If you already have an inspection report or open proceedings, a deadline is running and everything you do in these days becomes part of the proceedings. We defend you with the material that really carries weight: your case file as it actually stands, not as you would like it to be.
Do you have open AML sanction proceedings?
Tell us what you have received and when. We will tell you what stage the proceedings are at and what can still be done.
Sanction proceedings are not won with adjectives. They are won by putting the facts in order, narrowing the legal classification and providing real evidence at each procedural step.
We take on the entire case: access to and a full copy of the case file, analysis of the inspection report, written submissions, proposal of evidence and a response to every request for information, all under a single approach. One point of contact and one version of the facts, from the first step to the final decision.
Correcting things while the proceedings are still open helps, but only if it is done with real dates and in plain view: an approved action plan, effective measures and evidence of closure, submitted for what they are—later corrections—and never disguised as documents from the time.
How a SEPBLAC inspection unfolds and what is at stake in the inspection report, before any proposed penalty exists.
Which conduct is classified as minor, serious or very serious, and which types of penalty Law 10/2010 provides for. The general explainer, on a separate page.
Administrative sanction proceedings and the criminal offense of money laundering are different things. Where the line lies and how the defense is coordinated on both fronts.
The external report on your system is one of the pieces that carries the most weight: it proves what was reviewed, when and with what result.
Almost nobody writes to us about prevention once proceedings are already open. These four do, and almost always on the very day they receive the notice.
“We were inspected over transactions from some time ago. The files on those buyers are half-finished, and now I’m being asked to prove the source of funds of people I have no relationship with.”
“We buy from and sell to individuals who walk in off the street. We never thought we were an obliged entity until the request for information arrived, and now there is a proposed penalty on the table.”
“They are asking for the beneficial ownership files of clients from several financial years, and not all of them are complete. I need to know what I can submit and, above all, what I must not touch.”
“We have several branches, and the system alerts were never really reviewed. The inspection report says we failed to report transactions we should have reported.”
In AML proceedings you almost never lose because of what you did years ago: you lose because of what you do in the days after receiving the inspection report.
Redoing or “completing” the documentation: rebuilding customer files, signing papers today dated yesterday or making emails disappear turns a compliance problem into a credibility problem, and can take the matter into territory far worse than the administrative one. Documentation is submitted as it is. What is missing is missing: that is defended, not dressed up.
Answering in the heat of the moment: responding to the request for information on your own, with improvised explanations and without having read the full case file. Every sentence you write goes into the proceedings and never comes out; it often establishes facts nobody was accusing you of.
Not submitting what you do have: some entities have minutes of the internal control body, records of training delivered, reports sent to SEPBLAC and external expert reports, yet never submit them because nobody looked for them. As far as the proceedings are concerned, evidence that is not submitted does not exist.
| Stage | What is decided | What the defense contributes |
|---|---|---|
| Inspection and inspection report | The facts recorded as established and the scope of what was reviewed: customers, transactions, periods and procedures. | Technical presence during the inspection, a critical reading of the inspection report and statements that narrow the scope before the facts become set in stone. |
| Investigation and proposed decision | The classification of the conduct—minor, serious or very serious—and the circumstances taken into account to grade the response. | Written submissions on the facts and on the classification, proposal of evidence and proof of the compliance program as it stood at the time. |
| Decision and subsequent remedies | The decision of the competent body, depending on the seriousness of the infringement, with whatever type of penalty may apply. | Administrative appeal and, where appropriate, judicial review before the contentious-administrative courts, plus control of the ancillary effects: publication, positions and license. |
We read the entire case file, settle the version of the facts you will maintain and prepare written submissions with the evidence that already exists in-house. If the system also needs fixing, we do it in parallel and with real dates, so that it helps rather than hurts.
Three things, in this order. First, freeze everything: nobody touches, tidies, prints or “updates” customer folders, emails or systems. Second, note the date of notification and take it to a lawyer that same day, because the procedural clock starts running from then. Third, appoint a single point of contact within the entity so that three different versions of the same facts do not come out.
What you should not do is reply immediately to “get it off your plate”: improvised answers establish facts that cannot be undone later.
No. It is the question we are asked most, and the answer admits no nuance: documentation is submitted exactly as it was when the events took place. Filling in files, signing backdated statements or deleting traces fixes nothing and does add a new problem, one of credibility and, depending on the case, of a different nature.
What you can do—and should—is correct the system going forward: update procedures, review the customer base and document that remediation with its real date. That is submitted for what it is, and in that area it does work in your favor.
It is, but only as a starting point. A manual that is not applied is just paper; what counts is the system in operation: minutes of the internal control body, training actually delivered, reviewed alerts, reports to SEPBLAC, decisions to refrain from executing transactions and the external expert review.
That is why, at the preparation stage, half the work consists of tracking down evidence the entity already generated and never organized: emails, minutes, system logs and customer files that were done properly. A partially applied program, well documented, is not defended in the same way as nothing at all.
In anti-money laundering matters, the investigation of sanction proceedings is the responsibility of SEPBLAC—the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offenses—and the decision lies with the competent body depending on the seriousness of the infringement, within the framework of the Commission for the Prevention of Money Laundering and Monetary Offenses (CPBCIM).
That separation matters for strategy: some arguments are deployed before the investigating body while the facts are being built, and others only make sense against the proposed decision or on appeal.
We don’t give figures in writing, and you should be wary of anyone who does before reading your case file. Law 10/2010 classifies infringements as minor, serious and very serious and provides, depending on the case, for a fine, a private reprimand, a public reprimand and—in the most severe cases—removal from office or revocation of the authorization.
What can be anticipated after reading the inspection report is the scenario: which conduct is arguable, which is hard to defend and which circumstances may influence the grading. We explain the general regime in money laundering fines.
Cooperating helps; improvising does not. Cooperating means providing what is requested, on time, in order and with an index that makes it possible to locate each document, as well as explaining precisely how your system worked. That builds the image of a serious entity and spares the investigating body from having to make assumptions.
Handing over boxes in no particular order, giving evasive answers or sending documentation that contradicts what you have already said is not cooperating. Every submission must go through a prior filter: what exactly is being requested, what exists, what does not exist and how what is missing is explained.
They are different planes and it is best not to mix them. Proceedings under Law 10/2010 penalize failures in the prevention system—due diligence, reporting, record keeping, internal control—whereas the money laundering offense requires its own elements and is tried in the criminal courts.
That said, some facts can play out on both planes, and later conduct—tampering with documentation, for example—can open a new front. That is why the defense is designed with both routes in mind from the outset. You can see the criminal context in criminal penalties for money laundering.
As a general rule, yes: opening proceedings does not in itself suspend your activity. But it is wise to act as if every new transaction will be examined under a magnifying glass, because in practice it will be.
That means immediately strengthening whatever the inspection report flags: up-to-date due diligence, documented decisions to refrain, reviewed alerts and reports that go out when they should. Open proceedings combined with a system that has not changed is the worst possible combination in front of the body that has to decide.
For the first review, what you already have is enough: a full copy of what has been notified (inspection report, requests for information, order initiating proceedings or proposed decision), the date you received it, the AML manual in force during the period reviewed and the names of the SEPBLAC representative and of the members of the internal control body.
With that, we carry out an initial diagnosis of the state of the proceedings and the evidence available. From there, we define the defense plan and who within your entity takes care of each piece.
No two cases are the same, but the order of work does repeat. This is the sequence we follow from notification to closure.
Immediate preservation of documents and systems, access to the full case file and reconstruction of the timeline using the material as it stands. Before arguing, you need to know exactly what you are being charged with and over which period.
We separate what is arguable about the facts from what is argued about the classification. Written submissions are drafted, evidence is proposed and the compliance program in force at the time is proven, piece by piece.
Submissions on the proposed decision, analysis of the decision and a choice between an administrative appeal and judicial review before the contentious-administrative courts. In parallel, completion of the remediation so that the same finding does not reappear.
If you are still at the preliminary stage—a visit has been announced or you have received a first request for information—start with SEPBLAC inspection and our inspection support.
The 10 elements that make up a prevention system you can defend before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before the inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
You will read these words in every document you receive. Understanding what each one means tells you where you are in the proceedings and what you can still do.
The document that records what was verified during the inspection: customers reviewed, transactions, procedures and period examined. It is the basis for everything that follows.
The act that formally opens the sanction proceedings and sets out the facts charged and their provisional classification.
In AML/CFT matters, the investigation is the responsibility of SEPBLAC, which gathers the elements of the case and drafts the proposal.
The document in which the investigating body sets out the facts it considers proven, their classification and the penalty it proposes.
A reasoned response to the facts and the classification, accompanied by documents and the evidence proposed.
How the conduct fits into one of the three categories of Law 10/2010. The type of penalty and the body that decides depend on it.
A penalty with external visibility provided for in Law 10/2010, alongside the fine and the private reprimand. Its reputational impact usually exceeds the financial one.
In the most severe cases, the law provides for the removal from office of those who hold management or administrative positions and, where applicable, revocation of the authorization.
A set of dated evidence—minutes, training, alerts, reports, external reviews—showing that the program was not just a manual left in a drawer.
Incomplete customer files, deficient identification or lack of information on the purpose and nature of the business relationship.
Customer records and identification documents with their original date, contracts, onboarding system logs and the customer acceptance policy in force during the period.
Corporate structures without identification of the beneficial owner, or without reasonable measures to verify it when ownership was not obvious.
Statements obtained, registry extracts, ownership charts and searches carried out, with the date on which they were made.
Transactions showing indications of money laundering that were not reported to SEPBLAC, or that were executed when the entity should have refrained, according to the inspector’s analysis.
Alerts generated and their documented analysis, reports sent with their acknowledgment of receipt, decisions to refrain and the reasons for closing each alert.
An internal control body that does not exist in practice, with no meetings, or a SEPBLAC representative appointed only on paper.
Minutes of the body with resolutions and follow-up, appointment of the representative, delegation of functions and evidence of their real activity.
Staff with no documented AML/CFT training, and no annual external expert review or its follow-up reports.
Annual training plan, attendance lists and materials, external expert reports and evidence of the measures adopted after them.
If you recognize yourself in any of these situations, stop today: almost all of them can be put back on track, but only before the next procedural step.
Sanction proceedings never come alone: they stem from an inspection, are measured against a regime of infringements, may have a criminal dimension and end in a remediation plan that someone is going to review. These pages cover each of those fronts.
What the supervisor reviews, how to prepare for the visit and what is at stake in the inspection report before any proposed penalty exists.
The penalty regime of Law 10/2010 explained: categories of infringement and the types of penalty provided for.
The criminal route, with its own elements and its own procedure. When it can run alongside the administrative proceedings.
Closing findings with evidence and being able to prove it: the deliverable you show when the supervisor asks again.
To strengthen the evidence during the proceedings, we usually work in parallel on the AML audit, the external expert report and an update of the AML manual. And if the problem arises just as you are applying for a license, see AML in the authorization application.
Tell us which document you have received—inspection report, order initiating proceedings, request for information or proposed decision—and its date. We review the status of the proceedings and the strategy before the time limit runs out.
Last updated: August 4, 2026
Sanction proceedings for anti-money laundering breaches are opened when supervisory action concludes that an obliged entity’s system did not meet the requirements of Law 10/2010 of April 28 and its implementing regulation, Royal Decree 304/2014. The investigation is the responsibility of SEPBLAC and the decision lies with the competent body depending on the seriousness of the infringement. For the entity, the proceedings are not just another administrative formality: money is at stake, as is the continuity of its relationship with banks and, in the most severe cases, the position of its directors.
Almost no proceedings come out of nowhere. There is usually a prior inspection—on-site or desk-based—that ends in an inspection report with the supervisor’s conclusions on the customers reviewed, transactions, procedures and period examined. That document is the raw material for everything that follows: the facts recorded in it will be the ones in dispute, and those that were not qualified at the time are much harder to rebut once a classification is on the table. That is why, strictly speaking, the defense starts before any proceedings exist: during the visit and in the statements entered in the record. If you have arrived late to that stage, the work consists of reconstructing the real scope of what was reviewed and separating what was actually verified from what was assumed. That distinction—proven facts versus inferences—is the first line of argument in any serious set of written submissions. You can see how to prepare for the preliminary stage in SEPBLAC inspection and in our support during inspections.
Every defense unfolds on three planes, and it is important not to confuse them. The first is the facts: exactly what was reviewed, for which customers and periods, and what documentation existed at that time. The second is the classification: even accepting a fact, challenging whether it fits the category of infringement charged, because Law 10/2010 distinguishes between minor, serious and very serious infringements, and not every formal breach belongs on the rung proposed by the investigating body. The third is the circumstances surrounding the conduct: the size and risk profile of the entity, the existence of a real, if imperfect, prevention program, the absence of a prior record, the cooperation provided during the inspection and the corrective measures adopted. Effective written submissions attack on all three planes and do so in an orderly way, fact by fact, with an index of documents that lets the investigating body locate each piece of evidence without searching for it. What never works is a generic document that protests without proving anything.
The material that carries the most weight in AML/CFT proceedings is what shows that the system existed and worked, even if it had gaps. We mean dated evidence: the AML manual in force during the period and its previous versions, the entity’s risk self-assessment, minutes of the internal control body with resolutions and follow-up, the appointment of the SEPBLAC representative, training plans with their attendance lists, the alerts generated and their analysis, the reports sent with their acknowledgment of receipt and the external expert reports with the measures adopted afterwards. A substantial part of the defense work consists of tracking down that material within the entity itself, because it often exists and nobody has ever organized it: emails with instructions to the team, screenshots of alerts that were worked, customer files that were done properly. A partially applied, well-documented program is not defended in the same way as a void, and the difference between the two scenarios usually lies in the effort put into gathering the evidence, not in the underlying reality. An AML audit also helps you measure precisely how far your position goes before writing the first line of your submissions.
There is one mistake that turns difficult proceedings into lost proceedings: touching the documentation after receiving the notice. Filling in old customer files, signing backdated beneficial ownership statements, printing and filing policies that were never approved, deleting emails or cleaning up system logs. Not only does this fail to fix the original breach—which in many cases is arguable or can be graded down—it also adds a credibility problem that contaminates the entire defense and can take the matter into territory other than the administrative one. The operating rule is simple: from minute one, a written internal preservation order is issued, folders, mailboxes and systems are frozen, everyone with access is notified, and every correction is made going forward, with its real date, within a documented remediation plan that is submitted for what it is. Nor is it wise to improvise answers: every reply to a request for information must go out reviewed, with an index of documents and consistent with what has already been said, because internal contradictions do more damage than the very gap they try to cover. Correcting helps; pretending hurts, and badly.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .
More in SEPBLAC Inspection