IdentificationStep 1
Identification and verification
We verify each customer's identity with reliable supporting documents (Article 3 of Law 10/2010) and, if the customer is a company, its corporate documentation.
Before any transaction.
KYC Outsourcing in Spain
Our team handles your customers' KYC: identification, beneficial ownership, politically exposed person (PEP) and sanctions screening, source of funds and periodic review. We work with your policies, keep a documented file for each customer, and the decision to accept them remains with your entity.
Want to outsource your KYC? We'll prepare a quote
Tell us what type of entity you are and how many new customers you onboard each month, and we'll prepare a tailored quote.
- Reply within 24 h
- No commitment
- Confidential
- Turnaround per file
- 24 business hours
- Review of each customer
- In-house team
- Document retention
- 10 years
- Outsourcing regulated by the AMLR
- July 10, 2027
What we do
All your customers' KYC, handled by our team
Our team reviews every file, applying your entity's policies and putting the analysis in writing. You receive the file with our recommendation, and you decide.
Beneficial ownerStep 2
Beneficial owner
We trace ownership up to the natural persons who own or control more than 25%, or who control the company by other means, even through several layers of companies (Art. 4).
Complex structures included.
ScreeningStep 3
PEPs and sanctions
We check whether the customer or its beneficial owner holds or has held prominent public functions (Art. 14) and whether they appear on EU or UN financial sanctions lists (Art. 42).
At every onboarding.
FundsStep 4
Business activity and source of funds
We obtain the purpose of the relationship and the customer's business activity (Art. 5) and analyze where the money comes from when the risk calls for it.
Backed by supporting documents.
EnhancedStep 5
Enhanced due diligence
For high-risk customers we apply enhanced measures (Art. 11): more documentation, deeper analysis and a reasoned recommendation for your entity.
Higher risk, deeper analysis.
ReviewStep 6
Periodic review
We update files at regular intervals and whenever the customer's circumstances change, as ongoing monitoring requires (Art. 6).
Files kept up to date.
Scenarios
When it makes sense to outsource KYC
These are the moments when entities most often ask us to take over their customer verification.
Growth
Onboarding is growing faster than your team
If every new customer waits days to clear KYC, you lose business. An external team absorbs the peaks without you having to hire.
Small entity
You don't have a dedicated compliance person
In a small entity, KYC often falls to someone who already does other things. Outsourcing it brings method and leaves the rest of the system in your hands.
External review
The external expert or the supervisor finds incomplete files
Files with no beneficial owner, no sanctions check or no update are among the first things a review picks up.
Complex customers
Foreign companies, crypto or multi-layered structures
These are the files that take the most time and where mistakes are easiest to make. We analyze them with legal judgment.
What the law says
KYC and its outsourcing, by the numbers
Figures from Law 10/2010 and Regulation (EU) 2024/1624 (AMLR).
Law 10/2010, Art. 4(2)(b)
25%
Share of capital or voting rights above which a natural person is the beneficial owner of a company.
Law 10/2010, Art. 25
10 years
Period for which due diligence records must be kept.
Law 10/2010, Art. 7(3)
No KYC, no deal
If due diligence measures cannot be applied, the relationship cannot be established and the transaction cannot be carried out.
Law 10/2010, Art. 8(4)
Part of the entity
The law provides for outsourcing in which, under contract, the provider is treated as part of the obliged entity.
AMLR Art. 18(3)
6 tasks
Tasks that cannot be outsourced, including deciding the customer's risk profile and whether to establish the business relationship.
AMLR Art. 90
July 10, 2027
Date from which Regulation (EU) 2024/1624, which regulates outsourcing in its Art. 18, generally applies.
Shall we handle your entity's KYC?
Tell us your onboarding volume and the type of customers you have, and we'll prepare a tailored quote.
Frequently asked questions
KYC outsourcing: frequently asked questions
Is it legal to outsource KYC?
Yes. Law 10/2010 provides for outsourcing in which, under contract, the provider is treated as part of the obliged entity (Art. 8(4)). From July 10, 2027, Article 18 of Regulation (EU) 2024/1624 (AMLR) regulates it in detail: prior notice to the supervisor, a written agreement and periodic controls. What cannot be delegated is responsibility or the key decisions.
Who is responsible and what does my entity decide?
Your entity remains responsible for compliance. We identify, verify and analyze, and deliver the file to you with a recommendation; your entity decides the customer's risk profile and whether to accept the relationship, two tasks that cannot be outsourced under the AMLR (Art. 18(3)). Reporting suspicious transactions to SEPBLAC also stays with your entity, through its SEPBLAC representative.
What does the service include?
Identification and verification of each customer, identification of the beneficial owner, screening for politically exposed persons and financial sanctions, the purpose of the relationship and the source of funds, enhanced due diligence in high-risk cases and periodic review of the files. Each customer ends up with a documented file.
How long does it take you to review a customer?
We respond within 24 business hours per file once we have the complete documentation. If the customer has a complex structure or is high-risk, more documentation may be needed; we tell you from the outset.
How much does it cost?
We prepare a tailored quote based on the number of onboardings, the type of customer and the risk of your business. Tell us about your case in the form and we'll get back to you.
How is this different from identity verification software?
Software checks documents; it doesn't assess whether the information makes sense. In our service, our team reviews every file: it analyzes corporate structures, the source of funds and list matches, and puts its reasoning in writing.
What changes with the EU regulation in 2027?
From July 10, 2027, AMLR Art. 18 requires you to notify the supervisor of the outsourcing before it starts, sign a written agreement, ensure the provider applies your entity's policies and monitor it periodically. We help you get ready; we explain the contract in our guide to the KYC outsourcing agreement.
What about data protection for my customers?
Because we process the data on your entity's behalf, we act as a data processor, under a contract that sets out the instructions, confidentiality and security measures, as required by Article 28 of the General Data Protection Regulation (GDPR).
Practical guide
How we outsource your KYC, step by step
Well-run outsourcing makes it clear what we do, what your entity decides and how it is controlled.
Verifies and analyzes
Identification, beneficial owner, screening, source of funds and a proposed risk rating, using your policies.
Decides
The risk profile, customer acceptance and reporting to SEPBLAC.
Reviews
A written agreement, periodic controls and files ready for the external expert and for inspections.
Your outsourced KYC in 10 steps
- We review your customer acceptance policy and your risk analysis.
- We agree which types of customer the service covers and which documents we request from each.
- We sign a written agreement covering the tasks, confidentiality and data processing.
- We receive each new customer's documents through the channel we agree on.
- We identify and verify the customer and its beneficial owner.
- We screen for politically exposed persons and financial sanctions.
- We analyze the purpose of the relationship and the source of funds according to risk.
- We deliver the file with our recommendation within 24 business hours.
- Your entity decides the risk profile and whether to accept the customer.
- We review the files periodically and update them when circumstances change.
Source: Law 10/2010 (Arts. 3–8, 11, 14, 25 and 42) and Regulation (EU) 2024/1624 (Arts. 18 and 90).
Working glossary
Key KYC concepts
These terms appear in Law 10/2010, in Regulation (EU) 2024/1624 and in data protection legislation.
KYCConcept
KYC (know your customer)
The set of measures used to know who the customer is, who is behind them and what they do.
Arts. 3–6, Law 10/2010.
Due diligenceObligation
Due diligence
Identification, beneficial owner, purpose of the relationship and ongoing monitoring of the customer.
Arts. 3–6, Law 10/2010.
Beneficial ownerPerson
Beneficial owner
Natural person who owns or controls more than 25% of a company or controls it by other means.
Art. 4(2), Law 10/2010.
PEPRisk
Politically exposed person
Someone who holds or has held prominent public functions; requires enhanced measures.
Art. 14, Law 10/2010.
SanctionsLists
International financial sanctions
EU and UN measures that require freezing the funds of designated persons or entities.
Art. 42, Law 10/2010.
EnhancedHigh risk
Enhanced due diligence
Additional measures for high-risk customers, countries or transactions.
Art. 11, Law 10/2010.
MonitoringOngoing
Ongoing monitoring
Review of the relationship to keep the information up to date, including the source of funds.
Art. 6, Law 10/2010.
OutsourcingModel
Outsourcing
Assigning tasks to a provider that, under contract, is treated as part of the obliged entity.
Art. 8(4), Law 10/2010 and AMLR Art. 18.
ProcessorData
Data processor
A party that processes personal data on behalf of another, under a contract setting out its instructions.
GDPR Art. 28.
Playbook
What we do and what your entity decides
Identification and verification
What we do: we check each customer's documents.
What your entity decides: whether the documents are sufficient to proceed.
Beneficial owner
What we do: we reconstruct the chain of control.
What your entity decides: final validation of the beneficial owner.
PEPs and sanctions
What we do: we screen the lists and analyze every match.
What your entity decides: the measures to take on a confirmed match.
Risk profile
What we do: we propose the risk level, with our reasoning.
What your entity decides: the risk profile (AMLR Art. 18(3)(c)).
Customer acceptance
What we do: we prepare the file with our recommendation.
What your entity decides: whether to establish the relationship (AMLR Art. 18(3)(d)).
Common KYC mistakes
These are frequent failings that any review spots right away.
- Files with no identified beneficial owner.
- Not screening for financial sanctions at every onboarding.
- Applying the same due diligence to every customer, regardless of risk.
- Not updating the files of long-standing customers.
- Outsourcing without a written agreement.
Contact
Book a call
Tell us what type of entity you are, how many new customers you onboard each month and what kind of customers they are, and we'll prepare a tailored quote.
KYC outsourcing under Law 10/2010 and the AMLR
Updated October 22, 2026
KYC (know your customer) is the core of due diligence under Law 10/2010: identifying the customer and its beneficial owner, understanding its business and monitoring it on an ongoing basis. Many entities outsource it to gain capacity and method, while remaining responsible.
What the law requires
Law 10/2010 requires you to identify the customer with reliable supporting documents (Art. 3), identify the beneficial owner (Art. 4), understand the purpose of the relationship (Art. 5) and carry out ongoing monitoring that includes the source of funds (Art. 6). If these measures cannot be applied, you cannot do business with the customer (Art. 7(3)). We explain it in AML and KYC.
Outsourcing vs. reliance on third parties
The law distinguishes two arrangements. Reliance on a third party (Art. 8(1)–(3)) lets you rely on the due diligence already carried out by another obliged entity, under a written agreement and except for ongoing monitoring. Outsourcing (Art. 8(4)) is different: the provider works under contract as part of your entity and applies your policies. Our service is outsourcing.
What changes in 2027
Article 18 of Regulation (EU) 2024/1624 (AMLR), applicable from July 10, 2027, regulates outsourcing: prior notice to the supervisor, a written agreement, application of the entity's policies and periodic controls. It also lists six tasks that cannot be outsourced. We summarize it in AMLR.
The building blocks of KYC
Each building block has its own guide: beneficial ownership, politically exposed persons, international financial sanctions, enhanced due diligence, simplified due diligence, KYB for companies and remote video identification.
Who it is for
We work with obliged entities across sectors: payment institutions and fintechs, financial advisory firms (EAF), crypto-asset service providers, real estate firms and insurance brokerages.
Where it fits
KYC outsourcing is one part of your entity's anti-money laundering framework. It is coordinated with the SEPBLAC representative, with the technical unit if you have one, and with the external expert report, which reviews every year how it works.