Governance
From “nice-looking” policies to internal control that is actually carried out
“We turn your banking compliance program into evidence: owners, controls, records and traceability.”
Banking Compliance in Spain
Independent advisory and audit services in banking compliance for financial institutions, e-money institutions (EDE/ECE), fintechs and critical providers. We review corporate governance, internal control, AML/KYC, MiFID II, PSD2 and customer protection: we detect gaps, prioritize risks and leave you with a remediation plan you can defend before the Bank of Spain, the CNMV and SEPBLAC.
MiFID II
Conduct and customer protection
“We review pre-contractual information, tests, conflicts of interest, inducements and complaints with a supervisory focus.”
AML/KYC
Solid onboarding, not “loose folders”
“We check KYC/UBO, risk profile, record-keeping and consistency: everything that must hold up to a request for information.”
PSD2 / Operations
Controls, reporting and critical third parties
“We test processes and records: incidents, outsourcing, continuity, security and regulatory reporting.”
What a banking compliance service includes
Banking regulation and supervision
Regulatory mapping and obligations: internal control, conduct, payments, outsourcing and anti-money laundering, with a supervisory focus.
What is banking compliance?
It is the system of governance, policies and controls that ensures regulatory compliance and reduces the risk of sanctions, as well as operational and reputational risk.
Onboarding + Beneficial Ownership
Sample-based review of files: identification, UBO/beneficial owner, risk profiling, record-keeping and consistency with actual activity.
MiFID II and customer protection
Tests, client information, conflicts of interest, inducements and records. We align sales practices with supervisory criteria and traceability.
Training and evidence
Annual plan by role: targeted training, verifiable records and a stronger compliance culture in critical areas (sales, KYC, payments).
Action plan and follow-up
Prioritized findings + a plan with a timetable: owners, evidence and closure control to show the supervisor real improvement.
Review frequency and key timelines in banking compliance
In banking compliance, what matters is not “having documents” but demonstrating governance, controls that are actually performed, evidence, incident management and closure of actions. The supervisor looks at consistency, traceability and response times.
Periodic review: update the regulatory map, risks and controls when there are regulatory or business model changes.
Governance and reporting: committees, minutes and incident escalation, with clear owners and evidence.
Remediation plan: a realistic, verifiable timetable with follow-up (no “never-ending open actions”).
Record-keeping: compliance, KYC, complaints and control records, accessible when a request for information arrives.
Ongoing monitoring: track indicators (KRIs/KPIs) to detect deviations before an inspection.
AML/KYC within banking compliance (SEPBLAC)
An essential part of banking compliance is the AML/KYC pillar. If your institution or business is subject to anti-money laundering obligations, it is critical to align policies, operations and evidence so you can respond convincingly to requests for information. At Molina Law Boutique we work with an inspection-oriented approach: traceability, sampling and corrective actions.
Scope of banking compliance: what will we review?
We review your banking compliance program from a practical standpoint: policies, controls actually performed and evidence. We audit both documentation and operational and digital traceability.
1. Governance, policies and internal control
We check roles, committees, the responsibility matrix, policies and procedures. The goal: compliance that is not just “on paper” but workable and verifiable.
2. Operational controls, records and third parties
We review key controls: incidents, outsourcing, continuity, security and traceability of decisions. We validate records and evidence so you can respond to supervisors.
3. Training + critical pillars (AML/KYC and conduct)
We review role-based training and its evidence. We also sample critical points: KYC/UBO onboarding, alerts and the handling of complaints and claims.
Full program or follow-up review?
In banking compliance, you do not always need to “redo everything”: sometimes a focused review of controls and actions is enough. The key is that the level of evidence remains solid.
| Feature | Full Program (Standard) | Follow-up Review |
|---|---|---|
| When is it a good fit? | Program launch, significant changes, new business lines or material findings. | Interim periods, to validate closures, indicators and the effectiveness of corrective actions. |
| Scope | Governance, policies, controls, evidence, training, third parties and critical pillars (AML/KYC and conduct). | Focus on open actions, weak points and critical controls defined by risk. |
| Goal | Reduce regulatory risk and leave a “demonstrable system” in place for supervisors. | Confirm real improvement: verifiable closure and operational consistency. |
| Outcome | A complete roadmap with evidence and priorities. | A progress report with control status, residual gaps and next milestones. |
*If your business changes, the program must adapt: what “worked” last year may fall short after an operational or regulatory change.
How we work on your banking compliance
An agile methodology to improve compliance without disrupting day-to-day operations: assessment, sampling, evidence and action plan.
01
Assessment and regulatory map
We gather processes and documentation: internal policies, governance, third parties and records. We identify critical obligations and risks by business line.
02
Operational testing (sampling)
We test what really happens: KYC/UBO files, conduct controls, incidents and evidence. We validate the traceability and consistency of records.
03
Findings + remediation plan
We deliver a draft with gaps prioritized by risk and an action plan with owners, deadlines and the evidence required.
04
Final report and support with supervisors
A final document ready for audit or inspection: evidence, traceable decisions and metrics. We support you through implementation and closure.
Operational checklist
Evidence that strengthens your banking compliance in supervisory reviews
In banking compliance, evidence makes the difference: records, traceable decisions, controls actually performed, follow-up and documented closure.
Regulatory map
Controls performed
Traceable records
Remediation plan
-
Clear governance and responsibilities
Committees, roles, segregation of duties and incident escalation: everything must be recorded in minutes and logs.
-
Controls performed (not just designed)
Tests, reviews and results: evidence that the system works day to day.
-
Sampling explained
Define criteria and coverage: customers, products, channels and periods. If there are automated controls, document the rules and reviews.
-
Action plan with a timetable
Actions, owners and dates. The supervisor looks for verifiable closures, not intentions.
-
Organized, accessible archive
KYC/UBO, conduct, incidents and training: ready to hand over quickly in response to a request for information or an audit.
Common banking compliance mistakes we fix
The goal is not “compliance for compliance’s sake” but to reduce regulatory risk and demonstrate effective control to the Bank of Spain, the CNMV and SEPBLAC.
⚠️
The “paper manual”
Generic policies that are never applied. In banking compliance, what matters is evidence and the traceability of real internal control.
⚠️
Inconsistent KYC/UBO
Incomplete files or files not consistent with the risk. Missing updates, missing documentation or records that are not accessible when a request for information arrives.
⚠️
Conduct without traceability
Tests, client information or conflict-of-interest management without robust evidence. A critical point in MiFID II reviews.
⚠️
Remediation “without closure”
Open corrective actions with no owners or dates. This is seen as a lack of control and increases the risk of sanctions and reputational risk.
What a banking compliance program must be able to demonstrate
Beyond “having policies”, what matters in a review is traceability: governance, controls, evidence, incidents and closure of actions.
Governance
Controls
Evidence
Remediation
Governance and “ownership” of compliance
- Clear roles and segregation of duties in critical processes.
- Regular minutes and reporting from committees and responsible persons.
- Escalation of incidents, with a decision and evidence.
- Consistency between risks, policies and controls.
Consistency between design and execution is what “adds up” for supervisors.
Controls and evidence (what supervisors expect to see)
- What was checked: tests, results and findings (not just conclusions).
- Traceability: records of decisions, incidents and closures.
- Critical controls: AML/KYC, conduct, payments and third parties.
- Documentation quality: accessible, well-organized evidence.
Quality tip
If you cannot show “who did what, when and with what result”, the control is usually considered weak.
Third-party management and continuity
- Due diligence on critical providers and outsourcing.
- SLAs, audits, incidents and evidence of control.
- Continuity and operational resilience, with tests and records.
- Security and data access, with traceability.
Third parties do not remove responsibility: they are controlled with evidence.
Risk-based approach
- Controls proportionate to activity, customers and channels.
- Stronger measures in high-risk scenarios (KYC, fraud, complaints, conflicts of interest).
- Review and update when there are regulatory or product changes.
“Living” compliance: it adapts, it is tested and it is demonstrated.
Important note:
Request a readiness checklist
If your institution grows, changes products or brings in new providers, update the program. Banking compliance fails when it stays “frozen” in an old version.
Risks and penalties if your banking compliance is not up to date
Regulatory risk: breaches that can be detected in supervisory reviews (governance, controls, records and traceability).
Penalties and corrective measures: requests for information, mandatory action plans and potential financial impact.
Reputational risk: loss of trust and friction with partners, investors and counterparties.
Operational blockages: onboarding, accounts, payments, critical providers and audits.
Cost of reacting late: fixing things late is usually more expensive than implementing and documenting properly in time.
Need to strengthen your banking compliance?
We help you implement and audit a program you can demonstrate: governance, controls, evidence, findings and a remediation plan ready for supervisors.
All about banking compliance
What is banking compliance?
Banking compliance is the set of governance, policies, controls and evidence that allows an institution to comply with applicable regulation and prove it. It is not limited to “documentation”: it requires execution, records and traceability.
Its purpose is to reduce regulatory, operational and reputational risk and to respond convincingly to audits and inspections.
A strong program is measured by what you can prove, not by what you claim.
How often should it be reviewed? (Frequency)
Reviews should be periodic and also stepped up when there are significant changes (product, channel, provider, growth or new regulation).
Consistency between risks, controls, evidence and remediation is key for supervisors.
What areas does banking compliance cover?
It covers governance and internal control, conduct and customer protection, AML/KYC, third-party management, continuity and required records/documentation.
The scope is tailored to your type of institution and the real risks of your operations.
What does a banking compliance assessment include?
A practical evaluation of the program: policies, controls performed, file sampling, records, training and remediation.
What makes the difference:
- Evidence and results (not just “opinion”).
- Sampling explained: size, criteria, coverage.
- Findings prioritized by risk + an action plan with a timetable.
- An organized archive to respond quickly to requests for information.
Benefits of strong banking compliance
It reduces the risk of sanctions and reputational risk, improves relationships with counterparties and makes audits, access to banking services and controlled growth easier.
It also standardizes decisions and avoids “dependence on individuals”: the system becomes institutionalized.
What documentation should you prepare?
Policies and procedures, minutes/committees, risk map, KYC/UBO files, incident logs, training, controls and evidence of closures.
If everything is organized, the assessment is faster and the result more actionable.
What happens if the program is weak or outdated?
The risk of requests for information, corrective plans and sanctions increases, along with operational friction and loss of trust.
Fixing things late usually means more cost, more urgency and more exposure.
How much does a banking compliance service cost?
It depends on size, complexity, the number of processes, the volume of files and the level of evidence available.
We give you a quote after a brief assessment of the scope and risks.
Book a call (banking compliance)
Official sources
Key legislation, linked to the official text:
- Law 10/2014 of June 26 on the Organization, Supervision and Solvency of Credit InstitutionsBOE · consolidated text
- Royal Decree 84/2015 of February 13, implementing Law 10/2014 of June 26 on the Organization, Supervision and Solvency of Credit InstitutionsBOE · consolidated text
Legislation and links reviewed in .