Forming companies for third parties, providing them with a registered office, acting as director or secretary on behalf of others, or managing trusts brings you under Article 2(1)(o) of Law 10/2010 with one particular feature: on top of the AML system, you must register with the Commercial Registry (Registro Mercantil) and file an annual declaration.
A review of your position as a company service provider
Tell us which company services you provide and to what kind of client. We will tell you what is missing: the registration, the AML system, or both.
A company service provider has to meet two requirements at once: it is registered as such, and it has an AML system that works. Failing on one drags down the other.
A manual tailored to how your company services actually work: client acceptance policy, a file for each company formed or hosted, enhanced due diligence criteria and a special examination protocol. Together with the risk self-assessment that supports it.
Before the deed is signed, you need to know who is asking for the company, what for, with what money and who will control it. We design the acceptance file and the ownership chart that will hold up under review.
We identify which part of your activity makes you a company service provider, and from what point.
How the beneficial owner is determined, documented and updated in multi-layered corporate structures.
Declaration and consistency with the Central Register of Beneficial Ownership created by Royal Decree 609/2023.
Appointment of the representative and the internal control body, with the role performed externally if your organization is small.
Many firms have been doing this for years without ever registering in this capacity. The conversation usually starts when a bank or an institutional client asks to see the file.
“We set up several SLs (limited companies) a month for clients who come to us by referral. Nobody had told us that this alone makes us a company service provider, with its own registration and annual declaration.”
“We rent out offices and provide a registered office to dozens of companies. Some haven’t collected their mail in months, and we couldn’t say who is behind them if we were asked tomorrow.”
“I’m listed as board secretary and as attorney-in-fact in client companies. I need to know how far my liability goes and what file I must be able to show for each one.”
“We set up holding companies and vehicles for overseas investors who hardly ever come to Spain. The source of the money and the chain of control are exactly what we don’t have properly documented.”
None of them has to do with the quality of the corporate work. They have to do with what is not written down about who asked for the company and why.
Providing the service without being registered: forming companies or providing registered offices for third parties without registering with the Commercial Registry as a provider or filing the annual declaration keeps your entire activity off the supervisor’s radar. It is the first thing checked, and there is no explaining it away.
The beneficial owner on the deed: identifying the founding shareholder and taking it as settled. When there are also intermediate companies, fiduciary arrangements or straw men, the file has to rebuild the full chain of control, not just the first layer.
The portfolio nobody reviews: companies hosted or managed for years, with no known activity, no annual accounts filed and a file that has not been touched since incorporation. That is where the firm’s reputational risk builds up.
| Service you provide | Specific obligation | Evidence that proves it |
|---|---|---|
| Forming companies on behalf of third parties | Registration as a provider and identification of the beneficial owner and the purpose of the structure before the deed is executed | Registration with the Commercial Registry in this capacity, acceptance file and a dated beneficial ownership record. |
| Registered office and premises for client companies | Due diligence on the hosted company and ongoing monitoring for as long as the relationship lasts | Registered office agreement, register of hosted companies and periodic reviews, dated and signed. |
| Director, secretary or attorney-in-fact on behalf of others | Annual declaration of the activity as a provider and documented knowledge of the company’s real business | Declaration filed, acceptance of the appointment and a written record of the purpose and actual activity. |
We determine which part of your activity falls under Article 2(1)(o), handle the registration and the annual declaration, and build the AML system behind them: manual, acceptance policy, a file for each company, beneficial ownership and appointed officers.
Article 2(1)(o) of Law 10/2010 generally covers anyone who, on a professional basis, forms companies for third parties; acts as director, secretary or attorney-in-fact on behalf of another person; provides a registered office, premises or an address to a company; or takes part in managing trusts and similar arrangements.
You do not need to provide all of them: one, carried out professionally, is enough to bring you within scope. And it does not depend on your qualification or your professional association, but on the service you actually provide to the client.
Not entirely, and this is the most common confusion. A tax or accounting firm is already an obliged entity because of its own activity, and we cover that regime in AML for accountants and tax advisors. But if you also form companies or provide registered offices for clients, you take on a separate category with its own obligations: registration with the Commercial Registry as a provider and the annual declaration.
In plain terms: same firm, two categories. The manual has to cover both, and the client file has to show which service is being provided in each case.
It is a specific registration: anyone who professionally provides services to companies and trusts must register with the Commercial Registry in that capacity, regardless of whether the company is already registered as such or the individual already practices another profession.
That registration comes with an annual declaration on the activity carried out as a provider. It is a formality about scope, not substance: it does not prove that you comply, it proves that you exist in the supervisor’s eyes. That is why its absence stands out so clearly in a SEPBLAC review.
Four things, and all four before the deed is executed. The identity of whoever instructs you and of the future shareholders. The beneficial ownership, tracing the chain of control up to the natural person, not just the first layer. The purpose and nature of the structure: what that company will do and why it is set up this way. And the source of the funds used to capitalize it.
If any of the four answers is “the intermediary told me,” the file is not complete, and you are the one signing.
By moving up the chain until you reach the natural persons who exercise control, whether through ownership, agreements or other means; and, where no one can be identified that way, by applying the fallback rule in the regulations, which looks to the directors.
The result is documented in an ownership chart with supporting evidence (deeds, shareholder registers, certificates) and must be consistent with what has been declared to the Central Register of Beneficial Ownership created by Royal Decree 609/2023. Discrepancies between your file and the register are a red flag in themselves. We cover this in UBO and beneficial ownership.
Review them, and keep a record of the review. Ongoing monitoring of the business relationship requires you to check that the company’s activity still matches what was declared at the start. A hosted company with no known activity, no annual accounts filed and no contact is exactly the profile that calls for a special examination.
The outcome may be to update the file, apply enhanced measures, report the suspicion or end the relationship. What is not an option is to keep it in the portfolio without a written decision.
Because opaque structures do not create themselves: they are set up through professionals. When a shell company turns up in an investigation, the first question is who set it up, who gave it a registered office and who held its positions. That trail leads to the provider.
That is why the applicable standard is stricter than in other sectors: knowing the real purpose of each structure, not just its legal form. A firm that can explain with documents why it formed each company has a much smaller problem than one that can only show deeds.
Yes. Size shapes the internal control structure, but it does not remove the obligation to formally appoint a SEPBLAC representative and to notify that appointment. In small firms the role usually falls to the managing partner, with the internal control body scaled proportionately.
If nobody in-house can take it on reliably, the role can be performed externally by an external representative. What is not acceptable is for the position to be vacant, or for the appointment not to be recorded in writing and dated.
Yes, and in the expected direction. The EU AML package (Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620, which creates the AMLA authority) is moving forward with phased application and is being implemented. It harmonizes obligations that currently depend on each Member State and strengthens the treatment of beneficial ownership and corporate structures.
For a company service provider, that means a higher bar and less room for interpretation. Setting up an orderly system now is, above all, a way to avoid rebuilding it from scratch later.
The goal is twofold: to be properly registered as a provider and, when a request for information arrives, to be able to open the file of any company you have formed or host.
We identify which company services you actually provide and whether any of them brings you under Article 2(1)(o), and we handle any pending registration with the Commercial Registry and annual declaration.
Risk self-assessment of the firm, a manual with a client acceptance policy, a file template for each company, enhanced due diligence criteria and appointment of the officers responsible to SEPBLAC.
The uncomfortable part: reviewing the companies already hosted or managed, completing beneficial ownership details, updating files and deciding which relationships to continue and which to end.
If your firm also provides tax or accounting advice, read this page together with AML for accountants and tax advisors; if you practice law, with AML for lawyers. And if you want to delegate the function, see AML outsourcing.
The 10 elements of an AML/CFT system you can defend before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before an inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These terms will appear in your manual, in each company’s file and in any request for information you receive. It pays to use them precisely.
Anyone who, on a professional basis, forms companies for third parties, holds positions on behalf of others, provides a registered office or manages trusts and similar arrangements.
A specific registration based on your status as a company service provider, in addition to and separate from the company’s own ordinary registration.
Making a registered office, premises or a mailing address available to a company. This service alone is enough to bring you within scope.
The natural person or persons who ultimately own or control the company, directly or indirectly, or on whose behalf it acts.
A register created by Royal Decree 609/2023 that centralizes beneficial ownership information on legal persons and entities without legal personality.
A documented understanding of why the structure is being set up and what activity it will carry out. It is what distinguishes a normal engagement from an artificial one.
A company with no real activity or resources, used to put a layer between the funds and their owner. It is the defining risk of the sector.
Additional measures for high-risk clients, countries or structures: more information, more supporting documents and senior-level approval.
A documented analysis of transactions or engagements that do not match the declared profile, carried out before deciding whether the suspicion should be reported to SEPBLAC.
Provider activity properly defined, with registration with the Commercial Registry in this capacity and the annual declaration up to date.
Registry certificate of registration, declarations filed and an internal memo defining which services fall into the category.
A written policy setting out which engagements are accepted, which are turned down and which cases require approval from a responsible officer before signing.
Versioned acceptance policy, engagement intake form and a log of rejected engagements with the reason.
Chain of control traced to a natural person, with supporting documents and consistent with what has been declared to the central register.
Ownership chart, deeds and shareholder registers, and a documented check against the Central Register of Beneficial Ownership.
Periodic review of hosted or managed companies, with a written decision to continue, strengthen or end the relationship.
Review calendar, updated and dated records, and minutes of decisions on high-risk relationships.
SEPBLAC representative and internal control body appointed, staff trained and the system subject to external review.
Appointment minutes, annual training plan with attendees and certificates, and the external expert report.
We are not talking about abstract suspicions: these are concrete situations that come up in any file review.
The most expensive mistake in this sector is believing that a single regime covers everything. Advising on tax, representing clients in court and forming companies for third parties are different activities with different obligations, even when the same firm provides them. These pages define each boundary so that your manual covers what you actually do.
If you also handle tax and accounting work, that category follows its own route: when an engagement falls within scope and what file it requires.
Legal practice has its own scope and its own nuances regarding information protected by professional secrecy.
The corporate service itself: legal form, bylaws and filings, now with the AML file built in from the start.
Buying or selling companies that have already been formed requires enhanced due diligence on their history and on who is acquiring them.
For the general framework, start with anti-money laundering and check where you fit in the list of obliged entities. If what you want is to delegate the work, see our AML services.
Tell us how you work (company formation, registered office services, positions held for others, non-resident clients) and we will send you a concrete plan for regularization and compliance.
Last updated: August 4, 2026
Trust and company service providers hold a unique position in Law 10/2010: they do not handle the client’s money, but they build the vehicle through which that money flows. That is why Article 2(1)(o) adds them to the list of obliged entities, with an extra requirement that other sectors do not have: registration with the Commercial Registry in that capacity and an annual declaration on the activity carried out. This dual obligation (being registered and having a system that works) shapes all the compliance work of a corporate services firm.
The category is defined by the service provided, not by the qualifications of whoever provides it. As a general rule, it covers those who form companies on behalf of third parties; those who act as director, secretary or attorney-in-fact on behalf of another person; those who provide a registered office, premises or address to a company; and those who take part in managing fiduciary arrangements, trusts and similar structures. Providing just one of these services on a professional basis is enough. This explains the usual surprise: a business center that rents out offices and provides a registered office to dozens of companies is a company service provider, even though it has never thought of itself as part of the financial system. The same applies to the professional listed as board secretary in client companies. And to the firm that forms three or four companies a month for referred clients: volume is irrelevant; what matters is that the service is provided professionally. The first task, therefore, is an honest inventory of what is actually done, because that determines the registration, the scope of the manual and the file template. You can check your case against the list of obliged entities.
The first pillar is formal. Anyone who provides these services professionally must register with the Commercial Registry in that capacity and file an annual declaration on the activity carried out as a provider. It is a formality about scope: it does not prove compliance, it proves that you exist in the supervisor’s eyes, and its absence is the first thing to be detected. The second pillar is substantive and is the same as for any obliged entity: written policies and procedures, a self-assessment of your own risk, graduated due diligence (simplified, standard or enhanced), identification of the beneficial owner, treatment of politically exposed persons, record keeping, suspicious transaction reporting and refraining from executing transactions where appropriate, an internal control body, a SEPBLAC representative, annual staff training and review by an external expert. A firm can have the first pillar in perfect order and fail on the second, or vice versa: they are breached separately and sanctioned separately. Infringements of Law 10/2010 are classified as minor, serious and very serious, with penalties ranging from a private reprimand to fines, a public reprimand and, where applicable, removal from office; the proceedings are investigated by SEPBLAC and decided by the competent body depending on the seriousness of the infringement.
Many firms provide tax advice, accounting services and company formation at the same time. These are separate categories within the same Article 2, and it is best not to mix them up. Tax and accounting advice has its own way into the scope, which we cover in AML for accountants and tax advisors; legal practice adds its own nuances regarding information protected by professional secrecy, covered in AML for lawyers. This page specifically covers the activity of forming, hosting and managing companies for third parties, which is what triggers the registry registration and the annual declaration. The practical consequence is concrete: the manual must identify which services the firm provides under each category, and the client file must make clear what is being provided in each engagement. If the same client receives tax advice and also asks for a new company, there are two analyses, not one, and only the second triggers the registry registration and the annual declaration. We explain the corporate service itself in company formation.
No other sector is so close to the heart of the problem: opaque structures are set up through professionals, and when a shell company turns up in an investigation, the trail leads to whoever created it, gave it a registered office or held its positions. That is why the required standard does not stop at identifying the shareholder: you have to understand the real purpose of the structure and trace the chain of control up to the natural person, consistently with what has been declared to the Central Register of Beneficial Ownership created by Royal Decree 609/2023. The scope was already widened by Royal Decree-law 7/2021, which transposed the Fifth Directive (EU) 2018/843, and the EU AML package (Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620, which creates the AMLA authority) is moving forward with phased application and is being implemented, with stricter treatment of beneficial ownership. To see how it is documented today, read UBO and beneficial ownership and business due diligence.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .