Ley 10/2010 for lawyers: a practical AML compliance guide

Anti-money-laundering compliance is one of the areas where a firm can slip, almost without noticing, from adviser to regulated obligor. Spain’s Ley 10/2010, of 28 April, on the prevention of money laundering and terrorist financing does not impose a uniform regime on the legal profession: whether it applies depends on the specific work being carried out for the client. Understanding that boundary precisely is what separates calm compliance from an avoidable enforcement risk.

This guide explains when the law applies and when it does not, what obligations flow from customer due diligence, how the reporting duty to SEPBLAC works, and which parts of all this software such as Mandato can support — always within one non-negotiable principle: the decision and the report belong to the lawyer; the software organises, documents and retains.

When a lawyer is a regulated obligor (and when not)

Article 2.1 of Ley 10/2010 lists the regulated obligors. Lawyers are not caught simply by practising, but by carrying out certain activities on a client’s behalf. Specifically, a lawyer is caught when participating in the design, execution or advice on transactions that include, among others:

• The purchase and sale of real property or business entities.
• The management of funds, securities or other assets belonging to the client.
• The opening or management of bank, savings or securities accounts.
• The creation, operation or management of companies, trusts or analogous structures.
• Acting in the name of and on behalf of the client in any financial or real-estate transaction.

The logic is functional: the law is interested in the lawyer when the lawyer sits close to the flow of money — moving funds, forming corporate vehicles, intervening in transfers of assets — not by virtue of professional status in the abstract.

Against that, article 22 sets out a crucial exception. Lawyers are not subject to the reporting obligations with respect to information they receive from a client when ascertaining the client’s legal position, or in performing their defence or representation in judicial proceedings, or in connection with them, including advice on instituting or avoiding proceedings. In practical terms: litigation and pure legal defence fall outside the reporting duty.

The boundary is not always clean. The same client may instruct a criminal defence (exempt) and, in parallel, the purchase of a property (caught). Whether the law applies is analysed transaction by transaction, not client by client.

It is therefore worth documenting, for each matter, the nature of the instruction. A firm with international clients or with real-estate work will tend to encounter more caught transactions than one devoted exclusively to litigation.

Customer due diligence: the KYC obligations

When the transaction is caught, customer due diligence (know your customer) arises. The law sets out several measures that must be applied before establishing the business relationship and maintained throughout its life.

Formal identification. You must identify all natural or legal persons who seek to establish a business relationship or take part in transactions, and verify their identity with reliable documents beforehand. For foreign clients — routine in immigration practices — this means handling passports, NIE numbers and equivalent documentation according to nationality.

Beneficial owner. The beneficial owner must be identified — the natural person who ultimately owns or controls, directly or indirectly, a relevant percentage of the capital or voting rights of a legal person, or who exercises control by other means. In complex or internationally layered corporate structures, this is the obligation that demands the most effort.

Purpose and nature of the relationship. You must obtain information on the intended purpose and nature of the business relationship, gathering data on the client’s economic activity.

Ongoing monitoring. The relationship is not examined once. Ongoing monitoring requires scrutinising transactions to confirm that they match the knowledge held about the client and the client’s risk profile, and keeping the documentation up to date.

Measures are applied on a risk basis: simplified in low-risk situations, enhanced where higher-exposure factors are present.

PEP and sanctions screening

Two screens deserve their own mention because they structure much of the risk analysis.

Politically exposed persons (PEPs). The law imposes enhanced measures on those who hold or have held prominent public functions, as well as on their family members and close associates. Identifying a PEP does not mean rejecting the client; it means raising the level of scrutiny, obtaining senior-management approval and reinforcing monitoring.

Sanctions lists. Independently of Ley 10/2010, the international financial-sanctions framework requires checking that the client does not appear on restrictive lists. A positive match has immediate consequences and is not resolved with more paperwork.

Both screens must be documented: it is not enough to have run them — you must be able to evidence when, against what data, and with what result.

Retention, internal manual and control body

Compliance does not end when the client is onboarded. The law imposes a standing infrastructure.

• Ten-year retention. Due-diligence documentation and the supporting records of transactions must be retained for ten years, so that they can serve as evidence in any investigation.
• Internal manual. Regulated obligors must approve in writing and apply adequate policies and procedures for due diligence, reporting, retention, internal control, and risk assessment and management.
• Control body. Depending on the firm’s size, a representative before SEPBLAC — and, where appropriate, an internal control body — should be appointed.
• Training. Staff must receive specific, continuing training to recognise transactions that may be linked to money laundering.

These pieces are not formalities: in an inspection, their absence is precisely what is penalised, regardless of whether a suspicious transaction ever occurred.

The reporting duty to SEPBLAC

The Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences (SEPBLAC) is the supervisor and the financial-intelligence unit. The reporting duty has two channels:

Reporting on indication. Where there is any indication or certainty that funds or transactions are linked to money laundering or terrorist financing, you must report it to SEPBLAC on your own initiative, refraining from executing the transaction where possible.

Systematic reporting. With the frequency the regulations set, certain transactions are reported even absent any indication.

Here it is worth being categorical. Assessing whether an indication exists, deciding to report, and the report itself are professional acts of the lawyer — or of the firm’s control body. No software makes that legal determination or files the report in your place. Technology can bring the right information to the professional at the right moment; it cannot replace their judgement or assume their responsibility. And it always operates within the article 22 limit: information covered by legal defence is not reported.

How Mandato helps, honestly

Mandato approaches Ley 10/2010 as what it is for a firm: a problem of documentary organisation and traceability, not of automated decision-making. What the compliance module actually does:

• KYC by nationality. It guides identification by adapting the documents required to the client’s country — especially useful when the portfolio is international.
• Real sanctions screening. It checks the client against sanctions lists and records the result and the date.
• The organised Ley 10/2010 file. It gathers in one place the identification, the beneficial owner, the purpose of the relationship, the screens and their supporting evidence, so the documentation is complete and retained for the legal period.

What Mandato does not do, and it is worth stating plainly: it does not decide whether a transaction is suspicious, it does not file reports with SEPBLAC on your behalf, and it does not issue legal opinions. Those are the lawyer’s functions. Mandato reduces the friction of gathering and retaining the evidence that the procedure was followed; the assessment remains human.

That division of labour — the software documents, the professional decides — is not a technical limitation to disguise but the correct way to treat a regulated matter. A firm wanting to see how this module fits daily matter management can start with the general features and then weigh up the compliance detail.

A checklist to get started

If the firm still lacks a formal procedure, this order of work tends to help:

1. Classify the portfolio between caught instructions (art. 2) and instructions covered by the defence exemption (art. 22), matter by matter.
2. Approve the internal manual and appoint the representative before SEPBLAC.
3. Standardise KYC: which document is requested, how the beneficial owner is identified, and how purpose and risk profile are recorded.
4. Systematise PEP and sanctions screening, recording date and result.
5. Set up the ten-year archive with retention and retrieval guarantees.
6. Train the team and review the procedure periodically.

AML compliance rewards consistency: a simple procedure applied without exceptions protects more than a sophisticated one that is abandoned. Technology helps maintain that consistency, but the judgement and the signature remain the lawyer’s.