SEPBLAC EP/EDE Questionnaire: Spain’s Annual AML Return
In 2025 SEPBLAC sent its annual structured information request to Spanish payment institutions for the first time, and the answers now feed the risk profile it assigns to each of them. The request is known as the requerimiento de información estructurada (RIE), and in the sector as the EP/EDE questionnaire: a mostly quantitative dataset on activity, customer due diligence, reporting and internal control. SEPBLAC has run it for banks since 2020. It now also inspects the quality of the data reported.
1. What the RIE is
The RIE is SEPBLAC’s annual data request to whole sectors of obliged entities. SEPBLAC’s 2025 annual report calls it the most significant type of supervisory action it carries out, and explains its purpose. The data gives SEPBLAC a picture of each sector, lets it build a map of each entity’s residual money-laundering, terrorist-financing and proliferation-financing risk, and shows trends that guide targeted supervisory work.
It is not a suspicious activity report, a systematic report or a filing to the Fichero de Titularidades Financieras (FTF). Those are transaction- or account-level returns with their own channels. The RIE is a structured snapshot of the entity as a whole, compared across the sector. If you operate in several EU markets, it is the Spanish counterpart of the supervisory questionnaires covered in our comparison of AML data returns across the EU.
SEPBLAC describes the content as four blocks:
- Activity — customers, accounts, products, channels, volumes and geography.
- Customer due diligence — how the AML/CFT due diligence obligations are applied.
- Reporting obligations — suspicious activity reports, systematic reporting and requests from authorities.
- Internal control — organisation, risk analysis, manual, training, audit and resources.
2. Who receives it
SEPBLAC’s annual reports give the roll-out by sector. The 2025 figures come from the report SEPBLAC published in 2026:
| Sector receiving the RIE | 2023 | 2024 | 2025 |
|---|---|---|---|
| Credit institutions (annual since 2020) | 193 | 186 | 187 |
| Insurance undertakings (since 2023) | 81 | 74 | 74 |
| Law firms | — | 8 | 50 |
| Payment entities | — | — | 109 |
| Crypto-asset service providers | — | — | 132 |
SEPBLAC’s tables label the new line “payment entities” and do not list e-money institutions separately. Both are obliged entities under Article 2.1(h) of Ley 10/2010, and the market name “EP/EDE” (entidades de pago y de dinero electrónico) reflects that the request covers both. Do not assume an EMI is out of scope because the annual report does not mention it by name.
Two other rules in Article 2 decide the perimeter. First, the Law applies to non-resident entities doing the same business in Spain through branches, agents or services without a permanent establishment. An EEA PI or EMI with a Spanish branch is an obliged entity in its own right. Second, Article 2.2 extends the obligations to operations carried out through agents or other intermediaries. Activity through an agent network belongs to the principal’s answers.
3. Legal basis and consequences
There is no separate regulation for the questionnaire. It rests on SEPBLAC’s general power to request information:
- Article 21.1 Ley 10/2010 requires obliged entities to provide the documentation and information that the Commission for the Prevention of Money Laundering (CPBCIM) or its support bodies request. SEPBLAC is one of those support bodies under Article 45. Each request must say what is to be provided and set an express deadline. If the deadline passes with nothing sent, or the answer leaves out data needed to examine the situation properly, the duty counts as breached.
- Article 21.2 requires internal-control systems that let the entity answer information requests fully and diligently.
- Article 30 RD 304/2014 confirms that the Commission, its support bodies and other competent authorities may request the documentation and information an obliged entity obtains or generates.
The sanctions follow from Article 21. Breaching the duty to cooperate is a serious infringement under Article 52.1(k) when a support body such as SEPBLAC made the written request. It is a very serious infringement under Article 51.1(b) when the Commission itself did. So an incomplete answer is not just a quality issue: under Article 21.1, missing data can amount to non-compliance.
4. Format, channel and deadline: read the request itself
SEPBLAC does not publish a public campaign page for the payment-sector RIE. The template, its instructions, the delivery channel and the deadline all come with the request sent to each entity, and Article 21.1 requires the request to state the deadline. Those documents, not market practice, govern. Read them before anyone extracts data. Operationally, plan for the following:
- Fixed template. A structured request is processed automatically. Do not rename the file, add or reorder sheets, overwrite formulas or paste over validation. Use only the input cells the instructions allow.
- No silent blanks. Where a question does not apply or the answer is zero, use the convention the instructions give. Explain any estimate or unknown in the observations field rather than leaving a gap.
- Reference date and period. Check which answers are stocks at the reference date and which are flows over the year. Mixing the two is the commonest source of internal inconsistency.
- Return path. Send the file back through the channel named in the request. Keep proof of delivery with the final file and the working papers.
Put the campaign in the annual cycle next to your other Spanish returns; our Spain reporting calendar for payment and e-money institutions shows where it sits.
5. Data-quality traps
SEPBLAC’s 2025 report explains why it is now inspecting RIE data quality. It observed large deviations between entities that differences in business or inherent risk do not always explain, and it needs to know whether they reflect the entities or reporting errors. The traps below produce exactly that kind of deviation.
- Breakdowns and totals. Some breakdowns must add up exactly to the total, such as customers by legal type. Others can legitimately exceed it. A customer with two nationalities may count in two rows. Check which rule each breakdown follows before forcing it to match.
- Who counts as a customer. Spanish AML datasets often count beneficial owners, authorised persons and representatives as well as account holders. The FTF’s technical standard records those roles separately. Apply the definition the instructions give, not your CRM’s.
- Transfers only, or the full ledger. An extract from the payments engine covers credit transfers. It misses card spending, cash withdrawals, fees, FX and acquiring settlements. Questions about amounts moved through accounts usually mean everything that hit the account.
- The completeness test. Opening balance plus the year’s inflows minus its outflows should come close to the closing balance of customer funds. The test is sharpest for a branch that started the year with nothing, where inflows minus outflows should roughly equal the closing balance. A large gap means the flow figures are incomplete.
- Sole traders. For an autónomo, nationality and residence are the natural person’s. A business-registration country field will usually show Spain for every self-employed customer and hide the real geography.
- Currency. Convert every amount to euro and sum transaction amounts, not amounts in the original currency.
- AML-only restrictions. If a question asks about blocks for AML/CFT reasons, exclude fraud, credit and operational blocks unless the instructions say otherwise.
6. Consistency with the OCI and the external expert
Several figures in the RIE also appear in documents SEPBLAC can request at any time. The internal control body (órgano de control interno, Article 26 ter.4 Ley 10/2010 and Article 35.2 RD 304/2014) applies AML policies and records its decisions in minutes. The external expert examines the internal-control measures every year under Article 28 Ley 10/2010 and assesses them as at a reference date (Article 38.1 RD 304/2014). The risk analysis (Article 32) and the manual (Article 33) each carry a date. Answer with the versions in force at the reference date unless the instructions say otherwise.
| RIE block | Reconcile against | Typical mismatch |
|---|---|---|
| Activity | Full ledger, safeguarding records, FTF account inventory, prudential returns | Transfers-only volumes; accounts closed in the year counted as open |
| Due diligence | KYC system, risk-scoring history, enhanced due diligence log, PEP screening | Year-end risk stock reported where the question asks about the year’s flow |
| Reporting | Suspicious-activity register, systematic reports, authority-request register | One aggregated filing counted once in the register and many times in the RIE |
| Internal control | OCI minutes, training records, audit reports, external expert report | Different FTE, alert or training figures across documents |
Read the year’s OCI minutes before drafting. If the minutes and the RIE differ, fix the source or explain the difference in the observations field. Leaving two versions in SEPBLAC’s hands is the worst option. See our guides to the OCI and the examen externo.
7. Worked case: an EMI branch’s first campaign
Facts: an e-money institution authorised in another EEA state runs a Spanish branch that issued its first Spanish IBANs mid-year. Its data team builds the activity sheet from the payments engine. Inflows minus outflows come to 60% of the closing e-money balance.
What the rule says: the branch is an obliged entity under Article 2.1 Ley 10/2010. Under Article 21.1, an answer that omits data needed to examine the situation properly counts as non-compliance.
What the compliance officer does: treats the 40% gap as a perimeter problem, not a rounding issue. Re-runs the extract from the general ledger so that card transactions, cash withdrawals, fees and FX are included. Confirms the branch perimeter against the FTF account inventory, then repeats the completeness test.
Outcome: the flows now explain almost all of the closing balance. A short methodology note records the source tables, so next year’s file is built the same way.
8. Worked case: a payment institution with an agent network
Facts: a money-remittance payment institution distributes through several hundred agents in Spain. Its first draft reports activity only from its own premises, because agent volumes sit in a separate settlement system.
What the rule says: Article 2.2 Ley 10/2010 makes the obligations apply to operations carried out through agents. Article 37 RD 304/2014 extends internal-control measures to them.
What the compliance officer does: merges the agent settlement data into the activity and remittance answers, with agent-level detail where the template asks for it. Checks that agents subject to internal restrictions or terminations in the year match the internal-control answers and the OCI minutes.
Outcome: volumes several times the first draft, and a risk profile based on where the business actually happens.
9. Worked case: zero enhanced due diligence that was not zero
Facts: a mid-size payment institution’s draft reports no customers subject to enhanced due diligence in the year. Its OCI minutes record dozens of enhanced reviews triggered by risk-score increases, and the external expert’s report describes the enhanced due diligence process as working.
What the rule says: the RIE is used to set the entity’s risk profile, and SEPBLAC now inspects RIE data quality. The internal-control block has to describe the same organisation the expert assessed.
What the compliance officer does: traces the zero to a field that captures only manually escalated cases. Counts enhanced reviews from the monitoring system for the period. Applies the same definition across the related due-diligence questions and notes the method in the observations field.
Outcome: one figure in the RIE, the minutes and the expert report. An inspector who compares the three finds nothing to ask about.
FAQ
Is the SEPBLAC questionnaire mandatory?
Yes, once you receive it. It is a formal request under Article 21.1 Ley 10/2010. A late or incomplete answer breaches the duty to cooperate and can be a serious infringement under Article 52.1(k).
Do EEA branches and EMIs have to answer?
Ley 10/2010 covers e-money and payment institutions, including non-resident entities operating in Spain through branches or agents. If your Spanish operation receives the request, it answers for its Spanish activity.
When is it due?
SEPBLAC does not publish a campaign deadline. The request must state one under Article 21.1, so take the date and reference period from the letter you receive.
How is it submitted?
Through the channel named in the request, using the template supplied. Do not rename or restructure the file. Keep proof of delivery with the final version.
Is the RIE the same as our risk analysis or the external expert report?
No. The risk analysis (Article 32 RD 304/2014) and the expert report (Article 28 Ley 10/2010) are your own documents. The RIE is SEPBLAC’s dataset. They should agree wherever they measure the same thing.
What does SEPBLAC do with the answers?
According to its 2025 annual report, it builds each entity’s residual-risk map and the supervisory risk matrix, compares entities across the sector, and plans inspections. Some of those inspections now target RIE data quality.
10. What to do, today
- Ownership: name the SEPBLAC representative or the head of compliance as owner, with finance, data and operations as named contributors.
- Read first: when the request arrives, log the deadline, reference date and channel, and read the instructions before extracting anything.
- Ledger, not engine: build activity figures from the full ledger and run the inflows-minus-outflows test against closing customer funds.
- Perimeter: include agent activity and check the branch perimeter against the FTF account inventory.
- Reconcile: compare every overlapping figure with the OCI minutes, the risk analysis, the manual and the external expert report before sign-off.
- Method note: file a one-page note per sheet with sources, filters and definitions, so next year’s answer is consistent with this one.
Related: What is SEPBLAC · The OCI in Spain · The annual examen externo
