Spain
Overview
Law 10/2010 is Spain’s core preventive AML/CFT statute and Royal Decree 304/2014 is its principal implementing regulation. Law 12/2003 and Royal Decree 413/2015 provide the targeted terrorist-financing blocking architecture. Royal Decree 813/2026 amends the Law 10/2010 implementing regulation, partially transposes AMLD6 and enters into force on 28 October 2026, subject to specific transition periods.
Spain strengthened beneficial-ownership transparency through the Central Register of Beneficial Ownership created by Royal Decree 609/2023, alongside CDD beneficial-owner duties under Law 10/2010.
Obliged entities must examine and report suspicious activity to SEPBLAC under Law 10/2010 and its implementing regulation, with internal-control and special-examination requirements.
Compliance Calendar6
Requirement
Comunicación sistemática (DMO)
Authority / Report toSepblac
Deadline / triggerMonthly · between days 1 and 15 of each month for reportable operations from the previous month. If no reportable operations occurred during a natural semester, negative declaration between days 1 and 15 of the following month.
Requirement
- Subject scope
- Obliged subjects and operation categories within Article 27 of Real Decreto 304/2014, subject to the explicit exemptions in Article 27.3.
- Trigger
- Completion of a month containing operations subject to systematic communication; a negative semiannual declaration applies where no reportable operations occurred during the natural semester.
- Filing channel
- Telematic submission through the DMO application. Out-of-time reporting requires the additional justification procedure described by Sepblac.
Impact
- Consequences of non-compliance
- Late or missing systematic reporting can lead to administrative enforcement under Law 10/2010; exact classification/quantum depends on the breach.
- Enforcement authority
- Sepblac / CPBCIM and competent supervisory authorities.
- Operational impact
- Calendar owners can compute a recurring 1–15 filing window each month for entities within the systematic-reporting perimeter.
Requirement
Royal Decree 813/2026 — electronic-identification amendments become applicable
Authority / Report toInternal implementation / competent AML supervisor as applicable
Deadline / trigger8 April 2028 · eighteen months from publication, when the specified electronic-identification amendments become applicable.
Requirement
- Subject scope
- Obliged subjects using the electronic-identification and document-retention mechanisms affected by amended Articles 6.1(a) and 28 of the Regulation of Law 10/2010.
- Trigger
- Publication of Royal Decree 813/2026 in the BOE on 8 October 2026.
- Legal basis
Impact
- Consequences of non-compliance
- From the applicability date, affected identity-verification and record-retention processes must operate under the amended regulatory provisions.
- Enforcement authority
- SEPBLAC / competent sector supervisor / CPBCIM.
- Operational impact
- Plan technology, onboarding and record-retention changes sufficiently ahead of 8 April 2028.
Requirement
Gaming
Royal Decree 813/2026 — gaming identity and technical-system transition
Authority / Report toInternal implementation; where the six-month player verification condition is not met, the operator must terminate the contract and communicate that fact to the Directorate-General for the Regulation of Gambling
Deadline / trigger28 April 2027 · six months from entry into force. Existing players must make the changes needed for the account-holder/payment-method identity check, and gaming operators have the same six-month period to adapt technical systems.
Requirement
- Sector scope
- Gaming
- Subject scope
- Gaming operators and players registered before the new payment-account identity-match obligation enters into force, within the scope of the amended Regulation of Law 10/2010.
- Trigger
- Entry into force of Royal Decree 813/2026 on 28 October 2026.
- Filing channel
- Implement system and customer-remediation controls; communication to the Directorate-General for the Regulation of Gambling applies in the non-compliant post-transition scenario specified by the decree.
- Legal basis
Impact
- Consequences of non-compliance
- After the transition period, an operator must terminate the relevant contract if the required identity-match verification has not been achieved; other AML/CFT obligations remain applicable.
- Enforcement authority
- SEPBLAC / competent gambling authority within their respective remits.
- Operational impact
- Gaming operators should complete payment-account identity controls and technical-system changes before 28 April 2027 and establish the required post-deadline contract/notification workflow.
Requirement
Royal Decree 813/2026 — qualifying small obliged subjects must notify SEPBLAC representative
Authority / Report toServicio Ejecutivo de la Comisión (SEPBLAC)
Deadline / trigger28 July 2027 · nine months from entry into force to communicate the appointment of the representative to SEPBLAC under Article 35 of the Regulation.
Requirement
- Subject scope
- Obliged subjects in Article 2.1(i)–(u) of Law 10/2010 that, including agents, employ fewer than 10 persons and have annual turnover or annual balance sheet not exceeding EUR 2 million.
- Trigger
- Entry into force of Royal Decree 813/2026 on 28 October 2026.
- Filing channel
- Communicate the appointment of the representative to SEPBLAC in accordance with Article 35 of the Regulation of Law 10/2010 and current SEPBLAC procedure.
- Legal basis
Impact
- Consequences of non-compliance
- The decree creates a time-limited transition to bring qualifying entities into the representative-notification requirement; enforcement follows the applicable Law 10/2010 supervisory and sanctions framework.
- Enforcement authority
- SEPBLAC / CPBCIM and competent supervisory authorities.
- Operational impact
- Qualifying small obliged subjects should determine representative status early and complete the SEPBLAC notification before 28 July 2027.
Requirement
Comunicación por indicio (suspicious transaction / fact)
Authority / Report toSepblac
Deadline / triggerWithout delay (sin dilación).
Requirement
- Subject scope
- Obliged subjects under Law 10/2010 when the structured special examination under Article 17 results in indication or certainty of ML/TF connection.
- Trigger
- After the structured special examination identifies indication or certainty that a fact, transaction or attempted transaction is related to money laundering or terrorist financing.
- Filing channel
- Route depends on reporter type: credit institutions and specified centralised bodies use CTL 2.3; other obliged subjects use the current Sepblac/Banco de España electronic-register process with the prescribed F19 structure, subject to current instructions.
Impact
- Consequences of non-compliance
- Failure to report can constitute an administrative infringement under Law 10/2010; classification and monetary range depend on the specific infringement provision and facts.
- Enforcement authority
- Sepblac / CPBCIM and competent supervisory authorities.
- Operational impact
- Special-examination procedures should have explicit escalation ownership and service levels to avoid reporting delay once suspicion is established.
Requirement
Internal AML controls, risk procedures and annual training plan
Authority / Report toRelevant supervisory authority / Sepblac within its supervisory remit
Deadline / triggerOngoing internal-control framework. The implementing Regulation requires an annual AML/CFT training plan; no universal external filing date is asserted for the plan itself.
Requirement
- Subject scope
- Obliged subjects under Law 10/2010, subject to statutory size/scope exceptions for particular internal-control measures.
- Trigger
- Continuous operation and changing ML/TF risk exposure.
- Legal basis
- Real Decreto 304/2014Implementing regulationSepblac · national legislationOfficial legislation indexLey 10/2010Primary statute
Annual plan requirement is verified, but it is an internal governance obligation rather than a universal annual filing.
Impact
- Consequences of non-compliance
- Control failures may lead to remediation orders and administrative sanction proceedings under Law 10/2010.
- Enforcement authority
- Sepblac / competent sector supervisor / CPBCIM.
- Operational impact
- Maintain a risk-based control framework and a documented annual training plan tied to identified risks.
Authorities & FIU6
FATF Assessment
Measures how fully the jurisdiction has implemented FATF’s technical requirements. It does not measure practical effectiveness.
Measures whether the AML/CFT system achieves its intended results in practice. Follow-up reports do not normally replace these ratings.
Explore 40 FATF RecommendationsSee every Technical Compliance rating and what it means.+
Explore 11 Immediate OutcomesSee how FATF rates whether the AML/CFT system works in practice.+
Regulatory Timeline41
Spain published Royal Decree 813/2026 on 8 October 2026. Article 5 amends the Regulation implementing Law 10/2010, including formal-identification rules for business relationships and occasional transactions, mandatory identification in specified notarial, remittance/transfer and crypto-ATM operations, digital-identification/document-retention changes and gaming controls. Transitional provisions give six months for specified gaming identity/system adaptations, nine months for qualifying small obliged subjects to notify SEPBLAC of their representative, and eighteen months from publication before specified electronic-identification amendments become applicable. The decree partially transposes Directive (EU) 2024/1640.
Royal Decree-Law 25/2026 amends Law 10/2010 to align the AML/CFT perimeter with the EU crypto-asset framework. It expressly treats crypto-asset service providers as obliged entities, extends correspondent-relationship controls to crypto-asset services and transfers, and links serious infringements to obligations under Regulation (EU) 2023/1113.
FATF revised Recommendation 16 to standardise payment information and strengthen fraud/error controls in cross-border payments.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗FATF amended Recommendation 1 and related interpretive material to strengthen proportionality and simplified measures under the risk-based approach.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗FATF revised Recommendations 4, 30, 31 and 38 and related interpretive material to make asset recovery a stronger operational priority, expand tools to trace and confiscate criminal property and improve domestic and international cooperation.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗Spain establishes a central nationwide beneficial-ownership register and related access/filing architecture.
At its February 2023 Plenary FATF revised Recommendation 25 and its Interpretive Note to strengthen transparency and beneficial-ownership requirements for trusts and similar legal arrangements, complementing the 2022 strengthening of Recommendation 24 for legal persons.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗FATF strengthened Recommendation 24 on beneficial ownership transparency for legal persons.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗The reform implements elements of the Fifth AML Directive and brings relevant virtual-currency exchange and custodian-wallet activity into Spain’s AML framework.
FATF amended Recommendations 1 and 2 and their Interpretive Notes so countries and covered private-sector entities must identify, assess and mitigate risks of breaches, non-implementation or evasion of proliferation-related targeted financial sanctions.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗The Basel Committee revised its ML/TF risk-management guidelines to add principles for information exchange and cooperation between prudential and AML/CFT supervisors in authorisation, ongoing supervision and enforcement.
A Basel supervisory publication does not become domestic law merely because it is GLOBAL. National adoption, supervisory use or incorporation must be evidenced by a LOCAL milestone or source.
Basel Committee on Banking Supervision ↗FATF adopted detailed implementation requirements for virtual assets and VASPs in June 2019, including the application of wire-transfer information requirements commonly described as the Travel Rule. This operationalised the virtual-asset perimeter introduced through the 2018 Recommendation 15 revision.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗In October 2018 FATF revised Recommendation 15 and added the definitions of virtual asset and virtual asset service provider, formally bringing virtual-asset activity into the global AML/CFT standards architecture. Detailed implementation requirements followed in 2019.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗The regulation implements the institutional and procedural elements of Law 12/2003.
The implementing regulation details CDD, internal controls, SEPBLAC supervision and other operational obligations.
The Basel Committee issued Sound management of risks related to money laundering and financing of terrorism, superseding its 2001 CDD and 2004 consolidated KYC papers and integrating ML/TF risk management with prudential supervisory expectations.
A Basel supervisory publication does not become domestic law merely because it is GLOBAL. National adoption, supervisory use or incorporation must be evidenced by a LOCAL milestone or source.
Basel Committee on Banking Supervision ↗FATF adopted a consolidated revised set of 40 Recommendations integrating AML, CFT and proliferation-financing safeguards.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗Law 10/2010 became the core preventive AML/CFT statute and defines the obliged-entity, CDD, reporting and control framework.
Resolution 1737 imposed binding measures concerning Iran’s proliferation-sensitive nuclear activities, including an asset freeze on designated individuals and entities. Together with the DPRK regime, it forms a foundational UN counter-proliferation targeted-financial-sanctions architecture.
UN Members agree to accept and carry out Security Council decisions. This current Charter relationship is not proof of the jurisdiction’s domestic implementation, nor a claim about its membership status on the historical event date.
UN Charter · Article 25 ↗Following the DPRK nuclear test, Resolution 1718 imposed binding sanctions including an asset freeze on designated persons and entities connected to the nuclear programme. It became a central UN targeted-financial-sanctions pillar for counter-proliferation financing.
UN Members agree to accept and carry out Security Council decisions. This current Charter relationship is not proof of the jurisdiction’s domestic implementation, nor a claim about its membership status on the historical event date.
UN Charter · Article 25 ↗FATF added a ninth Special Recommendation addressing cash couriers and cross-border movement of currency.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗Resolution 1540 requires all States to adopt and enforce laws and domestic controls to prevent non-State actors from acquiring or using weapons of mass destruction and related materials. It forms a binding global legal pillar of the proliferation-financing control environment later reflected in FATF CPF standards.
UN Members agree to accept and carry out Security Council decisions. This current Charter relationship is not proof of the jurisdiction’s domestic implementation, nor a claim about its membership status on the historical event date.
UN Charter · Article 25 ↗The UN General Assembly adopted the United Nations Convention against Corruption on 31 October 2003. UNCAC addresses prevention of money laundering, laundering of corruption proceeds, confiscation and a dedicated asset-recovery framework; the Convention entered into force globally on 14 December 2005.
Current UN depositary relationship to 2003 UN Convention against Corruption. This is not a claim that the jurisdiction was already a Party on the GLOBAL event date; the national accession/ratification date is a separate LOCAL/STATUS fact.
UN Treaty Collection ↗FATF comprehensively revised its AML/CFT Recommendations, strengthening preventive measures and extending coverage.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗The law created a statutory architecture for blocking transactions and funds linked to terrorist financing.
The Basel Committee issued Customer due diligence for banks, setting minimum supervisory expectations for customer acceptance, identification, ongoing monitoring and risk management. It became an influential global banking KYC/CDD benchmark and was later reflected in FATF standards.
A Basel supervisory publication does not become domestic law merely because it is GLOBAL. National adoption, supervisory use or incorporation must be evidenced by a LOCAL milestone or source.
Basel Committee on Banking Supervision ↗FATF expanded its standards to terrorist financing through eight Special Recommendations.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗Resolution 1373 requires all States to prevent and suppress terrorist financing, criminalise the provision or collection of funds for terrorist acts, freeze terrorist assets without delay and prohibit making funds or financial services available to terrorists and related entities.
UN Members agree to accept and carry out Security Council decisions. This current Charter relationship is not proof of the jurisdiction’s domestic implementation, nor a claim about its membership status on the historical event date.
UN Charter · Article 25 ↗The Palermo Convention was adopted on 15 November 2000 and broadened the international money-laundering framework beyond drug proceeds through criminalisation and preventive measures tied to transnational organised crime. It entered into force globally on 29 September 2003.
Current UN depositary relationship to 2000 Palermo Convention. This is not a claim that the jurisdiction was already a Party on the GLOBAL event date; the national accession/ratification date is a separate LOCAL/STATUS fact.
UN Treaty Collection ↗The UN General Assembly adopted the International Convention for the Suppression of the Financing of Terrorism on 9 December 1999, creating the treaty framework for criminalising terrorist financing and international cooperation. It entered into force globally on 10 April 2002.
Current UN depositary relationship to 1999 Terrorist Financing Convention. This is not a claim that the jurisdiction was already a Party on the GLOBAL event date; the national accession/ratification date is a separate LOCAL/STATUS fact.
UN Treaty Collection ↗Resolution 1267 imposed an assets freeze and other targeted sanctions in the Taliban context and created the Security Council committee that became the foundation of the UN 1267 sanctions architecture. It is a key global precursor to modern terrorist-financing targeted financial sanctions.
UN Members agree to accept and carry out Security Council decisions. This current Charter relationship is not proof of the jurisdiction’s domestic implementation, nor a claim about its membership status on the historical event date.
UN Charter · Article 25 ↗FATF revised the Forty Recommendations to reflect evolving money-laundering methods and countermeasures.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗Royal Decree 925/1995 developed Law 19/1993, constituted the Commission’s support structure and detailed reporting obligations and procedures. Published on 6 July 1995, it entered into force the following day and anchored the Servicio Ejecutivo operationally within the framework.
Representatives of 13 financial intelligence units met in Brussels on 9 June 1995 and founded what became the Egmont Group. The milestone created the operational global network for FIU-to-FIU cooperation and exchange of financial intelligence.
Current profile relationship to the Egmont network. This does not imply membership in 1995; admission history is a separate LOCAL/STATUS fact.
Egmont Group · Member FIUs ↗Historical FinCEN/GAO membership evidence identifies Spain among the 14 first Egmont Group members; Egmont's official history dates the founding meeting to 9 June 1995.
Law 19/1993 established Spain’s preventive AML framework and created the Commission for the Prevention of Money Laundering and Monetary Offences together with its Servicio Ejecutivo. The law therefore marks both a preventive-law milestone and the statutory origin of the national financial-intelligence architecture.
FATF issued its original Forty Recommendations, establishing the first global AML standard framework.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗FATF records Spain as a member since 1990.
The G7 established FATF in 1989 to examine and develop measures to combat money laundering. FATF became the central global standard-setting body whose recommendations are implemented through national and regional AML/CFT frameworks.
Current relationship. Direct FATF membership and any listed regional assessment network participation are current profile relationships only. The GLOBAL milestone does not prove membership or domestic implementation on the event date; those remain LOCAL/STATUS evidence.
FATF Global Network ↗The Vienna Convention was adopted on 20 December 1988 and created the first treaty-level international obligation to criminalise laundering conduct linked to drug-trafficking proceeds, alongside confiscation and international-cooperation measures. It entered into force globally on 11 November 1990.
Current UN depositary relationship to 1988 Vienna Convention. This is not a claim that the jurisdiction was already a Party on the GLOBAL event date; the national accession/ratification date is a separate LOCAL/STATUS fact.
UN Treaty Collection ↗The Basel Committee published a Statement of Principles for banks aimed at reducing the risk that banking institutions would be used by criminals or as channels for money laundering. This helped establish the preventive and supervisory side of AML alongside the emerging criminal-law framework.
A Basel supervisory publication does not become domestic law merely because it is GLOBAL. National adoption, supervisory use or incorporation must be evidenced by a LOCAL milestone or source.
Basel Committee on Banking Supervision ↗