AML compliance for your currency exchange or money remittance business in Spain

The case, in five lines

What is brought

Design, filing and defence of the anti-money laundering system on which SEPBLAC (Spain's financial intelligence unit) reports before the Banco de España (Spain's central bank) authorises a bureau de change (articles 3.1 and 4.2.d of Royal Decree 2660/1998) or a payment institution (article 11.2 of Royal Decree-Law 19/2018): risk assessment, manual, bodies, representative and training. Answering the requests for information that arise from its objections and, if authorisation is refused, a recurso de alzada (administrative appeal) to the Minister for the Economy and a judicial review claim. Once authorised, keeping the system running: reports to SEPBLAC, external review and adaptation to legal reforms.

Before which court

The Banco de España grants authorisation after a report from SEPBLAC, which assesses whether the internal control measures are adequate (article 45.4.i of Law 10/2010); a small payment institution under the exemption regime is not subject to that report, but must describe its system. Afterwards, SEPBLAC supervises and inspects (article 47). A refusal by the Banco de España is appealed by recurso de alzada to the Minister for the Economy (today the Ministerio de Economía, Comercio y Empresa, the Ministry of Economy, Trade and Business) and, against the Minister's decision, before the Audiencia Nacional (National High Court), without the prior attempt at negotiation under article 5 of Organic Law 1/2025, which applies only in civil and commercial matters.

Deadline

Bureau de change: three months from receipt of the application, with silence deemed a refusal (article 3.2 of Royal Decree 2660/1998); payment institution: three months from receipt or from the date the documentation is complete (article 11.2 of Royal Decree-Law 19/2018). Waiting for SEPBLAC's report may suspend the time limit by up to three months (article 22.1.d of Law 39/2015, the Administrative Procedure Act, LPAC). Administrative appeal: one month from notification of the refusal; judicial review: two months (article 46.1 of the LJCA, the Contentious-Administrative Jurisdiction Act). Once operating: systematic reporting every month, an external review every year and, for a small bureau de change, nine months from 28 October 2026 to notify its representative.

Who can bring it

The obliged entities are anyone who carries on currency exchange on a professional basis (letter i of article 2.1 of Law 10/2010), even without authorisation, and payment institutions and small payment institutions that provide money remittance (letter h). An agent is not a category of its own: the institution answers for whatever is done through the agent (article 2.2). The policies are approved by the management body (article 31.2 of Royal Decree 304/2014); the applicant company, whether still in formation or already incorporated, applies for authorisation and brings any appeal.

Financial risk

Internal controls that do not pass SEPBLAC's report lead to requests for information and, if not corrected, to refusal after a hearing: article 4.2.d of Royal Decree 2660/1998 requires them both to obtain and to keep the authorisation. Once authorised, serious infringements (identification, enhanced due diligence, systematic reporting, internal control, external review or training) carry fines from 60,000 euros and very serious ones from 150,000, with possible suspension or withdrawal of the authorisation (articles 52, 56 and 57 of Law 10/2010).

First, which kind of obliged entity you are and which exemption you do not have

Law 10/2010 (Spain's anti-money laundering law) applies to you even before you hold an authorisation. Anyone who carries on currency exchange on a professional basis is an obliged entity under letter i) of article 2.1, and the Law treats them as a financial institution (article 2.4); payment institutions, electronic money institutions and small payment institutions under the exemption regime are obliged entities under letter h). An agent of a payment institution is not a category of its own: the institution answers for whatever is done through the agent (article 2.2) and must ensure that the agent complies (article 37 of Royal Decree 304/2014).

The letter determines the size of the system. Article 31.1 of Royal Decree 304/2014 exempts obliged entities under letters i) to u) that, counting agents, employ fewer than ten people and do not exceed 2 million euros in turnover or balance sheet, unless they belong to a larger group: they are exempt from the manual, the regulatory risk assessment, the external review and the training plan (articles 32, 33, 38 and 39). They are not exempt from the prior written risk analysis required by article 7.1 of the Law, from customer due diligence or from reporting. Payment institutions and small payment institutions fall under letter h): they have neither that exemption nor the one relating to the internal control body (article 35.2).

There are two areas with no published guidance. Whether a small bureau de change that both buys and sells banknotes can rely on the exemption is unresolved, because article 4.2.d of Royal Decree 2660/1998 requires it, as a condition of authorisation, to have procedures and bodies in line with articles 31 to 40: in the application we present the full system. Nor does any official source say whether a hotel or shop that only buys banknotes as a sideline bears every obligation under letter i). Which authorisation each business needs is explained in our cases on opening a bureau de change and on setting up a money remittance business.

What SEPBLAC reports on before the Banco de España authorises you

The Banco de España authorises a bureau de change after a report from SEPBLAC (article 3.1 of Royal Decree 2660/1998), and the same applies to a payment institution (article 11.2 of Royal Decree-Law 19/2018). The report addresses whether the internal control measures set out in the programme of operations are adequate (article 45.4.i of Law 10/2010). Registration of a small payment institution, which is deemed to take place after twenty days, is not preceded by that report, but the Banco de España's guide requires it to describe its anti-money laundering mechanisms, procedures and bodies, and SEPBLAC will supervise it afterwards.

The rule says 'after a report' and does not describe it as binding; what requires a refusal is failing to meet the internal control requirement (article 4.2.d of Royal Decree 2660/1998). In practice, a report with objections arrives as a request for information from the Banco de España and, if the defects are not remedied, refusal follows after a hearing. Waiting for the report may suspend the time limit for a decision by up to three months (article 22.1.d of Law 39/2015, the Administrative Procedure Act, LPAC), and a bureau de change has only three months from receipt before silence is deemed a refusal (article 3.2). How to answer a request for information or challenge a refusal is covered in the case devoted to that.

What stalls applications most is a manual that does not fit the business. In its recommendations on internal control, SEPBLAC asks for procedures fully tailored to the obliged entity's activity, and the Banco de España refers to them in its list of documents for currency exchange applications. A manual written for a bank, which says nothing about tourists' cash, the destination countries of the remittances or the agent network, contradicts the business plan filed in the same application. And the manual must be filed in Spanish, like the application and the articles of association (Banco de España guide for payment institutions, section 1.5).

Risk assessment, manual, bodies and representative: what has to be in writing

The system starts with a documented risk assessment covering types of customers, countries, products, services, transactions and channels (article 32 of Royal Decree 304/2014). From 28 October 2026 it must take into account, at a minimum, the national and supranational risk assessments and the information on evasion of international financial sanctions, and the policies must cover the application of those sanctions and countermeasures (articles 32.1 and 31.1). The assessment feeds the manual under article 33: customer acceptance, due diligence, a list of high-risk transactions, alerts, special review, bodies, training, agents and record-keeping and, from that date, a structured procedure on sanctions (letter o).

The representative before SEPBLAC must reside in Spain and hold a management or executive position in the company (article 26 ter.1 of Law 10/2010): a cashier, however experienced, cannot be the representative, nor can a partner who lives outside Spain. The appointment is proposed with a description of the person's career, and SEPBLAC may raise objections (article 26 ter.2); from 28 October 2026 this is done by a responsible declaration (declaración responsable) signed by the obliged entity, which keeps the supporting documents (article 35.1 of Royal Decree 304/2014). Until now a small bureau de change was exempt from appointing one; the reform removes that exemption and gives it nine months, until 28 July 2027, to notify the appointment. Failing to notify the proposal is a serious infringement (article 52.1.n).

The internal control body meets and keeps minutes (article 26 ter.4), operates separately from internal audit (article 26 ter.6) and approves the annual training plan (article 29). A payment institution always needs one; a bureau de change with fewer than 50 people and up to 10 million euros may entrust its functions to the representative (article 35.2 of Royal Decree 304/2014), and an entity without a training plan must show that the representative has received adequate external training (article 39.4). What almost nobody plans for: above 10,000 transactions a year, alerts must be automated (article 23), and there must be an internal channel through which employees and agents can report breaches, including anonymously (article 26 bis of Law 10/2010).

Identify and enhance: the thresholds for currency exchange and money remittance

Anyone carrying out an occasional transaction of 1,000 euros or more must be identified with a reliable document; in money remittance and transfer services, in every case, whatever the amount (article 4.1 of Royal Decree 304/2014), a rule kept in the wording in force from 28 October 2026. The beneficial owner is identified before a business relationship begins, before a transfer of more than 1,000 euros or before any other occasional transaction of more than 15,000 (article 9.1). Order EHA/2619/2006, which remains in force insofar as it does not conflict with the Royal Decree, also requires a slip signed by the customer and by the employee or agent, with the customer's identity, the amount, the country and the purpose (article 3.3).

Enhanced due diligence is mandatory for money remittance above 3,000 euros and for currency exchange above 6,000, per transaction or aggregated over the calendar quarter (article 19.2.b and c): adding up each customer's quarter is what exposes structuring. The declared activity and the beneficial owner are always checked and, depending on the risk, so are the source of funds or of wealth, the purpose of the transaction or senior management approval (article 20.1). High-risk countries and those flagged by the FATF (Financial Action Task Force) also require enhanced measures (article 19.2.e). Below the thresholds, your risk assessment governs, not the figure.

If you cannot apply customer due diligence, you do not carry out the transaction and you conduct the special review (article 7.3 of Law 10/2010); a transaction the customer refused to document is recorded as not executed and included in the monthly report (article 3.4 of the Order). For remote customers, from 28 October 2026 a secure procedure that meets the general authorisations published by SEPBLAC is enough, without prior authorisation of each procedure, and copies of the documents must be obtained within one month (article 21.1.d of Royal Decree 304/2014).

Special review, suspicious transaction reports and what is reported every month

Any complex or unusual transaction, or one with no apparent economic or lawful purpose, is examined whatever its amount, and the outcome is recorded in writing (article 17 of Law 10/2010). The review is structured, documenting its stages, steps taken and sources; the representative decides with reasons, it is entered in a chronological register and the file is kept for ten years (article 25 of Royal Decree 304/2014). If there is an indication or certainty of laundering, it is reported to SEPBLAC without delay, even a mere attempt (article 18), and the transaction is not carried out unless refraining is impossible or would hinder the investigation (article 19). In money remittance, several senders or beneficiaries with no apparent connection are an indicator (article 24 of Royal Decree 304/2014).

None of this is disclosed to the customer: telling them that their transaction is being examined or has been reported is prohibited (article 24 of Law 10/2010). Separately, every month SEPBLAC receives, with no need for suspicion, reports of physical movements of cash or bearer instruments above 30,000 euros, of those above 1,500 in money remittance and aggregated remittance data by country and by agent; if there is nothing to report, a nil return every six months (article 27 of Royal Decree 304/2014). Neither bureaux de change nor payment institutions are exempt (article 27.3).

Everything is kept for ten years; once five years have passed since the transaction, only internal control and whoever handles the legal defence have access (article 25 of Law 10/2010). The six years in Order EHA/2619/2006 no longer apply. For transfers, Regulation (EU) 2023/1113 requires them to carry the payer's name, account number or a unique transaction identifier, address and identity document number or, instead, date and place of birth, together with the payee's name and account, verified before sending (article 4); for transfers of 1,000 euros or less leaving the EU, the payer's and payee's names and accounts, or the unique transaction identifier, are enough, and verification is required only if the funds are received in cash or there is suspicion (articles 5.3 and 6.2), which for cash remittances means always.

External review, agents, cash and what arrives in July 2027

The external review is annual and is carried out by an external expert, because the law requires it: it describes the internal controls, assesses their effectiveness and proposes improvements; in the following two years it may be replaced by a follow-up report, and it is submitted to the management body within three months (article 28 of Law 10/2010). It is issued within two months of the reference date and, if deficiencies cannot be fixed at once, the management body adopts a remediation plan which, as a rule, does not exceed one year (article 38 of Royal Decree 304/2014). It binds payment institutions and small payment institutions, except a small payment institution that is a sole trader (article 28.4 of Law 10/2010); a small bureau de change is exempt. What nobody tells you: it cannot be done by an individual who has provided you with other paid services in the three years before or after (article 28.2), so the individual who drafted your manual cannot review it.

In money remittance with an agent network, the institution tells the Banco de España how each agent will control money laundering, and the agent may not operate until it is registered, which the Banco de España decides within two months (article 23 of Royal Decree-Law 19/2018). The manual sets the criteria for hiring agents (article 33.1.k of Royal Decree 304/2014), new agents' activity is subject to enhanced monitoring, and an agent that breaches the procedures seriously or systematically must have its contract terminated (article 37). A bureau de change, by contrast, cannot entrust the buying and selling of banknotes to agents. And the 1,000 euro cash payment limit in Law 7/2012 does not apply to its currency exchange or to transactions through payment institutions, provided they are supervised by the Banco de España and subject to this legislation (article 7.Uno.5).

From 10 July 2027 Regulation (EU) 2024/1624 (the AMLR) applies: it expressly names currency exchange offices as obliged financial institutions, requires due diligence on every occasional transfer of 1,000 euros or more (article 19.2) and sets an EU cash limit of 10,000 euros that Spain may keep lower (article 80). Until then Law 10/2010 and Royal Decree 304/2014 govern, and the manual will need two reviews: now, for Royal Decree 813/2026, and before July 2027. If you are already facing a SEPBLAC inspection or sanctioning proceedings, which are investigated by the Secretariat of the Commission for the Prevention of Money Laundering, we cover your defence in its own case; and if your bank closes your account because of the risk of your business, that has its own case too.

How we run the case, step by step

1. 1

   We classify your business and your category of obliged entity

   Cash exchange, money remittance, agents, headcount and group: these decide whether any exemption applies and whether you need an internal control body and an external review.

2. 2

   We carry out the risk assessment with your figures

   The customers, countries, products, channels and volumes in your business plan, with the national and supranational risk assessments and the international sanctions required by Royal Decree 813/2026.

3. 3

   We draft the manual and design the bodies

   A manual in Spanish tailored to your operations: customer acceptance, thresholds, alerts, special review, sanctions, training and agents. Your management body approves it.

4. 4

   We prepare the appointment of the representative

   We check residence and position, draft the responsible declaration and the career summary and train the representative to decide on reports to SEPBLAC.

5. 5

   We handle the application before the Banco de España

   We file as representatives under a power of attorney, without using your digital certificate, and answer the requests for information arising from SEPBLAC's objections, identifying every change.

6. 6

   We keep the system running and defend it

   A calendar of monthly and six-monthly reports, coordination of the external review that the law entrusts to an independent expert, adaptation to the 2027 EU Regulation and, if authorisation is refused, an administrative appeal and judicial review before the Audiencia Nacional.

The law that applies

• Arts. 2, 7, 17 a 20 y 24 a 29 Ley 10/2010. Obliged entities (letter h, payment institutions and small payment institutions; letter i, currency exchange); written risk analysis; special review, suspicious transaction reporting, refraining from execution and systematic reporting; prohibition of disclosure; ten-year record-keeping; a resident representative in a management position; annual external review and training. BOE-A-2010-6737
• Arts. 4, 9, 19, 20, 21 y 27 RD 304/2014. Identification from 1,000 euros and always in money remittance; beneficial ownership; enhanced due diligence above 3,000 euros in remittances and 6,000 in currency exchange, per transaction or per quarter; non-face-to-face identification; monthly reporting to SEPBLAC and six-monthly nil returns. BOE-A-2014-4742
• Arts. 31 a 39 RD 304/2014, en la redacción del RD 813/2026. Policies covering international financial sanctions, risk assessment, manual, bodies and a representative appointed by responsible declaration; exemption for letters i) to u) with fewer than ten people and up to 2 million euros, which from 28-10-2026 no longer covers the representative; external review and training. BOE-A-2014-4742
• Arts. 3 y 4 RD 2660/1998. The Banco de España authorises a bureau de change after a report from SEPBLAC, within three months, with silence deemed a refusal and an administrative appeal against refusal; a buying-and-selling bureau needs internal controls under articles 31 to 40 of Royal Decree 304/2014 to obtain and keep its authorisation. BOE-A-1998-28816
• Arts. 11 y 23 RDL 19/2018. A payment institution is authorised after a report from SEPBLAC; notification of each agent describes its anti-money laundering controls, and the agent may not operate until registered, which the Banco de España decides within two months. BOE-A-2018-16036
• Arts. 1 a 3 Orden EHA/2619/2006. In force, insofar as it does not conflict with Royal Decree 304/2014, for currency exchange and transfers not debited to an account: a signed slip with minimum content and non-executed transactions included in the monthly report; its six-year retention period gives way to the Law's ten years. BOE-A-2006-14513
• Arts. 4 a 7 Reglamento (UE) 2023/1113. Transfers must carry the payer's and payee's information, verified before sending; for transfers of 1,000 euros or less, only where funds are received or paid out in cash or there is suspicion. 32023R1113
• Arts. 19 y 80 Reglamento (UE) 2024/1624 (AMLR). Applicable from 10-7-2027: due diligence on occasional transfers from 1,000 euros for financial institutions and an EU cash limit of 10,000 euros, with lower national limits allowed. 32024R1624

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions