AML Obliged Entities in Spain
If your business qualifies as an obliged entity, you must put AML/CFT measures in place under Law 10/2010 and Royal Decree 304/2014. We help you turn compliance into traceable evidence: risk assessment, KYC/UBO, internal control, alerts and a corrective action plan you can defend before SEPBLAC.
Free consultation
We reply within 24 h
- Document retention
- 10 years
- Report submitted to the board
- Max. 3 months
- List of obliged entities
- Law 10/2010, Art. 2
- Implementing regulation
- Royal Decree 304/2014
Key AML/CFT obligations of obliged entities
What every obliged entity must implement, document and be able to prove to supervisors.
Law 10/2010 + Royal Decree 304/2014
The starting point: policies, procedures, internal control, due diligence, reporting and retention of evidence in line with the regulations.
Am I an obliged entity, and what applies to me?
We analyze whether you fall within scope and how far: activity, channels, customer types and risk exposure, so you avoid “generic compliance”.
KYC + Beneficial Owner (UBO)
Consistent files: formal identification, beneficial owner, profile, risk level and record retention for the legal periods.
Controls and evidence for information requests
Traceable decisions, alert management, an incident log and verifiable closure of corrective measures.
Article 29 plan (by role)
Up-to-date, role-specific training with a verifiable record. No generic courses unrelated to the real risks of your sector.
Corrective measures
Findings prioritized by risk + a plan with a timeline: owners, evidence and follow-up to close the obliged entity’s gaps.
How we help obliged entities comply with AML/CFT rules
An agile methodology to put obligations into practice, test operational effectiveness and leave defensible evidence without slowing down your operations.
Obliged entity diagnosis
We confirm whether you qualify as an obliged entity and your real scope: activity, risks, channels, customer types and the controls you need.
Operational testing (sampling)
We sample files and processes to audit how due diligence (KYC/UBO), alerts and record retention are applied.
Gaps and corrective measures
A draft listing the deficiencies found and corrective measures prioritized by risk, with a timeline and verifiable evidence.
Delivery and traceability
Documentation ready: supporting evidence, records, decisions and a roadmap to keep the obliged entity compliant.
What do we review at obliged entities?
We check that risk, procedure and evidence are consistent, to prove operational effectiveness. We audit physical documentation and digital traceability.
1. Records and Documentation (KYC)
We check that documents are retained for the legal period of 10 years. We review the completeness of formal identification and beneficial ownership declarations in a random sample.
.webp)
2. Software and Alerts
We put the monitoring tool to the test. We simulate risk scenarios to check whether it generates the right automated alerts and whether their handling is logged.
.webp)
3. Training Plan (Art. 29)
We review certificates and content. We confirm that training is up to date and specific to each role, not generic, and that there is a verifiable record.
Full review or follow-up?
What matters is the evidence: tests, sampling and closed corrections. Knowing the difference helps you optimize resources without lowering traceability.
| Feature | Full Review | Follow-up Review |
|---|---|---|
| When is it due? | When the system is set up, in the first cycle, or after substantial changes in controls and risks. | Where applicable, focused on verifying that earlier corrections have been implemented. |
| Scope | Comprehensive assessment: risk, KYC/UBO, alerts, training and governance (OCI). | Verification limited to the closure of corrective measures and the supporting evidence. |
| Legal Basis | Art. 28(1) of Law 10/2010 | Art. 28(1) (second paragraph) of Law 10/2010 |
| Objective | Measure operational effectiveness and detect gaps that affect the obliged entity. | Confirm that deficiencies have been remedied and that traceability is closed. |
*Order EHA/2444/2007 sets technical criteria for deciding whether a change requires a new full review before 3 years have passed.
Key AML/CFT evidence for obliged entities
In an inspection, evidence is what makes the difference: tests, sampling, dates and a documented remediation plan.
Evidence you must be able to show
- A defined reference date — Make clear which date “closes” the cycle so the supporting documentation stays consistent.
- Tests and results — Document what was tested, what the results were and which incidents were detected. Not just conclusions.
- Sampling explained — Size, criteria, customer types, products, periods and % reviewed. If statistical: population, method and confidence level.
- Remediation plan with a timeline — If deficiencies cannot be fixed right away, an approved plan with a timeline and evidence of closure.
- Organized records — KYC, beneficial owner, analyses performed and supporting documents: ready to hand over quickly when a request for information arrives.
Minimum timeline for obliged entities
Could I fall outside the obliged entity rules?
It depends on exactly how your activity fits. The list covers many sectors, and the scope varies with your operations and risk. Misclassification often shows up as a weakness in inspections.
Obliged entities and SEPBLAC: a practical approach to compliance
Obliged entities must be able to show an effective prevention and control system. To act as an external expert, you must notify SEPBLAC of your intention to do so before starting the activity. At Molina Law Boutique, we are registered with SEPBLAC as external experts.
Common mistakes by obliged entities that we fix
The goal is not to “check the box”, but to avoid operational gaps that lead to information requests, penalties and reputational lockout.
“Paper compliance”
A generic manual that is never applied. What counts is operational effectiveness and evidence, not nice-looking documents.
Incomplete or inconsistent UBO data
Collecting ID cards is not enough. Beneficial ownership is not properly documented, or there are errors in complex corporate structures.
Generic training
Art. 29 requires specific training. Typical mistake: off-the-shelf courses that ignore the sector’s real risks and lack a solid record.
High risk without enhanced measures
Failing to apply enhanced due diligence to PEPs, high-risk jurisdictions or sensitive operations creates direct exposure to penalties.
What an obliged entity must be able to prove
Beyond the “document”, what matters in an inspection is traceability: deadlines, tests, sampling and a corrective plan.
Governance and control cycle
- Planning aligned with risk and the annual cycle.
- A consistent reference date (no gaps between years).
- Prompt issuance: so the supporting evidence does not “arrive late”.
- Internal escalation: deficiencies reported to the board/OCI + corrective measures.
Key to avoid ending up with “formal compliance” and no real execution.
Sampling and evidence
- What was tested: tests, results and findings.
- Sample explained: size and coverage by customers, products and periods.
- Traceability: KYC/UBO, alerts and training backed by documents.
- Errors detected: cause, impact and verifiable correction.
Unexplained sampling is often the first weak point when a request for information arrives.
Independence and retention
- Real independence: avoid incompatibilities and conflicts.
- The right choice of expert: the team’s experience and competence.
- Retention: evidence ready to hand over quickly.
- Availability: order and speed when a request comes in.
Reduces penalty and reputational risk.
Risk-based approach
- Controls proportionate to the activity, customers and operations.
- Enhanced measures for PEPs and high-risk scenarios.
- Consistency between the manual, procedures and day-to-day execution.
What “adds up” in an inspection is consistency between risk, control and evidence.
Risks and penalties if compliance is not up to date
Information requests and proceedings: gaps in the internal control system can lead to sanctioning proceedings.
Financial penalties: they can escalate depending on the seriousness, volume and impact of the breach.
Reputational risk: loss of trust from banks, customers, investors and strategic partners.
Operational blocks: friction in onboarding and with suppliers, bank accounts and external audits.
Cost of reacting: fixing things late is always more expensive than implementing and documenting properly in time.
Are you an obliged entity and need to get your AML/CFT compliance in order?
We help you implement and demonstrate an effective system: KYC/UBO, alerts, training, records and a corrective action plan backed by defensible evidence.
Review my obligations as an obliged entityRelated services for obliged entities
Compliance as an obliged entity ties in with these services, which strengthen your AML/CFT program.
AML/CFT Manual
The core document of the program: policies, KYC, RBA, monitoring, governance and training.
→ AuditInternal AML/CFT Audit
Independent review of controls, KYC, monitoring and STRs, with a remediation plan.
→ ExpertExternal Expert Report
Independent audit required by Law 10/2010, with sampling, evidence and a corrective plan.
→ RiskRisk Self-Assessment (IAR)
RBA methodology: identifying, measuring and managing risks by customer and jurisdiction.
→ TraceabilityTraceability Report
Analysis of flows, source of funds and operational traceability for obliged entities.
→ CatalogFull AML/CFT Catalog
All our anti-money laundering services: implementation, audits and ongoing support.
→AML obliged entities in Spain: frequently asked questions
What does it mean to be an “obliged entity” for AML/CFT purposes?
It means your activity is subject to anti-money laundering obligations. You must implement an internal control system with a risk-based approach and be able to show that it works in practice under Law 10/2010 and Royal Decree 304/2014.
How do I know if my company is an obliged entity?
It depends on exactly where you fit in the legal list, the service you provide and how you operate. If in doubt, it is wise to confirm your status before implementing a system that falls short or is oversized.
What are the minimum obligations of an obliged entity?
Risk assessment, policies and procedures, due diligence (KYC), identification of the beneficial owner (UBO), internal control/OCI, training (Art. 29), monitoring and record retention.
What documentation must it show in an inspection?
Traceability: tests, sampling, records, alert management and documented decisions. Prioritized findings + a corrective plan with a timeline and evidence ready to hand over.
What are the benefits of getting compliance in order?
It reduces penalty and reputational risk, improves access to banking, speeds up audits and avoids operational blocks. A well-run system shows diligence and real control.
What should you prepare before an AML/CFT review?
Current manual, risk assessment, OCI structure/minutes, customer acceptance policy, KYC/UBO files, alert logs, training and evidence of corrective measures.
What happens if an obliged entity fails to comply?
The risk of information requests, penalties, operational blocks and reputational damage goes up. Preventing and documenting properly usually costs less than fixing things against the clock.
How much does a review of obligations cost?
It depends on size, sector, number of files and complexity. What matters most is the real scope of the sampling and the evidence available. We quote after a quick diagnosis.
Book a call
Obliged entities under Spanish AML/CFT law
Obliged entities are defined in Article 2 of Law 10/2010 on the prevention of money laundering and terrorist financing. They include financial institutions, payment institutions, electronic money issuers, investment services firms, professionals (lawyers, auditors, notaries), real estate businesses, casinos, dealers in high-value goods and crypto-asset service providers.
Core obligations
Every obliged entity must implement: risk assessment (RBA), due diligence procedures (KYC/KYB), identification of beneficial owners (UBO), an AML manual, transaction monitoring, sanctions/PEP screening, mandatory training (Art. 29), suspicious transaction reporting and record retention for 10 years.
Testing and audit
The system must be tested through internal audits and the External Expert Report under Article 28 of Law 10/2010. Evidence of operational effectiveness, sampling, the corrective plan and escalation to the control body is key before SEPBLAC.
AML/CFT services
Other related services
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Royal Decree 304/2014 of May 5, approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Order EHA/2444/2007 of July 31 (external expert report on the prevention of money laundering)BOE · consolidated text
Legislation and links reviewed in .