Outsourcing the AML Technical Unit in Spain

Spanish law does not specifically regulate it. Article 35(3) of Royal Decree 304/2014 requires the technical unit to have specialized staff, dedicated exclusively to it and with appropriate training in analysis, and Law 10/2010 mentions outsourcing only in its Art. 8(4), for providers that, under contract, are treated as part of the obliged entity. That is why, today, the prudent approach is to reinforce the technical unit with an external team while keeping the decisions within your entity. From July 10, 2027, AMLR Art. 18 expressly regulates the outsourcing of tasks.

Those that support the analysis: alert review, preparation of the written special examination, calibration of monitoring scenarios, team training and preparation of reports and evidence. What should always stay with your entity are the decisions: the customer's risk profile, whether or not to accept a transaction, and reporting to SEPBLAC.

Article 18(3) of Regulation (EU) 2024/1624 prohibits outsourcing six tasks: proposing and approving the business-wide risk assessment; approving the internal policies, procedures and controls; deciding the customer's risk profile; deciding to establish a business relationship or carry out an occasional transaction; reporting suspicious transactions to the FIU, except to another obliged entity of the same group in the same Member State; and approving the criteria for detecting suspicious or unusual transactions.

Your entity. Under the AMLR, the obliged entity remains fully responsible for everything related to the outsourced tasks and must be able to show the supervisor that it understands what the provider does (Art. 18(2)). Law 10/2010 takes the same approach when third parties are relied on for due diligence (Art. 8(1)).

Current Spanish legislation does not provide for a specific procedure. Under the AMLR, from July 10, 2027, the entity will have to notify the supervisor of the outsourcing before the provider starts performing the tasks (Art. 18(1)).

The AMLR requires a written agreement setting out the terms of the service, that the provider applies your entity's policies and procedures, and periodic controls over its work (Art. 18(4)), without hindering the supervisor's work (Art. 18(5)). We also recommend covering confidentiality, access to information, sub-outsourcing and response times. We explain it in detail in our guide to the KYC outsourcing agreement.

Under the AMLR, tasks cannot be outsourced to providers established in high-risk third countries identified by the European Union, unless the provider belongs to the same group and the other conditions of Art. 18(6) are met.

Not in the same way. The SEPBLAC representative must be a person resident in Spain who holds a director or senior management position in the company (Article 26 ter(1) of Law 10/2010), and the internal control body is a body of your entity. An external provider can support them, but cannot take their place. We explain this in SEPBLAC representative and internal control body.