KYC and anti-money laundering: complying with Law 10/2010

A foreign client instructs you on the purchase of a home on the coast. Another wants to incorporate a company to operate in Spain. A third asks you to handle the funds for a transaction. In all three cases, before you even discuss fees, the law is asking you for something else: to know who that person is, where their money comes from and what they are hiring you for. That law is Ley 10/2010, and it touches your firm more than many firms believe — and less than others fear.

Law 10/2010 on the prevention of money laundering and terrorist financing, together with its implementing regulation, Royal Decree 304/2014, makes lawyers obliged entities — sujetos obligados — for certain operations. Not for all of them. Understanding where that obligation begins and ends is the first step towards complying with it without turning the firm into a photocopy-collection agency.

When a lawyer is an obliged entity (and when not)

Article 2.1.ñ of Law 10/2010 does not simply say “lawyers”. It says: lawyers, when they take part in designing, carrying out or advising on certain operations on behalf of their clients. The list is specific: buying and selling real estate or business entities; managing funds, securities or other assets; opening or managing accounts; organising the contributions needed to create or run companies; and the creation or management of companies, trusts and similar structures. It also covers acting on the client’s behalf in financial or real-estate transactions.

Outside that list, the law does not reach you. Running an employment dispute, defending a client in criminal proceedings or advising someone on their legal position does not make you an obliged entity. Courtroom defence sits outside the regime, and that is not a technicality: it is how the law tries to coexist with the right of defence and professional secrecy.

The practical problem is that most firms do both kinds of work. The same lawyer defending a dismissal today is executing the purchase of business premises tomorrow. The obligation does not attach to the firm in the abstract: it switches on operation by operation, which is why the analysis should be documented on each matter, not carried in someone’s head.

Due diligence: three questions and one ongoing task

When an operation falls within the law, due diligence boils down to three questions and one continuous task.

The first is formal identification: who the client is, evidenced with a reliable identity document. For a Spanish client that means a DNI. For an international client, things get complicated: passports, residence cards, national ID documents from countries you have never dealt with, each with its own format and expiry rules.

The second is the beneficial owner. If the client is a company, the law requires you to identify the natural person who ultimately controls it — as a rule, whoever owns or controls more than 25%. With foreign structures — a limited company hanging off another, a holding company in a third country — this can be the most laborious question of the three.

The third is the purpose and intended nature of the business relationship: what the client is hiring you for, what operation they want to carry out and whether it makes sense given what you know about them.

The continuous task is ongoing monitoring: due diligence is not a snapshot at the start but a living relationship. If a long-standing client changes activity, structure or pattern of operations, the law expects you to notice and to update their file.

When the risk goes up: enhanced due diligence

The law works on a risk-based approach, and in some scenarios it demands enhanced measures. The most relevant for a firm with international clients: politically exposed persons (PEPs), their family members and close associates; non-resident clients; and operations involving countries or territories the authorities classify as high risk.

Enhancing due diligence does not mean suspecting everyone. It means asking for more: the source of funds and of wealth, internal sign-off before accepting the relationship, more frequent monitoring. For a firm working with foreign property buyers, the non-resident scenario is daily bread — which makes it all the more important to have a clear procedure rather than improvising client by client.

Special examination, SEPBLAC and professional secrecy

If you spot an operation that, by its nature, does not add up — an anomalous price, a structure with no apparent logic, an odd insistence on paying in a particular way — the law requires a special examination: stop, analyse, and leave a written record of the analysis and its conclusion. If the examination yields indication or certainty of money laundering, reporting to SEPBLAC — the executive service of Spain’s anti-money-laundering commission — is mandatory, and telling the client you have done so is prohibited.

This is where the law’s most uncomfortable tension for a lawyer lives: professional secrecy. The statute itself resolves it in part: lawyers are not required to report information received from a client while ascertaining that client’s legal position or defending them in judicial proceedings, including advice on bringing or avoiding proceedings. The boundary is not always sharp, which is exactly why the documented special examination matters so much: it is the evidence that the firm asked itself the question and answered it with judgement.

The manual, the procedures and the ten years

More than goodwill is expected of a firm that is an obliged entity: written prevention policies and procedures — the prevention manual —, a client-acceptance procedure, training for everyone who deals with clients and, depending on the firm’s size and structure, internal control bodies. The regulation scales these requirements to the size of the obliged entity, so it is worth checking what actually applies to you rather than copying a bank’s manual.

And there is one obligation underpinning everything else: record keeping. Due diligence documentation and transaction records must be kept for ten years. Ten years outlasts most computers, several office moves and a good deal of staff turnover. If a client’s KYC file lives in the mailbox of a lawyer who has since left, the obligation still exists — you just can no longer meet it.

Our full guide to Law 10/2010 for law firms covers each obligation in more depth.

The real problem: international paperwork and scattered files

On paper, all of the above is manageable. In practice, compliance almost always breaks down over logistics, not ignorance. Chasing a German client to send a usable copy of their passport. Working out which identity document is valid for a Moroccan client, a British one, an Argentinian one. Receiving the paperwork through three different channels and ending up with the beneficial-ownership certificate in an email, the passport in a WhatsApp and the form in a drawer.

The typical result is compliance that is real but unfindable: the firm did the due diligence, but proving it requires an archaeology of inboxes. And in front of an inspection, compliance you cannot evidence looks uncomfortably like non-compliance.

How Mandato helps

Mandato attacks exactly that part of the problem: the logistics. The KYC process is organised by the client’s nationality — each client is asked for the documents that correspond to their country, with instructions in their language —, sanctions screening is built into client onboarding, and the Law 10/2010 file lives next to the matter: the client record, their identification documents and the status of each check, in the same place where you work the case. When someone asks for a client’s KYC six years from now, the answer is one click away, not in a former colleague’s mailbox.

It is worth being equally clear about what Mandato does not do: it does not assess risk for you, does not decide whether you accept a client, does not perform the special examination and does not report anything to SEPBLAC. That judgement cannot be delegated and remains the firm’s. What the tool contributes is that the diligence work is complete, organised and findable — which, in practice, is half the battle.

Law 10/2010 does not ask law firms to become police officers. It asks them to know who they work with, to document it, and to be able to prove it for ten years. It is an obligation of method more than of suspicion. And method — unlike legal judgement — can be systematised.