The EU package substantially raises the ceiling on sanctions, and the Spanish draft bill concentrates the power to impose them in the same body that inspects. This page explains what is sanctioned, on what scale, and which circumstances aggravate or mitigate and, most importantly, what you can do beforehand so that a finding does not end in sanction proceedings.
Assessment of your exposure
We reply in under 24 h
Two levels should be kept apart. The first is substantive: which conduct counts as an infringement and the maximum sanction it carries, which is set by the EU package. The second is procedural: who investigates and who decides, which is what changes with the Spanish reform.
Directive (EU) 2024/1640 requires Member States to provide, for serious, repeated or systematic breaches, maximum pecuniary sanctions of at least €10 million or 10% of annual turnover for legal persons, whichever is higher.
This is a minimum that Member States must guarantee, not a cap: national law can go further.
Today SEPBLAC proposes and the Ministry decides. The draft bill concentrates both in ANIFI: the same body investigates and decides.
The likely consequence is not automatically greater severity, but faster proceedings and more consistent criteria across sectors.
The catalog of infringements is built around the core obligations of the system. What matters for an entity is not memorizing it, but understanding that almost all sanctionable conduct is detected by comparing two documents the entity already has.
| Area | Sanctionable conduct | How it is detected in an inspection |
|---|---|---|
| Due diligence | Failing to identify or verify the counterparty, or failing to apply enhanced measures when required. | File sampling: the inspector checks whether the procedure in the manual was applied to specific transactions. |
| Beneficial ownership | Failing to identify the natural person who has control, or stopping the analysis at an intermediate company. | Review of corporate chains in the sample of clients with ownership structures. |
| Reporting | Failing to report suspicious activity, reporting it late or reporting it with insufficient content. | Comparing the volume and quality of what was reported with the risk profile of the client portfolio. |
| Duty to refrain | Executing a transaction despite suspicion, outside the cases set out in the law. | Comparing the alerts recorded with the transactions actually executed. |
| Record keeping | Failing to keep records for the required period, or being unable to retrieve them. | Requests for old files with a tight response deadline. |
| Internal control | Lacking a manual, a risk analysis, a control body or a designated representative. | Initial document request: it is the first thing asked for. |
| Training | Failing to provide adequate training, or being unable to prove it. | Records of attendees, content and assessment by role. |
| Obstruction | Failing to respond to a request for information, responding late or hindering the supervisor’s work. | It is an infringement in its own right, regardless of the merits of the case. |
| Confidentiality | Disclosing to the client or to third parties that a report has been made or a measure taken. | Analysis of internal communications and of automatic notices to the client. |
Our own classification by obligation area. The specific definition of infringements and their classification as minor, serious or very serious is a matter for national law: today, Law 10/2010; in the future, the law resulting from the reform now going through the legislative process.
Sanctions exposure is not reduced by contesting the proceedings once they are open, but by working beforehand on what triggers them. And once they are open, what makes the difference is the technical quality of the written submissions and the credibility of the remediation plan.
A review of your system using the supervisor’s criteria to identify which findings would arise and which of them could lead to a sanction. The aim is to correct beforehand whatever would aggravate, because voluntary remediation before detection is the circumstance that counts most in your favor.
Updating the risk self-assessment, the manual and the procedures. This is what turns a sanctionable pattern into a one-off finding, which is exactly the difference between a request to remedy and sanction proceedings.
Analysis of the volume and quality of what is reported, and of how the duty to refrain works in practice, which is where the most serious infringements are concentrated.
Drafting written submissions, providing evidence, negotiating the remediation plan and, where appropriate, appealing the sanctioning decision.
Analysis of the personal exposure of directors and senior managers, and of the allocation of duties that sets its limits. The AML/CFT system is the responsibility of the management body.
Implementing and documenting the plan committed to before the supervisor. Compliance with it is checked later, and failing to comply with it aggravates.
Between the minimum and the maximum of any sanctions scale there is a huge margin, and that margin is decided by criteria that are largely in the entity’s hands. Knowing them serves two purposes: reducing exposure beforehand and shaping the defense afterwards.
For many entities, the financial impact of the sanction is smaller than that of the measures that accompany it. They should be kept in mind when assessing the real exposure from a breach.
| Measure | What it involves | Real impact |
|---|---|---|
| Public reprimand | Publication of the offender’s identity and of the infringement committed. | In regulated sectors, the reputational damage usually exceeds the financial damage and affects relationships with banks and counterparties. |
| Cease-and-desist order | An order to end the conduct and not to repeat it. | It requires correction within a deadline and under supervision, with later follow-up of compliance. |
| Ban on holding office | Temporary disqualification of those who held management or control functions. | It affects specific individuals and can force changes in the management body. |
| Withdrawal or suspension of authorization | Loss or suspension of the license to operate, for entities subject to authorization. | It is the most serious consequence and the one that turns a compliance problem into an existential one. |
| Sanctions on individuals | Fines on directors and on those who held control functions. | Liability does not end with the legal person: it reaches whoever decided on or tolerated the conduct. |
| Indirect effects | Loss of banking relationships, exclusion from public tenders and higher insurance costs. | They are not sanctions, but in practice they weigh as much as the fine, or more. |
Our own classification based on the regime of administrative measures in the EU framework. The specific list applicable in Spain will be the one set by the national law resulting from the reform.
We identify the findings an inspection would produce, separate the one-off ones from those that reveal a pattern, and prioritize correction by real exposure, not alphabetically.
In practice, very few entities receive maximum sanctions. What separates a request to remedy from serious sanction proceedings is almost always one of these six factors.
The pattern, not the case: one incomplete file can be corrected; twenty with the same gap prove a system failure. Sampling is designed precisely to tell them apart, and the classification of the infringement depends on that distinction.
The ignored warning: a finding flagged in a previous inspection and not corrected turns any later issue into a repeat breach. It is the aggravating circumstance with the most practical weight.
Lack of cooperation: late, incomplete or contradictory answers during the inspection are an infringement in their own right and taint the assessment of everything else.
Directors and heads of control functions can be sanctioned personally. A documented allocation of duties is what sets the limits of that exposure.
Publication of the sanction has effects beyond the fine: banking relationships, public tenders, insurance and counterparties that check who they are dealing with.
For obliged entities subject to authorization, a structural breach can affect the fit and proper requirements and, in the extreme, the license itself.
REGULATORY CONTROL CENTER · SANCTIONS EXPOSURE
Exposure does not depend only on size: it depends on what is examined in each sector and on how much prior supervision the entity has had. This panel shows where the real risk lies in each case.
An indicative reference to prioritize the work and size the project team.
None of them has to do with the original breach. All of them have to do with what is done afterwards.
When an inspection detects a failure in a sample, the failure is in the system, not in those files. Correcting only the files reviewed guarantees that the same finding will reappear in the next inspection, this time as a repeat breach.
Technical submissions are needed when there is a genuine disagreement. When the finding is correct, contesting it uses up the credibility you will need to negotiate the remediation plan.
Compliance with the remediation plan is checked later. An ambitious plan that is not delivered aggravates more than it mitigated when it was submitted.
Obstructing the supervisor’s work is an infringement in its own right. Answering after the deadline harms you, however strong your case is on the merits.
Directors and heads of control functions can be sanctioned personally. Defining and documenting the allocation of duties is the only thing that limits that exposure, and it has to be done beforehand.
Voluntary correction before detection is the mitigating circumstance with the most weight. Detecting a problem and not correcting it while nobody is looking wastes the best card you have.
Three principles worth more than any litigation strategy.
Voluntary remediation changes the nature of the matter. A problem detected, documented and corrected on your own initiative is rarely treated the same as the same problem found in an inspection.
What aggravates is evidence of a structural failure. Correcting the cause (the procedure, the criterion, the training) and not just the cases reviewed is what stops the finding from recurring.
A documented allocation of duties, with express delegations and regular reporting to the management body, is what defines each person’s personal exposure. It is built beforehand, never during proceedings.
If you want to assess your exposure or defend a case, see our AML services or request a free consultation.
Terms worth distinguishing precisely from the very first request for information.
Conduct contrary to AML obligations that the law classifies as minor, serious or very serious.
Committing an infringement when a similar one had already been committed before. It is the aggravating circumstance with the most practical weight.
Detecting and correcting the breach before the supervisor notices it, documented and dated.
Disclosure of the offender’s identity and of the infringement. In regulated sectors it usually weighs more than the fine.
Failing to respond to a request for information, responding late or obstructing the inspection. It is an infringement in its own right.
A document with measures, owners and verifiable deadlines, whose implementation is checked later.
The possibility of sanctioning those who held management or control functions, in addition to the entity.
The figure on which the maximum percentage of the sanction is calculated for legal persons.
Body envisaged in the draft bill that will investigate and decide AML sanction proceedings.
The EU framework requires Member States to provide, for serious, repeated or systematic breaches, maximum pecuniary sanctions of at least €10 million or 10% of annual turnover for legal persons, whichever is higher.
This is a minimum that national law must guarantee, not a cap: Spanish law can set higher scales. It is advisable to check the specific figure against the law in force at any given time.
No, and that is a widespread misconception. Before a sanction come recommendations, requests to remedy within a deadline and reprimands. Most findings are resolved at those steps.
What usually pushes a case toward sanction proceedings is not the seriousness of an isolated case, but evidence of a structural failure or the repetition of something already flagged.
Repetition. A finding flagged in a previous inspection and not corrected turns any later issue into a repeat breach, and it is the circumstance with the most practical weight when the sanction is graded.
It is followed by lack of cooperation during the inspection, the benefit obtained and the harm caused to third parties.
A great deal, and it is the most cost-effective recommendation on this whole page. Voluntary remediation (detecting, documenting and correcting on your own initiative, with dates) changes the nature of the conversation with the supervisor.
A problem corrected before anyone detects it rarely gets the same treatment as the same problem found in a sample.
Yes. Liability does not end with the legal person: directors and heads of control functions can be sanctioned, and even temporarily banned from holding office.
What limits that exposure is a documented allocation of duties, with express delegations and a record of the regular information the management body receives. It is built beforehand, not during the proceedings.
Public reprimand, cease-and-desist orders, a temporary ban on holding management positions and, for entities subject to authorization, suspension or withdrawal of the license.
For many entities, the impact of these measures (especially publication) exceeds that of the financial sanction itself.
Not on the substance: sanctionable conduct and the scales come from the legal framework. What changes is speed: today SEPBLAC proposes and the Ministry decides, and that separation drags proceedings out.
Faster proceedings and more consistent criteria across sectors can be expected. We cover this in ANIFI vs SEPBLAC.
It depends on whether it is correct. When there is a genuine technical disagreement, written submissions are necessary and must be argued rigorously. When the finding is accurate, contesting it uses up the credibility you will later need to negotiate the remediation plan.
The combination that works best is to acknowledge what is true, contest with evidence what is not, and present a realistic plan.
It aggravates your position. Compliance is checked later, and an ambitious plan that is not delivered harms you more than it mitigated when it was submitted.
That is why you should commit only to what can be done, with owners and verifiable deadlines, and document each step of its implementation.
The substantive obligations come from Regulation (EU) 2024/1624, which applies from July 10, 2027. The specific sanctions regime and the competent body will depend on the Spanish law resulting from the reform now going through the legislative process.
Until then, the current regime remains fully in force. You can follow the status of the reform on our page on Spain’s new AML law.
Everything stated on this page comes from the published EU legislative package or from official Spanish documents on the bill still going through the legislative process.
Entry for the EU anti-money laundering regulation in the Spanish Official State Gazette (BOE), with access to the PDF of the original publication. It is the regulation that brings football within the scope of obliged entities.
boe.es · DOUE-L-2024-80912 SEPBLACNote from the Spanish supervisor on the three acts published in the Official Journal of the EU on June 19, 2024, with the new obliged entities and the €10,000 cash limit.
sepblac.es · legislative package BOEThe mechanisms Member States must put in place: supervision, registers and cooperation. It is the piece Spain must transpose.
boe.es · DOUE-L-2024-80913 Ministry of EconomyOfficial page for the public hearing and consultation on the Spanish reform that creates ANIFI and brings in the new obliged entities. Submissions until September 30, 2026.
portal.mineco.gob.es · public consultation La MoncloaOfficial summary of the decision approving at first reading the draft bill for a comprehensive reform of anti-money laundering rules.
lamoncloa.gob.es · Council of Ministers BOEConsolidated text of the Spanish law still in force, which the reform now going through the legislative process is set to replace.
boe.es · BOE-A-2010-6737Regulatory content ages quickly, and an outdated guide wastes the time of anyone who follows it. That is why we publish who maintains it and with what method.
Tell us whether you have open proceedings or would like to assess your exposure before there are any, and we will tell you how much real room for maneuver there is and where to start.
The EU anti-money laundering package has substantially raised the ceiling on sanctions, and the Spanish reform concentrates the power to impose them in the same body that inspects. This double shift has caused a good deal of alarm in the sector, not always well directed: what determines an entity’s real exposure is not the top of the scale, but where on the scale its situation places it.
The EU framework requires Member States to provide, for serious, repeated or systematic breaches, maximum sanctions of at least €10 million or 10% of annual turnover for legal persons, whichever is higher. It is a minimum that national law must guarantee. But the trigger should be read carefully: serious, repeated or systematic. The vast majority of findings in a routine inspection do not fit that description and are resolved at much earlier steps (a recommendation, a request to remedy, a reprimand).
Three things, in this order. The first is the pattern: one incomplete file is a mistake, twenty with the same gap prove a system failure, and sampling is designed precisely to tell them apart. The second is repetition: a finding flagged in a previous inspection and not corrected turns any later issue into a repeat breach. And the third is lack of cooperation during the inspection, which is also an infringement in its own right, however strong the case is on the merits.
This is the actionable part, and the one most often wasted. The mitigating circumstance with the most practical weight is voluntary remediation: having detected a problem, documented it and corrected it on your own initiative, with dates, before the supervisor notices it. It changes the nature of the whole conversation. Added to this are active cooperation, an effective control system despite the one-off failure, and the absence of any benefit obtained or harm caused.
For many entities, the financial impact of the sanction is smaller than that of the measures that accompany it. A public reprimand has effects that far exceed the amount: banking relationships under review, tenders lost, counterparties having second thoughts. A temporary ban on holding office affects specific individuals and can force changes in the management body. And for obliged entities subject to authorization, a structural breach can end up affecting the license itself, which is when a compliance problem becomes an existential one.
Key legislation, linked to the official text:
Legislation and links reviewed in .