Internal AML Audit in Spain
Our AML audit is an independent, systematic review of your anti-money laundering internal control system. We assess the operational effectiveness of controls, KYC/KYB, monitoring and training, and leave you with a remediation plan backed by evidence you can defend before SEPBLAC.
Free consultation
We reply within 24 h
What is an AML/CFT audit?
An independent, systematic process for reviewing the framework, controls and procedures put in place to prevent and detect money laundering and terrorist financing.
AML policies and manual
Review of the AML manual, roles and responsibilities (Compliance Officer, Risk Committee, OCI) and whether they meet regulatory requirements.
Identification and verification
Verification of identification procedures for obliged entities, customer documentation, beneficial owners and source of funds where applicable.
Transaction monitoring
Assessment of detection rules, scenario coverage, threshold calibration, false positive rate and alert handling.
STRs and communication with authorities
Evidence of suspicious transaction reports, handling of communications with authorities, record retention and confidentiality.
Compliance culture
Review of training programs, attendance records, internal campaigns and assessment of the compliance culture at management and operational level.
Report and remediation plan
A report with findings ranked by severity, practical recommendations, owners, deadlines and a remediation plan with follow-up. It complements the External Expert Report where applicable.
AML audit process and key steps
We combine legal experience and technical capabilities to carry out audits tailored to your type of entity and risk profile.
Planning and scope
We define the objectives, scope (countries, units, product lines), materiality and resources. We gather the core documentation of the AML program.
Risk and control assessment
We review the risk assessment (RBA) and check that controls are aligned with the risks identified. We document preventive and detective controls.
KYC/KYB testing and sampling
We select a sample by risk profile and verify identification, beneficial owners, source of funds and file documentation.
Monitoring testing
We assess alert scenario coverage, threshold calibration, on-chain/off-chain correlation and traceability from the alert to the final decision.
STR review
We check escalation criteria, consistency of reports, record-retention periods and confidentiality protocols.
Training and culture
We review training records, investigation drills, rule-tuning exercises and follow-up on previous remediation.
Final report
We document findings ranked by severity, with practical recommendations, owners, deadlines and post-implementation controls.
Follow-up
A follow-up check to show that findings have been closed and that the corrective measures implemented are effective.
How we approach the AML audit
Legal experience + technical capabilities (blockchain analytics, KYC/KYB review, control testing) for audits tailored to VASPs and regulated entities.
.webp)
On-/off-ramp and KYC review
Review of onboarding processes, KYC/KYB evidence and controls on fiat↔crypto conversions to detect procedural weaknesses.
.webp)
On-chain monitoring testing
We assess detection rules, scenario coverage, threshold calibration and on-chain/off-chain correlation to measure effectiveness.
Audit report and training
Delivery of a report with findings, a remediation plan with owners and deadlines, and training to close the gaps identified.
Key players and common findings
Who takes part in the audit and which problems we find most often.
Recurring findings we fix
- Incomplete files — KYC/KYB documentation with missing dates, pending verifications or incomplete record retention.
- Outdated risk assessments — An RBA that does not reflect changes in business activity, customers, products or jurisdictions.
- Poorly calibrated monitoring rules — Generic thresholds, excessive false positives or risk scenarios left uncovered.
- Missing evidence in investigations — Alerts closed without documenting the decision, the reasoning or the audit trail.
- Insufficient sanctions screening — Outdated lists, partial coverage or no integration into operational workflows.
- AML manual not applied in practice — Approved policies that are not reflected in day-to-day operations or in verifiable records.
Key players in the audit
Compliance Officer: operationally responsible for the AML program and point of contact for the audit.
Senior management: responsible for governance, resources and risk acceptance.
Internal/external audit: carries out independent testing and issues a report with recommendations.
Regulator / FIU: receives reports and requests for information arising from the audit.
Practical remediation measures
Update the RBA, strengthen KYC/KYB, review detection rules, clean up the data sources used for sanctions and PEP screening, and document action plans with verifiable follow-up.
Request an audit →Technical and organizational controls we assess
The audit examines the technical and organizational (T&O) controls that support evidence integrity and confidentiality during investigations and remediation.
Access management
Documented role-based and least-privilege controls. We check that only authorized staff can access sensitive AML data.
Immutable audit logs
Logs retained in line with regulatory requirements, so that decisions, transactions and access to files can be reconstructed.
Screening built into workflows
Sanctions lists integrated into operational processes, with logs that show the action taken on each match.
Vendor due diligence
Evidence of third-party audits (KYC, custodians, analytics), certifications, AML/CFT clauses and service continuity plans.
Risks of not carrying out an AML audit
Regulatory sanctions: fines, disqualifications and requests for information due to inadequate controls or missing evidence of compliance.
Operational blocks: problems with correspondent banks, blocked accounts and friction when onboarding institutional clients.
Reputational risk: loss of trust among investors, partners and clients when there is no independent audit.
Criminal liability: exposure of directors and senior managers for failing to implement the controls required by AML/CFT rules.
Cost of reacting: fixing deficiencies after an inspection or a request for information costs far more than preventing them with periodic audits.
Do you need an AML/CFT audit with defensible evidence?
We review your entire program: KYC, monitoring, STRs, training and controls. We leave you with a report covering findings, remediation and follow-up.
Request an AML auditServices that complement the AML/CFT audit
The audit is not a one-off exercise. These services strengthen your compliance program and cover areas that audits often flag for improvement.
External Expert Report
Independent audit required by Law 10/2010: review of controls, sampling, evidence and a corrective action plan for SEPBLAC.
→ DocumentationAML/CFT Manual
Drafting or review of the manual: policies, procedures, roles, record retention and escalation protocols tailored to your business.
→ RiskRisk Self-Assessment (IAR)
Design and updating of the RBA methodology: identifying, measuring and managing risks by customer, product and jurisdiction.
→ CryptoCrypto-Assets and Blockchain
AML compliance for VASPs and exchanges: on-chain traceability, Travel Rule, MiCA and preparation for requests for information.
→ ComplianceCorporate Compliance
Criminal compliance programs (Article 31 bis of the Criminal Code), whistleblowing channel, code of ethics, training and third-party due diligence.
→ TraceabilityTraceability Report
On-chain analysis, source of funds, wallet identification and AML/KYT risk for bank account access, compliance and claims.
→What you should know about the internal AML/CFT audit
Expand each section to review the legal bases, individuals’ rights, the obligations of entities and the best practices that make the difference between “ticking the box” and having a defensible AML program.
1Legal bases for the audit work
The AML/CFT audit reviews compliance with the legal and regulatory obligations relating to the prevention of money laundering and terrorist financing. The applicable principles include lawfulness, proportionality, traceability and confidentiality of the information handled during the audit.
The legal bases considered include: the legal obligations that require information to be retained and made available; the need to comply with contracts with correspondent banks and providers that require evidence of controls; and the public interest, where the audit helps detect systemic risks or signs of unlawful activity.
Practical recommendation
The audit plan should identify the legal basis for each review procedure and record the authorizations needed to access sensitive data.
2Individuals’ rights in the audit context
Personal data may be processed during an AML audit. The rights of access, rectification, erasure, restriction and objection must be respected, except where the law requires retention or confidentiality because of AML/CFT investigations.
- Provide transparent information about the data processing carried out during the audit and its legal basis.
- Verify identity before handling requests relating to audited files.
- Log any access to personal data during the audit and keep review logs.
- Coordinate with the Data Protection Officer when the audit involves access to sensitive data.
3Obligations of entities being audited
Obliged entities (banks, VASPs, financial service providers and professionals subject to AML rules) must provide access to documentation, policies, KYC/KYB records, monitoring logs and STRs in the context of an AML audit.
It is essential to have an internal owner who coordinates the supply of evidence and ensures chain of custody and confidentiality. Formal cooperation through documented requests and agreed deadlines makes the audit work easier and reduces regulatory friction.
4Compliance Officer and internal control body (OCI)
The Compliance Officer and the internal bodies (Risk Committee, OCI) play a key role: they must provide access, validate methodologies and coordinate responses to findings.
Key
Formal reporting channels and a Compliance Officer with real authority make the program reviewed in the audit more robust.
5Internal procedures, AML manual and evidence
The AML manual is the core document the auditor examines: it must contain policies, operating procedures, record retention, escalation protocols and clearly defined roles. The audit checks that operational practices match what the manual sets out and that there are records supporting its application.
There must be evidence of internal testing, reviews and updates of the manual, as well as minutes of its approval by management or the OCI.
6Due diligence on vendors and counterparties
The audit reviews the due diligence applied to critical vendors (KYC services, custodians, analytics providers, integrators) and whether there are AML/CFT contractual clauses. It requests evidence of third-party audits, certifications, contracts with compliance clauses and service continuity plans.
7Training, internal audits and stress tests
Ongoing training, internal audits and stress exercises are evidence the organization must provide to demonstrate a compliance culture and response capability. The review covers training records, investigation drills, rule-tuning exercises and the results of previous audits, with follow-up on remediation.
8Sanctions, cooperation and international obligations
The audit also assesses compliance with sanctions lists (OFAC, EU, UN) and the entity’s ability to cooperate with national and international authorities when they issue requests for information. Non-compliance can lead to administrative sanctions, operational blocks and criminal liability.
Ensuring compliance with sanctions lists and international cooperation protocols is essential to reduce the regulatory risks an AML audit can detect.
All about the AML/CFT audit
What is an AML/CFT audit?
It is the independent process of reviewing an organization’s framework, controls and procedures for preventing and detecting money laundering and terrorist financing. It assesses adequacy, effectiveness and regulatory compliance, identifies gaps and proposes corrective actions.
What legal bases underpin the audit?
The audit reviews compliance with legal and regulatory AML/CFT obligations: Law 10/2010, Royal Decree 304/2014, applicable EU directives and sector-specific rules. The principles include lawfulness, proportionality, traceability and confidentiality.
Who takes part in the audit?
The key players are:
- Compliance Officer: operationally responsible for the AML program.
- Senior management: governance, resources and risk acceptance.
- Internal/external audit: independent testing and report.
- Regulator / FIU: receives reports and requests for information.
What is reviewed in the risk assessment (RBA)?
The auditor assesses how the entity identifies, measures and manages risks by customer, product, channel and jurisdiction. The review covers documentation, review frequency, risk-rating criteria, thresholds and the alignment of controls with the level of risk.
How are KYC/KYB files reviewed?
We select samples by risk profile and review file completeness, verification of beneficial owners, electronic verification evidence, source of funds in high-risk transactions and records of periodic updates.
What is assessed in transaction monitoring?
Alert scenario coverage, threshold calibration, false positive rate, alert investigation and closure processes, and traceability from the alert to the final decision, with evidence recorded.
What role does the AML manual play in the audit?
The AML manual is the core document: it must contain policies, operating procedures, record retention, escalation protocols and roles. The audit checks that operational practices match what the manual sets out and that there are records of its application.
How much does an AML/CFT audit cost?
It depends on the size of the entity, the number of jurisdictions, the volume of files, the complexity of its operations and the maturity of the AML program. We give you a tailored quote after an initial review of your risk and the documentation available.
Book a call
Tell us about your situation and we will explain how to approach your entity’s AML/CFT audit.
Regulatory framework for the AML/CFT audit in Spain
The internal AML/CFT audit is an obligation arising from Law 10/2010 on the prevention of money laundering and terrorist financing and its implementing regulation (Royal Decree 304/2014). Its purpose is to assess independently the adequacy, effectiveness and compliance of the prevention program implemented by the obliged entity.
Risk-based approach (RBA)
The AML audit must apply a risk-based approach: the controls reviewed must be proportionate to the entity’s business, customers, products and jurisdictions. The auditor assesses whether the RBA methodology is adequate and whether the measures applied are effective and documented.
Technical and organizational controls
Beyond the document review, the audit examines technical and organizational (T&O) controls: access management, encryption, logging, segregation of duties, backups, sanctions screening built into workflows and immutable audit logs that allow decisions and transactions to be reconstructed.
International cooperation and sanctions
The audit also assesses compliance with sanctions lists (OFAC, EU, UN) and the entity’s ability to cooperate with national and international authorities when they issue requests for information. Non-compliance can lead to administrative sanctions, operational blocks and criminal liability.
AML/CFT services
Other related services
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Royal Decree 304/2014 of May 5 approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .