Spain's new AML law (2027)

Two things need to be distinguished. The Spanish law is still going through the legislative process: the draft bill was approved at first reading on July 28, 2026, and its public consultation closed on September 30, 2026. The parliamentary stage comes next.

The EU Regulation, by contrast, does have a fixed date: it applies from July 10, 2027, regardless of where the national legislative process stands. That is the date that should govern any adaptation plan.

Several entire sectors: crypto-asset service providers, crowdfunding platforms, high-value goods traders (precious metals and stones, vehicles, boats, aircraft, art), investment migration operators and, with their own deadline in 2029, professional football clubs and football agents.

If your business may fit into any of those categories, checking is the first thing to do.

The draft bill proposes replacing it with a new law that also transposes the EU Directive and reorganizes the institutional architecture by creating ANIFI.

Until that law is published, Law 10/2010 remains fully in force. What does not wait is the EU Regulation, which applies directly from July 2027.

The EU framework sets a harmonized maximum of €10,000 for cash payments in the EU. Member States may keep or introduce lower limits, and Spain keeps its own, lower limits for certain transactions.

It is worth checking which limit applies to each type of transaction before adjusting your internal controls.

Identification and verification are strengthened, and the rules on registers and access to them are reorganized; this is one of the areas the Directive develops in most detail. The general benchmark of a 25% holding is kept.

In practice, what changes is the requirement to complete the chain up to the natural person and to keep the information up to date.

The National Financial Integrity Authority, the body the draft bill creates. It absorbs SEPBLAC and brings together financial intelligence, supervision, inspection and sanctioning powers. It is being built by transforming the FROB (Spain’s bank restructuring fund).

We explain it in detail on our page on ANIFI and compare the before and after in ANIFI vs SEPBLAC.

Yes, substantially. The EU framework requires maximum sanctions of at least €10 million or 10% of annual turnover, whichever is higher, for legal persons for serious, repeated or systematic breaches.

This is a minimum that national law must guarantee. We cover it in AML sanctions.

It is not advisable, for two reasons. First, the core obligations come from the EU Regulation and are enforceable from July 2027 regardless of the national legislative process.

Second, and more practical: building an AML/CFT system from scratch takes more than a year in an organization that has never had one. Starting when the law appears in the BOE means starting late.

Determine whether the wider scope covers you, to what extent and from when. It is a quick check, and it shapes absolutely everything else.

If the answer is yes and it is your first time, the order we recommend is: risk analysis, manual, procedures, control bodies, training and records. In that order, because each piece is calibrated on the one before.

Then the reform is an in-depth review, not a build. What you should test is whether your system meets the standard of the EU Regulation and not only that of Law 10/2010: more detailed due diligence, stricter beneficial ownership requirements and less room for your own interpretation.

The most cost-effective work is usually updating the risk self-assessment and checking the gap between what the manual says and what the organization does.