AML/CFT
From box-ticking to auditable evidence
“We turn policies and manuals into controls that actually run: sampling, traceability and a remediation plan with deadlines.”
AML External Expert Report in Spain
Your annual AML external expert report in Spain: an independent AML/CFT review under Article 28 of Law 10/2010 and Royal Decree 304/2014. We assess the operational effectiveness of your system (not just the paperwork), identify gaps and leave you with a corrective action plan you can defend before SEPBLAC and your internal control body (OCI).
OCI
Clear findings + corrective measures
“We deliver a report you can actually use: what fails, why it fails, the risk it creates and how to close it with evidence.”
KYC / Beneficial Owner
Consistent customer files, not “loose folders”
“We review document completeness, beneficial ownership (UBO) and record-keeping: the report must withstand an information request.”
Monitoring
Alerts handled with sound judgment
“We test risk scenarios to check whether the software raises the right alerts and whether their handling is properly recorded.”
What an AML external expert report in Spain includes
Law 10/2010 + Royal Decree 304/2014
An annual, independent review of the internal control system: operational effectiveness, evidence and proposals for improvement.
What is the AML external expert report?
It is a thorough, independent and documented review of the entity’s anti-money laundering policies, procedures and internal controls.
Identification + Beneficial Owner
Sample-based review of customer files: formal identification, UBO/beneficial owner, profile, risk and record-keeping.
Who is required to have this report?
Financial institutions such as banks and insurers. Professionals and advisers such as auditors and external accountants. High-risk sectors and other obliged entities.
Article 29 training plan
Review of content and evidence: up-to-date, role-specific training with a verifiable record.
Corrective measures
Prioritized findings + a plan with a timeline: owners, evidence and follow-up to close the gaps.
Annual AML review: frequency and key deadlines of the external expert report
This is a recurring obligation: the review must be carried out at least once a year. To be covered if an information request arrives, “having a PDF” is not enough. You must be able to show the reference date, the issue date, submission to the board, the corrective action plan and a file backed by evidence.
Annual (at a minimum): every year, it reviews the internal control system, its operational effectiveness and its gaps.
Internal escalation: material deficiencies are reported to the board/OCI, with actions and owners.
Remediation plan: a realistic, verifiable timeline (when issues cannot be fixed “on the spot”).
Record-keeping: add the report and its evidence to your records (KYC/UBO, alerts, training) with a long retention horizon.
Follow-up report: possible in years 2 and 3, where appropriate and if there are no substantial changes.
Registration as a SEPBLAC external expert
To act as an external expert, you must have notified SEPBLAC (Spain’s Financial Intelligence Unit) of your intention to do so before starting the activity. At Molina Law Boutique we are registered with SEPBLAC as external experts.
Scope of the AML audit: what will we review?
Our review covers the three mandatory areas set out in the regulations implementing Law 10/2010. We audit both physical documentation and digital traceability.
1. Records and documentation (KYC)
We audit document retention over the 10-year statutory period. We check the completeness of copies of formal identification documents and beneficial ownership declarations across a random sample of customers.
2. Software and alerts
We put your monitoring tool to the test. We simulate risk scenarios to check whether the software generates the right automated alerts and whether they are handled as promptly as SEPBLAC requires.
3. Training plan (Art. 29)
We review attendance certificates and the content of the courses given to employees. The external expert must confirm that training is up to date and specific to each job role, not generic.
Full report or follow-up report?
Under certain conditions, Law 10/2010 allows the full audit to be replaced by a follow-up report in the two following years. Understanding this difference keeps costs down without lowering the level of evidence.
| Feature | Full report (standard) | Follow-up report |
|---|---|---|
| When is it due? | First year, or after substantial changes to the control structure. | Years 2 and 3 (if there are no material changes). |
| Scope | Comprehensive audit of all internal control measures and bodies (OCI). | Verification only of the corrective measures previously proposed. |
| Legal basis | Art. 28.1 Law 10/2010 | Art. 28.1 (second paragraph) Law 10/2010 |
| Objective | Identify risks and assess overall operational effectiveness. | Check whether the deficiencies identified have been remedied. |
*Order EHA/2444/2007 sets out technical criteria to determine whether a change requires a return to the full report before the 3 years are up.
How we prepare your AML external expert report
We strictly follow Order EHA/2444/2007, using an agile methodology designed not to disrupt your day-to-day operations.
01
Document review
We request and review your Anti-Money Laundering Manual, your customer acceptance policies and the minutes of the internal control body (OCI) to check that, on paper, they comply with the law.
02
Operational testing (sampling)
We take a random sample of customer files to audit the correct application of customer due diligence (KYC) measures and document retention under Article 25 of Law 10/2010.
03
Detection and remediation
Before closing, we issue a draft setting out the deficiencies found. This lets you implement immediate corrective measures, which will be reflected positively in the final assessment.
04
Certified final report
Delivery of the digitally signed final report, ready to be made available to SEPBLAC. We include practical recommendations and a roadmap for the next annual review.
Operational checklist
Evidence that speeds up your anti-money laundering external expert report
If the report has to “hold up” under review, what makes the difference is evidence: tests, sampling, dates and a documented remediation plan.
Issue ≤ 2 months
Board submission ≤ 3 months
10-year retention
Remediation plan ≤ 1 year (general rule)
-
A defined reference date
Make clear which date “closes” the review period (so the report is not outdated or inconsistent).
-
Tests and results (not just conclusions)
Document what was tested, what the results were and what issues were found. Avoid a purely “declarative” report.
-
Sampling explained
State the size and criteria: customer types, products, periods and % reviewed. If statistical sampling is used, define the population, method, confidence level and error analysis.
-
Remediation plan with a timeline
If some deficiencies cannot be fixed immediately, have a plan with a precise timeline formally approved.
-
Well-organized records
KYC, beneficial ownership, analyses performed and supporting documents: ready to hand over quickly if an information request arrives.
Common mistakes we fix in your AML audit
The purpose of the external expert report is not just to tick a box, but to identify and remedy operational deficiencies that SEPBLAC treats as serious infringements.
⚠️
The “paper manual”
Having a generic manual that is not applied in practice. The law requires real operational effectiveness, not just effectiveness on paper.
⚠️
Beneficial ownership failures
Collecting ID documents is not enough. The notarial beneficial ownership deed (acta de titularidad real) is missing, or there are errors in complex corporate structures.
⚠️
Outdated training
Article 29 requires ongoing training. A typical mistake: generic courses that ignore sector-specific risks (real estate, crypto, jewelry, etc.).
⚠️
Enhanced due diligence skipped
Failing to apply enhanced measures to high-risk customers (PEPs or high-risk jurisdictions). This is penalized as a failure of customer due diligence.
What an external expert report must be able to demonstrate
Beyond the “document” itself, what matters in an inspection is traceability: deadlines, tests, sampling and a remediation plan.
Deadlines
Sampling
Independence
Operational effectiveness
Deadlines and report “governance”
- Annual report (with the option of a “follow-up” report in the 2 following years, where appropriate).
- Reference date consistent with the annual cycle (no gaps between years).
- Prompt issue: prevents the report from “arriving late” relative to the reference date.
- Internal escalation: material deficiencies reported to the board/OCI + corrective measures.
Key to avoiding “formal compliance without operational effectiveness”.
Sampling and evidence (what reviewers expect to see)
- What was checked: tests performed, results and findings (not just conclusions).
- Sample explained: size and coverage (customers, products, periods, etc.).
- Traceability: KYC/UBO, ongoing monitoring, alerts and training, with supporting documents.
- Errors found: cause, impact and verifiable correction.
Quality tip
If the report does not explain “how” the review was done (and with what sample), that is usually the first weak point when an information request arrives.
Independence + record-keeping
- Genuine independence: conflicts arising from paid services (time window).
- Suitable selection: justify the expert’s experience and competence.
- Retention: internal control documentation and evidence ready to hand over.
- Availability: fast, orderly responses to information requests.
Reduces sanction and reputational risk in inspections.
Risk-based approach
- Controls proportionate to your business, customers and operations.
- Enhanced measures for PEPs and high-risk scenarios.
- Consistency between the manual, procedures and day-to-day practice.
What “adds up” in an inspection is consistency between risk, control and evidence.
Important note:
Request the preparation checklist
To avoid inconsistencies, align your record-keeping policy with your internal control system: keep the report and its evidence together with your KYC/UBO files, alerts and training records.
Risks and penalties if your report is not up to date
Serious infringement: failing to carry out the annual external review when it applies.
Significant fines: starting at high amounts and potentially rising with net worth/turnover.
Reputational risk: information requests, inspections and loss of trust from banks, clients and investors.
Operational roadblocks: friction in onboarding and with suppliers, bank accounts and audits.
Reaction costs: fixing things late usually costs more than implementing and documenting them properly in time.
Need an external expert report that stands up before SEPBLAC?
We help you produce a complete, rigorous, evidence-based report: sampling, findings, corrections and documentation ready for any information request.
Everything about the external expert report (AML/CFT)
What is the AML external expert report?
The AML/CFT external expert report is an independent audit of the internal anti-money laundering control system. Its purpose is to assess the system’s operational effectiveness, identify deficiencies and propose corrections or improvements.
It must be kept available to SEPBLAC and to the entity’s internal control body (OCI).
It is not a mere “formality”: it is a key defensive document for information requests, inspections and access to banking.
How often is the external expert report required?
As a general rule, it is a recurring obligation that applies every year (at a minimum). In certain cases, it can be replaced by a follow-up report in the two following years if there are no material changes.
What matters is keeping the annual cycle going and staying consistent across reference date, tests, issue date and corrective measures.
Which regulations govern the report?
Mainly Law 10/2010 (Article 28) and its implementing regulation, Royal Decree 304/2014. The technical and independence criteria are set out in specific rules, including Order EHA/2444/2007.
The key: an independent review, traceable tests, conclusions and an improvement plan.
What exactly does the report include?
A full review of the system: AML/CFT manual, OCI, identification (KYC), beneficial owner (UBO), transaction monitoring, alerts, training (Art. 29), record-keeping and risk assessment.
What makes the difference:
- Tests performed and their results (not just an “opinion”).
- Sampling explained: size, criteria, coverage.
- Findings prioritized by risk + a corrective plan with a timeline.
- Evidence ready to hand over if an information request arrives.
Benefits of having an external expert report
It ensures strict compliance with Law 10/2010 and its AML implementing regulation. It identifies weaknesses in your internal control systems before they create greater risks, and it strengthens your credibility with authorities, clients and strategic partners.
It provides a formal report that demonstrates the company’s proactive accountability, along with concrete measures to improve procedures and reduce risk.
What documentation should you prepare before the audit?
To speed things up: your current manual, OCI minutes/structure, risk assessment, customer acceptance policy, KYC/UBO files, alert/monitoring logs, training records and evidence of previous corrective measures.
If everything is in order, sampling is more efficient and the report is of higher quality.
What happens if I don’t have the report or it is out of date?
You risk penalties, information requests and reputational damage, as well as friction with banks, investors and partners.
Prevention is far cheaper than fixing things against the clock.
How much does an AML external expert report cost?
It depends on your size, sector, number of customer files and the complexity of your operations. The decisive factors are the actual scope of the sampling and the evidence available.
We give you a tailored quote after a quick assessment of your risk and documentation.