The Spanish Official State Gazette of 8 October carried a royal decree with an unpromising title: Royal Decree 813/2026, "amending various royal decrees in the financial sector to adapt them to the current regulatory framework". Skim it and you would think of technical tweaks for banks. But its fifth article reforms Spain's anti-money laundering regulation (the one approved by Royal Decree 304/2014), and some of the changes reach much smaller businesses.
It comes into force on 28 October 2026.
There is a reason for the hurry. Spain is being evaluated this year by the FATF, the international body that periodically reviews how each country prevents money laundering, and in 2024 the European Union adopted a package of rules that will change much of the system from July 2027. The Government has brought forward by regulation what it could, including part of Directive (EU) 2024/1640. The rest will follow.
Small businesses must appoint a representative before SEPBLAC
For many of our clients, this is the change that matters.
Spanish Law 10/2010 places anti-money laundering duties on a long list of professions and businesses. The regulation has always treated the small ones more gently: if they employ fewer than ten people, agents included, and neither their turnover nor their balance sheet exceeds two million euros, they are spared almost all of the internal control machinery. No written policies, no documented risk assessment, no manual, no external expert review, no training plan. And until now, no obligation to appoint a representative before SEPBLAC, the Spanish financial intelligence unit, which receives suspicious transaction reports and supervises obliged entities.
That last exemption ends. The new Article 31.1 keeps the others but no longer lists Article 35 among them. From now on, small businesses must appoint a representative too.
Who is on that list? The obliged entities in letters i) to u) of Article 2.1 of the Law. In practice, among others:
- lawyers and court representatives, when they act for a client in buying or selling property or businesses, managing money or securities, opening accounts, setting up or running companies, or in financial or property transactions;
- auditors, external accountants and tax advisers;
- property developers and estate agents, including lettings when the rent reaches the statutory thresholds;
- those who form companies for others, act as directors or company secretaries on their behalf, or provide them with a registered office;
- jewellers, art and antique dealers, credit intermediaries, gambling operators and a few more.
There is time: nine months from entry into force, that is, until 28 July 2027, to notify the appointment.
Take a four-person tax advisory firm in Benidorm. Until now it had nobody designated before SEPBLAC. Before that date it will have to choose someone, file a responsible declaration (declaración responsable) stating that this person meets the requirements of the Law and the regulation, and keep the supporting documents in case SEPBLAC asks for them. That person will be responsible for the reporting obligations towards SEPBLAC: the one who files a suspicious transaction report if it comes to that, and the one who answers requests. They can rely on up to two authorised persons, or three if the business belongs to a group.
It is more than a form. Whoever is chosen should know what they are taking on.
Financial sanctions become part of the procedures
The second block reaches further than it seems. Until now the regulation spoke mainly of money laundering and terrorist financing. It now expressly brings in international financial sanctions and countermeasures: the lists of people and entities whose funds must be frozen by decision of the European Union, the United Nations or the Spanish Council of Ministers.
For those who must have an AML manual, that means three things. The written policies must also cover the application of sanctions. The manual must include a structured procedure for applying them (new letter o of Article 33.1). And the risk assessment must take into account, at a minimum, the national risk assessment, the EU one, sectoral assessments and what the authorities say about the risk of sanctions being breached or evaded.
The small business that remains exempt from the manual is not entirely off the hook. The asset freeze under Article 48 binds any person, natural or legal, and applies immediately once the EU regulation or the Council of Ministers decision takes effect. Obliged entities must report it in writing, also immediately, to the Directorate General of the Treasury and Financial Policy.
If you work with clients or companies outside the EU and do not check their names against sanctions lists, that is the first gap we would close.
Changes in customer identification
Here the reform touches several fronts at once, some of them very sector-specific.
At notaries, the exclusion for acts with no economic content (former Article 3.2) disappears and, except for the acts in Article 163 of the Notarial Regulation, identity must be established and verified in every transaction before a notary. The same goes for crypto-asset ATMs: identification always, as was already the case for money remittances.
The digital version of the Spanish ID card (DNI) is accepted as an identity document, and information obtained through electronic identification must be kept for ten years, like everything else. But there is no rush: these two changes do not apply on 28 October but eighteen months after the decree was published, and a ministerial order must first set out the technical means.
One small change in wording matters in practice. The Law sometimes allows a client's identity to be fully verified after the relationship has begun. If that verification is never completed, the new Article 12.2 requires the business to review the situation and decide whether to report it to SEPBLAC as a suspicious transaction. It will not always be necessary, but the decision has to be taken, and it is wise to put it in writing.
Remote identification changes too. The regulation allowed "other secure procedures" if SEPBLAC had authorised them in advance. The new wording refers instead to the minimum requirements in the general authorisations that SEPBLAC itself publishes. If you onboard clients by video call or through a third-party tool, check that your system fits them.
Finally, online gambling. Operators must check that the holder of the card or account used to pay in and withdraw money is the same as the holder of the gambling account. Players already registered have six months to comply; meanwhile they can keep playing and paying in, but cannot collect winnings. If verification has not been possible by the end of that period, the operator must terminate the contract, return the balance and notify the Directorate General for Gambling Regulation.
Foundations and associations: less paperwork for most
Here the reform goes the other way. Until now, every foundation or association had to identify all the beneficiaries of its funds and every donor giving 100 euros or more, even the local residents' association.
The new Article 42 follows a risk-based approach. The duty to record and keep donor and beneficiary data is reserved for entities that a sectoral assessment (still to be approved by the Prevention Commission) considers above medium risk, and for those working in countries at risk of terrorist financing. Even then, only for transactions above 1,000 euros that do not go through a bank or another obliged entity. The rest will keep their records under their own accounting rules.
All of them, however, must watch who sits on their governing bodies: people convicted of certain offences should not hold those positions (or, if they do, the risk must be controlled), and the entity may ask them for a criminal record certificate. They must also cooperate with the Commission, report suspicions through SEPBLAC's channels and, where possible, make sure money goes through the banking system.
One detail many small entities will welcome: banks will have to assess the risk of their foundation and association clients and, if they turn them away, put the reason in writing. It responds to a well-known problem, non-profits refused an account out of sheer caution.
Changes inside the administration
The rest of the fifth article looks inwards. The Director of SEPBLAC will have a six-year term, with no renewal and closed grounds for removal. The Financial Intelligence Committee is regulated and will coordinate a national risk assessment to be updated at least every four years. The statistics to be published and the content of SEPBLAC's annual report are set out, and officers from the regional police forces, staff from other ministries and personnel of the National Intelligence Centre may join it.
Of all this, one sentence in the new Article 67 bis matters to obliged entities. SEPBLAC must make available to them the risk assessments, guidance from the new European authority and information on sanctioned persons, but that does not relieve them of the duty to know and apply that information from the moment it is published. In other words, you cannot wait for it to be sent to you.
Dates worth noting
- 28 October 2026: the reform comes into force.
- 28 April 2027: the six-month adaptation period for online gambling ends.
- 10 July 2027: Regulation (EU) 2024/1624 starts to apply, and the general deadline to transpose the rest of Directive (EU) 2024/1640 expires.
- 28 July 2027: last day for small obliged entities to notify their representative.
- 8 April 2028: the rules on the digital ID card and electronic identification apply.
What we would do in your place
If you are a law firm, an accountancy, an estate agency or a company service provider, and you are small, start with the representative. Choose the person, check that they meet the requirements, prepare the responsible declaration with its supporting documents and file it calmly, without waiting for July.
Then, whatever your size, review how you check sanctions lists. If you already have an AML manual, update it with the sanctions procedure, the new sources for the risk assessment, what to do when a client's identification is not completed and, if you work remotely, how your system fits SEPBLAC's authorisations.
And if you run or advise a foundation or association, keep an eye on the sectoral assessment: whether your obligations become lighter depends on it.
Full transposition of the European rules must arrive before July 2027 and will bring more changes. This royal decree is the first piece, but some of its deadlines are already running.
Sources
- Royal Decree 813/2026 of 7 October, amending various royal decrees in the financial sector (BOE of 8 October 2026, BOE-A-2026-20915), fifth article and transitional provisions.
- Regulation implementing Law 10/2010, approved by Royal Decree 304/2014 of 5 May, Articles 3, 4, 6, 12, 21, 28, 31 to 35, 42, 48 and 67 bis, before and after the reform.
- Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing, Article 2.1.
- Regulation (EU) 2024/1624, Article 90, and Directive (EU) 2024/1640, Article 78.
This article contains general information for informative purposes and does not constitute legal advice or an investment recommendation. The rules cited may have been amended after publication; always check the text in force before taking a decision.