Abstract
Spanish anti-money laundering (AML) legislation has undergone significant development in recent decades, driven both by the adaptation to international standards and by the requirements of European Union law. Law 10/2010 of 28 April constitutes the core of the system, regulating the obligations imposed on obliged entities to prevent the financial system and certain professional sectors from being used to channel funds of illicit origin or intended for the financing of terrorism.
The subsequent transposition of the Fourth Directive (EU) 2015/849 through Royal Decree-Law 11/2018 strengthened essential aspects relating to beneficial ownership and the risk-based approach, increasing the strictness of due diligence requirements, internal controls, and analysis of suspicious transactions.
Likewise, the incorporation of the Fifth Directive (EU) 2018/843 by Royal Decree-Law 7/2021 introduced new categories of obliged entities and substantially reformed the corporate transparency framework through the creation of a Central Register of Beneficial Ownership, particularly relevant for criminal and administrative investigations.
The Structural Framework of Law 10/2010: Obliged Entities and General Obligations
Article 2 of Law 10/2010 identifies a wide range of obliged entities, including financial institutions, insurance companies, legal professionals in certain circumstances, casinos, real estate developers, auditors, investment firms, and, since 2021, providers of services related to crypto-assets. The regime is structured around three pillars: due diligence, reporting obligations and internal controls, and an autonomous sanctions regime (Arts. 50 et seq.).
The legal significance of the system lies in establishing a mandatory compliance framework whose breach may lead to administrative sanctions as well as criminal consequences, influencing the assessment of intent (dolo), corporate criminal liability, and findings of gross negligence.
The Three Levels of Due Diligence
Due diligence constitutes the backbone of Law 10/2010. It is structured in three levels—standard, simplified, and enhanced measures—regulated between Articles 3 and 15.
1. Standard Due Diligence Measures
Standard measures are the general requirement applicable to all business relationships unless circumstances justify a different level. They include:
a) Formal identification of the client (Art. 3)
Obliged entities must identify clients prior to establishing business relationships or executing occasional transactions. Identification must be conducted using reliable documentation, and the relationship cannot commence without completing this process.
b) Identification of the beneficial owner (Art. 4)
The law requires determining who ultimately controls the corporate or ownership structure. This point was significantly reinforced by Royal Decree-Law 11/2018 and further developed by Royal Decree-Law 7/2021, which established a centralised beneficial ownership system.
c) Understanding the purpose and nature of the relationship (Art. 5)
The economic and professional purpose of the business relationship must be documented to detect potential mismatches between declared activity and financial movements.
d) Ongoing monitoring (Art. 6)
Obliged entities must continuously monitor transactions to ensure consistency with the client’s profile.
e) Application of the risk-based proportionality principle (Art. 7)
Obliged entities must adjust resources and analysis based on the level of identified risk.
These obligations constitute an essential level of due diligence to prevent illicit funds from entering the financial system and have direct implications in criminal proceedings: their fulfilment or breach may be assessed to determine knowledge, willful blindness, or gross negligence.
2. Simplified Due Diligence Measures
Regulated in Articles 9 and 10 of Law 10/2010, they apply only where the risk is low and the clients, products, or transactions pose limited money laundering potential. Their application was qualified following the transposition of the Fourth Directive, which requires prior risk assessment to justify reduced controls.
Circumstances that may lead to simplified measures include:
• Credit institutions subject to equivalent requirements in other Member States.
• National or EU public administrations.
• Standardised financial products with limited anonymity.
However, their application can never be automatic. Royal Decree-Law 11/2018 strengthened the requirement to document the low-risk profile prior to applying this reduced-intensity regime.
3. Enhanced Due Diligence Measures
Where high-risk factors exist, obliged entities must apply enhanced measures (Arts. 11–15). These situations include:
• Non face-to-face transactions (Art. 12).
• Cross-border correspondent banking relationships (Art. 13).
• Politically Exposed Persons (PEPs) and their close associates (Art. 14).
• Products enabling anonymity or emerging technologies (Art. 16).
Enhanced analysis entails:
• Additional verification of identity through independent sources.
• Obtaining extended information on the origin of funds.
• Approval by senior management to establish or continue the relationship.
• Significantly stricter and more frequent monitoring.
The transposition of the Fifth Directive through Royal Decree-Law 7/2021 introduced providers of services related to crypto-assets as an inherent high-risk category, requiring systematic application of enhanced measures due to the vulnerability of these assets to anonymity and cross-border mobility.
Beneficial Ownership: Regulatory Evolution and Procedural Relevance
The beneficial ownership regime has undergone profound transformation. The Fourth Directive, implemented by Royal Decree-Law 11/2018, strengthened the obligation to obtain, retain, and update accurate information on who effectively controls legal entities.
With Royal Decree-Law 7/2021, the Central Register of Beneficial Ownership was created, managed by the Ministry of Justice, consolidating information from the Commercial Registry and the Notarial Registry, and ensuring interconnection with other European registers. This system constitutes a crucial tool for criminal and administrative investigations aimed at uncovering opaque corporate structures, trusts, or equivalent legal arrangements.
Practical Relevance for Economic Criminal Law
The interaction between the preventive AML framework and the criminal offence of money laundering is direct. The existence or absence of due diligence measures may serve as an indicator of:
• Direct or eventual intent.
• Willful blindness.
• Gross negligence in cases of relevant imprudence.
• Corporate criminal liability (Art. 31 bis of the Criminal Code), where an effective compliance programme may be decisive for exclusion or mitigation of liability.
Furthermore, the administrative sanctions regime of Law 10/2010 (Arts. 50 et seq.) provides for severe penalties—potentially reaching millions of euros—applicable even in the absence of criminally relevant conduct. This makes preventive legal advice an essential component of the specialised white-collar defence practice.
Conclusion
The Spanish AML framework constitutes a demanding and continuously evolving regulatory structure, closely aligned with European standards. Law 10/2010 and the reforms introduced by Royal Decree-Laws 11/2018 and 7/2021 have strengthened transparency, expanded the scope of obliged entities, and enhanced the risk-based approach, notably through beneficial ownership regulation and the incorporation of crypto-asset service providers.
For criminal defence practitioners, mastering this framework is essential both in money laundering proceedings and in advising on administrative and criminal risk exposure. A proper understanding of the three levels of due diligence and their practical implications enables stronger strategic approaches before the courts and reinforces compliance culture in supervised entities and professionals.
Why Fukuro Legal Can Assist You
Fukuro Legal, as a specialised criminal law firm, offers the essential combination of technical expertise in AML compliance and extensive experience in criminal and administrative proceedings. Its mastery of Law 10/2010 and the obligations arising from the Fourth and Fifth Directives enables the firm to advise obliged entities on the proper application of due diligence measures while also designing robust defence strategies when a criminal investigation questions the adequacy of internal compliance systems.
This dual perspective—preventive and contentious—makes Fukuro Legal an ideal partner to mitigate risks, respond effectively before SEPBLAC, and safeguard clients’ interests before the courts.
