Anti-Money Laundering Prevention

Regulatory Framework: Law 10/2010 on AML

Law 10/2010 of April 28, on the prevention of money laundering and terrorist financing (AML/CTF), transposes European legislation into Spanish law. Its implementing regulation is Royal Decree 304/2014.

The core objective is to prevent legitimate financial channels from being used to integrate funds of criminal origin. For lawyers, knowledge of this regulation is doubly relevant: as advisors to obligated clients and, in many cases, as obligated subjects themselves.

Obligated Subjects (Art. 2)

Article 2 lists over 30 categories of obligated subjects. The most relevant for legal practice are:

• Financial entities: banks, insurance companies, securities firms, payment institutions.
• Legal professionals: lawyers, court representatives and notaries when involved in financial, real estate or corporate transactions on behalf of clients.
• Auditors and accountants: statutory auditors, external accountants and tax advisors.
• Real estate promoters and agents: intermediaries in property transactions.
• Others: casinos, jewellers dealing in amounts above 10,000 euros, art dealers.

A law firm becomes an obligated subject when it participates in real estate transactions, company formation or management, bank account management, or the organization of capital contributions for business creation.

Due Diligence (Arts. 3 to 6)

Due diligence is the operational pillar of AML. It comprises four main obligations:

Formal Identification (Art. 3)

Every obligated subject must identify clients using reliable documents (ID card, passport, NIE) before establishing the business relationship.

Beneficial Owner Identification (Art. 4)

The obligated subject must determine who effectively controls the client legal entity. A beneficial owner is any natural person who directly or indirectly holds or controls more than 25% of the capital or voting rights.

Purpose of the Relationship (Art. 5)

The subject must understand the client's professional or business activity and the nature of the business relationship. A generic form is not sufficient: the consistency of transactions with the declared profile must be verified.

Ongoing Monitoring (Art. 6)

Due diligence does not end at the initial stage. There is an obligation to periodically update documentation and review transactions to detect inconsistencies with the client's risk profile.

Reporting Suspicious Transactions to SEPBLAC

SEPBLAC is Spain's financial intelligence unit. Obligated subjects must report:

• Any transaction showing signs of money laundering or terrorist financing.
• Transactions that are inconsistent with the client's declared activity.
• Attempted transactions, even if not completed.

Reporting is confidential: the obligated subject is prohibited from disclosing the report to the client (tipping off). Failure to report constitutes a serious infringement.

Record Retention: 10 Years

Article 25 requires the retention for 10 years of all documentation related to due diligence obligations and transactions. This includes copies of identification documents, transaction receipts, and records of SEPBLAC communications.

Sanctions Regime (Arts. 50 to 62)

The regime distinguishes three levels:

• Minor infringements: formal or isolated failures. Private warning or fines up to 60,000 euros.
• Serious infringements: failure to comply with due diligence, failure to report suspicious transactions, significant internal control deficiencies. Fines from 60,001 to 1,500,000 euros.
• Very serious infringements: widespread non-compliance, obstruction of SEPBLAC, using professional activity for laundering. Fines from 1,500,001 to 10,000,000 euros (or up to 10% of annual turnover). May include revocation of authorization to operate.

Practical Case: The Law Firm as Obligated Subject

A law firm is engaged to incorporate an SL with 100,000 euros in capital contributed entirely by a non-resident individual. The protocol must include:

1. Formal identification: passport and tax residency certificate.
2. Beneficial owner: verify whether the person acts on behalf of a third party.
3. Source of funds: request documentation proving the legitimate origin of the 100,000 euros.
4. Risk assessment: analyze whether the client profile, jurisdiction of origin, and transaction structure present elevated risk factors.
5. Decision: if indicators are insufficient or contradictory, report to SEPBLAC and, if appropriate, refrain from executing the transaction.