Banking and payments
The account manager
“They take the angry customer’s call, and they are the ones who most often end up over-explaining to calm the customer down.”
Tipping-Off Prohibition (AML): The Prohibition of Disclosure
Article 24 of Law 10/2010 prohibits telling a customer that information has been reported (or is about to be reported) to SEPBLAC. It sounds obvious until a customer asks why their transaction has been delayed and someone on your team says too much.
Does your team know what it can and cannot say? Free assessment
We review your customer service script and your internal confidentiality workflow.
- 50+ entities advised
- Reply within 24 h
- No commitment
- Prohibition of disclosure
- Art. 24
- Minimum fine, very serious infringement
- €150,000
- Compliance checklist
- 10 steps
- Key legislation
- Law 10/2010
Services
What we do for you on confidentiality
The prohibition of disclosure is breached by talking, not by writing. That is why the work is done with scripts and training, not just procedures.
Procedure
Confidentiality clause in the manual
We draft the section that governs who within the entity knows that a report exists, how the case file is flagged and what information may circulate by email, internal chat or CRM.
Learn more →
Art. 24Need to knowTraceability
Training
Script and front-line training
The team that deals with customers is the one that can disclose without meaning to. We prepare the response script and role-specific training, using real cases of conversations that got out of hand.
Learn more →
Front officeScriptCase studies
Reporting
Reporting workflow
How the report is submitted without leaving a trail that the customer or third parties can access.
Learn more →
SEPBLACWorkflow
Refraining
Fit with the duty to refrain
Stopping the transaction without explaining why: the hardest practical tension to manage.
Learn more →
Art. 19Tension
Third parties
Providers and outsourcing
What your KYC provider or your outsourced administrative firm (gestoría) may know, and under what contract.
Learn more →
ProvidersContract
Defense
Defense if disclosure has already happened
What to do when a disclosure has already happened and the damage has to be contained.
Learn more →
IncidentDefense
Concept
What exactly Article 24 prohibits
Not only disclosing that a report has been made: also that the transaction is being examined.
Article 24 of Law 10/2010 prohibits obliged entities, and also their directors and employees, from disclosing to the customer or to third parties that information has been reported to SEPBLAC, or that a transaction is being examined—or may be examined—because it may be related to money laundering or terrorist financing.
This is what is known internationally as tipping off, and the reason for it is simple: if the person under investigation knows they are being watched, the investigation loses all its value. That is why the prohibition is not limited to a report that has already been made; it also covers the mere examination of the transaction, even if nothing is ever reported.
The prohibition has two sides that are worth keeping apart. Externally, no one on the team may hint to the customer at the real reason for a hold or for a request for documents. Internally, information must circulate on a need-to-know basis: the more people who know that a report is in progress, the more likely it is that someone will mention it where they should not.
Exceptions
What you can disclose
The prohibition is not absolute, but the exceptions are strictly defined and narrow.
| Case | Scope | Condition | Practical safeguard |
|---|---|---|---|
| Within the same group | Sharing information between entities of the same corporate group | The group applies common AML/CFT policies and procedures | Document the group policy. Without it, the exchange is no longer covered. |
| Between financial institutions | Sharing between entities subject to EU AML rules or equivalent rules | It concerns the same customer and the same transaction, and a duty of secrecy applies | It does not cover general market inquiries or informal lists of blacklisted customers. |
| Between professionals | Lawyers, court representatives (procuradores), notaries, auditors and similar professionals | They practice within the same entity or network and act for the same client and transaction | The exception is narrow: same client and same transaction, not simply “the same firm”. |
| Dissuading from illegal activity | Trying to get the customer to refrain from carrying out an illegal activity | It is not disclosed that a report exists or will exist | It is the most useful exception and the easiest to overstep: you can say “no”; you cannot say “why”. |
| Requests from authorities | Providing information to judges, prosecutors, the criminal investigation police (policía judicial) or SEPBLAC itself | A legitimate request made in the exercise of their functions | Keep the request. It is your evidence of why the information was provided. |
Indicative table based on the wording of Article 24 of Law 10/2010. The exact scope of each exception should be checked against the current consolidated text before you rely on it.
Script
What you can and cannot say
A breach is almost never a document: it is a sentence said at the counter or on a call.
| Situation | What you must NOT say | What you can say | Risk if you get it wrong |
|---|---|---|---|
| The customer asks why their transaction is delayed | “It’s under review for money laundering,” “compliance has stopped it” | “We are completing an internal check on the transaction” | Direct disclosure |
| The customer asks why you are asking for documents | “Well, we got an alert” | “Our regulations require us to keep customer information up to date” | Indirect disclosure |
| The customer threatens to leave | “Well, we had to report your case” | “I understand your position; the procedure is the same for all customers” | Disclosure under pressure |
| A colleague from another department asks | “We’ve reported that customer” | Nothing. Refer them to the person in charge of the case file | Internal leak |
| A third party (the customer’s adviser, a correspondent bank) asks | Any reference to the examination or the report | That the inquiry must go through the proper formal channels | Disclosure to a third party |
| You decide to end the business relationship | “We’re closing your account over a money laundering issue” | The contractual ground for termination, with no reference to the examination or the report | Disclosure on exit |
The practical rule fits in one line: you can talk about the process, never about the reason. Anything that points to a suspicion, an alert or a report is off-limits.
Sectors
Where disclosures happen in each sector
The leak point changes depending on who deals directly with the customer.
Law firms
The relationship of trust
“The closer the relationship with the client, the harder it is to maintain confidentiality without it showing.”
Real estate
The deal that doesn’t close
“The buyer, the seller and two agencies all asking at once: the perfect setting for indirect disclosure.”
Crypto
The support channel
“Support tickets and chats are answered quickly and in writing: one badly worded message stays on record forever.”
Consequences
What happens if you disclose
A breach of Article 24 is sanctioned in its own right and extends to the individuals who commit it.
Disclosure destroys the usefulness of the report. If the customer knows they are being watched, the information sent to SEPBLAC can no longer serve the purpose for which it was sent.
It is a stand-alone infringement under Law 10/2010 and extends personally to directors and employees, not only to the entity as a legal person.
And it is practically impossible to undo. Unlike other breaches, a disclosure cannot be remedied with an action plan: it can only be documented as an incident and contained.
| Severity | Amount | Basis or alternative |
|---|---|---|
| Minor infringements | up to €60,000 | Less significant breaches, or breaches with no appreciable impact on the AML/CFT system. |
| Serious infringements | €60,000 – €5,000,000 | Or 10% of the company’s total resources. |
| Very serious infringements | €150,000 – €10,000,000 | Or 10% of the entity’s own funds. |
Does your customer service team know what it can say?
We prepare the response script, role-based training and the internal need-to-know procedure so that a difficult conversation does not turn into sanction proceedings.
Frequently asked questions
Tipping-off prohibition: common questions
What is tipping off?
It is the English-language term for prohibited disclosure: warning the customer or a third party that a transaction has been reported, will be reported or is being examined because of its possible link to money laundering. In Spain it is governed by Article 24 of Law 10/2010.
Does the prohibition only cover a report that has already been made?
No, and this is the point most often overlooked. The prohibition also covers the fact that a transaction is being examined or may be examined. In other words, you can breach Article 24 without having reported anything yet, simply by telling the customer that their transaction is under review.
Can I tell the customer that I will not carry out the transaction?
Yes. You can refuse to execute it and you can end the business relationship. What you cannot do is link that refusal to a suspicion, an alert or a report. The law allows you to dissuade the customer from carrying out an illegal activity, but that does not entitle you to explain that there is a case in progress.
Can I consult another entity about that customer?
Only in the strictly defined cases: entities of the same group with common AML policies, or financial institutions subject to EU rules where the exchange concerns the same customer and the same transaction and a duty of secrecy applies. Outside those cases, an informal inquiry between compliance officers at different entities is a prohibited disclosure, however common the practice is in the sector.
What about my external KYC provider or my outsourced administrative firm (gestoría)?
It depends on the relationship. A provider acting as such must be contractually bound by an equivalent duty of confidentiality, and the information it receives must be limited to what it needs to provide the service. If you outsource AML functions, this must be expressly governed by the contract: we cover it on our AML outsourcing page.
So what do I tell a customer who insists?
Whatever your script says, and the script must be written and approved before the situation arises. Neutral wording that talks about the process and never about the reason: internal checks, updating information, regulatory requirements that apply to all customers. Improvisation is behind almost every disclosure.
Can you breach it in writing without realizing?
Easily. An internal email forwarded to the customer, a CRM note visible from the customer portal, a comment on a support ticket or an overly explicit rejection reason in an automated notification. Reviewing the automated texts in your systems is one of the most cost-effective measures you can take.
Does it affect employees personally?
Yes. Article 24 is addressed to obliged entities and to their directors or employees. The entity’s liability does not exclude that of the individual who makes the disclosure, which makes it especially important to be able to show that specific training on this point was given.
How do we show that we comply?
With the written need-to-know procedure, the approved script, role-based training records, restricted system access to reported case files and the incident log. The absence of incidents proves nothing on its own; documented controls do.
Does this change under the EU AMLR?
Regulation (EU) 2024/1624 keeps the prohibition of disclosure with the same scheme of strictly defined exceptions and makes it directly applicable law from July 10, 2027. For Spanish entities, the practical change is that the regime is harmonized across Member States, which is especially relevant for cross-border groups. More detail on our AMLR page.
Operational guide
Practical guide to the tipping-off prohibition
You do not comply with Article 24 through a clause: you comply through scripts, system permissions and training. Ten steps that cover all three fronts.
Restrict who knows
The fewer people who know that a report exists, the lower the risk of a leak. Access to the reported case file must be restricted in the system, not just in the manual.
Write the answer in advance
Three or four neutral phrasings, approved and distributed. Whoever deals with the customer should not have to make anything up on the spot.
Review the system texts
Automated emails, rejection reasons, app notifications. This is where disclosure most often happens without anyone having spoken to anyone.
Tipping-off prohibition checklist in 10 steps
- Include in the AML manual the need-to-know rule and who belongs to the informed circle.
- Restrict system access to case files where a report has been filed, using specific permissions.
- Draft and approve the customer response script for holds, document requests and terminations.
- Review all automated texts—emails, notifications, rejection reasons—to remove references to alerts or reviews.
- Set rules for the CRM and internal notes: what may be written and which fields the customer can see.
- Set out in the contracts the duty of confidentiality of providers and outsourced functions.
- Define the procedure for responding to inquiries from third parties and other entities.
- Give specific training to front office, support and sales, which are the real leak points.
- Create a log of disclosure incidents with root-cause analysis and corrective action.
- Audit a sample of conversations and tickets every year to check that the script is being applied.
If you want to review the whole workflow, start with the AML manual or your team’s mandatory training.
Confidentiality in day-to-day operations
Where information really leaks
Disclosure is almost never deliberate. These are the four ways it gets out.
1) The conversationThe customer asks and someone answers
It is the main channel. An account manager who wants to help, a customer who insists and one explanation too many.
- Approved script
- Role-based training
- Escalation to the person in charge
2) The systemThe automated text that says too much
Rejection reasons, notification emails, statuses visible in the customer’s app. Nobody says a word, and the disclosure still happens.
- Template review
- Visible fields
- Neutral statuses
3) The groupThe informal inquiry between entities
A very widespread practice, and one covered only in strictly defined cases. Outside them, it is disclosure to a third party, with all the consequences.
- Applicable exception
- Same customer and transaction
- Duty of secrecy
4) The exitEnding the relationship
Closing the account or dropping the engagement is legitimate. Explaining the real reason is not. It is the moment of greatest risk, because the customer demands reasons and there is no longer a relationship to preserve.
Tip: have a standard termination letter drafted in advance. It must cite the contractual ground, never the risk analysis or the report.
Quick decisionPractical map: can I say this?
Three questions and the right answer to each.
Talking about the process
“We are completing an internal check.” Allowed.
Talking about the reason
“We got a money laundering alert.” Prohibited.
Talking about the decision
“We will not be able to carry out this transaction.” Allowed, without explaining why.
Confidentiality playbook
The tipping-off prohibition in practice
Need to know
A closed circle of people who know that a report exists.
System permissions matrix and the relevant section of the manual.
Response script
Approved neutral wording for typical situations.
Versioned, dated document distributed to the team.
Automated texts
No system template mentions alerts, reviews or reports.
Inventory of reviewed templates and review date.
Third parties and providers
Equivalent duty of confidentiality under contract.
Contract clause and register of providers with access.
Training
Role-specific training, with a focus on customer service.
Content, attendance and assessment by department.
Signs that you have a confidentiality problem
Any one of these indicates that Article 24 has not really been implemented.
- Any employee can see in the system which case files have been reported.
- There is no written script for when a customer asks about a hold.
- Automated email templates have never been reviewed from this angle.
- Other entities are consulted informally about specific customers.
- Termination letters are drafted case by case, without review.
Operational glossary
Key concepts of the tipping-off prohibition
Terms that appear in manuals, procedures and sanction proceedings.
Art. 24Basis
Prohibition of disclosure
Prohibits disclosing to the customer or third parties that an examination or a report exists or may take place.
Law 10/2010, Article 24.
Tipping offInternational
Warning the person under investigation
Standard name for the same duty in the FATF framework and in EU legislation.
FATF Recommendations.
Need to knowControl
Need to know
Operating principle that limits access to information to the smallest number of people strictly necessary.
Implemented with permissions, not with reminders.
DissuasionException
Dissuading from illegal activity
You may try to get the customer to desist, without disclosing that a report exists or will exist.
A narrow line: the what, yes; the why, no.
GroupException
Intragroup sharing
Allowed between entities of the same group with common AML/CFT policies and procedures.
Requires a documented group policy.
Art. 18Linked
Suspicious transaction reporting
The fact whose existence cannot be disclosed. Both duties arise at the same time.
Art. 19Linked
Duty to refrain from executing transactions
Stopping the transaction without being able to explain why is the central practical tension of Article 24.
See: duty to refrain.
IncidentManagement
Disclosure that has occurred
A disclosure cannot be undone: it is documented as an incident, its cause is analyzed and the control is corrected.
An incident log is mandatory in practice.
AMLR2027
Regulation (EU) 2024/1624
Keeps the prohibition and harmonizes the exceptions at EU level from July 2027.
See: AMLR.
COMPLIANCE CONTROL CENTER · ART. 24
Decision matrix: can I share this information?
Cross who you are talking to with what you are going to tell them. The cell tells you whether you are on the right side of Article 24 or not.
Disclosure matrix
Green: allowed. Amber: only with a supporting basis. Red: prohibited.
Counterpart \ Content
The process
The decision
The reason
The customer
Yesneutral wording
Yeswithout explaining
Noprohibited
Group entity
Yescommon policy
Yescommon policy
Yesif a policy exists
Unrelated third party
Yesgeneric only
Noprohibited
Noprohibited
Obliged entities
Who does the prohibition apply to?
To all obliged entities and, personally, to their directors and employees.
General
Obliged entities under Law 10/2010
We assess your position as an obliged entity and tailor the confidentiality script to the type of relationship you have with your customers.
See obliged entities →
Law 10/2010Art. 24
Law firms
Lawyers and advisory firms
The relationship of trust with the client makes it especially hard to maintain confidentiality without it becoming obvious.
See AML for law firms →
TrustEngagement
Real estate
Real estate agents
Several parties asking at once about a deal that is not moving forward: the highest-risk scenario for indirect disclosure.
See AML for real estate →
Multiple partiesPressure
Fintech
Payment institutions and fintechs
Automated texts and support tickets are the most common leak channel, and they leave a written record.
See our fintech approach →
TemplatesSupport
Common mistakes
The six confidentiality failures we see most often
All of them recur at entities whose manuals are otherwise well built.
Thinking you only breach it by talking about the report
The prohibition also covers the examination of the transaction. Saying “we’re reviewing it for compliance” is already disclosure, even if you never end up reporting anything.
Overly explicit rejection reasons
An automated notification that says “transaction rejected by anti-money laundering controls” discloses without anyone having spoken to the customer.
Informal inquiries between compliance officers
A very widespread practice in the sector, and one covered only in strictly defined cases. Outside them, it is disclosure to a third party.
Open access to reported case files
If anyone on the team can see the report flag in the system, need to know does not exist.
Termination letters drafted on the fly
Ending the relationship is the moment of greatest pressure and greatest risk. The letter must be a standard one, and it must be reviewed.
Not logging incidents
A disclosure that happened and was documented with its root-cause analysis shows a system that works. A disclosure that happened and was hushed up is an aggravating factor.
Official sources
Where all of the above comes from
Direct links to the consolidated texts and to the competent bodies.
BOE
Law 10/2010 of April 28
Consolidated text. Article 24: prohibition of disclosure and its exceptions.
BOERoyal Decree 304/2014 of May 5
Implementing regulations of Law 10/2010.
EUR-LexRegulation (EU) 2024/1624 (AMLR)
Keeps and harmonizes the prohibition of disclosure from July 2027.
SEPBLACExecutive Service of the Commission for the Prevention of Money Laundering
Spain’s financial intelligence unit.
FATFFATF Recommendations
The international standard that the concept of tipping off comes from.
TreasuryCommission for the Prevention of Money Laundering
Institutional information and the sanctions regime.
Initial publication, with a practical customer response script and treatment under the AMLR.
Planned review: application of Regulation (EU) 2024/1624.
Contact
Book a call
Tell us how your team currently answers when a customer asks about a transaction on hold.
Legal framework for the tipping-off prohibition in Spain
The prohibition of disclosure—known internationally as tipping off—is set out in Article 24 of Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing. It prevents obliged entities, and also their directors and employees, from disclosing to the customer or to third parties that information has been reported to SEPBLAC or that a transaction is being examined—or may be examined—because of its possible link to money laundering or terrorist financing.
The real scope: the examination, not just the report
Reading the provision narrowly—as if it only protected the fact that a report has been made—is wrong, and it lies behind a large share of breaches. The rule also covers the earlier stage: the internal analysis of a transaction. An entity can breach Article 24 without having filed any report at all, simply by telling the customer that the compliance department is reviewing their transaction.
The strictly defined exceptions
The provision allows certain exchanges of information that are not treated as disclosure: between entities of the same group that apply common AML/CFT policies and procedures; between financial institutions subject to EU or equivalent rules, where the exchange concerns the same customer and the same transaction and a duty of secrecy applies; and between professionals (lawyers, procuradores, notaries, auditors) who practice within the same entity or network and act for the same client and transaction. Attempting to dissuade the customer from carrying out an illegal activity is also allowed, provided that the existence or possibility of a report is not disclosed.
The tension with the duty to refrain
Article 24 applies at precisely the most uncomfortable moment: when the transaction has been stopped under the duty to refrain and the customer demands an explanation. This tension is structural, and good will does not resolve it. It requires a response script drafted and approved in advance, and specific training for staff who deal directly with customers. Improvising in front of an insistent customer is by far the most common cause of improper disclosure.
Personal liability and evidencing compliance
Unlike other AML/CFT obligations, Article 24 is also expressly addressed to directors and employees. This means that the entity’s liability does not displace that of the individual who makes the disclosure. As a result, evidencing compliance necessarily means showing three things: that a need-to-know procedure was implemented in the system, that an approved script had been distributed, and that specific training on this point was given to the staff most exposed. You can see how this fits into the overall system in the AML manual.
Related obligations
AML/CFT system
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
- Royal Decree 304/2014 of May 5 approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .