The long-standing family business
“We’ve been selling for forty years and nobody ever said a word. Now I find out we’re an obliged entity and I have no idea where to start or what I have to ask customers for.”
When cash payments exceed the threshold set by law, your business falls under Law 10/2010 as an obliged entity. We build you a system that actually works at the counter and stands up to a SEPBLAC inspection.
Does your jewelry store fall under Law 10/2010?
Tell us what you sell and how you take payment. We will tell you whether you are an obliged entity and what you need to set up, without jargon and without selling you more than you need.
You do not need a compliance department. You need six pieces, done well and used every day by the people behind the counter.
The manual is not a PDF to keep in a drawer: it is the procedure your staff follow. We draft it around how you actually operate—what you sell, how you take payment, whether you buy gold from private individuals—together with the business risk self-assessment.
Someone has to answer to the supervisor and sign the reports. If nobody in your family business has that profile, we take on the role externally and register the appointment properly.
Article 2 of Law 10/2010 lists who is covered. We tell you whether your activity falls within it and from when.
Staff training is mandatory and it is the first thing requested in an inspection. With a certificate and an attendance list.
We support you through the request for information: what to hand over, in what order and how to explain what you did get right.
Manual, training, representative and periodic review in a single service, with a fixed fee and no surprises.
It is almost never an in-house lawyer. It is the owner, the son or daughter who has joined the business, or the manager who has seen a letter from the supervisor.
“We’ve been selling for forty years and nobody ever said a word. Now I find out we’re an obliged entity and I have no idea where to start or what I have to ask customers for.”
“I buy pieces from private individuals every day and pay on the spot. I need to know what to record for each transaction and what to do when someone turns up with items that don’t match their story.”
“I lend money against jewelry and give it back when the customer repays. I’ve been told this is also covered by anti-money laundering rules and that I need a manual and a designated responsible person.”
“I sell to other stores and the odd foreign customer. My buyers are starting to ask for my AML manual and my company profile before opening an account for me or paying me.”
They are not bad-faith mistakes: they are nobody-ever-explained-it mistakes. The problem is that all of them show up within five minutes of an inspection.
Taking payment and recording nothing: the sale is made, the invoice is issued and that is the end of it. Without a copy of the ID document or a customer record, there is no way to prove you identified anyone, even if you did.
The manual downloaded from the internet: generic templates that talk about departments and committees your store does not have. A manual that does not describe how you actually operate does not protect you: it shows that nobody has read it.
Nobody appointed and nobody trained: if there is no internal responsible person or SEPBLAC representative, and counter staff have never been trained, the system does not exist, even if you have the paperwork printed out.
| At the counter | What the rules require | What goes on file |
|---|---|---|
| A cash sale above the regulatory threshold | Identify the customer and verify who they really are before closing the transaction | Copy of the ID document, customer record and an invoice linked to that record. |
| The same customer comes back several times with smaller amounts | Assess whether the transactions are linked and treat them together | Transaction log per customer and an internal note explaining the decision taken. |
| Buying gold pieces from a private individual | Ask about the origin of the pieces and act if the explanation does not add up | Description of the pieces, a signed statement from the seller and a record of the stated origin. |
We review how your store works, tell you exactly whether you are an obliged entity and set up whatever is missing: a tailored manual, customer record form, staff training and SEPBLAC representative. All in language your team understands.
It depends on how you take payment. Article 2 of Law 10/2010 covers those who professionally trade in jewelry, precious stones or precious metals when cash payments exceed the threshold set by the regulations. Below that amount, and always taking payment through banking channels, most stores fall outside the general regime.
The answer is not on the shop sign but in the till: if you accept cash for transactions of a certain size, you are in. We review it with you before selling you anything; you can see the full map on our obliged entities page.
That is the cleanest route. If your business does not accept cash above the regulatory threshold, as a general rule you do not come into scope through this door. That said, the policy should be written down and always followed: a sign in the store, an instruction to staff and a limit set on the POS terminal are worth more than good intentions.
Watch out for the usual slip: accepting a cash payment for an expensive piece “just this once”. On that particular day the obligation does apply and, if you did not comply with it, it is on record in your own books.
Three things, in this order. First, a valid ID document and a copy of it. Second, if a company is buying, find out who is behind it: the beneficial ownership, meaning the individual who controls that company. And third, for transactions of a certain size or that do not fit the profile, a question about the source of funds.
All of this goes into a customer record. Without a record, identification cannot be proven, and in AML what cannot be proven does not count.
No. There is a legal limit on cash payments when a business or professional is involved, with a different amount for certain non-resident payers. It is a tax rule separate from Law 10/2010, with its own penalty regime, and we do not publish the figures here because they should be checked case by case before you apply them at the till.
What matters for you: these are two different obligations and they are breached separately. You can respect the cash limit and still fail to perform due diligence, or the other way around. We give you the current amount, applied to your operations, in the first consultation.
For the retention period set by Law 10/2010, counted from the end of the business relationship or from the transaction. Records must be organized and easy to locate: if SEPBLAC asks for the file on a specific customer, the answer cannot be that it is in a box in the storeroom.
At the same time, those copies are personal data: their retention must be covered in your data protection notice, and access must be limited to those who need it. We set up both layers together so they do not clash.
It is not a police report: it is a suspicious transaction report (STR) to SEPBLAC, and it is confidential. When a transaction does not fit the customer’s profile or the explanation they give, the system requires you to examine it, document it and, if the suspicion remains, report it.
There is also a duty to refrain: in certain cases the transaction must not be carried out. And a rule that surprises many people: it is prohibited to tell the customer that they have been reported. That is why you should have the procedure in writing before a case arises, rather than improvising at the counter.
A person with real decision-making power in the business, who is formally appointed and notified to the supervisor. They sign the reports and deal with SEPBLAC. In a small company this usually falls to the owner or a family member with direct responsibility.
If nobody in the store has the time or the profile to take it on, the role can be performed from outside by an external SEPBLAC representative. What you cannot do is leave the position empty: it is one of the first things checked.
Usually a written request for information arrives first. It asks for the manual, the risk self-assessment, the appointment of responsible persons, the customer records for specific transactions, the training records and the external expert review.
What decides the outcome is not how eloquent the answer is, but whether those documents existed before the request and are dated. An organized file turns an inspection into a formality; an improvised one turns it into sanction proceedings. We explain this on our SEPBLAC inspection page.
It changes the most delicate part: identification. If the customer never sets foot in the store, you have to identify them remotely, and that has its own rules. Order ETD/465/2021 regulates remote video identification methods, with procedures that must be documented and evidence that must be kept.
Applied to your case: a photo of an ID card sent over WhatsApp is not enough. Either payment goes through banking channels and stays below the threshold, or you need to set up a proper non-face-to-face identification procedure. We tell you which of the two routes makes sense for you.
The goal is not to have nice-looking binders: it is for an employee to know what to do when a customer pulls out a wad of banknotes. This is the order we follow.
We look at what you sell, how much you collect in cash, whether you buy from private individuals and whether you lend against pledged items. That gives a clear answer: in or out, and from when. If you are out, we tell you and stop there.
Business risk self-assessment, a manual with your procedures, customer record form, appointment of responsible persons and registration of the SEPBLAC representative. Written in the language of your store, not of a bank.
Staff training, periodic review of the manual, external expert review and organized records. This is the part almost nobody keeps up, and the one that really makes the difference in an inspection.
If you would rather not handle it in-house, see our AML services or our external SEPBLAC representative service. And if what you need is to train your team, there is our mandatory anti-money laundering course.
The 10 elements of an AML/CFT system you can defend before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before an inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These are the words you will read in a SEPBLAC request for information. Understanding them keeps you from signing things you do not understand.
A person or company listed in Article 2 of Law 10/2010 and therefore required to identify customers, keep records and report suspicions.
The law on the prevention of money laundering and terrorist financing, implemented by Royal Decree 304/2014. It sets out what has to be done and who must do it.
Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offenses: the financial intelligence unit and AML/CFT supervisor.
A set of checks on the customer: identifying them, knowing whether they are acting on their own behalf and understanding the transaction. It can be simplified, standard or enhanced.
The individual who ultimately controls or benefits from a company that buys in your store. They must be identified; the company’s tax ID (CIF) is not enough.
A reasonable explanation of the money used to pay. It is requested for transactions of a certain size or when the transaction does not fit the customer’s profile.
A confidential report filed when, after examining the case, there are indications that the funds or transactions stem from criminal activity.
The duty not to carry out the transaction in certain cases, and to report it afterwards. It is the most uncomfortable decision at the counter and the one most often improvised.
A formally appointed person who signs the reports and handles the supervisor’s requests for information. The appointment is notified to SEPBLAC.
A written criterion on when a transaction triggers the obligations of Law 10/2010, consistent with how the business actually takes payment.
Cash acceptance policy, till and POS terminal settings, and instructions signed by counter staff.
The business’s own analysis of its risks: type of customers, high-value products, purchases from private individuals, distance selling.
A dated and approved self-assessment document, revised when the activity changes.
Identification of the customer and, where applicable, the beneficial owner, before executing the transaction, with a level of detail proportionate to the risk.
Customer records with a copy of the ID document, linked to the invoice or purchase receipt.
A procedure to examine transactions that do not fit, decide whether to refrain and report suspicions to SEPBLAC confidentially.
Internal special-examination notes, a log of decisions and receipts for the reports submitted.
Responsible persons appointed in writing, trained staff and external review of the system as required by the regulations.
Minutes of appointment, an annual training plan with attendees and certificates, and the external expert report.
If you recognize yourself in two or more, you do not have a paperwork problem: you have a system that does not exist.
Dealing in jewelry and precious metals is not the only business that suddenly discovers it is an obliged entity. Each activity has its own friction points: cash at the counter, a client’s money in the firm’s account, or the gambler who turns up with chips. If you run several activities, look at these pages too.
Agencies and developers: identifying buyer and seller, source of funds and a file for each transaction.
Gaming halls and gambling operators: entry controls, chip exchange and traceability of winnings and deposits.
Tax and accounting firms: when an engagement comes into scope and what file to open for each client.
If you also accept crypto payments or exchange virtual currencies, the applicable regime changes and becomes stricter.
Want to start with the basics? Visit our anti-money laundering page, see our AML services or first check whether you are on the list of obliged entities.
Tell us how your store works—what you sell, how you take payment, whether you buy gold from private individuals—and we will tell you what is missing and in what order to set it up.
Last updated: August 4, 2026
Dealing in jewelry, precious stones and precious metals is one of the sectors that Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing includes in its Article 2 for a specific reason: these are high-value goods, easy to carry and with a very liquid second-hand market. In practice, a neighborhood jewelry store can be subject to the same set of obligations—manual, due diligence, suspicious transaction reporting—as a financial institution, except that it has no compliance department to deal with them. This page translates that framework into day-to-day counter operations.
The key is not the product: it is the payment method. Traders in goods become subject to Law 10/2010 when cash payments reach the amount set by the regulations, calculated as those regulations provide. That is why two identical jewelry stores can be in different positions: the one that only accepts card and bank transfer is, as a general rule, outside the regime through this route; the one that accepts banknotes for pieces of a certain value is fully in. On top of this there is a second rule that is often confused with the first: the legal limit on cash payments when a business or professional is involved, which is a separate tax obligation, with its own penalty regime, and does not replace due diligence. Before setting anything up, you should put the business’s cash acceptance policy in writing and configure it at the till: it is the decision that shapes the rest of the system. We review it with you in the first consultation and tell you whether or not you are on the list of obliged entities.
Due diligence comes down to three steps that fit into one minute of a sale. Identify the customer with a valid document and keep a copy. When the buyer is a company, check who is behind it: the beneficial ownership of that company, because a tax ID (CIF) identifies no one. And understand the transaction, asking about the source of funds when the amount or the context justifies it. The rules scale these checks: there are cases of simplified due diligence and cases of enhanced due diligence, for example with politically exposed persons or high-risk customers. All of this is documented in a record for each customer, linked to the invoice, kept for the legal period and stored in an organized, easy-to-locate way. You should also plan for the awkward case: a transaction that does not fit the profile of the person carrying it out, which requires you to examine it, consider the duty to refrain and, if the suspicion remains, report it to SEPBLAC confidentially and without alerting the customer. The rule that sums up the sector is simple: in anti-money laundering, what is not documented did not happen, however well it was done at the time.
Law 10/2010 does not require a department: it requires identifiable responsible persons. That means a written manual with the business’s real procedures, a self-assessment of its own risk, an internal control body or officer depending on the size of the company, and a formally appointed SEPBLAC representative who signs the reports and handles requests for information. Add to that training for customer-facing staff—with an attendance list and certificate, because it is the first thing you will be asked to prove—and a review of the system by an external expert as required by the regulations. If you also sell remotely, there is one more piece: non-face-to-face identification, whose video methods are regulated by Order ETD/465/2021 and whose evidence must be kept. In a family business these roles usually fall to the owner, who already handles purchasing, the till and the workshop, which creates an obvious practical problem: nobody has the time. That is why many stores outsource the role to an external SEPBLAC representative and commission a tailored AML manual instead of improvising one from a template.
SEPBLAC action almost always starts with a request for information: the current manual, the risk self-assessment, the appointment of responsible persons, training records, customer records for specific transactions and the external expert review. What is assessed is whether those documents existed before the request and whether the system was actually being applied. Infringements of Law 10/2010 are classified as minor, serious and very serious, with penalties ranging from a private reprimand to fines and public reprimands; the proceedings are investigated by SEPBLAC and decided by the competent body depending on the severity. Meanwhile, the EU AML package—Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620 establishing the AMLA authority—is moving forward with phased application and is being implemented: it will harmonize obligations and raise the bar for traders in high-value goods. Preparing now is cheaper than redoing it later; if you already have a request for information on your desk, start with SEPBLAC inspection.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .