OCI
From a “nominal body” to effective governance
“We turn the internal control body into a living system: decisions, minutes, owners and traceable evidence.”
AML Internal Control Body (OCI) in Spain
We set up and improve your internal control body for AML/CFT under Law 10/2010 and Royal Decree 304/2014. We define functions, minutes, reporting and operational controls (not just paperwork), align the risk-based approach and leave evidence and a corrective action plan that you can defend before SEPBLAC and senior management.
Minutes
Minutes and reporting you can defend
“We structure meetings, resolutions, follow-up and escalation: what is decided, why, and how it is proven.”
KYC / Beneficial Owner
Oversight of customer files, not “loose folders”
“We review document completeness, the beneficial owner (UBO) and record keeping: the OCI must withstand a request for information.”
Monitoring
Alerts, escalation and records
“We validate alert and case-handling criteria: evidence, timeframes, decisions and traceability for each case.”
- Document retention
- 10 years
- Employee training
- Art. 29
- Implementing regulation
- Royal Decree 304/2014
What an effective AML/CFT internal control body (OCI) includes
Law 10/2010 + Royal Decree 304/2014 (OCI)
Design of internal governance: functions, owners, evidence, traceability and oversight of operational AML/CFT compliance.
What is the internal control body (OCI)?
It is the governance structure in charge of overseeing, documenting and proving that the AML/CFT measures are actually applied: decisions, follow-up and escalation.
Minutes, policies and reporting
Review and improvement of minutes, resolutions, follow-up and reporting: what is decided, when, on what basis and how the evidence is kept.
Who needs an operational OCI?
Financial institutions, insurers, professionals and other obliged entities: the OCI must be tailored to the risk, business, customers and actual operations.
Training and control culture
Oversight of training evidence: up-to-date, role-specific content with verifiable records of attendance and assessment.
Corrective measures and control
Prioritized findings + a plan with a timeline: owners, evidence and follow-up by the OCI to close gaps without improvising.
Frequency and key timelines of the internal control body
An operational OCI is measured by its cycle: meetings, minutes, follow-up and evidence. When a request for information arrives, what matters is not “saying it exists” but proving decisions, controls, escalation, corrective measures and records with traceability.
Meetings and minutes: a real meeting schedule, clear resolutions and defined owners.
Internal escalation: relevant incidents go to senior management or governing bodies, with actions and follow-up.
Action plan: a verifiable timeline to close gaps (if they are not fixed “on the spot”).
Record keeping: orderly records of KYC/UBO, alerts, training, minutes and OCI decisions.
Review after changes: strengthen the system when your business, customers or operations change.
The internal control body and its relationship with SEPBLAC
The internal control body (OCI) must be able to prove the governance, control and evidence of the AML/CFT system: minutes, decisions, follow-up and documents ready to answer requests for information. At Molina Law Boutique we help you set up an operational OCI and document the system so that you can defend it before SEPBLAC.
Scope of the internal control body: what will we review?
A solid OCI is more than an organization chart: it is control, evidence and follow-up. We review documents, operations and the digital audit trail.
1. Records and documents (KYC/UBO)
We check that documents are kept for the legal period of 10 years. We verify that formal identification and beneficial ownership declarations are complete for a sample of customers, with evidence ready for a request for information.
2. Software, alerts and case handling
We put your monitoring tool to the test. We simulate risk scenarios to check whether the system generates the right alerts and whether their handling is documented, traceable and reasoned.
3. Training and procedures (Art. 29)
We review evidence and content. The OCI must confirm that training is up to date and role-specific, with verifiable records, and consistent with the risks of your sector.
In-house OCI or specialist external support?
The key is not “who signs it” but whether the internal control body works: governance, operational controls, evidence and follow-up. Choosing the right model optimizes resources without losing traceability.
| Feature | In-house OCI (own team) | External support / co-sourcing |
|---|---|---|
| When does it make sense? | When the organization has the structure, the volume and solid document control in-house. | When specialist expertise is lacking, there are changes or growth, or you need to speed up evidence and methodology. |
| Scope | Day-to-day internal control, minutes, follow-up and operational execution. | Implementation, technical reinforcement, templates, methodology, sampling and better OCI traceability. |
| Working basis | Internal resources + your own procedures. | Procedures, checklists and standardized evidence to align with best practice and regulatory requirements. |
| Goal | Ensure continuity and stable internal control. | Close gaps, professionalize the OCI and leave evidence you can defend in response to requests for information. |
*The model must fit the operations, the risk and the level of traceability you can maintain consistently.
How we set up and organize your internal control body
A practical methodology to turn the OCI into effective governance: decisions, evidence, operational controls and traceability ready for requests for information.
01
OCI design and functions
We define the structure, responsibilities, approval flows, escalation and minutes. The internal control body must have a real mandate and minimum evidence.
02
Procedures and operational controls
We organize your procedures: customer acceptance, due diligence (KYC), beneficial owner (UBO), document retention and record keeping. The aim is for execution to be verifiable.
03
Minutes, follow-up and measures
We put in place templates for minutes and follow-up: incidents, decisions, owners and corrective measures with a timeline. Without follow-up, the OCI becomes “decorative”.
04
Periodic review and improvement
We set a review routine: alerts, training, evidence and records. The OCI must keep a living cycle, consistent with the risk and the operations.
Operational checklist
Evidence that strengthens your AML/CFT internal control body (OCI)
If the internal control body has to “withstand” a request for information, what makes the difference is evidence: minutes, decisions, records, sampling and a documented action plan.
Regular minutes
Documented escalation
10-year records
Corrective plan
-
Defined functions and owners
Make sure the OCI is not “just a name”: define roles, decision flows and who signs what, with traceability.
-
Minutes with useful content
Decisions, incidents, resolutions, owners and follow-up. Avoid empty minutes or minutes without evidence.
-
Defensible records and sampling
Check KYC/UBO files, alerts and training with a sample and criteria: coverage, periods, typologies and results.
-
Action plan with a timeline
If there are deficiencies, document a plan with deadlines, evidence of closure and review by the OCI.
-
Orderly, accessible records
Minutes, evidence and supporting documents ready for quick delivery in response to a request for information, with no “last-minute” searches.
Common internal control body mistakes we fix
An OCI that does not work leaves the entity exposed: the risk is not only “on paper”; it is operational and evidentiary before SEPBLAC.
⚠️
Non-existent or nominal OCI
It appears on the organization chart, but with no meetings, no minutes and no decisions. An internal control body must be operational and demonstrable.
⚠️
“Empty” minutes
Minutes with no resolutions, no owners and no follow-up. The OCI must leave an audit trail of decisions, incidents and measures.
⚠️
KYC/UBO without oversight
Collecting ID cards is not enough. What is missing is control of the beneficial owner, a consistent risk rating and evidence of review by the OCI.
⚠️
Alerts without criteria or records
Monitoring is useless without documented case handling: decisions, escalation and supporting evidence. It is penalized as a lack of diligence in operations.
What the internal control body must be able to show
Beyond the “organization chart”, what matters in an inspection is traceability: minutes, decisions, tests, follow-up and a corrective plan.
Minutes
Evidence
Escalation
Operational effectiveness
OCI governance and cycle
- Real meetings with minutes, resolutions and owners.
- Follow-up of incidents and corrective measures.
- Escalation of material deficiencies to senior management or governing bodies.
- Consistency between risk, control and evidence.
Key to avoiding “formal compliance without operational effectiveness”.
Evidence (what they expect to see)
- What was reviewed: tests performed, results and findings.
- Records: KYC/UBO, alerts, training and OCI decisions, with supporting documents.
- Traceability: why it was decided, when and on what evidence.
- Corrections: verifiable closure and follow-up.
Quality tip
If you cannot show “how” the OCI decides and supervises, that is usually the first weak point when a request for information arrives.
Record keeping and availability
- Records: minutes, evidence and supporting documents ready to hand over.
- Retention: organized documents, consistent with the legal retention periods.
- Availability: speed and order when answering a request for information.
- Consistency: procedures applied uniformly.
Reduces sanction and reputational risk in inspections.
Risk-based approach
- Controls proportionate to your business, customers and operations.
- Enhanced measures for PEPs and high-risk scenarios.
- Consistency between procedures and day-to-day execution.
What “adds up” in an inspection is consistency between risk, control and evidence.
Important note:
Request the OCI implementation checklist
To avoid inconsistencies, align your records with your internal control: keep OCI minutes, decisions, KYC/UBO, alerts and training with traceability.
Risks and penalties if your internal control body is not operational
Non-compliance risk: an OCI that does not exist, is nominal or has no verifiable evidence.
Fines and supervisory measures: a lack of operational control increases the risk of sanctions.
Reputational risk: inspections, requests for information and loss of trust from banks, customers and investors.
Operational blocks: friction in onboarding and with suppliers, bank accounts and external audits.
Cost of reacting: putting minutes, evidence and controls in order “against the clock” is usually far more expensive.
Do you need to set up or strengthen your AML/CFT internal control body (OCI)?
We help you turn the OCI into real control: useful minutes, KYC/UBO, alerts, training, follow-up and evidence ready for requests for information.
All about the AML/CFT internal control body (OCI)
What is the internal control body (OCI)?
The internal control body (OCI) is the governance structure in charge of overseeing and proving that the anti-money laundering system is actually applied. Its goal is to ensure operational effectiveness: decisions, minutes, follow-up, records and evidence.
It must be able to respond quickly to requests for information, showing traceability in KYC/UBO, alerts, training and corrective measures.
It is not “a job title”: it is real control with evidence you can defend.
How often should it meet and document its work?
“Existing” is not enough: the OCI must hold meetings and keep minutes at a frequency consistent with the risk, with a real follow-up cycle.
What matters is consistency between risk, decisions, evidence and corrective measures.
What legislation governs the OCI in AML/CFT?
Main framework: Law 10/2010 and its implementing regulation, Royal Decree 304/2014. In practice, you need traceable controls, evidence, record keeping and a risk-based approach.
The key: operational internal control, not just paperwork.
What does a well-implemented OCI include?
Governance and control: minutes, policies, customer acceptance, KYC and beneficial owner (UBO), transaction monitoring, alerts, training (Art. 29), record keeping, follow-up and corrective measures.
What makes the difference:
- Minutes with decisions and follow-up (not “empty minutes”).
- Verifiable records and evidence (KYC/UBO, alerts, training).
- Corrective measures with a timeline and documented closure.
- Orderly records, available when a request for information arrives.
Benefits of an operational OCI
It strengthens compliance and reduces sanction risk. It avoids inconsistencies between the manual and practice, and improves how you respond to banks, partners and audits.
It brings real internal governance: decisions, evidence and ongoing control.
What documents should you prepare?
To set up or strengthen the OCI: existing minutes, the current manual, the risk assessment, the customer acceptance policy, KYC/UBO files, alert and monitoring logs, training and evidence of corrective measures.
With orderly documents, the OCI gains speed, consistency and a stronger defense.
What happens if the OCI does not work or leaves no evidence?
The risk of sanctions, requests for information and reputational problems increases, along with friction with banks, investors and partners.
Preventing and documenting in time is much cheaper than correcting against the clock.
How much does it cost to set up or improve the OCI?
It depends on size, sector, number of customer files and how complex your operations are. What matters most is the evidence available and how organized things are today.
We give you a tailored quote after a quick review of risk, minutes and documents.
Book a call about the OCI
Official sources
Key legislation, linked to the official text:
- Royal Decree 304/2014 of May 5 approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .