AML fine in Spain or SEPBLAC inspection: how to defend yourself

The case, in five lines

What is brought

Defence in sanctioning proceedings under Law 10/2010 (the Spanish Anti-Money Laundering Act): answers during the inspection, submissions in response to the opening decision (acuerdo de incoación) and the proposed decision, and evidence. Against the penalty, a request for reconsideration (recurso de reposición) or an appeal to the superior body (recurso de alzada), depending on who imposed it, and a judicial review claim with an application for interim suspension. Separately, complying with or contesting any remedial orders from the Comité Permanente (the Standing Committee).

Before which court

Inspections are carried out by the SEPBLAC or, under a cooperation agreement, by the financial supervisor. Proceedings are opened by the Comité Permanente (Standing Committee) and investigated by the Secretariat of the Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias (the Commission for the Prevention of Money Laundering and Monetary Offences), under article 61 of Law 10/2010. Penalties are imposed by the Consejo de Ministros (the Council of Ministers) for very serious infringements, the Minister for the Economy for serious ones and the Director General of the Treasury for minor ones. Review lies with the Tribunal Supremo (the Supreme Court) (article 12.1.a LJCA, the Judicial Review Act), the Audiencia Nacional (the National High Court) (article 11.1.a) or the contentious-administrative section of the Tribunal Central de Instancia (the central first-instance court) (article 9.1.b), with no need for the pre-action negotiation attempt required by article 5 of Organic Law 1/2025, which applies only in civil cases.

Deadline

The proceedings lapse if no decision is notified within one year of notice of the opening decision, extendable by six months (article 61.4 of Law 10/2010). Against the penalty, one month for reconsideration or the appeal to the superior body and two for judicial review, from the day after notification (article 46 LJCA), both strict time bars. Serious and very serious infringements are time-barred after five years and minor ones after two; for due diligence failures, the period runs from the end of the business relationship, and the inspection interrupts it (article 60).

Who can bring it

The parties are the inspected obliged entity (article 2 of Law 10/2010) and each director or senior manager charged with intent or negligence (article 54), as well as the external expert where a serious infringement is charged (article 57.2). Each makes their own submissions and brings their own challenge against the Administración General del Estado (the Spanish central government).

Financial risk

Very serious: fines from 150,000 euros up to the highest of 10% of turnover, twice the value of the transaction, five times the profit or 10 million euros, with a public reprimand or the suspension or withdrawal of the authorisation, and 60,000 to 10 million euros and, where appropriate, disqualification for directors. Serious: from 60,000 euros, with a reprimand or suspension, and 3,000 to 5 million for directors (articles 56 and 57). Losing the judicial review claim usually means an adverse costs order.

What the SEPBLAC inspects: the manual matters less than how you apply it

The SEPBLAC (Servicio Ejecutivo de la Comisión), Spain's financial intelligence unit and anti-money laundering supervisor, may inspect any obliged entity listed in article 2 of Law 10/2010: banks, payment and e-money institutions, investment firms, fund managers, life insurers, crypto-asset platforms and custodians, estate agents, tax advisers or notaries. It follows a confidential, risk-based annual plan (articles 44.2.g and 47).

An inspection usually starts with a request for documents and continues with on-site visits, interviews and a sample of files. The inspectors review the manual (article 26.5), the risk assessment, identification, beneficial ownership and monitoring (articles 3 to 7), special review and suspicious transaction reporting (articles 17 and 18), internal control, training, the external expert (article 28) and international financial sanctions (article 42, amended in March 2026).

What gets penalised is rarely the manual itself but the gap between what it says and what is actually done. Article 7.1 requires you to be able to demonstrate, through a prior written risk assessment, that your measures are adequate. And a small non-financial obliged entity, with fewer than ten staff and turnover or a balance sheet of up to two million euros, is exempt from having a manual (article 31 of Royal Decree 304/2014), but not from that assessment or from customer due diligence.

During the inspection: cooperate without handing over the case against you

If a request is not answered on time, or is answered only in part, the duty to cooperate is deemed breached (article 21.1): a serious infringement if the written request comes from the SEPBLAC or the Secretariat, and a very serious one if it comes from the Commission (articles 52.1.k and 51.1.b). Obstructing the inspection is also punishable (articles 51.1.d and 52.1.y). Any extension must be requested in writing before the deadline expires.

What the inspector does not see does not exist. If the beneficial owner or the source of funds is recorded in another system, it is produced during the inspection with an index linking each finding to its evidence: the inspection report will be the foundation of the proceedings. Never create records after the fact or backdate them; remediation carries its real date, and when reviewing clients you must not tip them off that their transaction is being examined or has been reported (article 24).

If the review uncovers a transaction that should have been reported, it is examined and reported now: reporting late is a breach, but silence is worse, and remedying the breach on your own initiative mitigates the fine (article 59.1.c). Keep the criminal risk in view: the SEPBLAC refers any indications of a criminal offence to the public prosecutor and the courts (article 45.4.b), and money laundering through gross negligence is also a criminal offence. Every answer is prepared with both sets of proceedings in mind.

From report to proceedings: remedial orders, the opening decision and one year to decide

On the basis of the SEPBLAC's report, the Comité Permanente (Standing Committee) may issue orders requiring corrective measures (articles 26.6 and 44.2.h) and, on a proposal from the Commission's Secretariat, open proceedings (article 61.1), which the Secretariat then investigates. A remedial order does not spare you a penalty, and ignoring it is a further infringement: serious, or very serious where there is a deliberate refusal to comply (articles 52.1.w and 51.1.e).

The opening decision sets out the facts alleged, their provisional legal classification, the possible penalties and the investigating officer (article 64.2 LPAC, the Administrative Procedure Act). You must respond: if you do not, and the decision specifies your liability, it may stand as the proposed decision (article 64.2.f). And if your entity needs an authorisation to operate, a report from its supervisor on its stability must be obtained before a serious or very serious penalty is imposed (article 61.3): if it is missing, that is a ground of challenge.

The decision must be made and notified within one year of notice of the opening decision, subject to the suspensions provided by law and a reasoned six-month extension (article 61.4). Once that period expires, the proceedings lapse and do not interrupt the limitation period (article 95.3 LPAC), but new proceedings must be opened as long as the infringement is not time-barred. And there lies the trap: for due diligence failures, the five years run from the end of the client relationship, and the inspection interrupts them (article 60.1).

The defence on the merits: the sample, fault and the number of charges

The provision with the biggest financial impact is the least read. Under article 52.2, failures in identification, beneficial ownership, the purpose of the relationship, monitoring, existing clients, enhanced due diligence and record-keeping may be minor if they are merely occasional or isolated 'in view of the percentage of exceptions in the compliance sample', unless there are indications or certainty of money laundering. It means going from a fine of at least 60,000 euros plus a reprimand to one of up to 60,000 or a private reprimand.

That is why the sample is contested like expert evidence: how it was selected, since a sample targeted at high-risk clients does not measure overall compliance; which population it came from; what was counted as an exception; and whether a file was counted twice. Each file is rebuilt with what existed on the date of the facts: if the information was there, the exception falls away. Where the percentage decides the classification, the firm works with an expert statistician.

The entity is liable 'even for mere non-observance' (article 54), but penalties may only be imposed for intent or fault (article 28 of Law 40/2015): the Tribunal Supremo has held that there is no strict liability, although it expects more care from a professional. Offences cannot be extended by analogy (article 27.4): the very serious infringement in article 51.1.a requires a senior manager or employee to have raised indications internally, and a closed automated alert is not, in itself, such a report. Where one failing necessarily entails another infringement, only the more serious is punished (article 29.5).

The penalty: what it costs, what happens to your licence and the discount

Very serious infringements carry fines from 150,000 euros up to the highest of 10% of annual turnover, twice the value of the transaction, five times the profit or 10 million euros, with a public reprimand or the suspension or withdrawal of the authorisation (article 56); serious ones, from 60,000 euros up to 10% or 5 million, among other figures, with a reprimand or suspension (article 57); minor ones, a private reprimand or up to 60,000 euros.

The amount depends on the size of the transactions, profits, remedying the breach on your own initiative, previous penalties, intent and cooperation, among other criteria (article 59.1): a remediation plan approved by the board and delivered on dated milestones is the best argument. And the penalty is visible: a final public reprimand is published in the BOE (the Official State Gazette) and stays on the Commission's website for five years (article 61.5), and the European Banking Authority is notified of those imposed on financial institutions (article 61.7).

The discount in article 85 of Law 39/2015, at least 20% for admitting liability and a further 20% for paying, is designed for purely financial penalties, and for serious and very serious infringements under Law 10/2010 the fine always comes with a reprimand or a suspension. If it is offered, it requires you to waive any administrative appeal and leaves a final penalty which, like any other, turns the next serious infringement of the same type into a very serious one for five years (article 51.1.f).

Directors, senior managers and the external expert: each needs their own defence

Those holding management or senior executive positions are also liable if the infringement results from their intent or negligence (article 54). For very serious infringements, each may be fined 60,000 to 10 million euros and, where appropriate, removed with disqualification for up to ten years (article 56.3); for serious ones, 3,000 to 5 million euros and, where appropriate, disqualification for up to five years, a regime that reaches the external expert too (article 57.2).

The company's best defence, blaming the failure on an individual, may be the worst for that individual, and the designated representative to the SEPBLAC and the head of compliance are often in the firing line. Each director makes their own submissions and brings their own challenge. Their best evidence is the minutes: what resources the board approved, what reports it received from internal control and from the external expert, whose report goes to the board within three months (article 28.1), and what it decided.

For a foreign founder or director, the penalty does not stay in Spain: a disqualification or a personal fine weighs on any fit and proper assessment, in Spain or in another Member State. Check your directors and officers (D&O) policy today: it usually covers defence costs if the proceedings are notified to the insurer in time, although cover for the fine itself is debatable. And if the reform adapting Spanish law to the new EU AML package is more favourable, it will apply to you (article 26.2 of Law 40/2015).

Challenging the penalty: where, when and without it being enforced

A very serious penalty, imposed by the Consejo de Ministros (the Council of Ministers), allows optional reconsideration within one month (article 124 LPAC) or a claim before the Tribunal Supremo (the Supreme Court) (article 12.1.a LJCA); a serious one, from the Minister for the Economy, reconsideration or the Audiencia Nacional (the National High Court) (article 11.1.a); a minor one, from the Director General of the Treasury, an appeal to the superior body within one month (article 122 LPAC) and then the contentious-administrative section of the Tribunal Central de Instancia (the central first-instance court) (article 9.1.b). Judicial review must be sought within two months from the day after notification (article 46 LJCA).

The fine is not enforceable while an ordinary administrative appeal remains available (article 90.3 LPAC). After that, the authority may keep it suspended if you give notice that you will bring a judicial review claim, but the suspension falls away unless you apply for it in the document initiating that claim. A public reprimand is published once it is administratively final, with a note of the appeal (article 61.5): that is harm a late judgment cannot undo, which is why the court is asked to stay it (articles 129 and 130 LJCA).

Before the court, cases are won on the file: what was produced during the inspection and in the submissions, and the expert evidence on the sample. The court reviews the facts, the classification, fault and proportionality, and may annul or reduce the penalty; if you lose, an adverse costs order is the norm. The pre-action negotiation attempt under Organic Law 1/2025 (article 5) is required only in civil proceedings: in a claim against the consultant behind the manual or the provider of a defective alert system, before the civil section of the Tribunal de Instancia (the first-instance court).

How we run the case, step by step

1. 1

   We map deadlines and risks on day one

   We date every request and notification, calculate the lapse date (article 61.4) and the limitation period for each infringement (article 60), and assess the criminal risk before anything is put in writing.

2. 2

   We prepare for the inspection as if for trial

   We answer on time and in writing, request extensions in writing, prepare the interviews and deliver an index linking each finding to its evidence.

3. 3

   We remediate on the record, with dates

   The board approves a plan with owners and deadlines: client file look-back, risk assessment, manual, alerts and training. If a client does not provide what is missing, the relationship is terminated after a special review and without tipping the client off (articles 7.3 and 24).

4. 4

   We answer the opening decision point by point

   With an expert, we challenge the sample and the classification (article 52.2), as well as the definition of the offence, fault, the stacking of charges, limitation and the supervisor's report (article 61.3).

5. 5

   We answer the proposed decision and watch the clock

   We respond to the proposed decision, check every suspension of the time limit and, if the authority intends to reclassify the infringement as more serious, make submissions within the fifteen days allowed by article 90.2 LPAC.

6. 6

   We challenge the penalty and seek a stay

   We choose between reconsideration and judicial review, file on time before the competent authority or court and apply in the same filing for suspension of the fine and of its publication.

The law that applies

• Arts. 7, 21 y 26 de la Ley 10/2010. The obliged entity must be able to demonstrate through a written risk assessment that its due diligence is adequate, answer requests from the Commission and its supporting bodies fully and on time, and keep an up-to-date manual. BOE-A-2010-6737
• Arts. 31, 32 y 33 del Real Decreto 304/2014. The risk assessment, documented and reviewed periodically, covers clients, countries, products, services, transactions and channels, and the manual sets the minimum content of internal control; small non-financial obliged entities are exempt. BOE-A-2014-4742
• Arts. 51 y 52 de la Ley 10/2010. They classify as very serious, among others, failing to report what was flagged internally, ignoring a written request from the Commission or obstructing the inspection, and as serious, failures in due diligence, special review or internal control; occasional or isolated due diligence and record-keeping failures may be minor (article 52.2). BOE-A-2010-6737
• Arts. 54, 56, 57 y 59 de la Ley 10/2010. Fines from 150,000 euros for very serious infringements and from 60,000 for serious ones, always with a reprimand or suspension and set according to article 59; directors and senior managers are liable for intent or negligence, with fines and, where appropriate, disqualification. BOE-A-2010-6737
• Arts. 60 y 61 de la Ley 10/2010. A five-year limitation period for serious and very serious infringements and two years for minor ones, for due diligence from the end of the relationship. The Standing Committee opens proceedings, the body competent for the seriousness of the case decides, and proceedings lapse after one year, extendable by six months. BOE-A-2010-6737
• Arts. 26, 27, 28 y 29 de la Ley 40/2015 (LRJSP). A later penalty provision applies if more favourable, offences cannot be extended by analogy, penalties require intent or fault and, where one infringement necessarily results from another, only the penalty for the more serious one is imposed. BOE-A-2015-10566
• Arts. 64, 85, 90 y 95 de la Ley 39/2015 (LPAC). If unanswered, an opening decision that specifies liability may stand as the proposed decision; admitting liability or paying each reduces purely financial penalties by at least 20%, at the cost of waiving administrative appeals; the penalty is not enforceable while an ordinary appeal remains available, and lapsed proceedings do not interrupt the limitation period. BOE-A-2015-10565
• Arts. 9, 11, 12 y 46 de la Ley 29/1998 (LJCA). Acts of the Council of Ministers are challenged before the Tribunal Supremo, those of Ministers before the Audiencia Nacional and fines of up to 60,000 euros imposed by central bodies before the Tribunal Central de Instancia, within two months from the day after notification. BOE-A-1998-16718

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions