Spain AML Obligations for Accountants, Auditors and Tax Advisers: Law 10/2010 and Sepblac

In Spain, auditors, external accountants and tax advisers are "obliged entities" under Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing. The state gazette (BOE) publishes the consolidated text, and the Executive Service of the Commission for the Prevention of Money Laundering (Sepblac) receives reports. This guide draws on the consolidated text, which the BOE page showed as last modified on 30 September 2026, and is open about the parts we could not read. It is general information, not legal advice, and our reading of the Spanish-language text is ours.

Who is covered

Article 2.1.m of Law 10/2010 covers auditors of accounts, external accountants and tax advisers, among others. The tax-advice element is qualified: the law refers to those who provide tax advice as their main business or professional activity. Under article 2.2, where individuals act as employees of a legal person, the obligations fall on that legal person. A practice should therefore check both the professional category it falls into and whether tax advice is its main activity.

Identification and beneficial ownership

Article 3 requires formal identification before the business relationship or transaction, using documents that can be relied on, and prohibits anonymous or fictitiously named accounts. Article 4 defines a beneficial owner of a legal person as a person holding more than 25% of the capital or voting rights, or who otherwise controls the entity, and bars relationships with entities whose ownership and control cannot be determined. Article 7 allows due diligence to be scaled by risk but requires the firm to show a prior written risk analysis, and says the measures apply in full whenever there are signs of money laundering or terrorist financing. For the general method, see our guides to KYC and customer due diligence in accountancy practices and to ultimate beneficial ownership.

Special examination and reporting

Article 17 requires obliged entities to examine with special attention any act or transaction that might be linked to money laundering or terrorist financing, whatever its amount, and to record the results in writing. Under article 18, once that examination shows indications or certainty of a link, the entity must report to Sepblac "sin dilación", that is, without delay. Article 22 relieves lawyers of some duties, including the reporting duty in article 18, for information received from a client when determining the client's legal position or defending them in court proceedings. In the text we read, that relief is written for lawyers, so do not assume it extends to accountants or tax advisers. Our guide to suspicious activity reports and tipping off is UK-focused but explains the practical sequence of spotting, escalating and reporting.

No tipping off

Article 24 bars obliged entities and their staff from telling the client or third parties that information was reported to Sepblac or that a transaction is under review. The exceptions include sharing within a group, sharing among professionals in the same entity or network, and, for certain professionals, attempts to dissuade a client from an illegal activity.

Record keeping

Article 25 requires documentation to be kept for ten years, after which it is deleted. After five years from the end of the relationship or the transaction, access is limited to internal control bodies and those handling legal defence. That ten-year period is longer than the five years in several other regimes, so firms with clients in more than one country should apply the longest period that applies.

Internal controls, whistleblowing and training

Article 26 bis requires obliged entities to set up internal channels through which employees, managers or agents can report possible breaches, including anonymously, and requires protection against reprisals. Articles 26 to 27 allow professionals to form centralised prevention bodies, whose membership is voluntary except for officials named in article 2.1.n, and which can review transactions and report them to Sepblac. Article 28 requires the internal control measures and bodies to be examined annually by an external expert who issues a written report on their effectiveness. Article 29 requires staff awareness training, with an annual training plan approved by the internal control body, and article 30 requires the identity of employees who reported suspicious transactions to be kept confidential.

What we could not confirm

• The sanctions regime in articles 50 to 59, including fine amounts, because the text we could read stopped before it.
• The regulations that implement the law, such as Royal Decree 304/2014, and any thresholds or exemptions they set, which we did not read.
• Whether professional bodies for auditors, accountants or tax advisers have issued their own guidance, and how a particular practice would be supervised in practice.
• The detailed content of the 2026 consolidation changes.

Suggested next steps

These are our suggestions, not requirements. Confirm which category of obliged entity your practice falls into. Write down your risk analysis and your procedure for moving from a flagged transaction to a special examination and, if needed, a report without delay. Plan for an annual external review of your controls. For team training, see our CPD courses.

Frequently asked questions

Are accountants in Spain covered by AML law?

Yes. Article 2.1.m of Law 10/2010 covers auditors of accounts, external accountants and tax advisers, with the tax-advice element qualified by the main-activity test.

How long must records be kept?

Ten years under article 25, with access restricted after five years to internal control bodies and those handling legal defence.

When must a suspicion be reported?

Without delay, to Sepblac, once the special examination shows indications or certainty of a link, under article 18.