Writing the procedure and never executing it
A freezing protocol that nobody has ever applied is not a procedure: it is a piece of text. The only way to know whether it works is to time a drill on real activity.
ANIFI Account Freezing: Deadlines and Safeguards
It is the most far-reaching change in the draft anti-money laundering bill: the authority will be able to halt a transaction, freeze a bank or crypto-asset account and suspend a business relationship without waiting for court proceedings. This page explains the planned time limits, how the measure is triggered, what safeguards it carries and—what matters most to an entity—what operational capability you need to be able to comply with it.
Prepare your freezing capability
We reply in under 24 h
Starting point
What changes compared with the current system
Until now, the Spanish system’s response to a suspicious transaction was essentially informational: the entity reported it and, except in the specific cases where it had to refrain from executing it, the transaction went ahead. The authority analyzed it afterward. The draft bill reverses that logic and puts the supervisor in a position to intervene in the transactions concerned within a matter of days.
Definition · Suspension and freezing
These are administrative measures by which the authority can halt a specific transaction, temporarily prevent the use of an account (bank or crypto-asset) or suspend a business relationship when there are indications of money laundering or terrorist financing.
They are not a penalty or a conviction: they are precautionary measures to buy time for analysis before the funds disappear.
Definition · Who decides and who executes
The authority decides; the entity executes. The obliged entity does not assess whether the measure is justified: it applies it, documents it and is accountable for having been able to apply it on time.
That division of roles is what turns a seemingly legal matter into an operational and systems problem.
Scope
Three measures with three different time limits
The draft bill does not set up a single freezing power but three measures with different scope and duration. The distinction matters because the operational consequences for the entity and for the client are not the same.
| Measure | Planned maximum time limit | Effect on the client |
|---|---|---|
| Suspension of a transaction | 10 business days | A specific transfer or transaction is not executed. The rest of the client’s activity continues as normal. |
| Account freeze | 5 business days | The funds or crypto-assets in that account cannot be used for the duration of the measure. |
| Suspension of the business relationship | 5 business days | The relationship is frozen as a whole, not just a single transaction. |
| Authority’s response time | 3 business days from the report | Time available to the authority to order the measure when the entity reports indications concerning a transaction. |
| Extension beyond the time limit | Judicial ratification | Keeping the measure in place requires a court’s involvement, at the request of the Public Prosecutor’s Office. |
| Enhanced monitoring | No fixed time limit | The authority may require specific monitoring of the transactions of certain persons, with a subsequent report on the results. |
Figures from the draft bill submitted to public consultation. They may be amended during the parliamentary process: confirm them against the text finally adopted.
How we work
Six workstreams to be able to comply with a freezing order
Most of the entities we review could write the procedure without any trouble. Very few could carry it out on a Friday at seven in the evening, which is exactly when these orders arrive.
Capability
Real freezing capability test
We check how long it really takes your entity to locate and stop a transaction in progress or to freeze an account. It is timed, documented, and whatever falls short is fixed. It is the part of the system that almost nobody has ever tested.
Learn more →
DrillTimingSystemsEvidence
Detection
Reporting and response workflow
A detection, analysis and reporting procedure connected to execution capability: who reports, who receives the order, who applies it and how quickly, including weekends and holiday periods.
Learn more →
Red flagsWorkflowOn-call
Liaison
Channel with the authority
Appointing the point of contact, the channel for receiving orders and the acknowledgment and execution protocol. An order that lands in a mailbox nobody checks over the weekend is a breach by the entity.
Learn more →
RepresentativeChannel
Client
Dealing with the affected client
What can and cannot be said to the client whose transaction is suspended, how the communication is documented and how the later complaint is handled without breaching the duty of confidentiality.
Learn more →
ConfidentialityComplaints
Prevention
Enhanced client monitoring
Implementing the specific monitoring of high-risk persons that the authority may require, together with the reporting of results that comes with it.
Learn more →
MonitoringReporting
Defense
Responding to requests
Support in responding to orders and requests for information, and defense of the entity when it is questioned whether the measure could have been executed on time.
Learn more →
RequestsDefense
Operations
What capability it really requires of an entity
This is the point entities discover too late. A freezing power with time limits measured in days turns a provision in the manual into a requirement for systems, organization and staff availability.
| Capability | What it means in practice | How it is tested |
|---|---|---|
| Locating the transaction | Finding a specific transfer among all those in progress, identified by client, amount or reference. | A timed drill on real activity from an ordinary day. |
| Stopping it before execution | Having a technical mechanism to stop a transaction that has already entered the payment flow. | A test in a controlled environment, with a record of the time taken and of who carried it out. |
| Freezing an account | Preventing withdrawals without closing the account or alerting the client indirectly. | A review of system profiles and of what messages the client sees when trying to transact. |
| Receiving the order out of hours | A channel that is staffed beyond office hours, with an escalation protocol. | A receipt test on a Friday afternoon and during a holiday period. |
| Deciding without the usual person in charge | Execution must not depend on a single person who may be on sick leave or on vacation. | Backups designated in writing and tested. |
| Documenting execution | A record of the order received, the time, who executed it and what effect it had. | A retrievable file for each measure applied. |
| Lifting the measure | Restoring normal activity when the measure lapses, without leaving residual restrictions. | A lifting procedure and a follow-up check. |
Our own analysis based on the powers set out in the draft bill. None of these capabilities can be required today in these terms, and that is exactly the reason to test them before they can be.
Oversight
What safeguards accompany the measure
A power this intrusive is not unlimited, and it is worth knowing its boundaries both to comply with it and to advise the affected client. The draft bill limits it in three ways: its object, its time limit and judicial review of any extension.
| Safeguard | What it involves |
|---|---|
| Triggering condition | The measure requires indications of money laundering or terrorist financing, not a mere administrative irregularity or a breach of contract. |
| Fixed time limit | Each measure has a maximum duration and lapses automatically when it expires unless it is extended through the procedure provided for. |
| Judicial review of the extension | Keeping the measure in place beyond the time limit requires judicial ratification, at the request of the Public Prosecutor’s Office. |
| Proportionate scope | Suspending a specific transaction is less burdensome than freezing an account, and freezing an account less so than suspending the business relationship. |
| Statement of reasons | The order must identify its object and its grounds, an essential requirement for the entity to execute it correctly and for any challenge to it. |
| Means of challenge | The affected party has the usual remedies available against administrative acts, without prejudice to judicial review of the extension. |
Description based on the draft bill currently going through the legislative process. The exact scope of each safeguard and its procedural rules must be confirmed against the final text.
Could you stop a transfer this afternoon if you were ordered to?
We test your entity’s real freezing capability with a timed drill, document the result and fix whatever falls short. It is a test that AML/CFT systems have usually never been put through.
Risks
What is at stake
The risk here is not misreading the law: it is being physically unable to comply with it. And failing to comply with a freezing order is one of the hardest breaches to explain.
Being unable to execute the order on time: if the transaction has already been executed when the order arrives, the entity will have to explain why it was unable to stop it. The answer “our systems do not allow it” is not an excuse: it is a description of the breach.
Orders that arrive and nobody sees: the most common and most avoidable scenario. A receiving channel with no out-of-hours cover turns the supervisor’s problem into the entity’s problem.
Tipping off the client by accident: an automatic error message, a call from the relationship manager or a note in the app can reveal that the measure exists. It is a systems risk, not a matter of staff discretion.
DependencySingle person
If physical execution depends on a single person, the entity’s capability disappears when that person is on sick leave, traveling or on vacation.
LiftingResidual restriction
Lifting the measure when it lapses is as important as freezing. Restrictions that outlast the time limit lead to complaints and liability toward the client.
Crypto-assetsNewly covered accounts
The power expressly extends to crypto-asset accounts. Operators in the sector must be able to freeze holdings as quickly as a bank.
REGULATORY CONTROL CENTER · INTERVENTION CAPABILITY
Control panel: what is missing by type of entity
The ability to stop a transaction does not depend on size but on systems architecture and on how on-call cover is organized. This panel shows where the gap usually lies for each type of obliged entity.
Execution capability by type of entity
An indicative reference to prioritize the work and size the project team.
Area
Financial institution
Payment institution or fintech
Crypto-assets and new obliged entities
Locating the transaction
LowMature systems
MediumDepends on the provider
MediumOn-chain traceability
Stopping before execution
MediumAutomated flows
HighInstant settlement
HighIrreversibility
Out-of-hours receipt
MediumPartial on-call cover
HighNo shifts
HighSmall team
Documenting execution
LowSystem logs
MediumScattered records
MediumNo procedure
Diagnosis
Six mistakes in dealing with the freezing power
They all share the same root cause: having written the procedure without ever testing it.
Designing it for office hours only
Orders do not wait until Monday. A channel staffed from nine to six leaves out most of the time in which a transaction may need to be stopped.
Making it depend on a single person
Without backups designated in writing and tested, the entity’s capability evaporates when that person is unavailable.
Not thinking about what the client sees
An automatic error message, an in-app notification or a call from the relationship manager can reveal the measure. It is a systems configuration problem, not a matter of staff caution.
Forgetting about lifting the measure
Measures lapse. Without a procedure for lifting them and checking afterward, residual restrictions remain that lead to complaints and liability.
Assuming it only affects banks
The power expressly extends to crypto-asset accounts, and the scope of obliged entities widens with the EU package. Many of the new ones have no freezing capability at all.
Operational guide
How to build a real freezing capability
Three principles so that the entity can comply with an order the day it arrives.
Time it before it is real
The only valid proof that the entity can stop a transaction is having done it. A drill on an ordinary day’s activity, timed and with a written record, reveals in one afternoon what no written procedure can guarantee.
Never a single person or a single channel
Designated backups, an alternative channel for receiving orders and a defined escalation path. An entity’s capability cannot depend on one particular person checking their email.
Keep the freeze from talking to the client
Review which messages, alerts and notifications are triggered when a transaction is stopped or an account is frozen. It is configuration work that only comes to light through testing.
Checklist: 12 points on freezing capability
- Check whether your entity can locate a specific transaction in progress and how long it takes to do so.
- Test technically whether a transaction that has already entered the payment flow can be stopped.
- Verify that you can freeze an account without closing it and without alerting the account holder.
- Review which automatic messages the client sees when a transaction is rejected or an account is restricted.
- Define the channel for receiving orders and check that it is staffed outside office hours.
- Designate in writing the backups for whoever must execute the measure, and test them.
- Set up the protocol for acknowledging receipt and confirming execution to the authority.
- Document each measure applied: order received, time, who executed it and the effect produced.
- Write the procedure for lifting measures and verify that no residual restrictions remain.
- Train customer service staff on what can and cannot be said.
- If you deal in crypto-assets, check whether you can freeze holdings and how quickly.
- Run a full drill at least once a year and keep a written record of the result.
If you want to test your entity’s freezing capability, see our AML services or request a free consultation.
Operational glossary
The vocabulary of intervention
Terms worth distinguishing precisely, because each one has its own rules and time limits.
SuspensionMeasure
Halting a transaction
A measure by which a specific transaction is not executed. It has the narrowest scope and the longest time limit in the draft bill.
Up to 10 business days.
FreezeMeasure
Blocking an account
Temporarily preventing the use of a bank or crypto-asset account, without closing it or ending the relationship.
Up to 5 business days.
Business relationshipMeasure
Suspending the whole relationship
Freezing the relationship with the client as a whole, not just a single transaction.
Up to 5 business days.
Duty to refrainEntity’s own duty
The entity’s obligation
The obliged entity’s duty not to execute a transaction when there is a suspicion, subject to specific exceptions. It is distinct from an order by the authority.
It comes from the entity, not from the supervisor.
Judicial ratificationOversight
A court’s involvement
Required to keep the measure in place beyond the maximum time limit, at the request of the Public Prosecutor’s Office.
The time limit of the administrative route.
Enhanced monitoringSurveillance
Targeted monitoring
An obligation to monitor the transactions of certain persons specifically and to report on the results afterward.
No fixed time limit in the draft bill.
ConfidentialityDuty
Prohibition of disclosure
An obligation not to disclose to the client or to third parties that a report has been made or that a measure is in progress.
It also covers automatic notifications.
LiftingClosure
End of the measure
Restoring normal activity when the measure lapses, with no residual restrictions on the client.
Documented in the same way as the freeze.
ANIFIAuthority
National Financial Integrity Authority
Body provided for in the draft bill that brings together financial intelligence, supervision and sanctioning powers, and to which these powers are granted.
SEPBLAC is merged into it.
Frequently asked questions
Account freezing: frequently asked questions
Will ANIFI be able to freeze accounts without court authorization?
According to the draft bill, yes, within fixed time limits: it will be able to halt a transaction, temporarily prevent the use of a bank or crypto-asset account and suspend a business relationship when it finds indications of money laundering or terrorist financing.
What requires a court’s involvement is the extension: keeping the measure in place beyond the maximum time limit requires ratification by a judge at the request of the Public Prosecutor’s Office.
How long can a freeze last?
The draft bill distinguishes by type of measure: up to 10 business days for suspending a transaction and up to 5 business days for freezing an account or suspending the business relationship.
These figures come from a text still going through the legislative process and may change in the law finally adopted.
How long does the authority have to order the measure?
When an entity reports indications concerning a transaction, the draft bill provides that the authority must order the suspension within a maximum of three business days. Where the authority acts on its own analysis, the order will be issued as soon as possible.
For the entity, that three-day window is the critical one: the transaction must still be stoppable when the order arrives.
Can I tell the client that their account has been frozen?
No. The duty of confidentiality prevents you from disclosing that a report has been made or that a measure is in progress. And the problem is usually not staff indiscretion but automatic notifications: a specific error message, an in-app notification or a call from the relationship manager can give the measure away.
It is systems configuration work that is worth reviewing before you need it.
Does it also apply to crypto-asset accounts?
Yes, expressly. The draft bill provides for temporarily preventing the use of a crypto-asset account in the same way as a bank account.
For operators in the sector this poses an additional technical challenge, because the ability to freeze holdings is not always as well developed as it is at a traditional bank.
What happens if I cannot execute the order on time?
The entity will have to explain why. Physical impossibility is not an excuse: it is a description of the breach, because the ability to stop a transaction is part of what is required of the obliged entity.
That is why the practical recommendation is to test that capability now, with a timed drill, and to fix whatever falls short while there are still no consequences.
Is it the same as the duty to refrain?
No, and they should not be confused. The duty to refrain comes from the entity itself: when it detects a suspicion, it does not execute. The suspension order comes from the authority, and the entity applies it without assessing whether it is justified.
The two mechanisms coexist, and the internal procedure must distinguish them clearly so that nobody freezes up waiting for an order that is not going to come.
What safeguards does the affected party have?
Three main ones: the measure requires indications of money laundering or terrorist financing, not a mere irregularity; it has a fixed maximum time limit after which it lapses automatically; and any extension is subject to judicial ratification.
On top of that come the requirement for the order to state its reasons and the means of challenge available against administrative acts.
When does this come into force?
It has not been approved yet. The draft bill was approved at first reading on July 28, 2026 and its public consultation is still open; after that comes the parliamentary process.
What does have a fixed date is the underlying framework: Regulation (EU) 2024/1624 applies from July 10, 2027. You can see the full picture on our ANIFI page.
What should my entity do now?
Just one thing, and it is not a legal one: measure. Check how long it really takes you to locate and stop a transaction in progress, who can do it, what happens if that person is not there and what the client sees when it happens.
That diagnosis takes an afternoon, does not depend on the final text of the law and reveals gaps that no written procedure shows.
Sources
Official sources
Everything stated on this page comes from the published EU legislative package or from official Spanish documents on the bill still going through the legislative process.
BOE
Regulation (EU) 2024/1624 (AMLR)
Entry for the EU anti-money laundering regulation in the Spanish Official State Gazette (BOE), with access to the PDF of the original publication. It is the regulation that brings football within the scope of obliged entities.
boe.es · DOUE-L-2024-80912 SEPBLACPublication of the EU legislative package
Note from the Spanish supervisor on the three acts published in the Official Journal of the EU on June 19, 2024, covering the new obliged entities and the €10,000 cash limit.
sepblac.es · legislative package BOEDirective (EU) 2024/1640 (AMLD6)
The mechanisms Member States must put in place: supervision, registers and cooperation. It is the piece Spain must transpose.
boe.es · DOUE-L-2024-80913 Ministry of EconomyDraft Bill on comprehensive AML/CFT measures
Official page for the public hearing and consultation on the Spanish reform that creates ANIFI and brings in the new obliged entities. Submissions until September 30, 2026.
portal.mineco.gob.es · public consultation La MoncloaCouncil of Ministers meeting of July 28, 2026
Official summary of the decision approving at first reading the draft bill for a comprehensive reform of anti-money laundering rules.
lamoncloa.gob.es · Council of Ministers BOELaw 10/2010 on the prevention of money laundering
Consolidated text of the Spanish law still in force, which the reform now going through the legislative process is set to replace.
boe.es · BOE-A-2010-6737
Transparency
How this page is written and updated
Regulatory content ages quickly, and an outdated guide wastes the time of anyone who follows it. That is why we publish who maintains it and with what method.
Update history
- Initial publication. Content checked against the BOE entries for the EU package, SEPBLAC’s note on its publication, the Ministry of Economy’s public consultation page and the official summary of the Council of Ministers meeting of July 28, 2026.
- Scheduled for when the public consultation closes and when the final text of the suspension and freezing powers is known.
Contact
Book a call
Tell us how your payment flows work today and who can stop a transaction, and we will tell you whether you could comply with a freezing order and what is missing to be able to do so.
Account freezing and transaction suspension: the power that changes the system
For fifteen years, the Spanish anti-money laundering system has worked on an essentially informational logic. The entity detected and reported and—except in the specific cases where it had to refrain from executing—the transaction went ahead while the financial intelligence unit analyzed it. The draft bill approved in July 2026 breaks with that model by giving the new authority the power to intervene directly in transactions.
What can be stopped, and for how long
The draft bill sets up three distinct measures. Suspension of a specific transaction, with a planned maximum of ten business days. Freezing of an account (bank or crypto-asset), with a maximum of five. And suspension of the business relationship as a whole, also with five. Beyond those time limits, keeping the measure in place requires judicial ratification at the request of the Public Prosecutor’s Office. When it is the entity that reports indications concerning a transaction, the authority has three business days to order the suspension.
Why this is a systems problem, not a legal one
No entity will have trouble writing the procedure. The difficulty lies in carrying it out. A power with time limits measured in days requires being able to locate a specific transfer among all those in progress, to stop it technically even if it has already entered the payment flow, and to do so on a Friday afternoon or in August. In our experience reviewing AML/CFT systems, that capability has almost never been tested, and when it is timed for the first time the result surprises the entity itself.
The detail discovered too late
There is one aspect that does not appear in legal analyses and that causes real problems: what the client sees. A specific error message, an automatic in-app notification or a routine call from the relationship manager can reveal that the measure exists and breach the duty of confidentiality. It is not a matter of staff caution but of systems configuration, and it can only be detected by running a full drill and checking what is triggered on each channel.
What to do while the text is still open
The draft bill is under public consultation and its time limits may change. What is not going to change is the direction: both the EU and the Spanish supervisors are moving toward a model with the power to intervene. That is why the work worth doing now is not legal but operational: measuring how long it really takes to stop a transaction, who can do it, what happens if that person is unavailable and what restrictions remain when the measure lapses. That diagnosis takes an afternoon, does not depend on the final text and reveals gaps that no written procedure shows.
The new authority
The obliged entity’s operations
Official sources
Key legislation, linked to the official text:
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
- Directive (EU) 2024/1640 of May 31, 2024 on the mechanisms to be put in place by Member States for the prevention of money launderingEUR-Lex · Official Journal of the EU
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .