ES v13.3.0

Spain (ES) · Module Detail

Spain: AML/CFT & Financial Crime (Sentinel.gi-fed)

#

Ley 10/2010/RD 304/2014 AML framework; SEPBLAC FIU; CaixaBank EUR30m AML fine; June-2025 de-risking guidance; no dedicated Sentinel feed queryable this cycle.

Standing sub-brief · as of 8 July 2026146 words · last cycle 2026-10-12

AML/CFT & Financial Crime

SEPBLAC, established in 1993, is Spain's Financial Intelligence Unit and AML/CFT supervisory authority, coordinating with Banco de España and the CNMV. SEPBLAC's July 2025 explanatory note clarifies that obliged entities under Ley 10/2010 and RD 304/2014 must apply risk-based due diligence — identification, purpose understanding, ongoing monitoring — before denying or restricting accounts, services or payment products. This module's intelligence is attributed to the Sentinel.gi illicit-finance feed; no dedicated Sentinel query was available for Spain this cycle, so the above is carried as a proxy drawn from public SEPBLAC disclosures, and no independent illicit-finance analysis is offered here — see the Financial Intelligence Monitor for that remit.

Periodic update · new data 2026-10-12

AML/CFT & Financial Crime

Real Decreto 813/2026 extends the existing SEPBLAC-representative obligation under Ley 10/2010's implementing regulation to small real-estate credit intermediaries and other small obliged entities that had previously benefited from an exemption. Those entities now face a nine-month compliance deadline, running to 28 July 2027, to appoint a SEPBLAC representative. This is a governance-coverage expansion rather than a new type of obligation: the representative duty itself already existed for larger obliged entities, and the decree simply removes the small-entity carve-out.

Payment institutions and electronic-money institutions are not named as a primary target of this provision in the material reviewed, and the decree's payment-account identity-matching requirements, which do touch how funds are credited and returned electronically, are scoped specifically to gambling operators rather than to payment-service providers as a class. The substantive AML-architecture analysis of RD 813/2026, including its crypto-asset-service-provider SEPBLAC-gateway and crypto-ATM identification provisions, is carried by the financial-integrity monitor; this W11 treatment notes only the governance-coverage dimension as it might touch payment-adjacent intermediaries falling within the newly-expanded small-obliged-entity population.

Outlook

The 28 July 2027 compliance deadline for newly-covered small obliged entities is the concrete date to track. Whether any payment institution or EMI falls within the expanded small-entity population subject to the SEPBLAC-representative duty was not established in the material reviewed this cycle and would be the clearest item to confirm in a future cycle.

Sources and findings (8)
  1. T1https://www.sepblac.es/en/2026/02/18/development_harmonized/retrieved
  2. T?FIM (sentinel.gi) per-JID baseline profile — Spain — Spain's AML/CFT regime rests on Law 10/2010 and its implementing regulation, with Sepblac acting as both FIU and primary AML/CFT supervisor. FATF rates Spain compliant/largely compliant on 38 of 40 Recommendations and high/substantial on 10 of 11 effectiveness outcomes. CNMV supervises MiCA-authorised crypto firms; the golden-visa residency-by-investment channel was abolished in 2025.
  3. T2FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-002) — Enforcement: Sepblac — Banco Santander (Openbank digital unit)
  4. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness
  5. T2FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-001) — Enforcement: Sepblac — CaixaBank
  6. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: legal-gap
  7. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: regulatory-failure
  8. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: enforcement-absence