AML Manual in Spain
The AML manual is the core document of your anti-money laundering program: policies, KYC/KYB, risk assessment, transaction monitoring, governance and reporting procedures under Law 10/2010 and Royal Decree 304/2014.
Free consultation
We reply within 24 h
- Key legislation
- Law 10/2010
- Implementing regulation
- Royal Decree 304/2014
- List of obliged entities
- Art. 2
What is an AML/CFT manual?
The AML manual brings together the policies, controls and procedures designed to detect, prevent and report money laundering and terrorist financing. It is the document that evidences your program to SEPBLAC and supervisors.
Risk assessment
Identify, assess and document risks by customer type, product, channel and jurisdiction. The basis for prioritizing controls and justifying regulatory decisions.
Due diligence
Procedures to verify identity, beneficial owners, powers of attorney and documentation. Requirements differentiated by risk and customer type, with ongoing updates.
Transaction controls
Detection rules and scenarios (threshold, behavior, velocity, patterns) with traceability and evidence for audits and STRs.
Policies and internal controls
Written manual, roles and responsibilities, operating limits, alert escalation, segregation of duties and internal/external audit procedures.
Sanctions, PEPs and EDD
Automated checks against sanctions and PEP lists. Enhanced due diligence for high-risk individuals, jurisdictions or activities.
STRs and cooperation
Criteria and channels for filing suspicious transaction reports with the competent unit, with confidentiality and record-retention protocols.
How we draft your AML manual
We tailor the manual to your actual business instead of delivering a generic document. Each section is validated against your operations and prepared to withstand an inspection.
Initial assessment
We get to know your business, customers, products, channels and jurisdictions. We identify the AML/CFT obligations that apply to you and the specific risks of your model.
Risk assessment (RBA)
We design the classification methodology: criteria, segmentation, risk levels and associated measures. All of it documented and justifiable.
Drafting the manual
KYC/KYB, monitoring, screening, escalation, STR, training, retention and governance policies. Clear, operational language, not “pretty paperwork.”
Implementation and training
We support the rollout: operational checklist, role-based training, control testing and audit preparation.
Essential contents of the AML manual
A practical guide to implementing an anti-money laundering program tailored to financial institutions, VASPs and obliged entities.
.webp)
Regulatory framework and scope
Definition of obliged entities, scope of the manual, legal references and criteria for adapting policies to the jurisdiction and type of activity.
.webp)
KYC and monitoring procedures
Identification and verification protocols, risk classification and transaction monitoring rules to detect unusual transactions.
.webp)
Reporting, governance and training
Suspicious transaction reporting process, duties of the Compliance Officer, ongoing training and AML program audit.
Key players and risks in the AML program
Who takes part in implementing the manual and which risks we manage.
Essential measures included in the manual
- Risk assessment and segmentation (RBA) — Periodic assessment to identify threats by customer type, product, channel and jurisdiction, with documented classification criteria.
- Strengthened KYC/KYB procedures — Clear steps for verifying identity, beneficial owners and powers of attorney and for validating documents according to the risk level.
- Internal controls and governance — Written policies, roles, operating limits, alert escalation and a Compliance Officer with adequate authority and resources.
- Transaction monitoring and alerts — Detection rules (threshold, behavior, patterns) with processes for investigation, closure and evidence traceability.
- Sanctions and PEP screening — Automated checks with blocking/escalation policies and periodic updates of data sources.
- STRs and cooperation — Criteria, channels and protocols for reporting suspicious transactions while preserving confidentiality and record retention.
- Ongoing training and testing — Tiered training on AML obligations, red flags and procedures. Tests, drills and effectiveness audits.
Obliged entities and parties
Financial institutions: banks, payment institutions, electronic money issuers.
Investment service providers and insurers, included as obliged entities.
Professionals and non-financial sectors: real estate agencies, lawyers, auditors, casinos, dealers in high-value goods.
Risks the manual mitigates
Regulatory non-compliance, administrative or criminal penalties, reputational damage, exposure to fraud and operational failures. Implementing proportionate controls with records, audits and response plans significantly reduces risk.
Request an AML manual →Common AML manual mistakes we fix
Most deficiencies do not come from a “missing manual” but from generic manuals that do not reflect actual operations or lack executable controls.
Generic off-the-shelf manual
Policies copied without adapting them to the entity’s actual business, customers or jurisdiction. It does not survive the first question in an inspection.
KYC without ongoing updates
Files verified at onboarding but with no periodic reviews or update triggers when the customer’s risk or activity changes.
Uncalibrated monitoring
Generic rules with standard thresholds: excessive false positives or real risk scenarios left uncovered. No traceability of decisions.
Compliance Officer without authority
A role assigned “in name only,” with no functional independence, resources, power to suspend transactions or direct access to senior management.
Risks of operating without a proper AML manual
Regulatory sanctions: fines, disqualifications and requests for information due to missing AML/CFT policies, controls or evidence of compliance.
Criminal liability: exposure of directors and senior managers for failing to implement the controls required by law.
Reputational damage: harm to your standing with customers, investors, correspondent banks and partners if there is no documented AML program.
Operational blocks: blocked accounts, onboarding friction, problems with correspondents and providers that require AML evidence.
Cost of reacting: adapting the program after an inspection or sanction is much more expensive than implementing it properly from the start.
Do you need an AML/CFT manual that actually works?
We draft your manual to fit your business: policies, KYC, RBA, monitoring, screening, STRs, training and governance. Ready for inspections and audits.
Request an AML manualServices that complement the AML manual
The manual is not a stand-alone document. These services strengthen your program and cover areas the regulator usually reviews alongside the manual.
AML/CFT internal audit
Independent review of controls, KYC, monitoring, STRs and training, with a remediation plan.
→ ExpertExternal Expert Report
Independent audit required by Law 10/2010: sampling, evidence and a corrective action plan for SEPBLAC.
→ RiskRisk Self-Assessment (IAR)
RBA methodology: identifying, measuring and managing risks by customer, product and jurisdiction.
→ CryptoCrypto-Assets and Blockchain
AML compliance for VASPs: Travel Rule, on-chain traceability, MiCA and regulatory requirements.
→ ComplianceCorporate Compliance
Criminal compliance programs, whistleblowing channel, code of ethics, training and third-party due diligence.
→ CatalogFull AML service catalog
All our anti-money laundering services: implementation, audits, outsourcing and ongoing support.
→What you should know about the AML manual
Expand each section to review the legal bases, individuals’ rights, entities’ obligations and the best practices that set apart a “box-ticking” manual from one that protects your entity.
1Principles and legal bases for data processing
In AML, it is essential to apply the data protection principles (lawfulness, fairness, transparency, data minimization) and, for each processing activity, to identify the legal basis: compliance with a legal obligation, performance of a contract or a duly balanced legitimate interest.
The most common bases are: AML/CFT legal obligations (retaining information and making it available), performance of a contract (provision of financial services) and legitimate interest (fraud and security management, with a documented balancing test).
Recommendation
Document the legal basis that applies to each activity (onboarding, monitoring, reporting, retention) in the Record of Processing Activities and in the AML manual itself.
2Individuals’ rights
Individuals keep their rights over their data: access, rectification, erasure, restriction, objection and portability, except where restricted by retention obligations or AML/CFT investigations.
- Centralize requests with one designated person and an official channel.
- Verify identity using strengthened procedures.
- Record each request, decision and legal justification.
- Train teams to spot requests that could affect AML investigations.
3Obligations of obliged entities
Banks, payment institutions, financial service providers and covered professionals must comply with: identification of customers and beneficial owners, risk assessment, KYC/KYB and record retention.
There must be a documented procedure governing onboarding, source-of-funds verification, transaction controls and reporting mechanisms. Due diligence must extend to critical counterparties: correspondents, custodians and business partners.
4Compliance Officer and internal control body (OCI)
It is essential to appoint a Compliance Officer with functional independence, the power to suspend or escalate transactions and the authority to coordinate reports and responses to regulators.
Internal control body (OCI)
The internal control body validates RBA methodologies, approves audits and coordinates the legal, compliance and operations teams. Not having formally designated officers increases the risk of sanctions.
5Identification and verification (KYC/KYB)
Apply KYC/KYB in proportion to the profile: identify natural persons and legal entities, verify beneficial owners and obtain evidence of the source of funds for higher-risk transactions.
- KYC checklists by customer type and product.
- Document and digital verification through certified providers.
- Identification of beneficial owners in complex corporate structures.
- Request evidence of the source of funds for atypical transactions.
6Risk assessment (risk-based approach)
The RBA classifies customers, products and transactions by jurisdiction, nature of the business, transaction history and structural complexity. It determines whether standard or enhanced due diligence (EDD) applies, how often reviews take place and the triggers for blocking or escalating.
The methodology and indicators must be documented to justify decisions to auditors and supervisors.
7Detecting and reporting suspicious transactions (STR)
A secure internal channel for handling alerts, with clear escalation criteria and a procedure for reporting to the financial intelligence unit while preserving confidentiality.
- Transactions with no economic rationale or with insufficient documentation.
- Systematic structuring to stay below control thresholds.
- Dealings with sanctioned or high-risk jurisdictions.
- Corporate structures that conceal beneficial owners.
8Technical and organizational controls (T&O)
Proportionate controls: encryption of sensitive data, multi-factor authentication, role-based access control, audit logging, segregation of environments and automated screening built into operational workflows.
These controls let you operate with confidence in your dealings with supervisors and reduce your operational risk surface.
All about the AML/CFT manual
What is an AML manual?
It is the core document of the anti-money laundering program. It brings together KYC/KYB policies, the RBA methodology, monitoring procedures, incident management and reporting. It must be kept up to date, tested and available to supervisors.
Who is required to have an AML manual?
All obliged entities under Article 2 of Law 10/2010: financial institutions, payment institutions, professionals (lawyers, auditors), real estate agencies, casinos, dealers in high-value goods and VASPs where applicable.
What must it include, at a minimum?
KYC/KYB policies, risk assessment (RBA), monitoring procedures, sanctions/PEP screening, STRs, governance (Compliance Officer, OCI), training, record retention and audit procedures.
How often must it be updated?
At least once a year, and whenever there are relevant regulatory changes, changes in the entity’s business, new products/channels/jurisdictions, or audit findings that require adjustments.
What is the difference between an AML manual and an AML audit?
The manual is the document that sets out policies and procedures. The audit is the independent review that assesses whether the manual is actually applied and whether the controls are effective. They complement each other: a manual without an audit does not prove effectiveness, and an audit without a manual has no frame of reference.
What happens if I don’t have an AML manual?
Risk of administrative and criminal penalties, requests for information from SEPBLAC, operational blocks (banks, partners, audits), reputational damage and reaction costs far higher than the cost of preventive implementation.
What role does the Compliance Officer play?
The Compliance Officer is operationally responsible for the AML program and must have functional independence, access to senior management, the power to suspend suspicious transactions and the authority to coordinate reports and responses to regulators.
How much does it cost to draft an AML manual?
It depends on the size of the entity, the sector, jurisdictions, customer volume and the complexity of its operations. We give you a tailored quote after an initial review of your risk and the documentation available.
Book a call
Tell us about your situation and we will explain how to draft or update your entity’s AML manual.
Regulatory framework for the AML/CFT manual in Spain
The AML/CFT manual is an obligation arising from Law 10/2010 on the prevention of money laundering and terrorist financing and its implementing regulation (Royal Decree 304/2014). It must contain the policies, procedures and controls that the obliged entity applies to prevent and detect money laundering.
Mandatory content
At a minimum, the manual must include: identification of obliged entities and scope, risk assessment (RBA), due diligence procedures (KYC/KYB), transaction monitoring, sanctions and PEP screening, suspicious transaction reporting (STRs), internal governance (Compliance Officer, OCI), training and record retention.
Updates and testing
The manual must be updated at least annually and tested through internal audits and the External Expert Report where applicable. Evidence of updates, approval by management and operational application is key to demonstrating compliance to SEPBLAC.
AML/CFT services
Other related services
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Royal Decree 304/2014 of May 5 approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .