Remittances
Small, recurring transfers
“The typical pattern: small amounts, high frequency, specific geographic corridors and recurring beneficiaries.”
Terrorist financing prevention in Spain
It is the other half of AML/CFT, and the one almost nobody works on. In money laundering, dirty money tries to look clean; in terrorist financing, the money can be perfectly lawful and the problem lies in where it goes. That turns the whole logic of control upside down.
Does your system detect terrorist financing? Free assessment
Tell us how your monitoring is set up and we will tell you whether it covers this risk.
- 50+ entities advised
- Reply within 24 h
- No commitment
- Blocking law
- Law 12/2003
- CVAFT regulation
- Royal Decree 413/2015
- Minimum fine (very serious infringement)
- €150,000
- Fine for a minor infringement
- Up to €60,000
Services
How we help you with terrorist financing
Adapting a system designed for money laundering to a risk that behaves the other way around.
Lists
Sanctions list screening
Setting up and reviewing screening against European Union and United Nations lists, with matching criteria, handling of namesakes and a procedure for a positive hit.
Learn more →
EU listsUNNamesakes
Monitoring
TF-specific rules
Money laundering rules look for large, unusual amounts. Terrorist financing rules have to look for the opposite: small, recurring amounts with a relevant geographic or sector destination.
Learn more →
Small amountsPatternDestination
Freezing
Blocking and freezing of funds
What to do when a match with a sanctions list comes up.
Learn more →
FreezingProcedure
Risk
TF risk in your risk self-assessment
Most risk assessments deal with TF in a single paragraph. That is not enough.
Learn more →
Self-assessmentRisk in its own right
Reporting
Reporting suspected TF
The particular features of reporting suspected terrorist financing.
Learn more →
Art. 18Urgency
Training
TF-specific training
Your team is trained to spot money laundering. Spotting terrorist financing requires separate training.
Learn more →
IndicatorsCases
Concept
What it is and how it differs from money laundering
Same legal framework, opposite detection logic.
Terrorist financing is the provision or collection of funds, by any means, with the intention that they be used—or in the knowledge that they will be used—to commit terrorist acts or to support terrorist organizations or individuals. In Spain it falls within the scope of Law 10/2010, which is not only about preventing money laundering: it is about preventing money laundering and terrorist financing.
The key difference from money laundering completely changes the focus of control. In money laundering, the money has an unlawful origin and the offender’s goal is to make it look legal: control looks backward, at where the money came from. In terrorist financing, the money may come from a salary, a voluntary donation or a legitimate business: what is unlawful is its destination. Control therefore has to look forward.
The second difference is the amount. Money laundering is detected with rules that look for large or unusual transactions. Terrorist financing usually works with small amounts that trigger no threshold, repeated over time and often split among several parties. A system calibrated only for money laundering sees none of this, and that is not a tool failure: it is a design failure.
Comparison
Money laundering vs. terrorist financing
Nine differences that explain why a specific control is needed.
| Aspect | Money laundering | Terrorist financing |
|---|---|---|
| Source of funds | Always unlawful | May be lawful |
| What is being concealed | Where the money comes from | Its destination and final beneficiary |
| Typical amounts | Large, or split up from a large amount | Small and recurring |
| Direction of analysis | Backward: where it comes from | Forward: where it goes |
| Main signal | Mismatch with the economic profile | Geographic destination, beneficiary, pattern of transfers |
| Usual channels | Financial system, real estate, companies | Remittances, NGOs, informal systems, cash, crypto |
| Usefulness of thresholds | High: the amounts stand out | Low: almost never reached |
| Key tool | Transaction monitoring and source of funds | List screening and destination analysis |
| Reporting urgency | High | Maximum: there may be an imminent risk |
The practical consequence of this table is that an AML system built solely around amount thresholds and transaction profiles can be reasonably effective against money laundering and practically blind to terrorist financing.
Spanish framework
The Spanish framework: Law 12/2003 and the CVAFT
Two laws, a dedicated body and a blocking mechanism that almost nobody has set out in a procedure.
In Spain, two laws with different purposes coexist. Law 10/2010 requires obliged entities to apply preventive measures (due diligence, monitoring, reporting) to both money laundering and terrorist financing. And Law 12/2003 of May 21 on the prevention and blocking of terrorist financing governs the blocking of balances, accounts and positions where there is a link to terrorist activities.
The competent body under Law 12/2003 is the Commission for the Surveillance of Terrorist Financing Activities (CVAFT), whose regulation was approved by Royal Decree 413/2015 of May 29. It is little known outside the sector and has a very significant power: it can order positions to be blocked, which requires the entity to immobilize them immediately.
This national framework is overlaid by the European and international one: the EU regulations that impose restrictive measures and asset freezes on listed persons and entities, and the United Nations Security Council resolutions from which they originate. In day-to-day practice, this means a very specific obligation: screen your customer base and your transactions against those lists, and do so on an ongoing basis, because the lists change.
Sectors
Where terrorist financing risk arises
It is not concentrated where money laundering is, and that is precisely the difficulty.
Non-profit organizations
Fundraising for a cause
“Legitimate fundraising and diverted fundraising look very similar from the outside. The FATF has been flagging this sector as a specific risk for years.”
Crypto
Donation campaigns
“Public addresses circulated to raise funds, with tiny contributions from many different donors.”
Banking and payments
The customer with no mismatch
“Consistent transaction profile, normal amounts and no classic alert. Only the destination reveals the problem.”
Consequences
Why standard controls do not detect it
Terrorist financing is the most poorly covered risk in Spanish AML systems, and not for lack of resources.
Thresholds do not work. A system that alerts above certain amounts will never see terrorist financing activity, because it moves below them.
Outdated screening is worse than none. It creates a sense of control without covering the risk: lists change, and screening has to be ongoing, not only at onboarding.
And the urgency is different. A suspicion of terrorist financing may involve an imminent risk to people. The reporting workflow has to provide for that fast track.
| Severity | Amount | Basis or alternative |
|---|---|---|
| Minor infringements | up to €60,000 | Less significant breaches, or breaches with no appreciable impact on the AML/CFT system. |
| Serious infringements | €60,000 – €5,000,000 | Or 10% of the company’s total resources. |
| Very serious infringements | €150,000 – €10,000,000 | Or 10% of the entity’s own funds. |
Does your monitoring look for large amounts or for destinations?
We review your detection rules, your screening setup and your risk assessment to see whether terrorist financing is really covered or merely mentioned.
Frequently asked questions
Terrorist financing: common questions
What is terrorist financing?
The provision or collection of funds, by any means, with the intention that they be used—or in the knowledge that they will be used—to commit terrorist acts or to support terrorist organizations or individuals. In Spain it is governed both by Law 10/2010, on the prevention side, and by Law 12/2003, on the blocking side.
How does it differ from money laundering?
In two essential ways. First: in money laundering the money has an unlawful origin and the aim is to hide where it came from; in terrorist financing the money can be lawful and what matters is where it goes. Second: money laundering involves large amounts, while terrorist financing usually involves small, recurring amounts that do not reach any threshold.
Does my monitoring system detect it?
Probably not, if it is built only on amount rules and on mismatches with the transaction profile. Detecting terrorist financing requires different rules: recurring small amounts, geographic corridors, beneficiaries shared by customers with no apparent connection, and screening matches. It is worth reviewing this specifically, because it is the most common blind spot.
What is the CVAFT?
The Commission for the Surveillance of Terrorist Financing Activities, created by Law 12/2003, whose regulation was approved by Royal Decree 413/2015. It can order the blocking of balances, accounts and positions linked to terrorist activities, which requires the entity to immobilize them immediately.
What should I do if a customer matches a sanctions list?
First, rule out a false positive caused by a namesake, using documented criteria. If the match is confirmed, the funds must be frozen under the applicable EU regulation, the competent authorities must be notified, and you must refrain from executing any transaction. The procedure must be written in advance, because it is carried out within hours. We cover this on our international financial sanctions page.
How often should screening be updated?
Lists change frequently and without notice. Screening only at onboarding misses every later addition. The reasonable standard is ongoing or very high-frequency screening of the entire customer base, not just new customers.
Are NGOs obliged entities?
Non-profit organizations have their own regime within the AML/CFT framework and receive specific attention in the FATF international standards because of their exposure to terrorist financing risk. How each organization fits in should be analyzed case by case; it is not automatic. You can see the general criteria on our obliged entities page.
Should TF be dealt with separately in the risk assessment?
Yes, and it is one of the most frequent shortcomings. Many risk assessments give terrorist financing risk a generic paragraph that identifies no specific factors and leads to no different controls. If the resulting measures are identical to those for money laundering, the risk has not really been assessed.
How is suspected terrorist financing reported?
Through the same channel as any suspicious transaction report, but with one important difference: urgency. There may be an imminent risk, which justifies using the fastest channel available rather than waiting for the ordinary workflow. The internal procedure must expressly provide for this scenario.
Does anything change with the AMLR?
The EU package keeps money laundering and terrorist financing together and strengthens the obligations on targeted financial sanctions. The most significant new feature is the requirement for specific internal controls to implement restrictive measures, which many Spanish entities have not formalized today. More on our AMLR page.
Operational guide
Practical guide to terrorist financing prevention
Covering this risk does not require another system: it requires specific rules, lists and training within the one you already have.
Look forward
Money laundering rules analyze where funds come from. Add rules that analyze where they go: beneficiary, geographic corridor and recurrence.
And screen continuously
Lists change. Screening only at onboarding covers onboarding day and nothing more.
With a fast track
A suspicion of terrorist financing may involve a risk to people. The workflow has to be able to jump the queue.
10-step terrorist financing prevention checklist
- Analyze terrorist financing risk separately in the entity’s risk assessment.
- Identify the specific factors: geographic corridors, types of beneficiary, and exposed products and channels.
- Set up specific monitoring rules for small, recurring amounts, not just for large amounts.
- Implement screening against European Union and United Nations sanctions lists across the entire customer base.
- Set the screening frequency and make sure it also runs on existing customers, not only at onboarding.
- Document the matching criteria and the procedure for ruling out false positives caused by namesakes.
- Draft the procedure to follow after a confirmed match: freezing, reporting and refraining.
- Provide an urgent reporting channel for suspected terrorist financing involving imminent risk.
- Include terrorist financing indicators, distinct from money laundering ones, in training.
- Review the rule and list configuration every year, and keep a record of the review.
If you want to check how well this risk is really covered, start with the risk assessment or an AML/CFT audit of your detection rules.
Detection in practice
What terrorist financing looks like from inside a system
Four layers of control that, combined, cover a risk that none of them detects on its own.
1) ListsSanctions screening
It is the first barrier and the only one that gives certainty. Its value depends on how up to date it is and on the matching criteria, not on having a tool under contract.
- EU and UN lists
- Ongoing screening
- Matching criteria
2) DestinationWhere the money goes
Final beneficiary, destination country and relationship with the customer. This is the axis that money laundering analysis usually treats as secondary.
- Beneficiary
- Geographic corridor
- Consistency of the relationship
3) PatternSmall, repeated amounts
No single transaction stands out; the whole does. It requires aggregation rules by beneficiary and by period, not just per transaction.
- Recurrence
- Aggregation
- Shared beneficiaries
4) ResponseFreeze and report quickly
After a confirmed match, freezing is immediate and reporting is urgent. This is the scenario where a written procedure makes the most difference.
Tip: keep a one-page positive-match procedure, with phone numbers and the exact sequence of steps. It will be used under pressure and in a hurry.
Quick decisionPractical map: is this TF?
Three situations and the right response to each.
List match
Rule out a namesake. If confirmed: freeze, refrain and report urgently.
Small recurring transfers
Analyze the beneficiary and the corridor. It may not be TF, but it requires a documented analysis.
Donations to a vague cause
Verify the final recipient and the traceability of the fundraising.
TF playbook
Terrorist financing prevention in practice
Risk assessed separately
A dedicated section in the risk self-assessment report, with specific factors and conclusions.
A separate section of the risk assessment.
Sanctions screening
Screening of the entire customer base against EU and UN lists, at a defined frequency.
Log of screening runs and of matches handled.
Specific rules
Monitoring rules focused on recurrence and destination, not just on amount.
Documentation of active rules and their rationale.
Match procedure
Written sequence for a confirmed hit: freeze, refrain, report.
Approved procedure and log of cases handled.
Specific training
TF indicators distinct from money laundering ones, by role.
Training content and assessment of attendees.
Signs that terrorist financing is not covered
Any one of these points to a real blind spot, not a formal one.
- The risk assessment covers TF in a paragraph identical to the money laundering one.
- List screening runs only when the customer is onboarded.
- All monitoring rules are triggered by amount.
- There is no written procedure for a confirmed positive match.
- Training does not distinguish TF indicators from money laundering ones.
Operational glossary
Key terrorist financing concepts
Terms that appear in manuals, sanctions lists and communications from the authorities.
TFBasics
Terrorist financing
Provision or collection of funds intended for terrorist acts or to support terrorist organizations.
Covered by Law 10/2010 alongside money laundering.
Law 12/2003Blocking
Prevention and blocking of TF
Spanish law that governs the blocking of balances and positions linked to terrorism.
Implemented by Royal Decree 413/2015.
CVAFTBody
Surveillance Commission
Body with the power to order the blocking of positions under Law 12/2003.
Regulation: Royal Decree 413/2015.
FreezingMeasure
Immobilization of funds
Prohibition on dealing with the funds or economic resources of listed persons or entities.
See: international sanctions.
ScreeningControl
Screening against lists
Checking customers and counterparties against the sanctions lists in force.
Must be ongoing, not only at onboarding.
NamesakesNoise
False positive
A name match without a real identity match. Ruling it out must be documented.
Written criteria, not the analyst’s judgment.
NPOSector
Non-profit organizations
Sector flagged internationally for its specific exposure to TF risk.
FATF standard.
DestinationKey
Final beneficiary of the funds
In TF, the relevant analysis is where the money goes, not where it comes from.
Reverses the logic of money laundering controls.
PFRelated
Proliferation financing
A distinct and growing risk, with its own sanctions framework and its own national plan.
COMPLIANCE CONTROL CENTER · TF
Decision matrix: match and pattern
Cross the list screening result with the observed transaction pattern. Each cell shows the action required.
TF risk action matrix
Green: ordinary monitoring. Red: freeze and report urgently.
Screening \ Pattern
Ordinary
Small and recurring
Sensitive destination
No match
Normalmonitoring
Analyzedocument
EDD+ analysis
Uncertain match
Rule outnamesake
Analyzepriority
Analyzepriority
Confirmed match
Freeze+ report
Freeze+ urgent
Freeze+ urgent
Obliged entities
Who has to prevent terrorist financing?
All obliged entities under Law 10/2010. The obligation is the same as for money laundering; the control is not.
General
Obliged entities under Law 10/2010
The obligation to prevent terrorist financing applies to all obliged entities, not just the financial sector.
See obliged entities →
Law 10/2010Law 12/2003
Remittances
Money transfer and remittance companies
The channel with the most characteristic risk pattern: small amounts, high frequency and specific corridors.
See remittance companies →
CorridorsRecurrence
Crypto
Crypto-asset service providers
Fundraising campaigns using public addresses and tiny contributions from many different donors.
See crypto AML →
DonationsOn-chain
Fintech
Payment institutions and fintechs
A high capacity to move small amounts quickly: this requires aggregation rules by beneficiary.
See our fintech approach →
AggregationSpeed
Common mistakes
The six failures we see most often in TF prevention
They all share the same root: applying money laundering logic to terrorist financing.
Treating it as an appendix to money laundering
The risk assessment mentions TF and refers back to the same measures. If the resulting controls are identical, the risk has not been assessed.
Screening only at onboarding
Sanctions lists change constantly. A customer who was clean in 2023 may be listed today, and without ongoing screening nobody will know.
Rules based solely on amount
Terrorist financing activity moves below any reasonable threshold. A threshold-based system is blind to it by design.
Ruling out namesakes without written criteria
The analyst decides case by case and the reasoning is not recorded. If a real match is wrongly ruled out, there is no possible defense.
Having no positive-match procedure
When a confirmed hit comes up, you have to freeze, refrain and report within hours. Improvising that sequence guarantees mistakes.
Generic training
The team can recognize a money laundering pattern but not a terrorist financing one, because nobody has ever explained it to them separately.
Official sources
Where all of the above comes from
Direct links to the consolidated texts and to the competent bodies.
BOE
Law 10/2010 of April 28
Prevention of money laundering and terrorist financing: preventive measures for obliged entities.
BOELaw 12/2003 of May 21
Prevention and blocking of terrorist financing. Mechanism for blocking balances and positions.
BOERoyal Decree 413/2015 of May 29
Regulation of the Commission for the Surveillance of Terrorist Financing Activities (CVAFT).
TreasuryInternational financial sanctions
Applicable sanctions lists and communications from the Commission for the Prevention of Money Laundering.
FATFFATF Recommendations
International standard on terrorist financing and targeted financial sanctions.
EUR-LexRegulation (EU) 2024/1624 (AMLR)
EU framework that keeps money laundering and terrorist financing together.
Initial publication, with the operational distinction between detecting money laundering and detecting terrorist financing.
Planned review: application of the AMLR and of internal controls on restrictive measures.
Contact
Book a call
Tell us how your monitoring and list screening are set up today.
Legal framework for terrorist financing in Spain
The prevention of terrorist financing falls within the scope of Law 10/2010 of April 28, whose full title is “on the prevention of money laundering and terrorist financing.” That preventive side is complemented by Law 12/2003 of May 21 on the prevention and blocking of terrorist financing, which governs the blocking of balances, accounts and positions and creates the Commission for the Surveillance of Terrorist Financing Activities (CVAFT), whose regulation was approved by Royal Decree 413/2015 of May 29.
Why it requires a different control from money laundering
The structural difference between the two phenomena shapes the entire design of the system. In money laundering, the funds have an unlawful origin and the conduct consists of making them appear legal, so control focuses on their source. In terrorist financing, the funds may have a perfectly lawful origin—salaries, donations, business activity—and what matters is their destination. A prevention system built solely on analyzing origin and on amount thresholds is, by design, of little use against this risk.
The question of amounts
Terrorist financing activity is characterized by low-value movements, high frequency and, often, fragmentation among several parties. No single transaction is unusual enough to trigger an amount rule. Detection therefore requires rules built on recurrence, beneficiary and geographic corridor, with aggregation by recipient and by period, in addition to list screening.
Financial sanctions and freezing
The national framework is overlaid by European Union regulations that impose restrictive measures and asset freezes on listed persons and entities, which ultimately stem from United Nations Security Council resolutions. The operational obligation is the ongoing screening of customers and counterparties against those lists: screening carried out only at onboarding leaves every later addition uncovered. After a confirmed match, the funds must be frozen immediately, the entity must refrain from executing, and the competent authorities must be notified, a sequence that must be set out in a written procedure. You can see the details on our international financial sanctions page.
The related risk of proliferation
Alongside terrorist financing, the international framework identifies a distinct and growing risk: the financing of the proliferation of weapons of mass destruction, which is the subject of specific FATF recommendations and, in Spain, of a national plan approved by a Council of Ministers agreement. The draft bill (anteproyecto) reforming the Spanish AML/CFT framework expressly includes it in its scope, alongside money laundering and terrorist financing.
Control and detection
AML/CFT system
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Law 12/2003 of May 21 on the prevention and blocking of terrorist financingBOE · consolidated text
- Royal Decree 413/2015 of May 29 approving the Regulation of the Commission for the Surveillance of Terrorist Financing ActivitiesBOE · consolidated text
Legislation and links reviewed in .