KYC requirements in Spain: complying with Ley 10/2010 without losing your mind

Almost no firm breaches Ley 10/2010 out of ignorance. They know the rules. What fails is the calendar: the client signs, the matter starts, the conveyance moves, and three weeks later somebody remembers that the buyer’s passport is missing and so is the beneficial-ownership certificate for the company that will sign the deed. Then the chasing begins. Emails that go unanswered, a WhatsApp with a blurred photo of the wrong side of an ID card, a form that comes back unsigned.

That is where nearly all the pain comes from. And it is also where the only opinion in this article comes from: do the due diligence before the engagement letter, not after. Not out of regulatory purity, but for leverage. A client missing one document before their matter can start sends it that afternoon; a client whose matter is already running sends it when they get round to it.

The rest of this is the procedure. If you want the explanation of what the law requires and why, it is in the article on KYC and anti-money laundering and, at more length, in the guide to complying with Ley 10/2010.

First: decide whether the matter is in scope

Before asking for a single document, answer a binary question: is this instruction on the article 2.1.ñ list? Buying or selling real property or business entities, managing funds or securities, opening or managing accounts, organising contributions to form companies, and creating or running companies, trusts and similar structures. Also when you act on the client’s behalf in financial or real-estate transactions.

If it is not on the list, you are not an obliged entity for that matter. An unfair dismissal, a criminal defence, an opinion on someone’s legal position: out.

Write the answer in the file. One line will do: “Instruction in / out of the scope of art. 2.1.ñ because [reason], [date], [who decided].” That line is what saves you six years later, when nobody remembers why that matter had no KYC folder.

The five questions, with their articles

Customer due diligence is not a form. It is five obligations, each living in its own article. Worth knowing which is which, because a regulator’s request will cite them that way.

Article 3 — Formal identification. Who they are, evidenced by a reliable document, before the relationship begins. Anonymous or fictitiously named accounts are prohibited.

Article 4 — Beneficial owner. Where a legal entity sits behind the client, who ultimately controls it. The reference threshold is more than 25% of the capital or voting rights, directly or indirectly, and also anyone controlling by other means. Verification must happen before the business relationship is established.

Article 5 — Purpose and intended nature. What they are hiring you for and what professional or business activity they carry on. This is not a box: it is the baseline against which you later judge whether a transaction fits.

Article 6 — Ongoing monitoring. The relationship is monitored for as long as it lasts, and the documents are kept current. A passport that expires in 2027 stops evidencing anything.

Article 7 — Risk-based approach. Measures scale with risk — but article 7 also says the opposite of what many people read into it: where indications of money laundering appear, the full set of measures applies, with no scaling down.

What to ask for, by client type

This is the part no manual writes and every firm ends up improvising. Four lists cover 95% of cases.

Spanish individual. Valid DNI or NIE, both sides. Current address. Occupation. Source of funds where the transaction warrants it.

Foreign individual. Valid passport — the full biographic page, legible, not a photo shot at an angle — and, where they reside in Spain, the TIE or registration certificate. An NIE where the transaction requires one. This is where the time goes: a British client, a Moroccan client and an Argentine client bring three different documents in three different formats, and the firm that has not decided in advance what it accepts from each country ends up deciding over WhatsApp, one client at a time.

Spanish company. Deed of incorporation and current articles. CIF. A recent Commercial Registry extract. The director’s identity document and evidence of their appointment. Plus the beneficial-ownership declaration, with an identity document for every owner above 25%.

Foreign company. All of the above, plus the real problem: evidencing the chain of control when a limited sits under a holding company that sits under a trust. Ask for the ownership chart in writing, signed by someone who can answer for it. A beneficial-ownership certificate issued in a country with no equivalent public register is not worth what a Spanish one is worth, and your file should show you knew that.

One operational detail that saves weeks: ask for everything at once, with the specific list and the reason for each document, in the client’s own language. Three emails asking for one document each take a month. One email asking for five takes four days.

When risk goes up: article 14 and non-residents

Article 14 governs politically exposed persons, and enhanced due diligence there means three concrete things: you need senior management authorisation to start or continue the relationship, you must establish the source of wealth and source of funds, and monitoring is intensified. It extends to family members and close associates.

For a firm with international clients, the recurring case is not the PEP but the non-resident, and the point there is to have decided in advance: what extra you ask for, who authorises it, and how often it is reviewed. Enhanced diligence does not mean distrusting anyone. It means having a procedure instead of a different judgement every Tuesday.

What has to be written down, and isn’t

Where a transaction does not fit — an odd price, a structure with no apparent logic, a strange insistence on paying a particular way — article 17 requires a special examination: stop, analyse, and record the analysis and its conclusion in writing. If the examination produces an indication, article 18 requires reporting it to SEPBLAC, and tipping off the client is prohibited.

The usual failure is not skipping the examination. It is doing it in your head and never writing it down. A firm that analysed a transaction, concluded it was ordinary and left no trace has, as far as an inspection is concerned, exactly the same file as one that never looked.

Two paragraphs is enough: what caught your attention, what you checked, what you concluded, who and when.

What the file has to contain

All of the above converges on one folder. If an inspector opened it tomorrow, or a partner who was not there when it was created had to defend it, they would need to find six things and nothing more:

1. The scope decision. The article 2.1.ñ line: in or out, why, when, and who decided.
2. Identification of everyone involved, on a current and legible document (art. 3).
3. Beneficial ownership, with the chain of control where companies are involved, and an identity document for every owner above 25% (art. 4).
4. The client’s purpose and activity, written in their words rather than inferred (art. 5).
5. The screening result for sanctions and PEP status, with the date and what it was screened against. An undated screening evidences nothing; what matters is that it happened first.
6. The special examinations, if any, and the senior authorisation if the client was a PEP or high risk (arts. 14 and 17).

Note what is not on the list: the risk assessment is not a document you file and forget, but the label that decides how often everything else gets revisited (art. 6). A KYC file closed in 2026 and never reopened is an incomplete file by 2029, however well it was built to begin with.

Ten years, and what that actually means

Article 25 sets retention at ten years from the end of the business relationship or the transaction. It also requires that, after five years, the documentation be held with restricted access limited to those with responsibility for prevention.

Ten years is longer than a computer lasts, longer than two office moves, and longer than several rounds of staff turnover. The practical question is not “do I have it?” but “will someone who wasn’t here when it was filed be able to find it?” If the client’s passport lives in the mailbox of a lawyer who left in 2028, the obligation still exists; what no longer exists is the ability to meet it. And keeping records for ten years does not suspend the GDPR: the same file Ley 10/2010 obliges you to retain is subject to the firm’s data protection obligations — restricted access, encryption, and erasure once the period runs out.

And article 26 requires written policies and procedures, training and internal controls, scaled by the implementing regulation — Royal Decree 304/2014 — to the size of the obliged entity. A three-person firm does not need a bank’s manual. It needs its own, short, and it needs to be able to show it applies it.

Which part of this a tool solves

Worth being precise here, because this gets oversold.

A good system solves the logistics: asking each client for the documents that match their nationality, in their own language, keeping the status of every verification visible, screening against sanctions lists at onboarding, and storing the KYC file next to the matter and the client record instead of scattered across three inboxes. In Mandato that sits in every plan, including the cheapest one, because charging extra for compliance struck us as hard to defend.

What no tool does: assess risk for you, decide whether you take the client, write the article 17 special examination, report to SEPBLAC, or draft your article 26 manual. That judgement cannot be delegated and stays with the firm. And documentary identity verification — confirming a passport is genuine — is a separate service, and one you should not assume is bundled anywhere.

Where to start this afternoon

You do not need a project. You need an intake list and one decision about sequence.

Write the four lists above, adapted to the countries your clients actually come from. Put them where a new matter gets opened, not in a shared folder. Then move the moment: the KYC folder is completed before the engagement letter goes out.

That change of order will not save you any work in the first week. It will end the chasing, which is where the time was going.