Unlicensed currency exchange or money transfer in Spain: the risk and the way out

The case, in five lines

What is brought

Defence against a request for information, an inspection or disciplinary proceedings by the Banco de España (Spain's central bank) for carrying on a reserved activity without authorisation (currency exchange with the public or payment services, such as money remittance), followed by regularisation: registration as an agent of a payment institution, registration as a small payment institution, a licence of your own or a currency exchange authorisation.

Before which court

The Banco de España requests information, inspects, investigates and imposes penalties (article 13.2 of Royal Decree 2660/1998; fourth additional provision of Law 10/2014, which confers the power on the Ministry, acting itself or through the Banco de España). Its decision is challenged by recurso de alzada (an administrative appeal) to the Minister for the Economy, now the Ministerio de Economía, Comercio y Empresa (Ministry of Economy, Trade and Business) (article 113 of Law 10/2014), and the Minister's decision, in sole instance, before the Audiencia Nacional (National High Court) (article 2.3 of Law 13/1994), without the prior attempt at negotiation under article 5 of Organic Law 1/2025, which applies only in civil and commercial matters.

Deadline

The request for information must be answered within the period set in the request itself; any extension must be sought before it expires (article 32 of Law 39/2015, the Administrative Procedure Act, LPAC). Disciplinary proceedings must be decided within one year (article 107.3 of Law 10/2014). The recurso de alzada must be filed within one month of notification (article 122.1 LPAC); judicial review within two months from the day after notification of the Minister's decision (article 46.1 of the LJCA, the Contentious-Administrative Jurisdiction Act). Very serious infringements become time-barred after five years and serious ones after four, counted from the date the continuing activity ends (article 95 of Law 10/2014).

Who can bring it

Liability falls on the individual or company that carried on the activity and, in addition, on each director or manager, de facto or de jure, responsible for the infringement (article 100.1 of Law 10/2014). Any appeal is brought by whoever is penalised. We act before the Banco de España as the company's accredited representatives, without using your digital certificate.

Financial risk

A fine on the company of three to five times the profit obtained, or up to 10% of its turnover or 10,000,000 euros (article 97.1.a of Law 10/2014); up to 5,000,000 euros for each responsible director and disqualification for up to ten years (article 100.1); provisional suspension of the activity (article 111); publication in the BOE (Spain's Official State Gazette) with your identity (article 115); and a record that is weighed in the fit and proper assessment if you later apply for a licence (article 30 of Royal Decree 84/2015).

What is reserved and how businesses stray into it without knowing

There are two regimes, and they should be kept apart from day one. Buying or selling foreign banknotes with the public in premises open to the public requires authorisation from the Banco de España (Royal Decree 2660/1998): a purchase-only authorisation, which any individual or company may hold, including as a sideline to a hotel or a shop, and a purchase-and-sale authorisation, reserved to a sociedad anónima (public limited company) with 60,000 euros of capital and an exclusive corporate purpose, unless it is also a payment or electronic money institution. Buying and selling currency on your own account, as an investment, is not a regulated activity; doing it for the public is.

Money remittance is one of the eight payment services (article 1.2.f of Royal Decree-Law 19/2018, RDL 19/2018): receiving funds from a payer, without opening an account in anyone's name, for the sole purpose of transferring an equivalent amount to the payee, or receiving funds on the payee's behalf and making them available to the payee (article 3.36). The word “equivalent” matters: in offsetting arrangements between two people in different countries, known as hawala, the money never crosses the border but the relative is paid, and in our view this falls within the literal definition. Only banks, electronic money institutions, payment institutions, small payment institutions and Correos (the Spanish postal service) may provide it; everyone else is prohibited from doing so (article 5).

Many businesses stray into it without realising: the company that collects from its customers in order to pay third parties on their behalf, the shop that changes money and pays the proceeds by transfer into someone else's account (our reading of the definition, with no published official guidance), the call shop that settles balances with a partner abroad. The exclusion in article 4.f only takes cash-to-cash exchange out of payment services where the funds do not pass through a payment account, and that exchange still needs the authorisation under Royal Decree 2660/1998. And a detail almost nobody notices: the exception to the 1,000-euro cash payment limit only covers exchange carried out by establishments authorised and supervised by the Banco de España (article 7.Uno.5 of Law 7/2012).

What the Banco de España can do to someone who is not registered

Where someone offers financial services without being entered in any register, the law empowers the Ministry of the Economy to request, itself or through the Banco de España, any accounting or other information, in whatever detail and at whatever intervals it sees fit, and to carry out inspections to clarify the activities and verify what is declared (fourth additional provision of Law 10/2014). For currency exchange in premises open to the public, the Banco de España is directly competent: it requests information, inspects, investigates and imposes penalties through a simplified procedure (article 13.2 of Royal Decree 2660/1998).

The request itself is the first risk. Failing to provide the information within the period given, providing false information or resisting the inspection is a very serious infringement, and the penalty may be imposed each time it happens (fourth additional provision, paragraph 2). In February 2026 the BOE (Spain's Official State Gazette) published a 24,000-euro penalty, already reduced by 20%, on a company that did not provide the information requested in an inspection either on time or in full, which prevented the supervisor from checking whether it was providing payment services: it was penalised without the activity being proved. This is not a theoretical risk: in 2025 the Banco de España took action in 54 cases against persons showing signs of carrying on reserved activities, currency exchange among them.

Even before opening proceedings, where there is urgency, the Banco de España may adopt provisional measures, including suspending the alleged offender's activity, and may publish them (article 111 of Law 10/2014). It has no periodic penalty payments under this law: its levers are the order to cease as an ancillary measure (article 97.2.a) and repeated penalties. The deadline for replying is the one set in the request; if it is not enough, an extension must be sought before it expires (article 32 LPAC). Replying well means handing over everything requested, complete and on time, with a submission that explains the flow of funds and does not accept characterisations that do not apply.

The infringement and the fines: for the company and for each director

Providing any of the payment services repeatedly and on a professional basis without being a payment service provider is a very serious infringement under article 92.aa of Law 10/2014, a point inserted by RDL 19/2018. If it falls short of that, for example because it was occasional, it is a serious infringement: carrying out acts or transactions without authorisation where authorisation is required (article 93.a). “Repeated and professional” is the first battleground: how many transactions, over what period, with what advertising and for what commission. The difference between one classification and the other changes the scale of the fine and the limitation period.

For the company, the fine for a very serious infringement ranges from three to five times the profit obtained, where it can be quantified, or up to 10% of net turnover for the previous financial year, or up to 10,000,000 euros if that percentage is lower (article 97.1.a). For each responsible director or manager, de facto or de jure: up to 5,000,000 euros, suspension for up to three years and disqualification from any financial institution for up to ten (article 100.1). These may be accompanied by an order to cease and a public reprimand in the BOE (article 97.2). In a case published in 2020, after a 40% reduction, the company paid 72,000 euros and its chairman 9,000.

For exchanging banknotes without authorisation, the picture is less clear. Article 13 of Royal Decree 2660/1998 gives jurisdiction to the Banco de España and lays down the simplified procedure, but it refers to the tenth additional provision of Law 26/1988, repealed in 2014. That reference is now read as made to Law 10/2014 (its sixth additional provision), but no decision or provision we can cite states which specific infringement applies today to exchanging banknotes without authorisation. That is no reason to relax: it is a line of defence to be worked on in the written submissions. And if, besides the banknotes, there were transfers to third parties, that part falls squarely within article 92.aa.

The proceedings: time limits, reductions and appeals

The Banco de España investigates and decides, and has one year to decide and notify, extendable under the general law (article 107.3 of Law 10/2014). Very serious infringements become time-barred after five years and serious ones after four; for a continuing activity, the period starts when the activity ends, it is interrupted by notice of the commencement of proceedings and it runs again if the file stalls for six months through no fault of the person concerned (article 95). What nobody tells you: as long as you keep operating, the limitation period does not even start. Stopping is also what sets the clock running.

The law reduces the fine by at least 20% for acknowledging responsibility and by a further 20% for voluntary payment, which can be combined, provided that administrative appeals are waived (article 85.3 LPAC), and the Banco de España applies them. Before accepting them, you need to weigh what they bring with them: the penalty becomes final and is published in the BOE with the identity of the person responsible and on the Banco de España website for at least five years (article 115), and it is a penalty that will be weighed in the fit and proper assessment if you later apply for a licence or sit on a board. Whether to pay at a discount or to fight is decided with the figures and the regularisation plan in front of you.

The penalty is not enforceable until it brings the administrative route to an end (article 113.1). It is challenged by recurso de alzada (administrative appeal) to the Minister for the Economy, now the Ministerio de Economía, Comercio y Empresa (Ministry of Economy, Trade and Business), within one month of notification (article 113.2 and article 122.1 LPAC); the Ministry has three months to decide. Against its decision, judicial review lies in sole instance before the Audiencia Nacional (National High Court) (article 2.3 of Law 13/1994), not before the Tribunal Superior de Justicia de Madrid (High Court of Justice of Madrid), within two months (article 46.1 LJCA), with interim measures available and a risk of costs. The prior attempt at negotiation under article 5 of Organic Law 1/2025 is not required: it applies only in civil and commercial matters.

The way out: stop, document it and choose the route to regularisation

Getting out starts with stopping, and with being able to prove it: the date you stopped, notice to customers, removal of signs, website and advertising, settlement of pending transfers to their beneficiaries and a record of what remains. And nothing is destroyed. Anyone who exchanges currency on a professional basis is an obliged entity for anti-money laundering purposes even without authorisation (article 2.1.i of Law 10/2010) and must keep the documentation for ten years (article 25); moreover, those records are your best defence on volume, commission and the origin of the money.

For money remittance, the fastest route is usually to become an agent of an authorised or small payment institution: it is the institution, not you, that notifies the Banco de España of the agent; the Banco de España has two months to register you and you may not operate until you are registered (article 23 of RDL 19/2018). The institution is fully liable for its agents and will examine your past and your good repute before appointing you. If you want a licence of your own, registration as a small payment institution allows an average of up to 3,000,000 euros a month, with no minimum capital and no EU passport, and is deemed to take place twenty days after the documentation is complete (article 14 of RDL 19/2018 and article 4.1 of Royal Decree 736/2019); authorisation as a payment institution requires 20,000 euros if you only remit money and is decided within three months, with silence meaning refusal. This is covered in the case “I want to start a remittance business: agent or money transfer licence in Spain?”.

For banknotes there is no agent shortcut: purchase and purchase-and-sale cannot be entrusted to agents. A shop that changes money for its customers may apply for a purchase-only authorisation as a sideline activity, with good repute presumed from the business already open (articles 2.1, 4.1 and 4.3 of Royal Decree 2660/1998); selling banknotes requires a purchase-and-sale bureau, authorised by the Banco de España after a report from SEPBLAC (Spain's financial intelligence unit) within three months, with silence meaning refusal (article 3). If you also pay out by transfer, two applications are needed for the same company. They are explained in “Currency exchange licence in Spain (bureau de change): the Banco de España authorisation” and “FX payments licence in Spain (online currency exchange): do you need one for transfers?”.

What weighs afterwards: good repute, your bank and the criminal risk

The good repute of shareholders, directors and managers is assessed under article 30 of Royal Decree 84/2015, which applies to payment institutions and to bureaux de change. All available information counts: the person's record with supervisors, administrative penalties (whether intentional or final, their seriousness, limitation, mitigating circumstances and subsequent conduct) and relevant, well-founded investigations, with a criminal record certificate for each person. The provision does not expressly mention having operated without authorisation: it weighs through those channels. That is why stopping early and cooperating is not just prudence; it is the subsequent conduct the provision requires to be taken into account.

The mistake that turns a defensible past into a closed door is hiding it. Obtaining authorisation by means of false statements is an infringement (article 93.a of Law 10/2014) and a ground for revocation (article 18 of RDL 19/2018), and the Banco de España knows about its own actions. In the application we set out what happened, when it stopped, what has been corrected and which controls now prevent it, with documents. An application like that gets examined; one the supervisor only half uncovers gets refused.

Your bank is the other front. If it sees recurring cash deposits and payments to third parties, it will apply its due diligence and, if it cannot do so, it will not maintain the relationship (article 7.3 of Law 10/2010); this is covered in the case “Bank account closed for a payment institution or bureau de change in Spain”. As for criminal law, no official source we have read makes operating without authorisation a crime in itself: it is an administrative infringement. Money laundering is a different matter, tied to the criminal origin of the funds, and complete records are also the best way to rule it out. Anti-money laundering obligations once authorised are covered in “AML compliance for your currency exchange or money remittance business in Spain”.

How we run the case, step by step

1. 1

   We read the request and fix the deadline

   Who signed it, on what legal basis, exactly what it asks for and from which day time runs. If the period is not enough, we ask for an extension before it expires.

2. 2

   We classify what you were doing

   Transaction by transaction: over-the-counter exchange, money remittance or payments on behalf of third parties; whether it was repeated or occasional, and what profit it produced.

3. 3

   We organise the cessation and preserve the evidence

   Date of cessation, notice to customers, pending transfers settled and records intact: nothing is deleted.

4. 4

   We reply to the Banco de España on your behalf

   A complete, timely submission that explains the flow of funds, filed as the company's representatives under a power of attorney, without using your digital certificate or your Cl@ve login.

5. 5

   We choose and prepare the regularisation

   Agent of a payment institution, registration as a small payment institution, a licence of your own or a currency exchange authorisation, with the past disclosed and documented.

6. 6

   If proceedings are opened, we conduct the defence

   Submissions on classification, repetition, who is responsible and the amount; a reasoned decision on the reduction; and an administrative appeal and the Audiencia Nacional if needed.

The law that applies

• Arts. 1.2, 3.36 y 5 RDL 19/2018. Eight payment services, including money remittance; its definition (receiving funds without opening an account in order to transfer an equivalent amount to the payee); reservation to authorised or registered providers and prohibition for everyone else. BOE-A-2018-16036
• Arts. 14 y 23 RDL 19/2018. Registration as a small payment institution up to an average of 3,000,000 euros a month, with no passport; the institution notifies the Banco de España of the agent, the Banco de España has two months and the agent may not operate until registered; the institution is fully liable for it. BOE-A-2018-16036
• Art. 13 RD 2660/1998. Anyone exchanging currency in premises open to the public without authorisation is subject to information requests, inspection and penalties by the Banco de España, through a simplified procedure for very serious infringements. BOE-A-1998-28816
• Arts. 92.aa, 93.a, 97 y 100 Ley 10/2014. Repeated, professional provision of payment services without being a provider is very serious, and serious if it falls short; a fine on the company of three to five times the profit, up to 10% of turnover or up to 10,000,000 euros, and on each director of up to 5,000,000, with disqualification for up to ten years. BOE-A-2014-6726
• Arts. 95, 107, 111, 113 y 115 y disposición adicional cuarta Ley 10/2014. Limitation of five and four years, running from cessation for a continuing activity; one year to decide; provisional measures, including suspension; administrative appeal to the Minister; publication in the BOE and online; information requests and inspection of unregistered persons, with a very serious infringement if they do not cooperate. BOE-A-2014-6726
• Art. 30 RD 84/2015. Good repute: all available information is assessed, including the person's record with supervisors, penalties with their finality, seriousness, limitation and subsequent conduct, and relevant, well-founded investigations, with a criminal record certificate. BOE-A-2015-1455
• Art. 85.3 Ley 39/2015 (LPAC). Reductions of at least 20% for acknowledging responsibility and for voluntary payment, which can be combined, conditional on waiving administrative appeals. BOE-A-2015-10565
• Art. 2.3 Ley 13/1994, de Autonomía del Banco de España. The Audiencia Nacional hears, in sole instance, challenges to the Minister's decisions on appeals against acts of the Banco de España. BOE-A-1994-12553

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions