Finding out late is the norm: the anti-money laundering system is not set up after the license. It is filed within the application, and it must match your program of activities, your business plan and the staff you say you will have.
Have you been asked for an AML manual for your authorization?
Tell us which license you are applying for and before which supervisor. We will tell you which AML package your application needs.
On AML, an application is not approved because it contains documents. It is approved because the documents describe a system that this specific project can run from day one.
No templates. We draft the manual around your actual products, your customer acquisition channels, your type of customer and the jurisdictions you will work with, backed by the risk self-assessment and by due diligence procedures your team can actually carry out.
The application does not only ask what you will do, but who will do it. We design the governance—internal control body, SEPBLAC representative, allocation of duties—and we can take on the role of external representative while your structure grows.
Article 2 of Law 10/2010 sets out the list. Where you fit in it determines the scope of the system you must file.
Composition, duties, meeting frequency and minutes. It is the piece that most often appears as “appointed” but is never actually set up.
Your AML manual and your program of activities are read together. If they do not say the same thing, a request for information follows immediately.
Procedures, tools, training, external review and ongoing monitoring: everything that has to be up and running from your first customer.
Four conversations we have every month, always with the same opening line: “we thought AML came after the license.”
“We had the program of activities and the fit and proper assessment sorted, and now they are asking for an AML manual, a risk self-assessment and a SEPBLAC representative. We haven’t written a single line of any of that.”
“Our onboarding is fully digital and remote. The manual we were handed describes a branch where customers come in to sign, and that has nothing to do with what we are going to do.”
“We came from the previous register and thought that was enough. Now they are asking for a complete prevention system, with monitoring and risk profiles, before authorizing anything.”
“There are four of us and we are going to have international investors. I need a proportionate system, but one that holds up to the first question about the beneficial ownership of a foreign vehicle.”
The AML part of an authorization application is rarely rejected for missing documents. It gets stuck because the documents are not credible.
The downloaded manual: it is spotted instantly. It mentions products you will not offer, describes branches that do not exist, cites rules from another sector or keeps references that no longer hold. An experienced reviewer spots it within two pages, and from then on reads the rest of the application with suspicion.
The manual that does not match the rest: your program of activities says digital customer acquisition and the manual describes face-to-face identification; your business plan talks about non-resident customers and the risk self-assessment does not cover them. Internal inconsistency is the easiest finding to spot and the most expensive to fix late.
Placeholder appointments: appointing as SEPBLAC representative or as a member of the internal control body someone with no knowledge, no time and no resources. The supervisor asks about profile, duties and time allocated, and that is where the shortcut ends.
| Application document | What the supervisor looks at | What it must match |
|---|---|---|
| AML manual and procedures | That they describe your specific operations: products, customer acquisition channels, customer types and the jurisdictions you will work with. | The program of activities and the project description: same services, same customers, same channels. |
| Risk self-assessment | That the entity has analyzed its own risk before operating, rather than inheriting a generic matrix from another sector. | The business plan: expected volumes, target markets and expected customer profile. |
| Internal control body and representative | Specific people, with real knowledge and time commitment, and a body with defined duties and operating rules. | The declared organization chart and resources: if there are no staff to support the function, the section falls apart on its own. |
We write the AML package around your actual project and align it with the program of activities, the business plan and the organization chart you have already filed. And if your structure is still small, we take on the role of SEPBLAC representative while it grows.
Because authorization is granted to an entity that must be able to comply from its first day of activity, not whenever it suits it. The prevention system is part of the organization and resources the supervisor assesses before deciding, just like capital or the fit and proper status of key position holders.
Seen that way, it makes sense: if the first transaction can come the day after you are registered, there cannot be a window in which the entity operates without procedures, without a designated person in charge and without customer acceptance criteria.
It is not, and it is spotted quickly. The signs are always the same: chapters on products your license does not allow, references to channels or branches you do not have, a risk self-assessment that does not mention your target market, procedures designed for a much larger team than yours, and references to rules that do not fit your sector.
The problem is not just that you are asked to correct it: a manual that clearly belongs to another project taints how the rest of the application is read and multiplies the questions about everything else.
As a general rule, the section includes: an AML/CFT manual with written policies and procedures; the entity’s risk self-assessment; due diligence procedures—simplified, standard and enhanced—and procedures for identifying the beneficial owner; treatment of politically exposed persons; a record-keeping policy; procedures for suspicious transaction reporting and the duty to refrain; the setting up of the internal control body and the appointment of the SEPBLAC representative; a staff training plan; and provision for the annual external expert review.
The exact scope depends on your type of entity and your risk profile, but that is the skeleton reviewers expect to see.
It is a common solution in small projects, and in practice it works well when the appointee has sufficient knowledge, real time commitment and effective access to the entity’s information. What does not work is a name put in just to fill a box.
Bear in mind that the obliged entity’s responsibility cannot be outsourced: even if the function relies on outside support, the system is still yours and your board of directors is still accountable. We explain this in external SEPBLAC representative.
Quite a lot, and it is one of the points that triggers the most requests for information. Non-face-to-face video identification is regulated by Order ETD/465/2021 of May 6, which provides for recorded (asynchronous) video and live video methods, with retention of evidence and prior authorization of the procedure on the terms set by the Order itself.
In the application you must describe the full flow: what is captured, how it is checked, what is retained, who reviews doubtful cases and which provider is involved. A manual that talks about signing in person when your product is an app is the most visible contradiction you can file.
The skeleton is common—manual, self-assessment, due diligence, governance, training, external review—but the emphasis changes a lot. For a payment institution, what is at stake is the analysis of operations and transaction monitoring; for a crypto-asset project, traceability and counterparty risk; for an investment firm, the source of funds and the beneficial ownership of structures.
That is why we do not reuse manuals between clients: the table of contents may look similar, but the content that matters is precisely the part that cannot be copied.
Before you file, not after the first request for information. When the AML section arrives late or weak, the effect is not just a delay: it forces you to redo documents already filed, because any change to the manual has knock-on effects on the program of activities, the organization chart and the declared resources.
Our practical recommendation is to build it in parallel with the rest of the application, not as a final appendix. You get a better document, you get it sooner, and you avoid the most uncomfortable round of questions in the process.
The EU package—Regulation (EU) 2024/1624 (AMLR), Directive (EU) 2024/1640 (AMLD6) and Regulation (EU) 2024/1620, which creates the European authority AMLA, based in Frankfurt—applies in stages and is being implemented.
For your application this means two things: today you file under Law 10/2010 and its implementing regulation, but it makes sense to design the system with that framework in mind, especially regarding due diligence, beneficial ownership and the traceability of information. A system built well now can be adapted with minor tweaks; one built in a hurry has to be redone from scratch.
That is when the real supervision begins. The manual has to be kept up to date, the risk self-assessment is reviewed when the business changes, the internal control body has to meet and keep minutes, training is delivered and documented, and the annual external expert review produces findings that have to be closed.
That cycle is exactly what we work on in our AML remediation plan. And if a supervisory review ever comes, what they look at is not the manual you filed, but the evidence you have generated since then.
Same order for every license: first define the scope, then write the system, and only at the end draft the manual. Doing it the other way around is what produces generic documents.
Fitting into the list of obliged entities in Article 2 of Law 10/2010; defining products, channels, customer types and jurisdictions; and the entity’s own risk self-assessment. Everything else follows from here.
Procedures for due diligence, beneficial ownership, politically exposed persons, alerts, reporting and record keeping; internal control body, SEPBLAC representative, training and tools. And only then: the manual.
Cross-checking against the program of activities, the business plan and the organization chart, responding to requests for information, and actually putting the system into operation for the day your first customer arrives.
If you are still deciding on your type of entity, see investment firm (ESI) authorization, payment institution license, electronic money institution license or registration and authorization under MiCA.
The 10 elements of an AML/CFT system you can defend before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before an inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These are the terms you will read in the supervisor’s request for information. If your manual uses them precisely, half the conversation is already won.
A person or entity included in the list in Article 2 of Law 10/2010. Most financial licenses place you within it from day one.
A document in which the entity identifies and assesses its exposure by customer, product, channel and geography, and decides which measures to apply as a result.
The document that organizes the whole system: acceptance criteria, due diligence, detection, reporting, record keeping, training and control.
A set of know-your-customer measures graded according to risk: identification, purpose of the relationship and ongoing monitoring.
The natural person who ultimately controls the customer. Identifying them is one of the points that triggers the most requests for information in corporate structures.
A collective body responsible for approving and overseeing the prevention system, with defined duties, composition and operating rules.
The person appointed as the entity’s point of contact with SEPBLAC (the Executive Service), responsible for channeling reports and requests for information.
A remote identification method regulated by Order ETD/465/2021, with recorded and live video methods and retention of evidence.
An external review of the prevention system, with a report and findings. It is provided for in the application even though it is carried out once the entity is operating.
That the entity knows exactly why it is an obliged entity and which obligations apply to it given its type and planned activity.
A regulatory classification memo referring to Article 2 of Law 10/2010 and a description of services consistent with the program of activities.
The entity’s own risk self-assessment, with conclusions carried over into the customer acceptance policy and the applicable level of due diligence.
A dated and approved self-assessment, an acceptance policy and an AML manual with version control.
Workable procedures to identify the customer and the beneficial owner through the channel the entity will actually use.
A documented onboarding flow, standard forms and declarations, a description of the identification method and contracts with technology providers.
An internal control body set up and a SEPBLAC representative appointed, with a profile, duties and time commitment that can be evidenced.
Resolutions setting up the body and making the appointment, CVs, job descriptions and an organization chart showing where the compliance function sits.
A staff training plan from day one and provision for the annual external expert review in the compliance calendar.
An annual training plan with content and target audience, and documented provision for the external review and its follow-up.
Five things an experienced reviewer spots in the first few minutes of reading.
The AML/CFT package is built the same way for every authorization, but the weight falls in different places depending on the type of entity: where your risk lies, which channel you use and what type of customer you will have. These are the licenses for which we most often build this section from scratch.
Investment firms: source of funds, beneficial ownership of structures and consistency with the program of activities.
Here the focus is on operations: transaction monitoring, agents and remote onboarding channels.
Projects coming from the previous register that discover the prevention system must now be filed before they start operating.
The most common case: a small project, a lean structure and an AML section that has to be both proportionate and complete.
If you want to understand the framework first, start with anti-money laundering and obliged entities. If you already know what you need, go straight to the AML manual or our AML/CFT services. And if the system already exists but a review has raised reservations, see the remediation plan.
Tell us which type of entity you are applying for—EAF, payment institution, electronic money institution, CASP, fund manager—and where your application stands. We review what is missing in the AML/CFT part and the order in which to build it.
Last updated: August 4, 2026
Almost every financial license turns the applicant into an obliged entity under Law 10/2010 of April 28 and its implementing regulation, Royal Decree 304/2014. That is why the supervisor does not wait until the entity is operating to ask about anti-money laundering: it requests the complete system within the authorization application, together with the program of activities, the fit and proper assessment of key position holders and evidence of resources. This page is designed for projects that discover this requirement halfway through and need to build the whole section without holding up the rest of the process.
The supervisor’s logic is simple: authorization is granted to an entity that can comply from its first day of activity. There is no window in which you can operate without customer acceptance criteria, without identification procedures and without a designated person in charge, because the first customer can come in the day after you are registered. That is why the AML section is examined as part of the organization and resources, on the same level as capital or the fit and proper status of directors. This has a practical consequence worth taking on board early: the prevention system is not an annex drafted once the rest of the application is finished, but a piece that shapes all the others. If the manual describes a compliance team that the organization chart does not include, or an onboarding channel that the program of activities does not mention, the request for information is not about the manual alone: it covers the whole package, and forces you to redo documents you thought were final.
The content varies with the type of entity, but the skeleton is stable: classification as an obliged entity under the list in Article 2 of Law 10/2010; the entity’s risk self-assessment; a customer acceptance policy; simplified, standard and enhanced due diligence procedures; identification of the beneficial owner; treatment of politically exposed persons; record keeping; detection, analysis and suspicious transaction reporting to SEPBLAC, plus systematic reporting; refraining from execution where appropriate; the internal control body; the SEPBLAC representative; annual staff training; and the annual external expert review. Order matters as much as content: first define the scope and the risk, then operations and governance, and only at the end draft the manual, which is simply all of the above put in writing. Doing it the other way around—starting with the manual—is exactly what produces documents that describe no one.
Almost every project has seen an AML manual circulating as a PDF, and the temptation to adapt it is huge. The problem is that an experienced reviewer identifies it immediately, and not because of the format: because of the internal inconsistencies. Chapters on products the license applied for does not allow, references to offices or an agent network in a purely digital project, a risk matrix that does not mention the markets in the business plan, procedures sized for a team that does not exist, references to rules from another sector. Each of these signs raises questions, and the questions pile up over the rest of the application. The alternative is not to write more pages, but to write the right ones: a manual proportionate to the project’s real size, describing what the team can carry out and using the same vocabulary as the rest of the documents filed. Proportionality, well argued, can be defended without difficulty; copying cannot.
The AML section does not end with authorization: that is when the real supervision begins. The manual is updated when the business changes, the risk self-assessment is reviewed, the internal control body meets and keeps minutes, training is delivered and documented, alerts are analyzed and reports go out when they have to. The annual external expert review produces findings, and those findings must be closed with evidence within a remediation plan. It is also worth keeping a close eye on the EU AML package—Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620, which creates the AMLA authority—which applies in stages and is being implemented: a system built well today can be adapted with minor tweaks, while one improvised to get by will have to be redone from scratch. And if a supervisory review ever comes, what is examined is not the manual you filed, but the evidence you have been generating.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .
More in AML Manual