Every obliged entity must approve in writing and apply an express customer acceptance policy that describes which customers present a higher-than-average risk and which enhanced precautions apply to them (Article 26(2) of Law 10/2010). Not having one is a serious infringement. We draft it based on your risk analysis.
Would your acceptance policy survive an inspection?
Tell us what type of obliged entity you are and what customers you have, and we will tell you what your policy needs to cover.
The acceptance policy turns your risk analysis into clear rules: which customers you accept, with what measures, and in which cases you do not start the relationship or you end it.
We start from your written risk analysis, which the law requires in order to grade due diligence measures (Article 7(1) of Law 10/2010), and isolate the factors that carry weight in your business.
We describe the customers with a higher-than-average risk, both those the law already classifies as such and those that emerge from your analysis, as well as low-risk and standard-risk customers.
We assign each category its level of due diligence (simplified, standard or enhanced), with the information and documents to request.
We set out the cases for not accepting a customer or ending the relationship, the special examination required and how to document the decision.
We prepare the policy so that the competent body can approve it in writing and it can be included in the manual, and we train the staff who onboard customers.
We define when the policy is reviewed and how customers are reclassified when their circumstances or the business risk change.
Your acceptance policy has to reflect your actual business. These are the moments when it becomes outdated.
New products, channels or markets change your customers’ risk profile and require you to review the categories.
The external review checks whether the policy precisely describes your higher-risk customers and the measures you apply to them.
If refusals depend on each account manager, you will not be able to justify them to the supervisor or to the customer.
Regulation (EU) 2024/1624 keeps the rule that you do not do business without due diligence, and it requires you to keep a record of the decisions taken.
Key data from Law 10/2010, its implementing regulation (Royal Decree 304/2014) and Regulation (EU) 2024/1624.
The policy is approved in writing and applied: keeping it in a drawer is not enough.
It is the first item of the minimum content of the AML manual, together with the measures to mitigate risk, including refusing to do business.
Without due diligence, no relationships are established and no transactions are executed; if this happens during the relationship, the relationship is ended.
Failing to approve in writing and apply an express customer acceptance policy is a serious infringement.
Minimum fine for a serious infringement, imposed together with a reprimand or, for authorized entities, a temporary suspension.
From July 10, 2027, the AMLR requires you to refrain from the relationship or terminate it, and to keep a record of those decisions.
We review your acceptance policy against your risk analysis and propose the changes in order of urgency.
It is the document in which an obliged entity sets out which customers it accepts and with what measures. Article 26(2) of Law 10/2010 requires it to be approved in writing and applied, to describe the types of customers that could present a higher-than-average risk, and to be graduated, with enhanced precautions for higher-risk customers.
It is a general obligation under Law 10/2010. Article 31(1) of the implementing regulation exempts insurance brokers, and obliged entities under Article 2(1)(i)–(u) with fewer than 10 people and no more than €2 million in turnover or balance sheet total, from several internal control obligations, including those in its Arts. 31–33, unless they are part of a group that exceeds those thresholds. Even so, they must still apply risk-based due diligence.
At a minimum, a precise description of the customers who may pose a higher-than-average risk, either because the law says so or because your risk analysis shows it, and the measures to mitigate that risk, including, where appropriate, refusing to establish relationships or terminating the relationship (Article 33(1)(a) of Royal Decree 304/2014). In practice, it is advisable to add the low-risk and standard-risk categories and the measures for each.
Some are set by the law itself, such as politically exposed persons or cross-border correspondent banking relationships, which are subject to enhanced measures (Arts. 11–16 of Law 10/2010). Others come from your own analysis: activity, ownership structure, source of funds, channel or transaction volume.
Yes. If you cannot apply due diligence measures, the law requires you not to establish the relationship or to end it, with a special examination (Article 7(3) of Law 10/2010). This refusal creates no liability for the obliged entity, unless there is unjust enrichment. Outside that case, the policy must explain, using objective criteria, when you do not accept a type of customer.
In the financial sector, the EBA Guidelines EBA/GL/2023/04 ask firms not to reject entire categories of customers without assessing the specific risk, to consider mitigating measures before refusing or ending the relationship, and to document the decision. The EU AMLR takes the same approach: manage risk rather than avoid it across the board.
The obliged entity’s management body approves the AML policies (Article 31(2) of Royal Decree 304/2014). In regulated professions with a centralized prevention body, that body approves it (Article 26(2) of Law 10/2010). The policy is then included in the manual and circulated to the staff who onboard customers.
From July 10, 2027, Regulation (EU) 2024/1624 keeps the obligation to refrain from starting the relationship, or to end it, when due diligence cannot be completed. It also requires you to consider whether to report the transaction and to keep a record of the measures taken (Art. 21). Your policy should be prepared now to document these decisions.
A good acceptance policy can be applied without hesitation from the very first onboarding and is easy to justify to the supervisor.
The risk factors of your business determine the customer categories and the measures for each one.
Each category with its due diligence level, its documentation and who decides on acceptance.
Onboardings, rejections and terminations with their reasons, for the external expert and SEPBLAC.
Source: Law 10/2010 (Arts. 7, 26, 52 and 57), Royal Decree 304/2014 (Arts. 31 and 33), Regulation (EU) 2024/1624 (Art. 21) and EBA Guidelines EBA/GL/2023/04.
These terms appear in Law 10/2010, in Royal Decree 304/2014 and in any external expert review.
Written rules on which customers the obliged entity accepts and with what measures.
Customers who, by law or according to your analysis, require enhanced precautions.
The higher the customer’s risk, the more intensive the measures.
Identification, beneficial owner, purpose of the relationship and ongoing monitoring.
Additional measures for higher-risk cases, such as politically exposed persons.
A written assessment of the business’s risks that justifies the degree of the measures.
Not starting the relationship, or ending it, when due diligence cannot be applied.
Rejecting entire groups of customers without assessing each customer’s specific risk.
The document that contains the acceptance policy and the other internal control procedures.
Acceptance policy: the general rules on which customers you accept and with what measures.
Customer risk profile: the specific assessment of each customer.
Acceptance policy: before each onboarding and when reviewing the relationship.
Customer risk profile: at onboarding and during ongoing monitoring.
Acceptance policy: the management body, in writing.
Customer risk profile: assigned under the approved procedure.
Acceptance policy: the business risk analysis.
Customer risk profile: the customer’s data and documents.
Acceptance policy: customer categories and graduated measures.
Customer risk profile: a risk level and the measures that go with it.
These are flaws that show up when the policy is compared with a sample of customer files.
Tell us what type of obliged entity you are, what customers you have and how you currently decide on onboarding, and we will tell you what your acceptance policy needs to cover.
Updated October 15, 2026
Article 26(2) of Law 10/2010 requires obliged entities to approve in writing and apply an express customer acceptance policy. It is the piece that connects the risk analysis with day-to-day due diligence.
The policy must describe the types of customers that could present a higher-than-average risk, and it must be graduated, with enhanced precautions for those customers. Under Article 7(1), the degree to which due diligence measures are applied according to risk is set out in that policy, supported by a written risk analysis.
Article 33(1)(a) of Royal Decree 304/2014 makes it the first item in the AML manual, with a precise description of higher-risk customers and of the measures to mitigate that risk, including refusing to do business or ending the relationship. Article 31(2) gives the management body the task of approving it.
If due diligence cannot be applied, the obliged entity does not establish the relationship or execute the transaction; if the impossibility arises later, it ends the relationship and carries out the special examination (Art. 7(3)). For higher-risk customers, the policy works together with the customer risk profile and the enhanced due diligence measures.
The EBA Guidelines EBA/GL/2023/04, on managing risk when providing access to financial services, ask financial institutions to assess each customer’s risk instead of rejecting entire groups, to consider mitigating measures before refusing, and to document their decisions. The AMLR takes the same approach from 2027.
The acceptance policy is one piece of the anti-money laundering system and is reviewed in the external expert report. Failing to approve it in writing and apply it is a serious infringement (Article 52(1)(m) of Law 10/2010).