as financial entities.
- Financial. Banks, life insurers, insurance brokers on life or investment products, investment firms, fund, venture capital and pension managers, mutual guarantee companies, payment and electronic money institutions, currency exchange, and crypto asset service providers (z), tied to MiCA's definition since 1 October 2026.
- Lending and postal transfers. Postal transfer services, loan brokers and certain non bank lenders.
- Professions. Auditors, external accountants, tax advisers, notaries, registrars, company and trust service providers, and lawyers and other independent professionals for named transactions.
- Property and goods. Developers and estate agents (rentals from €10,000 a month or €120,000 a year); dealers in jewelry, precious stones and metals, art and antiques; traders in goods (article 38).
- Gaming and cash. Casinos, gambling operators (lotteries, bingo and some other games only for prize payouts), cash in transit firms, and individuals moving cash under article 34.
- Others. Foundations and associations (article 39), and operators of payment and settlement systems and managers of cards issued by others (article 40).
Firms from abroad that enter the Spanish market are covered when they do the same business in Spain through a branch, an agent or free provision of services. An EU firm working through agents, or another permanent establishment that is not a branch, names a resident representative as its central contact point; a free provision firm names one too, residence not required (art. 26 ter(3)).
What do the KYC and AML requirements in Spain oblige a firm to do?
KYC requirements in Spain are the due diligence duties in articles 3 to 16 of Law 10/2010: identify, find the beneficial owner, learn the purpose, monitor, and go further where risk is higher. Three of them sit outside the usual onboarding checklist.
- The written special examination: article 17 wants the result of every special examination in writing, report or not, so a closed alert with no note is a gap.
- The representative and the internal control body: article 26 ter names who answers to SEPBLAC, a Spanish resident in a management post. Royal Decree 813/2026 ended the exemption of small i) to u) firms (under 10 staff with agents, turnover or balance sheet up to €2 million), which notify one by 28 July 2027.
- The annual external review: an outside expert examines the internal controls yearly (article 28; individual entrepreneurs and professionals excepted); for two years after a full report, a follow up report on the fixes may replace it.
The table gives the twelve duties as in force on 4 November 2026. Its fourth column says how complead, formerly Sanction Scanner, records each duty.
| Obligation | Legal basis, in force on 4 November 2026 | What a program must do | How complead does it |
|---|---|---|---|
| Policies, risk analysis and internal control | Law 10/2010 arts. 26, 26 ter, 28; RD 304/2014 arts. 31, 32 | Written policies and a prevention manual, a risk analysis built on the national and EU risk assessments and on the sanctions evasion information authorities provide, an internal control body, a representative to SEPBLAC and an annual external review. Insurance brokers and i) to u) firms under 10 staff and €2 million, outside larger groups, are exempt from RD 304/2014 arts. 31, 32, 33, 38 and 39 (internal control procedures, risk analysis, manual, external review, training); notaries and registrars are not. | Each rule and threshold change is versioned with who made it, when and why, and every rule can be scoped to a product, a segment or a jurisdiction. |
| Formal identification (customer due diligence) | Law 10/2010 art. 3; RD 304/2014 art. 4 | Identify and verify with reliable documents before any relationship and any occasional transaction of €1,000 or more; remittances, transfer management, notarial operations (listed notarial acts excepted) and crypto ATM operations at any amount; lottery and gambling prizes from €2,500. | Onboarding, screening and monitoring share a single engine, which gives every customer one risk score. |
| Beneficial owner (titular real) | Law 10/2010 art. 4; RD 609/2023 register | Identify each natural person who owns, directly or indirectly, more than 25 percent of the capital or voting rights, or who controls the entity in another way (listed companies under equivalent disclosure rules excepted); where nobody does, the administrators; for trusts, the settlor, trustee, protector, beneficiaries and any other natural person who ultimately controls the trust; no relationship if the ownership and control structure cannot be determined. | With no fixed depth cap, KYB and UBO verification traces ownership upward to the natural persons at the top, screens each ultimate beneficial owner and reports any layer it cannot resolve as unresolved. |
| Purpose and ongoing monitoring | Law 10/2010 arts. 5, 6 | Learn the purpose of the relationship; scrutinize transactions against the customer's profile, source of funds included; keep data current. | An API trigger switches monitoring on or off for each name, so a name that stops mattering drops out of screening. |
| Politically exposed persons | Law 10/2010 arts. 14, 15 | Domestic and foreign PEPs, including regional posts and local posts in provincial or regional capitals and local entities over 50,000 inhabitants, plus family and close associates; approval from at least the next management level, source of wealth and funds, enhanced monitoring; the measures run two years after office ends, then by risk. | PEP lists belong to the screening coverage, each with a fuzzy matching threshold of its own; what happens next is up to the reviewer. |
| Enhanced due diligence | Law 10/2010 art. 11; RD 304/2014 art. 19 | Enhanced due diligence for countries on the EU high risk list, private banking, remittances above €3,000 and currency exchange above €6,000 per calendar quarter, and other high risk cases. | A jurisdiction scoped rule lifts the customer's score, and its alert shows the rule behind the score and the signals that matched. |
| Special examination and reporting | Law 10/2010 arts. 17, 18, 19, 24 | Examine unusual operations in writing; file a suspicious activity report with SEPBLAC "sin dilación", attempts included; abstain from executing, or execute and report at once where abstaining is impossible or would hinder the investigation; no tipping off, except to authorities or for police purposes in a criminal investigation, within a group, among letter m) and ñ) professionals of one firm or network, and between financial entities, or between m) and ñ) professionals, of the same professional category with equivalent secrecy duties on the same customer and operation. | Agents put together the evidence, a narrative and a work log, and case management carries reporting support; the representative decides whether to file. |
| Systematic reporting (DMO) | Law 10/2010 art. 20; RD 304/2014 art. 27 | Report monthly: physical cash and bearer instruments over €30,000 not paid into or out of a customer's account, remitters' cash over €1,500, operations with listed territories over €30,000, declared cash movements, and aggregate remittance and foreign transfer data; a nil return every six months; insurance brokers, financial advisory firms and letters k) to y) exempt. | The €30,000 line can be written as a no code rule and tried against real history in a 30, 60 or 90 day window, with alert volume shown, before release. |
| Financial sanctions | Law 10/2010 art. 42; RD 304/2014 art. 31 | Apply EU freezes, and UN Security Council freezes on terrorism and proliferation, from the moment of designation; written policies, proportionate to the firm's activity and size, that assess sanctions evasion risk (art. 42.5); SEPBLAC may waive that risk assessment for a sector whose specific risks are identified and understood, never for financial entities (art. 42.6); SEPBLAC supervises (art. 42.4). | List data refreshes every 15 minutes, and every search is logged, searches with no match included. |
| Transfers of funds and crypto transfers | Regulation (EU) 2023/1113 | Payer and payee information travels with transfers of funds and crypto asset transfers, except in the cases article 2 lists (card payments for goods and services among them). | Each transfer's sender and receiver are screened through the API during processing. |
| Record keeping | Law 10/2010 art. 25 | Keep due diligence and transaction records for ten years; from five years after the relationship or the occasional transaction ends, only internal control and legal defense may access them. | Each search stays in the audit trail with the user who ran it, the time and the outcome. |
| Training | Law 10/2010 art. 29 | Accredited, ongoing courses under an annual plan, designed around the sector's risks and approved by the internal control body. | Training stays with the firm; because every alert shows its rule and the signals behind it, trainers can teach from real cases. |
Where do Spain's euro lines sit against the EU's?
Spain sets most lines below the EU's. Some survive the AML Regulation: its article 80(3) keeps national cash limits already below €10,000, so Spain's €1,000 stays after July 2027.
Picture an illustrative Barcelona jeweler paid €2,500 in cash by a resident customer. Under Law 7/2012, article 7, payer and receiver are jointly liable for a 25 percent fine; the party that reports the payment to the tax agency first, within three months, escapes it, and a report by both at once clears neither. Payments at credit institutions, and some exchange office and payment institution operations, fall outside the limit.
| Line | Spain, in force November 2026 | AMLR, from 10 July 2027 |
|---|---|---|
| Occasional transaction, identification | €1,000 (RD 304/2014 art. 4.1); lottery and gambling prizes €2,500 | €10,000, or a lower value set by EU technical standards for higher risk sectors (art. 19(1)(b), 19(9)); gambling €2,000 (art. 19(5)) |
| Remittance, transfer management, notarial, crypto ATM | Any amount (RD 304/2014 art. 4.1) | Transfers of funds from €1,000 for credit and financial institutions other than CASPs (art. 19(2)); CASPs from €1,000, with identification below that (art. 19(3)) |
| Cash payment involving a business | €1,000 or more may not be paid in cash; €10,000 for a payer with no tax domicile in Spain who is not acting as a business (Law 7/2012 art. 7) | €10,000 cap; lower national limits stay (art. 80) |
| Beneficial owner | More than 25 percent (Law 10/2010 art. 4.2 b)) | 25 percent or more (art. 52(1)) |
| Record keeping | Ten years (Law 10/2010 art. 25) | Five years; an authority may require up to five more, case by case (art. 77(3)) |
| Cash declaration | €10,000 entering or leaving Spain; €100,000 moved inside Spain (Law 10/2010 art. 34) | Not an AMLR line; EU border controls under Regulation (EU) 2018/1672 |
Sources: AML Regulation (EU) 2024/1624 and the BOE texts linked above.
How does Spain work with the FATF and the EU? International collaboration
Spain was the first country assessed under the 2012 FATF Recommendations, in a mutual evaluation published on 5 December 2014. A 2018 follow up rated it compliant or largely compliant on 38 of the 40 Recommendations. A follow up assessment published on 4 December 2019 found high or substantial effectiveness on 10 of the 11 immediate outcomes (FATF Spain page).
A new round starts in 2026. The preamble of Royal Decree 813/2026 says so and calls the reform especially relevant ahead of that FATF mutual evaluation.
MiCA and the transfer of funds regulation have applied directly since 30 December 2024, and Royal Decree 813/2026 partly transposes the sixth directive, Directive (EU) 2024/1640.
Under article 48 bis, SEPBLAC exchanges information with other FIUs, outside the EU under Egmont Group principles or a memorandum. At another EU unit's request, and on signs of laundering or terrorist financing, it may suspend a transaction in progress for up to one month, unless a court extends it at the prosecutor's request.
Which fines and prison terms apply to AML breaches in Spain?
| Breach or offense | Basis | Sanction (in force, November 2026) |
|---|---|---|
| Very serious breach (art. 51) | Law 10/2010 art. 56.1 | Fine from €150,000 up to the highest of 10% of annual turnover, twice the transaction's value, five times the profit where it can be determined, or €10 million; plus a public reprimand or, for a firm that needs an authorization, its suspension or withdrawal |
| Serious breach (art. 52) | art. 57.1 | Fine from €60,000 up to the highest of 10% of turnover, the transaction's value plus 50%, three times the profit where it can be determined, or €5 million; plus a public or private reprimand or, for an authorized firm, suspension |
| Directors, very serious breach | art. 56.3 | €60,000 to €10 million each; removal with disqualification up to ten years; public reprimand |
| Directors and external experts, serious breach | art. 57.2 | €3,000 to €5 million each; reprimand; removal with disqualification up to five years |
| Undeclared cash movement (art. 34) | art. 57.3 | €600 up to 50% of the means of payment, plus a reprimand |
| Laundering | Criminal Code art. 301 | 6 months to 6 years in prison and a fine of one to three times the value, in the upper half for drug trafficking and other listed crimes; gross negligence 6 months to 2 years and the same fine |
| Laundering in an organization, or by an obliged entity at work | art. 302 | Prison in the upper half of the range, one degree higher for the organization's leaders; fines for legal persons |
| Cash limit breach | Law 7/2012 art. 7 | 25% of the amount paid; payer and receiver jointly liable |
Take an illustrative payment institution with €40 million in annual turnover and a very serious breach. Ten percent of turnover is €4 million, below €10 million, so the ceiling is €10 million, unless twice the transaction's value or five times a provable profit is higher. The floor is €150,000. A reprimand or a license measure comes with the fine. A group that must consolidate has its turnover read from the parent's latest consolidated accounts (art. 56.2).
A public reprimand is published in the BOE and stays on the Commission's website for five years (art. 61.5); publication may be delayed while it would harm an investigation or market stability, and withheld for good only when market stability cannot be ensured (arts. 56.5, 57.5). Other final very serious and serious sanctions, cash declaration cases excepted, appear there for five years without names (art. 61.6).
What the 2025 sanctions record shows
The Commission's 2025 report on sanctions, as summarized by the law firm Écija on 8 June 2026, counts 51 sanctions final in administrative proceedings, all for serious breaches. The lowest fine was €60,000. It was also the most used.
Firms failed most on policies and procedures, then on the special examination and enhanced due diligence. The report itself ties the sector counts to how closely supervisors examine each sector for its risk, not to weaker performance.
| Measure (2025, as reported by Écija on 8 June 2026) | Figure |
|---|---|
| Final sanctions | 51, all for serious breaches |
| Lowest and most used fine | €60,000 |
| Highest fine | €12,274,340 |
| Breaches sanctioned, by sector | Currency exchange 12, credit institutions 10, insurers 9, payment institutions 7, online gaming 7, casinos 6 |
| Breaches sanctioned, by type | Policies and procedures 10, special examination 7, enhanced due diligence 7, ongoing monitoring 6, formal identification 6, purpose of the relationship 4 |
Where do screening and monitoring meet Spanish duties? AML solutions for Spain
Under article 47.4 a firm hands SEPBLAC's inspectors any record they ask for, software and internal communications included.
Article 42 makes an EU freeze, or a UN terrorism or proliferation freeze, binding from designation, so a feed that lags a day is a risk. Client screening and ongoing monitoring matches names in 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes, with fuzzy matching thresholds tuned per list type and per individual list. Sanction Scanner, the screening product, is part of complead. Every search is logged. The log keeps the user, the time and the result, including searches with no match.
To test a feed, take a name the EU listed this week and compare your tool's answer with the free check against the EU and UN lists. A different answer suggests one feed lags.
Transaction monitoring builds the €30,000 DMO line or the €1,500 remitter line as a rule without code. Agents close the routine cases. They attach the evidence, the narrative and the work log. The analyst or the representative to SEPBLAC makes the call, and the record shows who made it.
What did 2025 and 2026 change in Spain, and what is due in 2027?
What changed:
- 2025: 51 final sanctions, all for serious breaches (as reported by Écija on 8 June 2026).
- 22 March 2026: Royal Decree Law 7/2026 rewrote article 42: freezes apply from designation, and article 42.5 adds sanctions evasion policies. Congress validated it (Resolution of 26 March 2026).
- 1 July 2026: Spain's 18 month MiCA transition for crypto firms already serving clients ended, or sooner on authorization or refusal (ESMA's list of MiCA transitional periods).
- 1 October 2026: Royal Decree Law 25/2026 took effect, tying article 2.1 z) and the crypto definitions of article 1 to MiCA; Congress validated it (Resolution of 16 October 2026).
- 28 October 2026: Royal Decree 813/2026 took effect: crypto ATM operations identified at any amount, written sanctions policies (RD 304/2014 art. 31), sanctions evasion information in the risk analysis (art. 32).
What comes next:
- 2026: The FATF mutual evaluation of Spain begins.
- 10 July 2027: The AML Regulation applies (from 10 July 2029 for football agents and professional football clubs), and most of Directive (EU) 2024/1640 is due.
- 28 July 2027: Small firms in letters i) to u) notify their representative.
- 2028: AMLA begins direct supervision of selected firms.
Three tasks for the representative to SEPBLAC this week:
- List every flow you identify at any amount: remittances, transfer management, notarial operations and crypto ATMs.
- Add the authorities' sanctions evasion information to the written risk analysis, as article 42.5 and RD 304/2014 article 32 now ask.
- For a small i) to u) firm, send SEPBLAC the representative notice before 28 July 2027.
What the Spain PDF adds (2026 edition)
The page above holds every article and euro line, each read in the BOE consolidated text or the EU Official Journal as in force on 4 November 2026. The 16 page PDF, sent through the form beside this guide, adds the pieces a compliance file keeps: fourteen checks with the article behind each one, a suspicious transaction decision record and an illustrative customer risk factor template for Spain.
