Every obliged entity must be able to show, through a written risk analysis, that its anti-money laundering measures are adequate. We prepare your risk self-assessment report: factors, controls, residual risk and action plan, in line with Law 10/2010 and Royal Decree 304/2014.
Is your risk analysis up to date? Free review
Tell us about your business and we’ll tell you what your risk analysis must contain and what it is missing.
The risk analysis is the foundation of your entire AML system: your due diligence, your manual and your controls all depend on it. We build it with your real data and leave it ready for an inspection or an external expert review.
We gather information on your customers, countries, products, services, transactions and distribution channels: the factors required by Article 32 of Royal Decree 304/2014.
We rate each factor with a methodology you can explain, consistent with the official risk assessments and the guidance that applies to your sector.
We review your due diligence, monitoring and internal control measures and measure how effective they really are, not what the manual says.
We cross inherent risk with your controls to obtain the residual risk for each factor and prioritize where to strengthen.
We turn the conclusions into a concrete action plan and into the necessary adjustments to your AML manual and customer acceptance policy.
We update the analysis when your business changes and carry out the specific analysis the law requires before you launch a product, service, channel or technology.
The risk analysis is not something you do once and file away: the law requires it to be reviewed, and there are times when it cannot wait.
If your business makes you an obliged entity, the risk analysis is the first document you need: without it, you cannot justify your due diligence.
Before you launch a product, provide a new service, use a different distribution channel or adopt a new technology, you need a specific, documented risk analysis.
A SEPBLAC request for information or the external expert review starts from the risk analysis to assess your whole system.
New markets, new types of customer or strong growth are significant changes that require the analysis to be reviewed.
Key points from Law 10/2010 on the prevention of money laundering and terrorist financing, and from its implementing regulation, approved by Royal Decree 304/2014.
You must be able to show the authorities that your measures are adequate to the risk through a prior analysis set down in writing.
Customers, countries or geographic areas, products, services, transactions and distribution channels.
The analysis is reviewed periodically and, in any case, whenever a significant change occurs.
Mandatory before launching a product or service, using a new distribution channel or adopting a new technology.
An external expert reviews the internal control measures every year; in the following two years, this review can be replaced by a follow-up report.
Some small obliged entities are exempt from Article 32, but the Law still requires their due diligence to be based on a written analysis.
We review the one you have or prepare it from scratch, with a methodology you can explain to SEPBLAC and to the external expert.
It is the document in which the obliged entity identifies and assesses its exposure to money laundering and terrorist financing, analyzes its controls and sets the measures to reduce the risk. The regulation calls it a risk analysis (Article 32 of Royal Decree 304/2014), and SEPBLAC refers to it as a risk self-assessment report in its recommendations.
Yes. Article 7(1) of Law 10/2010 requires you to be able to show the authorities that your due diligence measures are adequate through a prior risk analysis set down in writing, and Article 32 of Royal Decree 304/2014 requires internal control procedures to be based on a documented risk analysis.
At a minimum, the risks by type of customer, country or geographic area, product, service, transaction and distribution channel. It is also advisable to take into account the national and sectoral risk assessments and the supervisor’s guidance applicable to your business.
It must be reviewed periodically and, in any case, whenever a significant change occurs. In addition, before launching a new product or service, using a new distribution channel or adopting a new technology, you must carry out and document a specific risk analysis.
Article 31 of Royal Decree 304/2014 exempts insurance brokers and certain obliged entities with fewer than 10 people and an annual turnover or balance sheet not exceeding €2 million from several internal control obligations, including the one in Article 32. The exemption does not apply if they belong to a group that exceeds those figures, and the Law still requires their due diligence to be based on a written risk analysis.
The risk analysis is the foundation of the manual: it determines, for example, which customers are higher risk and which enhanced measures apply. If you change the analysis, you will usually need to adjust the manual and the procedures.
Yes. The external expert review under Article 28 of Law 10/2010 assesses the adequacy of the internal control measures, and the risk analysis is its starting point. A deficient analysis translates into deficiencies in the expert’s report.
Regulation (EU) 2024/1624, applicable from July 10, 2027, keeps the entity’s risk assessment as a central element. In Spain, a draft royal decree that would expand the minimum content of the analysis was also put out for public consultation in March 2026. Until it is approved, the current Article 32 applies.
You can tell a good risk analysis because anyone can follow its reasoning: where the data comes from, how it is assessed and which decisions it justifies.
The analysis must start from your customer base, your products and your channels. A generic document proves nothing to the supervisor.
Clear scales, justified weightings and reproducible results. If you cannot explain why a factor is high risk, the analysis does not hold up.
The analysis is only useful if it translates into measures: customers under enhanced due diligence, limits, controls and an action plan with owners.
Sources: Law 10/2010 (Articles 7, 26 and 28), Royal Decree 304/2014 (Articles 31–33) and SEPBLAC recommendations on internal control measures.
These terms appear in the risk analysis, in the manual and in the external expert’s report. Mastering them helps you defend your AML system.
The principle under which the intensity of the measures is adjusted to the risk of each customer, product or transaction.
The exposure to money laundering that the business carries by its very nature, before any controls are applied.
The risk that remains once controls have been applied, which must be acceptable to the entity.
Customers, countries or geographic areas, products, services, transactions and distribution channels.
Additional measures for higher-risk customers or transactions, either because the law requires them or because the analysis shows they are needed.
The document that sets out the obliged entity’s policies and procedures, based on the risk analysis.
The body responsible for applying the AML policies and procedures within the entity.
Annual review of the internal control measures by an expert, with possible follow-up reports in the following two years.
Spain’s financial intelligence unit and its supervisory authority for anti-money laundering.
Basic analysis: generic or unsourced.
Robust analysis: drawn from your actual customer base and business.
Basic analysis: no explicit criteria.
Robust analysis: justified, reproducible scales and weightings.
Basic analysis: taken for granted.
Robust analysis: assessed for both design and effectiveness.
Basic analysis: no practical consequences.
Robust analysis: an action plan with owners and deadlines.
Basic analysis: filed away once done.
Robust analysis: reviewed periodically and after every significant change.
These are failings that weaken your position before the supervisor and the external expert.
Tell us about your business, your types of customer and whether you already have a risk analysis, and we’ll tell you what you need to bring it up to date.
The risk analysis, which SEPBLAC calls the risk self-assessment report, is the document in which each obliged entity identifies and assesses its exposure to money laundering and terrorist financing. It is the foundation of the risk-based approach of Law 10/2010 and its implementing regulation, approved by Royal Decree 304/2014.
Article 7(1) of Law 10/2010 requires obliged entities to be able to show the authorities that their measures are appropriate in scope given the risk, through a prior analysis set down in writing. Article 32 of Royal Decree 304/2014 adds that internal control procedures must be based on a documented risk analysis that identifies and assesses risks by type of customer, country or geographic area, product, service, transaction and distribution channel.
The analysis must be reviewed periodically and whenever a significant change occurs. Before launching a new product, providing a new service, using a new distribution channel or adopting a new technology, the law requires a specific risk analysis, carried out in advance and documented.
The AML manual, customer risk classification and enhanced due diligence measures all depend on the risk analysis. The external expert review under Article 28 of Law 10/2010, carried out every year with possible follow-up reports in the following two years, reviews the adequacy of the whole system. If you need ongoing support, you can also outsource the AML function.
Article 31 of Royal Decree 304/2014 exempts insurance brokers and certain obliged entities with fewer than 10 people and an annual turnover or balance sheet not exceeding €2 million from several internal control obligations, including the one in Article 32. The exemption does not apply if they belong to a group that exceeds those figures, and it does not relieve them of having to justify their due diligence with a written analysis.
Regulation (EU) 2024/1624, applicable from July 10, 2027, keeps the entity’s risk assessment as a central element of the system. In Spain, the draft royal decree put out for public consultation in March 2026 provides that the analysis must take into account, as a minimum, the national, supranational and sectoral risk assessments. Until it is approved, the current text applies.
Key legislation, linked to the official text:
Legislation and links reviewed in .