4 Nov 2026 · fim-2026-11-01
Lead Signal
Spain has moved on two fronts to close long-standing gaps in its anti-money-laundering architecture, and the two moves read as a single institutional posture rather than two unrelated events. Real Decreto 813/2026, which enters into force on 28 October 2026, reforms the regulation implementing Law 10/2010 by amending eleven financial royal decrees at once. It sets minimum standards that non-face-to-face identification procedures must meet to satisfy SEPBLAC, fixes the term of the SEPBLAC Director at six non-renewable years, and removes the exemption that had let small obliged entities avoid designating a SEPBLAC representative. Confirmed reporting places this reform at the centre of Spain's institutional AML architecture for the period ahead.
Alongside it, Royal Decree-law 25/2026 brings all crypto-asset service providers within the obliged-entity perimeter of Law 10/2010 from 1 October 2026, under the amended article 2(1)(z). A breach of Travel Rule information-accompanying-transfer obligations is now classified as a serious infringement carrying a minimum fine of sixty thousand euros, and SEPBLAC is to report on the adequacy of AML controls as part of the CNMV authorisation procedure for these providers. Together, the two instruments narrow the space between licensing and anti-money-laundering supervision that crypto-asset firms in Spain had previously occupied.
Other Developments
Enforcement activity continued in parallel domains that sit adjacent to the AML perimeter. The Banco de España fined CBNK Banco de Colectivos, S.A. and four board members a combined 369,600 euros for a very serious infringement of remuneration-policy rules tied to senior-management pension-savings contributions. This is a prudential and conduct matter rather than an anti-money-laundering finding, but it sits within the same confirmed institutional enforcement record for the period.
The CNMV separately fined an unnamed investment firm and three of its directors a combined 1,048,000 euros for very serious infringements connected to the protection of client funds. This finding rests on press reporting rather than on independently retrieved primary notice from the official gazette, and is accordingly carried at a probable rather than confirmed level of confidence.
The transposition calendar for beneficial-ownership register access remains open. Articles 11, 12, 13 and 15 of the sixth EU Anti-Money Laundering Directive required transposition by 10 July 2026, and Spain has not yet produced a transposition act for those provisions. The institutional pre-positioning achieved through Real Decreto 813/2026 and Royal Decree-law 25/2026 addresses supervisory architecture and the crypto-asset perimeter respectively, but neither constitutes the beneficial-ownership transposition itself.
Cross-Monitor Connections
The crypto-asset obliged-entity designation under Royal Decree-law 25/2026 is the kind of finding that other monitors tracking digital-asset infrastructure and information-operations risk will want visibility on, since a Travel Rule compliance perimeter with a defined minimum penalty changes the cost calculus for counterparties routing value through Spanish-licensed providers. The SEPBLAC architectural reform under Real Decreto 813/2026, by fixing supervisory leadership tenure and extending representative-designation duties to previously exempt small entities, is a structural change of the kind that compliance-technology and institutional-capacity trackers elsewhere in the fleet would read as a capacity-building signal rather than an incident. Neither finding carries a conflict-finance or sanctions-evasion dimension strong enough to warrant cross-routing to those trackers.
Outlook
The period ahead turns on whether Spain closes the beneficial-ownership transposition gap before further EU-level scrutiny attaches to the delay. The sixth Directive's access-harmonisation provisions were due by 10 July 2026, and no transposition act had been identified as at the most recent recency date tracked. Separately, previously exempt small obliged entities will need to complete designation or communication of a SEPBLAC representative by 28 July 2027, a horizon-tracked consequence of Real Decreto 813/2026 that firms should treat as a distinct compliance milestone from the 28 October 2026 entry into force of the reform itself. For crypto-asset service providers, the practical question is less whether the obliged-entity designation applies from 1 October 2026 than how consistently the stated SEPBLAC-adequacy reporting operates inside the CNMV authorisation procedure in practice.
3 Nov 2026 · fim-2026-11-03
Lead Signal
Spain tightened its anti-money-laundering architecture through two linked instruments that came into force within weeks of each other. Real Decreto 813/2026, published in the Boletin Oficial del Estado on 8 October 2026 and in force from 28 October 2026, amends eleven financial royal decrees, with its core axis a reform of the regulation implementing Law 10/2010. Non-face-to-face identification procedures must now meet SEPBLACs minimum general-authorisation standards, SEPBLACs own institutional architecture is reformed (including a fixed six-year non-renewable term for its Director and fixed minimum content for the national risk assessment and annual report), and the exemption that had let small obliged entities avoid designating a SEPBLAC representative is eliminated. Separately, Royal Decree-law 25/2026, in force from 1 October 2026, amends Law 10/2010 so that all crypto-asset service providers become obliged entities, with breach of the Travel Rule under Regulation (EU) 2023/1113 now classed as a serious infringement carrying a minimum fine of 60,000 euros. Together the two instruments close the gap between MiCA-driven authorisation of crypto-asset service providers by the CNMV and their supervision for anti-money-laundering purposes by SEPBLAC.
The sequencing is notable: the crypto-specific obliged-entity extension took effect four weeks before the broader institutional and identification reform, suggesting a deliberate staging of pre-positioning moves rather than a single omnibus package. Read together, they represent the kind of structural tightening that outpaces discrete enforcement activity in analytical significance.
Other Developments
Banco de Espana sanctioned CBNK Banco de Colectivos, S.A. a fine of 369,600 euros for breaches of remuneration-policy rules, following proceedings opened in April 2025 and sanctions approved by the Governing Council on 3 March 2026, published in the BOE on 15 October 2026. The gap between proceedings opening and sanction publication illustrates the multi-year tail typical of Spanish supervisory enforcement.
The CNMV fined an unnamed investment firm and three directors a combined 1,048,000 euros for serious irregularities in client-fund protection, under a sanctioning agreement the CNMV Council adopted on 25 June 2026 and published once the appeal window lapsed. The amount and multi-director scope point to control failures reaching beyond a single compliance function.
Beneficial-ownership transposition remains pending. Articles 11, 12, 13 and 15 of the sixth EU Anti-Money Laundering Directive, governing beneficial-ownership register access, require transposition by Spain by 10 July 2026, ahead of the directly-applicable EU Anti-Money Laundering Regulation taking full effect on 10 July 2027. No Spain-specific register-access development beyond this pending deadline was identified.
Cross-Monitor Connections
The crypto obliged-entity extension under Royal Decree-law 25/2026 sits directly at the intersection of market-access authorisation and financial-crime supervision: a crypto-asset service provider authorised by the CNMV under the EU Markets in Crypto-Assets framework is now simultaneously an obliged entity under SEPBLAC supervision, with SEPBLAC reporting on anti-money-laundering control adequacy inside the CNMV authorisation procedure itself. This fusion of market-access and financial-crime gatekeeping is the kind of structural development that a payments-focused reading of the same CASP population would frame primarily as a licensing condition, while here it registers as a supervisory-perimeter expansion. The SEPBLAC institutional reforms in Real Decreto 813/2026 — fixed leadership tenure, standardised risk-assessment content — are the sort of compliance-architecture change that typically precedes, rather than follows, a change in enforcement intensity against regulated-sector entities generally.
Outlook
The near-term calendar carries two further staged obligations. Beneficial-ownership register access provisions under the sixth Directive were due for transposition by 10 July 2026, with the directly-applicable Regulation taking full effect from 10 July 2027; where transposition status cannot be confirmed as complete, this should be read as scheduled rather than asserted as either passed or outstanding. Separately, formerly-exempt small obliged entities face a 28 July 2027 deadline to designate a SEPBLAC representative under the Real Decreto 813/2026 changes. Sanctions architecture, enabler-jurisdiction exposure, conflict-finance findings and commercial-activity signal showed no material movement and are not addressed further here.
18 Oct 2026 · fim-2026-10-18
Lead Signal
Spain published Real Decreto 813/2026 in the Boletin Oficial del Estado on 8 October 2026, amending the implementing regulation of Ley 10/2010 (Real Decreto 304/2014) to remove the EUR 1,000 occasional-transaction identification threshold for crypto-asset ATM operators, taking effect 28 October 2026. From that date, anyone using a crypto-asset ATM in Spain must be identified regardless of the amount involved, closing a gap that previously allowed small-value transactions to pass without customer identification. The same instrument strips the exemption that had allowed certain small obliged entities to avoid designating a representative to SEPBLAC, and removes identification exemptions previously available for notarial acts.
Other Developments
MiCA's transitional period closed. Spain's transitional period for legacy crypto-asset service providers under Regulation (EU) 2023/1114 ended on 1 July 2026, the same date it ended across every EU Member State, bringing the full MiCA authorisation regime into effect for Spanish-supervised entities going forward. CNMV's register stood at fifteen entities. As of 2 October 2026, the CNMV's register listed fifteen Spanish entities operating under the post-transition regime: nine authorised crypto-asset service providers and six notified banks. CNMV opened a consumer-complaints consultation. On 15 October 2026 the CNMV opened a public consultation on a draft circular that would extend its formal complaints-handling service to clients of crypto-asset and crowdfunding service providers, a extension of consumer-redress infrastructure that previously covered only traditional investment-services clients. Spain's standing AML/CTF baseline remains in place. Spain's AML/CTF regime, anchored in Ley 10/2010 and Real Decreto 304/2014 and supervised by SEPBLAC, continues to operate without a change in FATF standing: Spain is not on the FATF grey list, and FATF's most recent assessment found Spain compliant or largely compliant on 38 of 40 Recommendations following a 2018 re-rating on three Recommendations. SEPBLAC published its National Risk Assessment for 2026 on 31 July 2026, providing the current risk basis underlying Spain's AML/CFT measures.
Cross-Monitor Connections
The RD 813/2026 crypto-ATM identification tightening sits directly at the intersection of Spain's AML/CFT regime and its digital-asset regulatory architecture: it is not a crypto-specific instrument but a general amendment to the AML implementing regulation that happens to bear most heavily on crypto-asset ATM operators and other payment-adjacent obliged entities. Readers tracking Spain's crypto regulatory posture separately should note that RD 813/2026 operates alongside, rather than as part of, the MiCA authorisation framework that governs licensing of crypto-asset service providers. The CNMV's consumer-complaints consultation likewise touches both the crypto-regulatory and financial-conduct registers, extending an existing investor-protection mechanism to a newly regulated population of CASP and crowdfunding clients rather than creating a new substantive right.
Outlook
RD 813/2026's crypto-ATM and SEPBLAC-representative provisions take effect 28 October 2026, and the near-term question is implementation: whether crypto-asset ATM operators have the identification infrastructure in place by that date, and how SEPBLAC handles the influx of small entities that now require a designated representative where none was previously required. The CNMV's draft circular consultation on crypto/crowdfunding complaints remains open, with the circular expected to enter into force shortly after adoption and publication in the BOE. No FATF plenary action on Spain is in train, and Spain's standing AML/CTF regime shows no sign of near-term structural change beyond this cycle's regulatory delta.
12 Oct 2026 · fim-2026-10-12
Lead Signal
Spain's Council of Ministers approved Real Decreto 813/2026, published in the BOE on 8 October 2026, amending the regulation that develops Ley 10/2010, Spain's foundational AML/CFT statute. The decree's crypto-facing provisions close an anonymity gap that previously existed at crypto-asset ATMs: identity verification is now mandatory for every transaction at such machines regardless of the amount involved, subject to an 18-month transitional period running to 8 April 2028. The same decree introduces an AML-gateway precondition for crypto-asset service provider authorisation: CASPs must obtain a prior report from SEPBLAC, Spain's financial intelligence unit, before the CNMV can grant MiCA authorisation, a requirement scheduled to take effect 28 October 2026. Both measures are explicitly tied, in the decree itself, to Spain's forthcoming FATF mutual evaluation, with a possible onsite assessment window in February 2027 and a possible Plenary discussion in October 2027. The architectural significance here exceeds any single enforcement action: Spain is restructuring the gatekeeping points in its AML perimeter, specifically the CASP authorisation chain and the crypto-ATM channel, ahead of external review rather than in response to a documented failure.
Other Developments
SEPBLAC representative coverage expands to small obliged entities. The same decree removes the exemption that had previously let small real-estate credit intermediaries and certain other small obliged entities forgo appointing a SEPBLAC representative; those entities now have a nine-month compliance deadline, running to 28 July 2027, to bring themselves into line. This is a governance-layer extension of an existing obligation rather than a novel duty, and it broadens the population of entities subject to direct SEPBLAC-facing accountability.
A parallel gambling-sector AML duty was introduced by the same instrument. Gambling operators must now verify that the holder of the payment method used for a deposit or withdrawal matches the holder of the gambling account before crediting or returning funds electronically, with a six-month transition to 28 April 2027 for existing players. This sits outside the crypto and cross-sector SEPBLAC measures but was enacted through the same decree, illustrating that RD 813/2026 functions as an omnibus AML-tightening instrument touching several obliged-entity categories at once.
A wholesale replacement of Ley 10/2010 is in train but not yet drafted into bill form. Spain's Ministry of Economy, Trade and Business opened a public consultation on an Anteproyecto de Ley de medidas integrales covering AML, counter-terrorist-financing, and counter-proliferation-financing measures, intended to replace Ley 10/2010 in its entirety. The consultation closed 30 September 2026; no bill text has yet been published. This finding rests on secondary law-firm and tax-adviser commentary rather than a retrieved primary consultation-portal document, so its procedural status should be read with that qualification. Current obligations under Ley 10/2010 remain in force unchanged pending further process.
Mexico's fifth-round FATF Mutual Evaluation Report carries a possible October 2026 Plenary discussion, per FATF's own Global Assessment Calendar; the outcome has not yet been published in any source retrieved this cycle.
Cross-Monitor Connections
The crypto-facing provisions of RD 813/2026, the SEPBLAC-gateway precondition for CASP authorisation and the crypto-ATM identification mandate, are also tracked by the crypto monitor as licensing-adjacent developments; this financial-integrity brief carries the substantive AML analysis of both, while the crypto monitor's own sub-briefs reference them only for their gating effect on CASP authorisation. The gambling-sector payment-identity-matching duty introduced by the same decree is tracked independently by the advennt monitor as an operator obligation under Ley 13/2011; the underlying AML rationale and SEPBLAC architecture sit with this monitor. No conflict-finance, sanctions-architecture, or world-payments-specific connection was identified for Spain within this cycle's pooled search budget, though the SEPBLAC representative-coverage expansion touches payment-adjacent intermediaries that the world-payments monitor's own W11 sub-brief for this jurisdiction addresses from a payments-conduct angle.
Outlook
Spain's regulatory trajectory is one of pre-emptive tightening rather than documented deterioration: every development this cycle, the crypto-ATM and CASP-gateway measures, the SEPBLAC-representative expansion, and the pending wholesale AML law replacement, reads as structural preparation ahead of the FATF mutual evaluation window, with a possible onsite visit in February 2027 and possible Plenary discussion in October 2027. The clearest open item is the procedural fate of the Anteproyecto de Ley de medidas integrales: whether a bill text emerges, and on what timeline, will determine whether Spain's AML architecture is substantially rewritten or continues to be refined through decree-level amendments such as RD 813/2026. Mexico's pending mutual evaluation outcome is a secondary item to watch, as a comparative data point for how FATF's current evaluation cycle treats jurisdictions with recently tightened but not-yet-tested AML architectures.
28 Sep 2026 · fim-2026-09-28
Lead Signal
Spain's crypto-asset supervisory architecture consolidated this cycle as the MiCA transitional period for legacy virtual-asset service providers closed on 1 July 2026. From that date, the CNMV becomes the sole gatekeeper for crypto-asset services in Spain, narrowing what had been a dual Banco de España/CNMV authorisation surface into a single authorisation gate. This is the kind of structural change that matters more than any single enforcement action: it redefines the population of entities that can lawfully touch the Spanish crypto-asset on-ramp, and by extension the population subject to AML/CFT obligations attaching to crypto-asset service provision.
Other Developments
FATF follow-up flags a persistent targeted financial sanctions gap. Spain's most recent FATF follow-up work rates the country compliant with 21 of 40 Recommendations and largely compliant with a further 16, leaving 3 rated only partially compliant. Despite this generally strong headline position, secondary commentary continues to identify weaknesses in Spain's capacity to freeze terrorism-linked assets under targeted financial sanctions, a gap that persists notwithstanding the country's broadly favourable overall AML/CFT rating.
EU AML Package architecture continues to bind Spain structurally. Spain sits under the direct-application binding mechanism as an EU-27 EEA member, meaning the AML Regulation (Regulation (EU) 2024/1624) applies to it directly without national transposition, running in parallel to the sixth AML Directive's per-member-state transposition track and the AMLA Regulation's (Regulation (EU) 2024/1620) establishment of a hybrid EU-level supervisory perimeter. No Spain-specific 6AMLD transposition delta or AMLA direct-supervision designation was independently retrieved this cycle, so this remains a structural backdrop rather than a confirmed this-cycle development for Spain specifically.
Cross-Monitor Connections
The MiCA transitional close-out connects directly to the crypto monitor's own tracking of the same event under its crypto_licensing module, where the CNMV's assumption of sole gatekeeping authority is read as a licensing-architecture development; here, the same fact is read for its AML-relevant consequence of narrowing the population of entities providing an on-ramp into the Spanish financial system without CNMV authorisation. It also connects to world_payments' interest in Spanish payment-services architecture to the extent that crypto-asset service providers increasingly intersect with traditional payment rails, though no world_payments-specific finding was surfaced this cycle bearing directly on the crypto transition.
Outlook
The most consequential open question following the transitional close-out is whether any legacy Banco de España registrant failed to secure CNMV CASP authorisation before the 1 July 2026 cliff and continues to operate outside the lawful perimeter; general industry practice is understood to require wind-down of unauthorised legacy activity, but the distance between that expectation and the practice of any individual firm was not assessed this cycle. Separately, confirmation of Spain's specific 6AMLD transposition status and any AMLA direct-supervision designation remains an open item that would clarify how the broader EU AML Package architecture applies to Spain in practice, distinct from the structural fact of AMLR's direct application.