We design and maintain the anti-money laundering system of payment institutions, EMIs, money remitters and licensed fintechs: traceable digital onboarding, monitoring with calibrated rules, alerts with a documented file and an agent network that is not your blind spot.
Would your AML system survive a review?
Tell us which license you hold or are applying for, what volume you process and through which channels. We will tell you where the gap is before the supervisor finds it.
At a fintech, the problem is not having a manual. It is making sure the manual, the rules engine and what actually happens in production all say the same thing. These are the pieces we review.
A manual built on your real model (product, channel, country and customer profile), with due diligence levels, escalation criteria, a threshold policy and the procedure for special review and reporting. Versioned and approved, not inherited from a bank template.
Frictionless customer onboarding with an audit trail: non-face-to-face identification in line with Order ETD/465/2021, KYB for business customers, beneficial ownership, screening at onboarding and due diligence levels consistent with the assigned risk.
Self-assessment by product, channel, geography and customer. Your rules should come out of this document, not the other way around.
Due diligence, contract, training and oversight of those who bring in customers and operate on your behalf. The classic weak spot of the sector.
Screening at onboarding and on an ongoing basis, handling of matches and traceability of every discarded match.
If your flows involve crypto-assets, analysis of addresses and counterparties is added to traditional screening.
Four conversations that keep coming up: the one before the license, the high-risk corridor, the card program and the compliance officer who inherits an uncalibrated engine.
"We are preparing the application to the Bank of Spain, and they ask us to describe the AML system. I don’t want a pretty manual: I want one we can actually run the day we have ten thousand customers."
"We send remittances to countries that everyone classifies as high risk. I need rules that detect real smurfing, not rules that block half of my regular customers every Friday."
"We issue wallets and cards with fully digital onboarding. My question is not whether we identify customers properly. It is whether I could prove it with evidence if SEPBLAC asked me for twenty specific files."
"I joined as compliance officer and found thousands of open alerts and rules that nobody knows who configured, or why. I need to sort it out before the next review."
They are rarely failures of intent or budget. They are failures of traceability. The system does reasonable things that nobody can prove afterwards.
The engine with factory settings: rules and thresholds that came as the vendor’s defaults, with no document explaining why those values and not others, and not a single calibration test against your own data. It works until someone asks why.
The alert backlog: a queue that grows every month and is closed in bulk when the workload peaks, with generic reasons such as "usual activity". An alert closed without documented reasoning is worse than an alert that was never generated.
The agent network without files: distributors who bring in customers in your name with no prior due diligence, no documented training and no visits. You are answerable for their operations even if the customer never knew you existed.
| Area of the model | What the supervisor expects | Supporting evidence |
|---|---|---|
| Fully digital onboarding | Non-face-to-face identification through an approved procedure, applied the same way every time and reconstructable case by case | A procedure in line with Order ETD/465/2021, retained evidence and a log of rejected onboardings with the reason. |
| Agent and distributor network | That the institution controls, and answers for, those who bring in customers and operate in its name, to the same standard it applies in-house | Due diligence on the agent, a contract with AML obligations, documented training and recorded periodic reviews. |
| High transaction volume | Justified rules and thresholds, calibrated with your own data, and alerts closed with a reasoned decision | A versioned rule catalog, a calibration report and an alert file showing analyst, date and conclusion. |
We review the whole picture: risk map, manual, onboarding, rules and thresholds, alert queue, sanctions screening and agent oversight. We tell you what is missing, what is surplus and in what order to fix it, so that your file holds up to a SEPBLAC request for information.
From the moment you operate. Payment institutions, electronic money institutions and money remitters are listed in Article 2 of Law 10/2010 as financial institutions, and the obligations arise with the activity, not with the first request for information.
In practice, you need the system before that: the authorization application to the Bank of Spain requires you to describe how you will prevent money laundering, with what resources and who is responsible. A project that reaches that stage with a generic manual usually comes away with requests for information. We handle it together with the payment institution license.
Both, at different levels. The Bank of Spain authorizes and registers your license under the payment services framework (Directive (EU) 2015/2366 (PSD2) and, in Spain, Royal Decree-law 19/2018) and supervises the institution as a whole. SEPBLAC is the financial intelligence unit and the specific anti-money laundering supervisor: it receives your reports and reviews your system.
In practice, that means two counterparts, two files and no using one as an excuse with the other. What was submitted in the license application must match what is actually done when SEPBLAC checks it.
Yes, with a proper procedure. Order ETD/465/2021 regulates remote video identification methods (asynchronous video and live video). It requires the procedure to be documented and approved before use, and the evidence to be retained.
What does not work is what we see most often: a photo of the ID document uploaded from a phone with no verification and no trail. Nor is it enough to hire a vendor and trust it: responsibility stays with the institution, and the vendor’s procedure has to be yours, reviewed and approved by you. More detail in AML and KYC.
The ones that follow from your risk map, not the ones the vendor ships by default. The right sequence is: a risk self-assessment by product, channel, geography and customer type; that gives you the scenarios you need to monitor; and each scenario becomes a rule with its threshold.
Typical scenarios include structuring, unusual transaction velocity, immediate inflows and outflows, high-risk corridors, inconsistency with the declared profile and links between seemingly independent accounts. The list is not what counts. What counts is having a document that explains why each threshold has the value it has.
There is no official figure, and be wary of anyone who gives you one. What is assessed is whether the rate is measured, explained and under control. An engine that generates more alerts than your team can analyze produces a worse result than a narrower one that is properly handled: alerts closed en masse with no criteria.
The reasonable answer is a documented calibration cycle: measure the rate, identify the noisy rules, adjust thresholds with your own data, test the effect before moving it to production and record the before and after. That report is your best defense when someone asks why a transaction did not trigger an alert.
Everything a third party needs to reconstruct the decision without calling you. At a minimum: which rule fired and with what parameters, the transaction and customer data at that moment, the analysis performed, the additional information requested and received, the reasoned decision, who made it and when.
If the conclusion was to file a suspicious transaction report, the proof of the report to SEPBLAC is also kept on file; if it was to refrain from executing the transaction, the record of that decision. And if it was to dismiss the alert, the specific reason: "usual activity" is not a reason, it is a label.
Yes. The external network operates in your name, and the institution answers to the supervisor for its operations. It is the most common blind spot in remittances and product distribution: agents who onboard customers to a different standard from the in-house one, without documented training and with nobody reviewing a sample of their files.
Control is proven with documents: prior due diligence on the agent, a contract with express AML obligations, training with attendance records, periodic review of the files they bring in and minutes of visits. We cover this in payment institution agents.
Not by definition, but they do have features you must recognize in the self-assessment. In remittances, the key factors are destination corridors, cash transactions, small repeated amounts and the use of intermediaries. In marketplaces and aggregated payment models, the difficulty lies in knowing both ends of the transaction and in detecting merchants that channel third-party funds.
Pretending that the risk does not exist is the costly mistake. Recognizing it, scaling due diligence and documenting the additional controls is what turns an awkward model into a defensible one. You can see how it fits in money transfer and money remitters.
You can rely on vendors, but responsibility cannot be outsourced. The institution must know and approve the procedures the vendor applies, be able to audit them, retain the evidence and keep control of the decisions that matter: accepting a customer, closing an alert or filing a suspicious transaction report.
Add the technology layer: contracting critical ICT providers also falls within the scope of Regulation (EU) 2022/2554 (DORA), with a register of information on providers and mandatory contractual clauses. If you want to delegate the internal function, see AML outsourcing.
An AML system in payments is judged by its end-to-end traceability: why that rule, why that threshold, who analyzed it and what they decided. This is the path we put in place.
Self-assessment by product, channel, geography and customer. It produces the scenarios to monitor, the due diligence levels and the threshold policy. It is the phase almost everyone skips, and the one that later forces you to redo everything.
Manual and policies, onboarding with traceable non-face-to-face identification, sanctions screening, a rules engine configured with your own criteria and an alert workflow with files and escalation levels.
Periodic calibration with real data, control of the alert queue, review of the agent network, team training and the external expert review. This is the part that turns a system that has been set up into a living one.
If you are still at the license stage, start with the payment institution license or the EMI license. If you already operate and need to put your system in order, see our AML services and the external SEPBLAC representative.
The 10 elements of an AML system you can defend before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before an inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These terms appear in requests for information and in external expert reports. Using them precisely saves half a meeting of clarifications.
An institution authorized and registered by the Bank of Spain under the PSD2 framework and Royal Decree-law 19/2018, and listed in Article 2 of Law 10/2010 as a financial institution.
The set of identity, activity and purpose checks carried out before accepting the customer and updated during the relationship.
A remote identification method regulated by Order ETD/465/2021: asynchronous or live video, with an approved procedure and retained evidence.
Automated analysis of transactions against defined risk scenarios, to detect behavior that is inconsistent with the customer’s profile.
The parameter that determines when a transaction generates an alert. Its choice must be justified by your own data and reviewed periodically.
An alert generated by a legitimate transaction. The false positive rate measures the quality of the calibration and determines the real capacity of the analysis team.
The complete record of an alert: triggered rule, data, analysis, information requested, reasoned decision, author and date.
Confidential reporting to SEPBLAC of transactions showing indications of money laundering, and of the systematic reports required by the regulations.
Checking the customer and its counterparties against financial sanctions lists and for politically exposed person (PEP) status.
A self-assessment that recognizes the real risks of the business (corridors, cash, agents, marketplace), not a generic textbook matrix.
An approved and dated self-assessment document, a matrix by product, channel, geography and customer, and the approval minutes.
Customer onboarding with due diligence levels consistent with the assigned risk and with traceable, reproducible non-face-to-face identification.
A procedure in line with Order ETD/465/2021, retained evidence, KYB files and a log of rejected onboardings.
Rules derived from the risk map, justified thresholds and an alert queue handled within internal deadlines.
A versioned rule catalog, calibration reports, queue metrics and a complete file for each alert.
Screening at onboarding and on an ongoing basis, with written criteria for handling matches and rescreening after list updates.
Engine configuration, a log of matches with the reason for discarding each one and evidence of periodic rescreening.
Effective control over those who bring in customers or operate in the institution’s name, and over the vendors the system relies on.
Due diligence on the agent, contracts with AML obligations, documented training and review or visit minutes.
They are the first to show up in an external review, and the most expensive to fix once the request for information has already arrived.
Moving remittances to complex corridors is not the same as issuing electronic money or combining payment activity with a commercial business. Your license and model determine which scenarios you must monitor and which additional controls the supervisor requires. These pages cover each case.
Authorization by the Bank of Spain under PSD2 and Royal Decree-law 19/2018, with the AML system built into the application.
Issuing electronic money, wallets and card programs: mass onboarding and control of fund top-ups and withdrawals.
When payment activity sits alongside another business: segregation of funds, conflicts and cross-risks.
Complex corridors, cash and agent networks: the model that requires the most additional controls to be evidenced.
For the general AML framework, go to anti-money laundering. If you issue electronic money with a European reach, check the EMI license. And if your flows involve crypto-assets, start with crypto sanctions screening.
Tell us about your model (remittances, marketplace, cards, wallets, agents) and we will give you a concrete assessment of your AML system and of what it needs to be defensible.
Last updated: August 4, 2026
A payment institution or an electronic money institution is a financial obliged entity from the moment it operates: it is listed in Article 2 of Law 10/2010, and its AML system is reviewed to the same standard as a bank’s, but with two differences that make it harder. The first is volume: thousands of transactions a day that no team can review one by one, which forces you to automate and to justify the automation. The second is the channel: customers who never set foot in a branch and are identified remotely. This page looks at the system from those two angles.
The framework for the activity is set by Directive (EU) 2015/2366 (PSD2) and, in Spain, Royal Decree-law 19/2018: the Bank of Spain authorizes and registers payment institutions and electronic money institutions and supervises how they operate. The AML framework is set by Law 10/2010, and there the specific supervisor is SEPBLAC, which is also the financial intelligence unit that receives reports. They are two separate files that mirror each other: what was described in the license application (resources, organization, controls) is exactly what SEPBLAC will check is being carried out. Hence the most expensive mistake at the authorization stage: submitting a bought or inherited AML manual that describes an institution you are not, with branches you do not have and controls nobody is going to carry out. When the review comes, the gap between paper and production is the finding. If you are at that stage, see the payment institution license and the tailor-made AML manual.
Non-face-to-face onboarding is where most fintechs fail the documentary test. Order ETD/465/2021 regulates remote video identification methods (asynchronous and live) and requires the procedure to be documented and approved before use, and its evidence to be retained. Two nuances are often overlooked. First, relying on a vendor does not shift responsibility: the vendor’s procedure must be reviewed, approved and auditable by the institution, which must be able to retrieve the evidence for any specific onboarding. Second, identification is only the first layer. You still need to assign a due diligence level consistent with the risk, apply KYC and KYB when the customer is a company, trace beneficial ownership up to a natural person and run sanctions screening before opening the account. Fast onboarding and traceable onboarding are not incompatible, but only if the design allowed for it from the start.
Transaction monitoring is judged by its backward traceability. The right chain starts with the risk map: the self-assessment by product, channel, geography and customer produces the scenarios to monitor, and each scenario becomes a rule with a justified threshold. Structuring, unusual velocity, immediate inflow and outflow of funds, high-risk corridors and inconsistency with the declared profile are common scenarios, but the list is not what gets reviewed. What gets reviewed is the document that explains why the threshold has the value it has and when it was last reviewed. Then comes the uncomfortable part: calibration. An engine that generates more alerts than the team can analyze leads to bulk closures, which is the worst possible outcome. Measuring the false positive rate, adjusting with your own data, testing before production and keeping the before-and-after report is what turns an operational complaint into a defense. And each alert needs its own file: triggered rule, data, analysis, information requested, reasoned decision, author and date.
The structural weak spot of the sector is the external network: agents and distributors who bring in customers and execute transactions in the institution’s name, often to a different standard from the in-house one. The institution answers to the supervisor, and control is proven through prior due diligence, a contract with express AML obligations, recorded training and periodic review of a sample of the files they bring in; the details are in payment institution agents. On top of this comes the business model as a risk factor: remittances to certain corridors, marketplaces with aggregated payments and prepaid card programs have profiles that must be recognized in the self-assessment and offset with additional controls. On the horizon, two frameworks already shape decisions: the EU AML package (Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620, which creates the AMLA authority), which applies in stages and is being implemented, and Regulation (EU) 2022/2554 (DORA), which subjects the system’s critical ICT providers to a register of information and mandatory contractual clauses.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .