Starting to prepare when the request arrives
Documentation produced after the request shows. Recent approval dates, minutes numbered back to back and training given the month before tell a story the inspector knows well.
ANIFI Inspection: How to Prepare
A supervisor with its own funding and a larger structure carries out more inspections. And what it finds are not new breaches: they are the ones that were already there. This page explains how an inspection unfolds, which documents are requested and in what order, which findings always come up and what you can fix now, while nobody is looking yet.
Mock inspection
We reply in under 24 h
- EU Regulation (AMLR)
- Reg. 2024/1624
- AML/CFT law in force
- Law 10/2010
- EU AML package published
- June 19, 2024
- Pre-inspection checklist
- 12 points
Starting point
How an anti-money laundering inspection unfolds
No inspection starts on the day the request for information arrives. It starts much earlier: on the day the first file was misfiled or a manual describing a different organization was approved. What happens during the inspection is only the check on decisions made years before.
What is really checked
The question is not whether you have the documents: it is whether what they say matches what you did. The manual is compared with the files, the self-assessment with the actual products, and the training with the attendance records.
A contradiction between a document and the evidence is a more serious finding than the absence of the document.
Why more inspections are to be expected
ANIFI will be funded through fees paid by supervised entities and is being built on a pre-existing structure. That means stable inspection capacity that does not depend on the ordinary budget.
The effect will be most noticeable in sectors that rarely receive direct supervision today.
Documentation
What is requested, and in what order
The order matters, because each document shapes how the next one is read. An inspector who starts with a generic risk self-assessment will read the rest of the file looking to confirm that impression.
| Document | What is examined | Typical finding |
|---|---|---|
| Risk self-assessment | Date, scope and match with current products, channels and clients. | Approved years ago and never reviewed, even though the business has changed. |
| AML/CFT manual | That it describes actual operations and that its thresholds match those in the risk assessment. | Template text referring to products or areas the entity does not have. |
| Organization chart and roles | That the people named currently hold those roles and have the required independence. | Names of people who are no longer with the entity. |
| Control body minutes | That the body exists, meets and takes documented decisions. | A body formally set up but with no minutes or decisions. |
| Training records | Attendees, content, date and assessment, by role. | A generic annual course with no individual records and not tailored to risk. |
| Sample of files | That due diligence was applied as the manual says and that beneficial ownership is traced through to a natural person. | Files that stop at the first foreign company. |
| Reporting history | Volume and quality, compared with the risk profile of the client portfolio. | Under-reporting: very few reports for the entity’s size and sector. |
| Log of dismissed alerts | That alerts are analyzed and the reasons for dismissing them are recorded. | Alerts resolved informally, with no trace of the analysis. |
Our own analysis based on supervisory practice in anti-money laundering. The specific content of each request depends on the scope set by the authority.
How we work
Six workstreams to be ready
Useful preparation is not about tidying up folders the week before. It is about checking, in good time, whether your system withstands the same cross-check the inspector will carry out.
Simulation
Mock inspection
We reproduce the request and the sampling using the criteria the supervisor is likely to apply: we ask for the same documents, pick files at random and compare the manual with practice. The result is the list of findings a real inspection would produce, with time to correct them.
Learn more →
SamplingCross-checkReportAction plan
Foundation
System update
Review and update of the risk self-assessment, the manual and the procedures so that they describe the entity you are today, not the one you were five years ago.
Learn more →
RiskManualProcedures
Reporting
Review of reporting history
Analysis of the volume and quality of what has been reported against the risk profile of the client portfolio. It is the cross-check any supervisor runs with its own sector data.
Learn more →
VolumeQuality
People
Verifiable training
A training plan by role, with content tailored to the real risk and retrievable evidence of who received it and when.
Learn more →
PlanEvidence
Governance
Control body and representative
Checking that the control body exists, meets and takes decisions, and that the representative has been appointed, notified and is available.
Learn more →
OCICMinutes
Defense
Support during the inspection
Dealing with the inspection team, preparing for the interviews, drafting written submissions and negotiating the remediation plan.
Learn more →
SubmissionsRemediation
Diagnosis
The findings that always come up
After reviewing many AML/CFT systems, the list of what gets found is surprisingly stable. None of these findings requires complex legal analysis: they are all detected by comparing two documents.
| Finding | Where it comes from | How to fix it beforehand |
|---|---|---|
| Outdated self-assessment | It was approved when the system was set up and nobody reviewed it when products or channels changed. | An annual review with minutes, and an early review whenever there are significant business changes. |
| A manual that does not describe the entity | It was based on a template and never adapted to actual operations. | Rewrite the operational chapters after interviewing the people who carry out each process. |
| Incomplete beneficial ownership | Files stop at the first foreign company. | Review a sample and complete the ownership chains, applying enhanced measures where that is not possible. |
| Under-reporting | Too little is reported for the risk profile, or only the obvious cases. | Compare your own volume with the sector’s and review the internal reporting threshold. |
| Training without evidence | It is delivered but not recorded per person or assessed. | A plan by role with attendance lists, content, date and assessment. |
| Inactive control body | It was set up when the manual was approved and never met again. | A meeting schedule and minutes recording decisions, even brief ones. |
| Dismissed alerts with no trail | They are resolved in a conversation and not documented. | An alert log recording why each alert was dismissed and who decided. |
| Uncontrolled outsourcing | Tasks are delegated to a provider with no contract or access rights. | A contract covering scope, audit rights and the entity’s responsibility. |
Action
How to respond to a request for information
The quality of the response carries as much weight as the content of the system. An entity that answers quickly, completely and in an orderly way conveys internal control; one that answers piecemeal, in several batches, conveys the opposite, even when it is right.
| Rule | Why |
|---|---|
| Always answer within the deadline | Missing a deadline is a breach in its own right and colors how everything else is read. |
| Deliver everything at once, not in parts | Piecemeal deliveries suggest that the documentation is being produced now and did not exist before. |
| Do not provide more than requested | Widening the scope on your own initiative opens issues that nobody had raised. |
| Explain what you do not have | Keeping quiet about a gap is worse than acknowledging it together with the correction plan and its timetable. |
| Have a single point of contact | Several people answering in parallel produce different versions of the same fact. |
| Prepare for the interviews | The team must know the manual and describe its work the way the manual describes it. If they do not match, the finding is the contradiction. |
| Document what you hand over | Keep a record of what was delivered, when and to whom, so that you can later rebuild your own file of the inspection. |
Rules of professional practice, not legal requirements. The deadlines and procedural steps of the inspection procedure will be those set by the applicable legislation.
What would an inspection find in your entity today?
We do the same work the inspector would do: we ask for the same documents, pick files at random and compare the manual with practice. We give you the findings with time to correct them.
Risks
What is at stake
An isolated finding gets corrected. What worries a supervisor—and what leads to sanctioning proceedings—is the pattern.
From finding to pattern: one incomplete file is a mistake; twenty incomplete files with the same gap are a system failure. Sampling is designed precisely to tell one from the other.
Documentary contradiction: a manual that requires an approval which the files show was never sought is more serious than not having the procedure in writing, because it proves that the system was defined and not applied.
Responsibility of the management body: the AML/CFT system is the board’s responsibility. An ineffective system is not fixed by pointing at an employee.
DeadlinesLate response
Answering after the deadline is a breach in its own right and colors how the rest of the response is read, however solid it may be.
InterviewsDifferent versions
When the team describes its work one way and the manual another, the finding is not the procedure: it is the gap between the two.
HistoryFull series
With investigation and decision-making concentrated in the same body, an entity’s reporting history is analyzed as a whole, not case by case.
REGULATORY CONTROL CENTER · INSPECTION READINESS
Control panel: where to start depending on your sector
Preparation does not cost everyone the same. This panel shows where the finding usually lies for each type of obliged entity.
Preparation priority by type of obliged entity
An indicative reference to prioritize the work and size the project team.
Area
Financial institution
Professional or real estate
Crypto-assets and new obliged entities
Risk self-assessment
MediumNeeds updating
HighOften nonexistent
MediumPoorly calibrated
Sample of files
MediumHigh volume
HighNo traceability
MediumRecent
Documented training
LowAnnual program
HighNo records
MediumSmall team
Active control body
LowFunctioning
HighOn paper only
MediumNewly created
Diagnosis
Six mistakes when facing an inspection
None of them has to do with the substance of the case. They all concern how the situation is managed.
Answering in batches
Piecemeal responses suggest that the documentation is being put together on the fly. It is better to ask for an extension and deliver everything complete.
Providing more than requested
Widening the scope on your own initiative opens issues nobody had raised and drags out the inspection for no benefit at all.
Not preparing the team for the interviews
The inspector asks the person who carries out the process, not the person who wrote the manual. If the descriptions do not match, that gap is the finding.
Hiding a gap
A gap that is acknowledged together with its correction plan and timetable can be managed. A gap kept quiet that surfaces in the sampling becomes something else.
Not documenting the inspection itself
It is worth recording what was delivered, when and to whom. That file of your own is essential if there are written submissions or an appeal later on.
Operational guide
How to prepare for an inspection in advance
Three principles that are worth more than any last-minute tidying of folders.
Do the inspector’s work before the inspector does
Request the documents from yourself, pick files at random and compare the manual with practice. Whatever this exercise turns up is exactly what the inspection will turn up, with the difference that now there is time.
Make sure the team and the paperwork say the same thing
The most cost-effective preparation is not about documents but about people: whoever carries out each process should describe it the same way the manual does. If they do not match, you have to decide which of the two to correct.
Leave a trail of everything you do
Control body minutes, training records, the reasons for dismissing alerts and evidence of reviews. It is minor work that prevents most findings.
Checklist: 12 points before an inspection
- Check the approval date and the last review date of your risk self-assessment.
- Check that the manual describes the products, channels and clients the entity has today.
- Verify that the people in the organization chart are the ones currently holding those roles.
- Check that the control body meets and keeps minutes recording its decisions.
- Gather the training records per person, with content, date and assessment.
- Pick ten files at random and check whether due diligence was applied as the manual says.
- Check in that sample whether beneficial ownership is traced through to a natural person.
- Compare your volume of suspicious transaction reports with the risk profile of your client portfolio.
- Verify that dismissed alerts record the reason and who made the decision.
- Review your outsourcing contracts and their audit and access rights.
- Appoint the single point of contact for a possible inspection, and a deputy.
- Document the outcome of this exercise and the correction plan, with dates.
If you want to run a mock inspection, see our AML services or request a free consultation.
Operational glossary
Inspection vocabulary
Procedural terms worth knowing before the first request for information arrives.
Request for informationProcedure
Formal request for documentation
A communication in which the authority asks for documents or information, with a response deadline; failing to meet it is an infringement in itself.
Always meet the deadline.
SamplingMethod
Review of selected files
A technique in which the inspector selects a set of transactions and checks whether the system described was applied to each one.
This is where a mistake is told apart from a pattern.
FindingOutcome
Breach detected
A discrepancy between what is required and what is found. It can lead to a recommendation, a requirement to remedy or a proposed sanction.
Not every finding ends in a sanction.
Written submissionsDefense
Response to the inspection record or report
A document in which the entity responds to the findings, providing evidence or explaining the context and the correction plan.
Its technical quality carries a lot of weight.
Remediation planCommitment
Correction timetable
A document in which the entity undertakes to correct what was detected, with specific measures and verifiable deadlines.
Compliance with it is checked afterwards.
Under-reportingIndicator
Reporting less than expected
A situation in which the volume of suspicious transaction reports is out of line with the entity’s risk profile.
It is detected by cross-checking sector data.
Internal control bodyStructure
The system’s decision-making body
The structure that analyzes alerts, decides on reports and proposes improvements. It must meet and keep a record.
Without minutes, it is presumed inactive.
EvidenceProof
Retrievable record
Documentation proving that the procedure was applied: files, minutes, logs and signed decisions.
What is not on file did not happen.
ANIFIAuthority
National Financial Integrity Authority
Body envisaged in the Spanish draft bill that will bring together supervision, inspection and sanctioning powers.
The same body investigates and decides.
Frequently asked questions
ANIFI inspection: frequently asked questions
Will there be more inspections with ANIFI?
It is reasonable to expect so. The new authority is funded through fees paid by supervised entities and is being built on a pre-existing structure, which gives it stable inspection capacity instead of depending on the ordinary budget.
The effect will be most noticeable in sectors that rarely receive direct supervision today: professionals, real estate agencies and the sectors that the EU package brings into scope for the first time.
What is the first thing requested?
The risk self-assessment, and not by chance: it is the document on which the whole system is calibrated, and its date and scope shape how everything else is read.
Then come the manual, the control body minutes, the training records and, finally, the sample of files, which is the long phase.
What is checked in the sampling?
Whether the system described in the manual was actually applied to specific transactions: whether the due diligence required by the procedure was carried out, whether beneficial ownership is traced through to a natural person, whether alerts were analyzed and whether the required approvals were sought.
It is the phase that produces the findings, because it tests what you say against what you do.
Which finding comes up most often?
The outdated risk self-assessment. It is approved when the system is set up and nobody reviews it, even when the products, the channels or the type of client change. Since everything else is calibrated on it, once it falls out of date it drags the rest down with it.
The second most frequent is the template manual: a correct text that describes an organization that is not the entity’s own.
Is it worse not to have a procedure, or to have one and not apply it?
To have one and not apply it. The absence of a procedure may be a gap in the system; a contradiction between what the manual requires and what the files show proves that the system was defined and not complied with.
It is the finding that is hardest to explain and the one that most easily escalates into sanctioning proceedings.
How should you answer a request for information?
Within the deadline, in full and in a single delivery. Piecemeal responses suggest that the documentation is being produced now; it is better to ask for an extension and deliver everything together.
And without widening the scope on your own initiative: providing more than requested opens issues that nobody had raised.
What happens in the interviews?
The inspector asks the person who carries out the process, not the person who wrote the manual. If the staff member describes their work one way and the manual another, the finding is not the procedure: it is the gap between the two.
Preparing the team is not about coaching them on what to say, but about making sure the manual describes what they really do.
What is a remediation plan?
The document in which the entity undertakes to correct what was detected, with specific measures, owners and verifiable deadlines. If it is well designed, it can redirect findings that would otherwise escalate.
Compliance with it is checked afterwards, so it should be realistic and not a statement of intent.
Can I prepare without knowing when they will come?
It is exactly the other way around: you can only prepare beforehand. A mock inspection—requesting the same documents from yourself, picking files at random and comparing the manual with practice—produces exactly the list of findings a real inspection would produce, with the difference that there is time to correct them.
And it does not depend on the final text of the Spanish law: the cross-check is the same today as it will be in two years’ time.
Is what I know about SEPBLAC inspections still valid?
For the most part, yes. The inspection method—request, desk review, visit, sampling and report—does not change because a new institution takes over. What changes is who carries it out, with what resources, and the fact that whoever inspects is also whoever decides the case.
You can see the full comparison on our ANIFI and SEPBLAC page.
Sources
Official sources
Everything stated on this page comes from the published EU legislative package or from official Spanish documents on legislation still going through the legislative process.
BOE
Regulation (EU) 2024/1624 (AMLR)
Entry for the EU anti-money laundering regulation in the Spanish Official State Gazette (BOE), with access to the PDF of the original publication. It is the regulation that brings football within the scope of obliged entities.
boe.es · DOUE-L-2024-80912 SEPBLACPublication of the EU legislative package
Note from the Spanish supervisor on the three pieces of legislation published in the Official Journal of the EU on June 19, 2024, covering the new obliged entities and the €10,000 cash limit.
sepblac.es · legislative package BOEDirective (EU) 2024/1640 (AMLD6)
The mechanisms Member States must put in place: supervision, registers and cooperation. It is the piece Spain must transpose.
boe.es · DOUE-L-2024-80913 Ministry of EconomyDraft Bill on comprehensive AML/CFT measures
Official page for the public hearing and consultation on the Spanish reform that creates ANIFI and brings in the new obliged entities. Submissions until September 30, 2026.
portal.mineco.gob.es · public consultation La MoncloaCouncil of Ministers meeting of July 28, 2026
Official summary of the decision approving at first reading the draft bill for a comprehensive reform of anti-money laundering rules.
lamoncloa.gob.es · Council of Ministers BOELaw 10/2010 on the prevention of money laundering
Consolidated text of the Spanish law still in force, which the reform now going through the legislative process is set to replace.
boe.es · BOE-A-2010-6737
Transparency
How this page is written and updated
Regulatory content ages quickly, and an outdated guide wastes the time of anyone who follows it. That is why we publish who maintains it and with what method.
Update history
- Initial publication. Content checked against the BOE entries for the EU package, SEPBLAC’s note on its publication and the documents of the Spanish legislative process.
- Planned for when the final rules on the new authority’s supervision and inspection procedure are known.
Contact
Book a call
Tell us when you last reviewed your system and whether you have had an inspection, and we will tell you what a supervisor would find today and in what order it makes sense to fix it.
Anti-money laundering inspections: how to really prepare
There is a widespread misconception about anti-money laundering inspections: that you prepare for them when the request for information arrives. In reality, by then almost everything has been decided. What the inspection does is check decisions made years earlier—how a file was archived, whether anyone reviewed the risk assessment, whether the control body ever actually met—and those decisions cannot be reconstructed after the fact without it showing.
The order of the request is no accident
Documents are requested in a sequence that follows a logic: first the risk self-assessment, then the manual, then the control body minutes and the training records, and finally the sample of files. Each piece shapes how the next one is read. An inspector who opens a generic self-assessment, with no recent date and no match with the entity’s actual products, will read everything else looking to confirm that first impression.
Where findings arise
In the sampling. It is the longest phase and the only one that tests what you say against what you do: whether due diligence was applied as the manual says, whether beneficial ownership is traced through to a natural person, whether the required approvals were actually sought, whether dismissed alerts left a trace of the analysis. It is also the phase that separates what is a concern from what is not: one incomplete file is a mistake; twenty with the same gap are a system failure.
Contradiction weighs more than absence
Contrary to what is often thought, not having a written procedure can be a minor gap. What is serious is having one and the files showing that it was not applied: that proves that the entity defined a control and chose not to comply with it. That is why the most cost-effective preparation is not about documents but about alignment: checking that whoever carries out each process describes it the same way the manual does, and deciding which of the two needs correcting when they do not match.
Why it pays to do it now
With the reform under way, more inspection activity is to be expected: an authority with its own funding through fees has stable supervisory capacity, and the effect will be felt especially in sectors that rarely receive supervision today. The good news is that the self-diagnosis exercise does not depend on the final text of the law: requesting the documents from yourself, picking ten files at random and comparing the manual with practice produces exactly the same list of findings a real inspection would produce, with the only difference that there is still time to correct them.
The new authority
Your system
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
- Directive (EU) 2024/1640 of May 31, 2024 on the mechanisms to be put in place by Member States for the prevention of money launderingEUR-Lex · Official Journal of the EU
Legislation and links reviewed in .