Payment institutions
Electronic money within thresholds
“The regulatory case exists, but repeated top-ups and cash redemption are exactly where SEPBLAC looks first.”
Simplified Due Diligence (AML)
Simplified due diligence (SDD) is not an exemption: it lowers the intensity of the measures, and that reduction has to be justified, documented and reviewed. We help you define which customers and products qualify, how to apply it in practice and how to defend it before SEPBLAC.
Can you apply simplified due diligence? Free assessment
Tell us your type of customer or product and we will tell you whether it qualifies for simplified measures.
- 50+ institutions advised
- Reply within 24 h
- No commitment
- Regulated in Law 10/2010
- Arts. 9 and 10
- Implementing rules in Royal Decree 304/2014
- Arts. 15–17
- Minimum fine, very serious infringement
- €150,000
- Maximum fine, minor infringement
- Up to €60,000
Services
What we do for you on simplified due diligence
Defining the simplified regime is not a matter of ticking a box: it means building a defensible approach and putting it in writing.
Risk
Catalog of low-risk cases
We start from your risk self-assessment (IAR) to determine which customer, product and channel categories qualify for simplified measures in your specific entity, and which do not, even where the law allows them.
Learn more →
Royal Decree 304/2014IARLow risk
Manual
SDD procedure in your manual
We draft the section of your AML/CFT manual that governs simplified due diligence: who approves it, with what documentation, what monitoring is kept in place and in which cases it lapses automatically.
Learn more →
AML/CFT manualApprovalLapse
Enhanced
The boundary with EDD
Where simplified due diligence ends and enhanced due diligence begins, with operational criteria.
Learn more →
EDDHigh risk
KYC
Fit with your KYC process
How the simplified regime works alongside real-world onboarding without breaking the audit trail.
Learn more →
OnboardingEvidence
Audit
Review of simplified customer files
We sample the files where you applied SDD to check whether they would withstand an inspection.
Learn more →
SamplingSEPBLAC
AMLR
Adapting to the EU regulation
What changes in the simplified regime once the AMLR applies in July 2027.
Learn more →
AMLR2027
Concept
What simplified due diligence is
A justified reduction in intensity, not an exemption from obligations.
Simplified due diligence is the regime that allows an obliged entity to apply less intensive know your customer measures when the risk of money laundering or terrorist financing is demonstrably low. It is provided for in Articles 9 and 10 of Law 10/2010 and developed in Articles 15–17 of Royal Decree 304/2014.
The most widespread misconception is to treat it as a waiver. It is not. SDD adjusts the intensity of the measures, not whether they exist: you still have to identify the customer, you still have to understand the purpose of the relationship and you still have to monitor it. What changes is how much: less documentation at the outset, less exhaustive verification of the beneficial owner in certain cases, or less frequent reviews.
And there is a hard limit you should be clear about from the start: as soon as a suspicion arises, the simplified regime lapses. It is not a discretionary decision, nor something that can wait until the next review. Suspicion triggers the standard regime, or the enhanced one, immediately.
Eligible cases
When simplified due diligence can be applied
The regulatory catalog, with the small print on what remains mandatory.
| Category | Case | What you can simplify | What you can NOT skip |
|---|---|---|---|
| Customers (Art. 15) | Public-law entities of an EU Member State | Obtaining additional supporting documents and enhanced verification of the beneficial owner | Formally identify the entity and document why it fits the case |
| Customers (Art. 15) | Financial institutions domiciled in the EU or in equivalent third countries and subject to supervision | Gathering less detailed information on the business activity and the purpose of the relationship | Check the authorization and effective supervision, and keep monitoring |
| Customers (Art. 15) | Companies listed on an EU regulated market and subject to disclosure requirements | Verification of the beneficial owner through the general shareholding route | Prove admission to trading and that the transparency requirements are met |
| Products (Art. 16) | Life insurance policies with an annual or single premium below the regulatory thresholds | Intensity of identification and of information on the source of funds | Identify the policyholder and watch for artificial splitting of premiums |
| Products (Art. 16) | Electronic money instruments within the set loading and redemption limits | Prior identity verification within the thresholds | Monitor top-ups, control anonymity and apply the limits on cash redemption |
| Products (Art. 16) | Pension plans and retirement savings products without an early redemption clause | Initial documentation and review frequency | Identify the plan member and go back to the standard regime if redemption becomes available |
Indicative table based on the current wording of Royal Decree 304/2014. The specific thresholds must be checked against the consolidated text before you apply them, and they never replace the entity’s own risk assessment: a case listed as low risk may not be low risk in your business.
The list is not automatic
A customer fitting a case under Article 15 does not oblige you to apply simplified due diligence; it only allows you to. The decision is still yours and has to be consistent with your risk assessment. If your IAR says that segment is medium risk, applying SDD leaves you with no defense.
Some situations always rule it out
Suspicion of money laundering or terrorist financing, high-risk jurisdictions, opaque structures, or any circumstance that raises the risk above average. In those cases the simplified regime is not available, whatever the customer’s category.
Comparison
Simplified, standard and enhanced: what changes in each
The three regimes coexist, and the same customer can move from one to another during the relationship.
| Element | Simplified (SDD) | Standard | Enhanced (EDD) |
|---|---|---|---|
| Formal identification | Mandatory, with lighter documentary requirements | Mandatory | Mandatory, with additional verification |
| Beneficial owner | Verification through the general route | Identification and reasonable verification | Exhaustive documentary verification of the whole chain |
| Purpose of the relationship | Basic information | Enough information to build a profile | Detailed, cross-checked information |
| Source of funds | Not generally required | Depending on risk | Required and documented |
| Ongoing monitoring | Less frequent, never eliminated | Periodic, depending on risk | Intensified, with senior management review |
| Internal approval | As set out in the manual’s procedure | Ordinary course of business | Senior management or a designated officer |
| Lapses if there is suspicion | Yes, immediately | Moves to enhanced | Stays in place and is intensified |
The difference between the three regimes is not one of procedure but of depth of proof: what you will be asked for in an inspection is the justification for the regime you chose, not just the file.
Sectors
The same case does not carry the same weight in every sector
An EU financial institution is low risk for almost everyone. An electronic money product is not.
Insurance
Low premiums and premium splitting
“Simplified due diligence based on the premium amount lapses as soon as a splitting pattern is detected that takes the total above the threshold.”
Asset managers and investment firms
Institutional clients
“A financial counterparty supervised in the EU is the cleanest case, and even then you have to prove the supervision and keep a record of it.”
Law firms and advisory firms
Low-risk engagements
“The nature of the engagement matters as much as the client: the same client may qualify for simplified due diligence on one matter and not on the next.”
Consequences
What happens if you get simplified due diligence wrong
The simplified regime generates more audit findings than any other, precisely because it looks like the easiest one.
The risk is not applying SDD; it is being unable to explain it. In an inspection the legal basis is rarely disputed: what is disputed is whether there was a written record of the criterion and of who approved it.
Misapplied simplified due diligence taints the entire file. If the regime lapsed and nobody noticed, all subsequent monitoring falls short of what is required.
It is one of the most common deficiencies in external expert reports: procedures that provide for SDD but do not define when it is reviewed or who revokes it.
| Severity | Amount | Basis or alternative |
|---|---|---|
| Minor infringements | up to €60,000 | Less significant breaches, or breaches with no appreciable impact on the AML/CFT system. |
| Serious infringements | €60,000 – €5,000,000 | Or 10% of the company’s total resources. |
| Very serious infringements | €150,000 – €10,000,000 | Or 10% of the entity’s own funds. |
Would your simplified due diligence procedure withstand an inspection?
We review your manual, your catalog of low-risk cases and a sample of real customer files to show you where the gap is before the supervisor finds it.
Frequently asked questions
Simplified due diligence: common questions
Does simplified due diligence exempt you from identifying the customer?
No. This is the most common conceptual mistake. Simplified due diligence reduces the intensity of the measures, but formal identification of the customer remains mandatory in every case. What can be adjusted is the volume of supporting documents, the depth of beneficial owner verification in certain cases and the frequency of reviews.
Who decides that a customer goes under the simplified regime?
Your internal procedure. The law permits the regime; your AML/CFT manual must specify who approves it, on what supporting evidence and how often it is reviewed. A procedure that merely repeats the article of the regulations is not a procedure: it is a quotation.
Can it be applied to a customer from a high-risk country?
No. The involvement of a jurisdiction classified as high risk rules out the simplified regime and, in most cases, directly triggers enhanced measures. You should cross-check your catalog of cases against the FATF list and the European Commission’s list of high-risk third countries.
What happens if a suspicion arises in the middle of the relationship?
The simplified regime lapses immediately. You must move to standard or enhanced measures as appropriate and, if the suspicion is confirmed, trigger the suspicious transaction reporting process. You do not wait for the next periodic review.
Does anything change with the EU AMLR?
Yes, and structurally. Under Regulation (EU) 2024/1624, applicable from July 10, 2027, low-risk cases will no longer be set by national rules: they will be harmonized at EU level, with technical standards developed by AMLA. In practice: less national leeway and a greater need to justify why a case applies. We cover this on our AMLR page.
Do you still have to carry out ongoing monitoring?
Yes. Ongoing monitoring cannot be waived; it can only be made less frequent. The difference matters: an entity that never reviews a simplified file is not applying SDD, it is in breach.
What documentation do I have to keep?
The same as under the standard regime as regards identification, plus (and this is what gets forgotten) the justification for the regime itself: why that customer or product fits a low-risk case, who validated it and on what date. All of it for the ten-year legal retention period.
Does simplified due diligence apply to the customer or to the transaction?
It can apply by customer (Art. 15 of Royal Decree 304/2014) or by product and transaction (Art. 16). They are not interchangeable: a low-risk customer may take out a product that does not qualify for simplified due diligence, and a low-risk product may be taken out by a customer who requires enhanced due diligence. The stricter regime always prevails.
How is it documented in practice?
With a note in the customer file identifying the case applied, the evidence that supports it, the person who approves it, the date and the next review. Five fields. That note is what turns a decision into a defensible decision.
Does this also affect non-financial obliged entities?
Yes. Law firms, tax and administrative agencies, real estate agencies, jewelers or gambling operators can apply the simplified regime when the conditions are met, and they have exactly the same duty to justify it. You can see how each activity fits on our obliged entities page.
Operational guide
Practical guide to simplified due diligence
Implementing SDD properly is a matter of judgment and of writing: defining the cases, setting who decides and keeping a record. Ten steps that cover the full cycle.
Risk assessment first
Your catalog of simplified cases is built from your IAR, not from the regulations. The law sets the ceiling of what is allowed; your assessment sets what is prudent in your case.
Then the manual
Who approves, on what supporting evidence, how often it is reviewed and in which cases it lapses automatically. Without those four elements, the procedure does not exist.
And always the file note
Case applied, supporting evidence, approver, date and next review. It is the first thing requested when an inspector opens a file marked as simplified.
Simplified due diligence checklist in 10 steps
- Review your risk self-assessment (IAR) and identify which customer, product and channel segments could be low risk in your actual business.
- Compare those segments with the cases in Articles 15 and 16 of Royal Decree 304/2014 and discard any that your own analysis does not support.
- Write the simplified due diligence procedure into your AML/CFT manual: scope, approval, supporting evidence and review.
- Define the grounds for automatic lapse: suspicion, a high-risk jurisdiction, a change of product, newly arising opacity.
- Configure your onboarding system so that the simplified regime is an explicit flag on the file and not an omission.
- Set the review frequency for simplified files, which will be lower than the standard one but never nonexistent.
- Train your onboarding team: SDD is the measure most often applied by default when it is not well understood.
- Set up the escalation process for when a simplified file triggers a monitoring alert.
- Include a sample of simplified files in the annual internal audit plan and in the external expert report.
- Review the full catalog at least once a year and whenever there is a relevant regulatory change, with an eye on the 2027 AMLR.
If you would like us to review your simplified regime, you can start with the AML/CFT manual or with an AML/CFT audit of real customer files.
SDD in practice
From “this customer is easy” to a criterion you can defend
The simplified regime almost always breaks in the same place: the decision is sound but the documentation is poor. These are the four stages where it is won or lost.
1) FitDetermine whether the case exists
It is not enough for the customer to look low risk: it has to fit a case in the regulations and your own risk assessment at the same time.
- Case under Royal Decree 304/2014
- Consistency with the IAR
- Supporting evidence
2) ApprovalWho signs off the reduction
The decision to apply simplified measures has an owner. If there is no name, there is no decision: there is an omission that someone will have to explain.
- Named owner
- Date
- Evidence retained
3) MonitoringMonitoring does not disappear
It becomes less frequent. A simplified file that has never been reviewed is not simplified: it is an abandoned file, and that is how an inspection reads it.
- Defined frequency
- Active alerts
- Documented review
4) LapseThe moment it stops applying
Suspicion, a change of jurisdiction, a new corporate structure, a different product. The system has to detect the trigger and reverse the regime without relying on someone remembering.
Tip: define the lapse as a system rule, not as an instruction in the manual. Instructions get forgotten; rules get executed.
Quick decisionPractical map: which regime do I apply?
Three typical situations and the regime that applies to each.
Clear case
EU-supervised financial institution, ordinary product, no red flags: documented simplified due diligence.
Doubtful case
It fits the letter of the regulations, but your IAR places it at medium risk: standard regime.
Excluded case
Suspicion, a high-risk jurisdiction or opacity: enhanced due diligence and internal escalation.
SDD playbook
Simplified due diligence in practice
Catalog of cases
A closed list of the categories that qualify for the simplified regime in your entity, derived from the IAR.
Document approved by the internal control body (OCI), with date and version.
Approval
A named officer validates the use of the regime in each file.
Approver and date fields in the file.
Supporting evidence for the case
Proof that the customer or product actually fits the case relied on.
Listing certificate, supervisor’s register entry, product terms and conditions.
Monitoring
Periodic review, less frequent than standard but set in writing.
Review schedule and record of the reviews carried out.
Lapse
Automatic rules that reverse the regime in the event of suspicion or a change in circumstances.
System log, alerts and reclassified files.
Signs that your simplified regime will not hold up
If you recognize two or more of these, review it before your next audit.
- The manual mentions simplified due diligence but does not say who approves it.
- There is no catalog of your own: the list in the regulations is applied as is.
- Some simplified files have not been reviewed since onboarding.
- The lapse depends on an analyst remembering, not on a system rule.
- No distinction is made between simplified due diligence by customer and by product.
Working glossary
Key concepts of simplified due diligence
Terms that appear in manuals, external expert reports and SEPBLAC requests for information.
SDDBasis
Simplified due diligence
A regime of less intensive measures for customers, products or transactions with reduced risk.
Legal basis: Arts. 9 and 10 of Law 10/2010.
EDDOpposite
Enhanced due diligence
A higher-intensity regime for high-risk situations. It never coexists with simplified due diligence.
See: enhanced measures.
IARRisk
Risk self-assessment report
The core document that determines which segments qualify for the simplified regime in your specific entity.
See: risk map.
LapseCritical
Loss of the simplified regime
The point at which simplified measures stop applying and you have to return to the standard or enhanced regime.
Triggers: suspicion, high risk, opacity.
Low riskConcept
Proven reduced risk
It is not a hunch: it is a conclusion supported by the risk assessment and by verifiable data.
It must be possible to reconstruct it after the fact.
Beneficial ownerUBO
Ultimate beneficial owner
Under the simplified regime it is verified through the general route, but its identification is never skipped.
See: beneficial ownership.
MonitoringContinuity
Monitoring of the relationship
A permanent obligation. Simplified due diligence reduces its frequency, not its existence.
See: ongoing due diligence.
AMLR2027
Regulation (EU) 2024/1624
Harmonizes low-risk cases at EU level from July 10, 2027.
See: AMLR.
Art. 15/16Rule
Regulatory cases
Article 15 of Royal Decree 304/2014 lists cases by customer; Article 16, by product or transaction.
The stricter regime always prevails.
COMPLIANCE CONTROL CENTER · SDD
Decision matrix: which due diligence regime applies
Cross the customer category with the nature of the product. The result is not a commercial recommendation: it is the regime you will have to defend if asked.
Applicable regime matrix
The stricter of the two axes is the one that applies.
Customer \ Product
Ordinary
Sensitive
High risk
Art. 15 case
SDDdocumented
Standardno reduction
EDDenhanced
Ordinary customer
Standardbaseline
Standard+ monitoring
EDDsource of funds
Elevated risk
EDDalways
EDD+ escalation
EDD+ senior management
Obliged entities
Who does the simplified regime apply to?
Any obliged entity under Law 10/2010 can apply simplified due diligence when the conditions are met. What changes from sector to sector is what counts as low risk in practice.
General
Obliged entities under Law 10/2010
We analyze whether your business qualifies as an obliged entity and which due diligence regime applies to each segment of your portfolio.
See obliged entities →
Law 10/2010Royal Decree 304/2014
Fintech
Payment and electronic money institutions
The electronic money case is the one most often misapplied: thresholds, repeated top-ups and cash redemption.
See our fintech approach →
ThresholdsTop-ups
Law firms
Lawyers and advisory firms
Simplified due diligence depends on the engagement as much as on the client. The same client may qualify on one matter and not on the next.
See AML/CFT for law firms →
EngagementClient
Crypto
Crypto-asset service providers
In the crypto sector the room for the simplified regime is very narrow, and it narrows further under the AMLR.
See crypto AML/CFT →
CASPAMLR
Common mistakes
The five failures we see most in simplified due diligence
All of them come up regularly in external expert reports and in the supervisor’s requests for information.
Confusing simplified with exempt
You stop identifying the customer or verifying the beneficial owner. That is not SDD: it is a breach of Article 4 of Law 10/2010, and it is penalized as such.
Copying the list in the regulations as your own catalog
Article 15 sets what you can simplify. Your risk assessment sets what you should simplify. Copying the rule without filtering it through your IAR leaves your criterion without support.
Not documenting the approval
The file says “simplified”, but there is no trace of who decided it or when. It is the most frequent deficiency and the easiest to fix.
Forgetting the lapse
The customer changes its structure, a new jurisdiction comes in or an alert fires, and the file stays marked as low risk for months.
Mixing up simplified due diligence by customer and by product
They are two different cases with different requirements. When they are confused, you end up applying the broader of the two reductions, which is exactly the opposite of what the law requires.
Never reviewing the catalog
A catalog of cases from 2019 applied in 2026 ignores two amendments to the regulations and the entire EU AML package. The annual review is not a recommendation.
Official sources
Where all of the above comes from
Direct links to the consolidated texts and to the competent bodies. Always check the specific thresholds in the version in force before applying them.
BOE
Law 10/2010 of April 28
Consolidated text. Articles 9 and 10: simplified due diligence measures.
BOERoyal Decree 304/2014 of May 5
Regulations implementing Law 10/2010. Articles 15–17: eligible cases and application of the simplified regime.
EUR-LexRegulation (EU) 2024/1624 (AMLR)
EU anti-money laundering regulation. Harmonizes reduced-risk cases from July 2027.
SEPBLACExecutive Service of the Commission for the Prevention of Money Laundering
Spain’s financial intelligence unit. Guidance and sector communications.
TreasuryCommission for the Prevention of Money Laundering
Institutional information, penalty regime and international financial sanctions.
FATFFinancial Action Task Force
International standards and lists of high-risk jurisdictions.
Initial publication. Includes the expected impact of the AMLR on reduced-risk cases.
Planned review: Regulation (EU) 2024/1624 starts to apply and replaces the national list of cases.
Contact
Book a call
Tell us which customer segment you want to place under the simplified regime and we will tell you whether it holds up.
Legal framework for simplified due diligence in Spain
Simplified due diligence is governed by Articles 9 and 10 of Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing, and developed in Articles 15–17 of Royal Decree 304/2014 of May 5. The regime allows obliged entities to apply less intensive know your customer measures where a reduced risk has been established, without this ever amounting to an exemption from the obligations of identification, understanding the purpose of the relationship and ongoing monitoring.
What can and cannot be simplified
The simplified regime acts on the intensity of three elements: the supporting documents required from the customer, the depth of verification of the beneficial owner in certain cases, and the frequency of periodic reviews. It does not affect formal identification, which is mandatory in every case, or the duty to report suspicious transactions, which remains intact. A file under the simplified regime without customer identification is not a simplified file: it is a breach of Article 3 of Law 10/2010.
The cases in Royal Decree 304/2014
Article 15 of the regulations sets out cases relating to the customer: public-law entities of the European Union, financial institutions domiciled in the EU or in third countries with equivalent requirements and subject to supervision, and companies listed on regulated markets that are subject to disclosure requirements. Article 16 sets out cases relating to the product or transaction: certain life insurance policies below premium thresholds, electronic money instruments within loading and redemption limits, and pension plans without an early redemption clause. Both lists are enabling, not mandatory: they allow you to apply the regime, they do not require you to.
The limit: suspicion and high risk
The simplified regime is not available where there is suspicion of money laundering or terrorist financing, where jurisdictions classified as high risk are involved, or where any circumstance places the risk above the entity’s average. In those cases the standard regime or enhanced due diligence measures apply, and reclassification must be immediate, not deferred to the next scheduled review.
What changes with the AMLR in 2027
Regulation (EU) 2024/1624 (AMLR), applicable from July 10, 2027, moves the due diligence regime from national law to directly applicable EU law. Reduced-risk cases will be harmonized, and their technical development will fall to the new EU authority (AMLA), created by Regulation (EU) 2024/1620. For Spanish entities this means two things: less room for national interpretation and a greater need to document why each case applies. You should review your internal catalog of low-risk cases before that date, not after.
The role of SEPBLAC and ANIFI
Compliance is currently supervised by SEPBLAC, as financial intelligence unit and supervisory body. The draft bill (anteproyecto) now going through the legislative process provides for it to be integrated into a new National Financial Integrity Authority (ANIFI), with broader supervisory and sanctioning powers. On simplified due diligence, what an inspection checks is usually not whether the case has a legal basis but the traceability of the decision: who made it, on what supporting evidence and when it was last reviewed. You can find the details on our ANIFI page.
Due diligence
AML/CFT system
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Royal Decree 304/2014 of May 5 approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
Legislation and links reviewed in .