AML
The full framework
"AML (anti-money laundering) covers policies, risk analysis, due diligence, monitoring, suspicious transaction reporting, training and the control body."
AML and KYC: differences and obligations
AML (anti-money laundering) is the full compliance framework; KYC (know your customer) is one of its components: the identification and due diligence of the customer and the beneficial owner. We help you implement both in line with Law 10/2010, SEPBLAC requirements and the new EU AML package.
Free consultation
We reply within 24 h
- Beneficial ownership threshold
- More than 25%
- List of obliged entities
- Art. 2
- Simplified due diligence
- Arts. 9–10
- Key legislation
- Law 10/2010
Services
What you need for a robust AML/KYC system
Six building blocks that turn anti-money laundering and know-your-customer obligations into a documented system you can defend before SEPBLAC.
AML
AML manual and policies
We draft the AML/CFT manual, the risk analysis and the internal procedures: the backbone of the AML system under Law 10/2010.
Learn more →
Law 10/2010ManualRisk analysisSEPBLAC
KYC
Identification and due diligence processes
We design KYC onboarding: formal identification, verification, beneficial owner (UBO), purpose of the relationship and ongoing monitoring, with a risk-based approach.
Learn more →
OnboardingBeneficial ownerRBA
Beneficial owner
Identifying the beneficial owner (UBO)
We determine who is really behind each customer: the natural persons with control above 25%, or the director, with the traceability the law requires.
Learn more →
UBO+25%
Reporting
Suspicious transaction reporting to SEPBLAC
We set up monitoring, special examination and suspicious transaction reporting to the FIU: the natural output of the AML system.
Learn more →
MonitoringReporting
Governance
Representative and control body
We set up the SEPBLAC representative role and the internal control body, with the functions, independence and training the law requires.
Learn more →
RepresentativeOCI
Control
External review and audit
We coordinate the annual external expert review and assess how effective the AML/KYC system is, leaving the evidence SEPBLAC expects to find.
Learn more →
External reviewEvidence
Concepts
AML and KYC are not the same: one contains the other
This is the most common confusion. AML is the whole anti-money laundering framework; KYC is the part about knowing and identifying the customer. Understanding how the two relate is the first step to building a system that works.
KYC
The know-your-customer component
"KYC (know your customer) covers identification, verification, the beneficial owner and the purpose of the relationship. It is an essential part of AML, not a synonym for it."
Risk
Everything revolves around risk
"The risk-based approach decides which due diligence to apply: simplified for low risk, standard by default and enhanced for PEPs or high-risk customers."
Ongoing
It does not end at onboarding
"KYC does not end at onboarding: the relationship is monitored on an ongoing basis and customer data is kept up to date over time."
Why it matters
Why are AML and KYC critical?
A weak AML/KYC system—without real due diligence, without a verified beneficial owner or without monitoring—exposes the firm to SEPBLAC penalties, to directors’ liability and to unknowingly facilitating money laundering offenses.
The most common mistake: treating KYC as a mere onboarding formality (uploading an ID document) and forgetting that it is ongoing due diligence, covering the beneficial owner, the purpose of the relationship and monitoring.
The beneficial owner is the weak spot: failing to identify who is really behind a corporate structure is one of the failings most pursued by SEPBLAC and the new European framework.
Risk is what drives it: applying the same due diligence to every customer—neither enhanced for high-risk customers nor simplified for low-risk ones—reveals a system that does not really work.
Law 10/2010
Obliged entities
The AML/KYC obligation extends to a broad list of obliged entities (Art. 2), not just banks: also fintechs, real estate agencies, advisory firms and more.
SEPBLAC
Penalties
Non-compliance can amount to very serious infringements, with high fines and liability for directors and senior managers.
EU AML package
July 10, 2027
Regulation (EU) 2024/1624 (AMLR) will apply directly from that date, with more detailed and demanding due diligence rules.
Would your AML/KYC system withstand a SEPBLAC inspection?
Before the supervisor reviews it, check that your manual reflects your real risk, that your KYC identifies the beneficial owner, that due diligence is scaled to risk and that monitoring and suspicious transaction reporting really work.
Frequently asked questions
AML and KYC: common questions
What is AML?
AML (Anti-Money Laundering) is the prevention of money laundering and terrorist financing (PBC/FT in Spain): the full framework of policies, procedures and controls that a firm puts in place so that it cannot be used to launder money.
In Spain it is governed by Law 10/2010 and its implementing regulation (Royal Decree 304/2014), under the supervision of SEPBLAC.
What is KYC?
KYC (Know Your Customer) is the set of measures used to identify and know the customer: formal identification, identity verification, determining the beneficial owner and understanding the purpose of the business relationship.
It is how the due diligence required by Law 10/2010 works in practice.
How do AML and KYC differ?
They are not synonyms: KYC is one part of AML.
- AML: the overall framework (risk, due diligence, monitoring, reporting, training, control body).
- KYC: the specific component of identifying and knowing the customer and the beneficial owner.
In other words: all KYC is AML, but AML goes far beyond KYC.
What is due diligence?
It is the set of obligations to know your customer: formal identification, identification of the beneficial owner, understanding the purpose and intended nature of the business relationship and ongoing monitoring. It is scaled to risk: simplified, standard or enhanced.
What is the risk-based approach?
It is the principle that not all customers receive the same level of scrutiny. The firm classifies the risk of each customer, product and transaction and applies proportionate measures:
- Simplified for low risk (Arts. 9–10 of Law 10/2010).
- Standard by default.
- Enhanced for high risk (PEPs, high-risk countries, etc.).
Who must apply AML/KYC?
The obliged entities listed in Article 2 of Law 10/2010: not only banks, but also payment and electronic money institutions, investment firms, crypto-asset service providers, real estate agencies, advisory firms and gestorías (administrative agencies), lawyers in certain transactions, casinos and many more.
Can KYC be done remotely?
Yes. The rules (Article 21 of Royal Decree 304/2014) allow non-face-to-face identification by electronic means when reliable procedures are used, such as video identification or electronic identification under eIDAS. The new European framework strengthens the use of secure electronic identification means.
What changes with the new EU AML package?
The 2024 package introduces a single rulebook: Regulation (EU) 2024/1624 (AMLR), directly applicable from July 10, 2027; Directive (EU) 2024/1640 (AMLD6); and the new European authority, AMLA. For Spain, which already has a solid framework under Law 10/2010, it means raising the bar: more detailed due diligence, stricter beneficial ownership rules and greater harmonization.
Are KYC and identity verification the same thing?
Not exactly. Identity verification is just one step of KYC (checking that the customer is who they claim to be). KYC goes further: it covers the beneficial owner, the purpose of the relationship, the risk profile and ongoing monitoring.
People also ask
AML and KYC: beneficial owner, PEPs, CDD and acronyms
What is the beneficial owner (UBO)?
It is the natural person who ultimately owns or controls the customer: as a general rule, whoever holds more than 25% of the capital or voting rights, or exercises control by other means. Identifying this person is a central part of KYC.
What is a PEP?
A politically exposed person: someone who holds or has held prominent public functions, and their close associates. A business relationship with a PEP requires enhanced due diligence because of the higher associated risk of corruption or money laundering.
What is the difference between CDD and EDD?
CDD (Customer Due Diligence) is standard due diligence, applied by default. EDD (Enhanced Due Diligence) is the enhanced level: deeper scrutiny for high-risk customers, including verifying the source of funds.
Are AML and PBC the same thing?
Yes. AML is the English acronym (Anti-Money Laundering) and PBC the Spanish one (Prevención del Blanqueo de Capitales). They are often used interchangeably; in Spain the legal term is PBC/FT, which adds terrorist financing.
How does KYC relate to data protection?
KYC collects personal data, so it must coexist with the GDPR: process only the data that is necessary, inform the customer and keep the data for the retention period set by anti-money laundering rules. These obligations work together; they do not conflict.
How often does KYC need to be updated?
There is no single deadline: it depends on the customer’s risk. The law requires ongoing monitoring and up-to-date information; higher-risk customers are reviewed more often than low-risk ones.
How they fit together
AML vs KYC and the levels of due diligence
AML is the framework; KYC is one of its components. And within KYC, the level of due diligence depends on each customer’s risk.
AML: the full framework
An anti-money laundering system covers much more than knowing your customer. These are its core building blocks:
- Risk analysis
- Assessment of the risk of the firm and of each customer.
- Due diligence
- This is where KYC comes in: identifying and knowing the customer.
- Monitoring
- Monitoring and examination of transactions.
- Reporting and control
- Suspicious transactions, training and control body.
KYC: knowing your customer
KYC is the customer due diligence component. Its core steps under Law 10/2010:
- Formal identification of the customer (reliable identity document).
- Identification and verification of the beneficial owner (UBO).
- Purpose and intended nature of the business relationship.
- Ongoing monitoring of the relationship over time.
| Level | Acronym | When it applies | What it involves |
|---|---|---|---|
| Simplified | SDD | Low-risk customers, products or transactions (Arts. 9–10). | Lighter measures, without dispensing with identification. |
| Standard | CDD | The standard regime, applied by default to most customers. | Identification, beneficial owner, purpose and monitoring. |
| Enhanced | EDD | High risk: PEPs, high-risk countries, complex relationships. | Deeper scrutiny and verification of the source of funds. |
Levels of due diligence under Law 10/2010 and Royal Decree 304/2014. The level assigned is based on the risk-based approach and must be documented and justified. The new Regulation (EU) 2024/1624 (AMLR), applicable from July 10, 2027, sets out these due diligence and beneficial owner identification requirements in more detail.
Practical guide
How to implement AML and KYC: a practical guide
An AML/KYC system is not an onboarding form: it is a living process that must show, with data and traceability, that the firm knows its customers and monitors their transactions. The key is to scale measures to risk and keep evidence.
Start with the risk analysis
Without its own risk analysis, there is no valid AML system. The analysis justifies which due diligence applies to each customer and why. Copying a generic template is the first failing SEPBLAC detects.
The UBO is not optional
Identifying and verifying the natural person who controls the customer is one of the most closely watched obligations. In complex corporate structures, you must be able to explain and document who is behind them.
KYC is a living process
Due diligence does not end at onboarding: you need to monitor transactions, update data and react to red flags. KYC frozen at onboarding is a system that does not work.
Checklist: a robust AML/KYC system
- Confirm whether the firm is an obliged entity under Article 2 of Law 10/2010.
- Prepare the firm’s own risk analysis.
- Draft the AML manual and internal procedures.
- Design KYC onboarding: formal identification and verification.
- Identify and verify the beneficial owner (UBO) of each customer.
- Scale due diligence to risk (simplified, standard or enhanced).
- Implement transaction monitoring and examination.
- Set up the channel for reporting suspicious transactions to SEPBLAC.
- Appoint the SEPBLAC representative and the internal control body.
- Plan training, the external expert review and the periodic review of the system.
If you want to implement or review your AML/KYC system, see our anti-money laundering (AML/PBC) services or our page on the AML manual.
AML/KYC in practice
From customer onboarding to ongoing monitoring
An effective AML/KYC system is not a form: it is a cycle (risk, identification and KYC, risk-based due diligence, monitoring and reporting) that you prove through traceability. Here is a visual overview of how it works in practice.
1) RiskRisk analysis: the starting point
Everything starts by assessing the risk of the firm and of each customer. This justifies which due diligence to apply and is the foundation of the whole AML system.
- Firm-level risk
- Risk by customer and product
- Low/medium/high classification
2) KYCKYC: knowing and identifying the customer
Formal identification, verification, beneficial owner and purpose of the relationship. The customer due diligence component, in person or remote.
- Identification and verification
- Beneficial owner (UBO)
- Purpose of the relationship
3) Due diligenceDue diligence scaled to risk
Simplified for low risk, standard by default and enhanced for PEPs or high risk, with verification of the source of funds where appropriate.
- Simplified (SDD)
- Standard (CDD)
- Enhanced (EDD)
4) MonitoringMonitoring and reporting: the living system
Ongoing monitoring, special examination of transactions, suspicious transaction reporting to SEPBLAC and data updates. This is what makes AML real.
Tip: inspections usually review the beneficial owner, how due diligence is scaled and the traceability of alerts and reports.
Key ideaQuick map: AML or KYC?
AML
The full framework: risk, due diligence, monitoring, reporting, training and control.
KYC
The know-your-customer component: identification, beneficial owner and purpose.
Relationship
KYC sits within AML: it is necessary, but not sufficient on its own.
Playbook
AML and KYC in practice
Risk analysis
Documented assessment of the firm’s risk and customer classification criteria.
Risk analysis document and scoring methodology.
Identification (KYC)
Formal identification, identity verification and beneficial owner of each customer.
KYC file, copies of documents and beneficial owner record.
Scaled due diligence
Applying simplified, standard or enhanced measures according to risk.
Justification of the level applied and, for EDD, source of funds.
Monitoring
Ongoing monitoring of transactions and special examination of those that trigger alerts.
Records of alerts, special examinations and decisions.
Reporting and control
Suspicious transaction reporting, SEPBLAC representative and training.
Reports to SEPBLAC, minutes of the control body and training plan.
Common mistakes SEPBLAC detects
Spot them before an inspection to avoid requests for information and penalties.
- Treating KYC as an onboarding formality rather than ongoing due diligence.
- Failing to identify and verify the beneficial owner in corporate structures.
- Applying the same due diligence to all customers, without scaling it to risk.
- Template manual and risk analysis, unrelated to the actual business.
- Failing to document alerts, special examinations and reports.
Working glossary
Key concepts: AML, KYC and due diligence
If you are setting up or reviewing your AML and KYC system, these terms appear in the manual, in onboarding and in your dealings with SEPBLAC. Understanding them well helps you build a consistent system.
AMLFramework
Anti-Money Laundering
Prevention of money laundering and terrorist financing: the full compliance framework. In Spain, PBC/FT (Law 10/2010).
Known as PBC in Spanish.
KYCComponent
Know Your Customer
Identification, verification, beneficial owner and purpose of the relationship. It is the customer due diligence component within AML.
One part of AML, not a synonym for it.
CDDDue diligence
Customer Due Diligence
Standard-level customer due diligence: identification, beneficial owner, purpose of the relationship and ongoing monitoring.
The default regime.
EDDEnhanced
Enhanced Due Diligence
Enhanced due diligence for high-risk customers (PEPs, high-risk countries): deeper scrutiny and verification of the source of funds.
Section 3 of Chapter II of Law 10/2010.
UBOBeneficial owner
Beneficial owner
The natural person who ultimately controls the customer: as a general rule, through more than 25% of the capital or voting rights, or through other means of control.
Ultimate Beneficial Owner.
PEPRisk
Politically exposed person
Someone who holds or has held prominent public functions, and their close associates. Requires enhanced due diligence because of the higher risk.
In Spanish: persona expuesta políticamente.
SEPBLACSupervisor
Supervisor and FIU
Servicio Ejecutivo de la Comisión de Prevención del Blanqueo (Executive Service of the Commission for the Prevention of Money Laundering). It is Spain’s supervisor and Financial Intelligence Unit.
Receives suspicious transaction reports.
RBAPrinciple
Risk-based approach
The principle under which measures are scaled to the risk of each customer, product or transaction. It is the logic that runs through the whole AML/KYC system.
RBA for short.
AMLREU
Regulation (EU) 2024/1624
The single EU anti-money laundering rulebook, directly applicable from July 10, 2027. It sets out due diligence and beneficial ownership rules in detail.
Alongside AMLD6 and the AMLA authority.
Contact
Book a call
Tell us about your case and we will review your AML and KYC system so that it complies with Law 10/2010 and withstands SEPBLAC supervision.
AML and KYC regulatory framework in Spain: Law 10/2010 and SEPBLAC
In Spain, AML (anti-money laundering) and KYC (know your customer) obligations are governed by Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing and its implementing regulation, Royal Decree 304/2014. The supervisor and Financial Intelligence Unit is SEPBLAC.
AML and KYC: a whole-and-part relationship
AML is the full framework: risk analysis, due diligence, monitoring, suspicious transaction reporting, training and the control body. KYC is one of its components: identifying and knowing the customer and the beneficial owner. Confusing the two is common, but KYC, essential as it is, does not cover all of an obliged entity’s obligations.
Due diligence scaled to risk
Law 10/2010 structures due diligence around the risk-based approach: simplified measures for low-risk customers and transactions (Articles 9 and 10), standard measures by default and enhanced measures in higher-risk cases, such as politically exposed persons (PEPs) or high-risk countries. Identifying the beneficial owner cuts across all of them.
The new European Union AML package
The 2024 anti-money laundering package introduces a single rulebook: Regulation (EU) 2024/1624 (AMLR), directly applicable from July 10, 2027; Directive (EU) 2024/1640 (AMLD6); and the new Anti-Money Laundering Authority (AMLA), operational since 2025. Spain already has a solid framework under Law 10/2010, so the impact will not be a break with the past but a step up towards more detailed due diligence and stricter beneficial ownership rules. This ties in directly with our anti-money laundering services and with the AMLR.
Anti-money laundering
EU framework and sectors
Resources and blog
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
- Royal Decree 304/2014 of May 5 approving the Regulation implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .