Examen especial — the analysis before a Spanish SAR
Spain puts a mandatory analytical step between an alert and a suspicious activity report, and gives it a name, a procedure, a decision-maker and a ten-year file. The examen especial is not the investigation your monitoring team happens to do; it is a regulated process whose adequacy SEPBLAC judges — and where SEPBLAC finds it insufficient, it returns the report. Most Spanish SAR-quality problems are examen especial problems wearing a different label. This piece sets out what the duty requires, how Real Decreto 304/2014 structures it, who decides, what the register must contain, and what a defensible file looks like.
1. The duty
Article 17 of Ley 10/2010, de 28 de abril requires obliged entities to examine with special attention any act or operation, regardless of amount, which by its nature may be related to money laundering or terrorist financing — recording the results of the examination in writing.
It then names the categories that must always attract that attention: any operation or pattern of behaviour that is complex, unusual or without an apparent economic or lawful purpose, or that shows indications of simulation or fraud.
Two design points are already visible in the wording. There is no threshold — the phrase “regardless of amount” is in the statute, which is why value-based escalation rules cannot define the population. And the duty reaches patterns of behaviour, not only individual transactions, so a monitoring model that only scores transactions in isolation is under-scoped by construction.
Article 17 also imposes an obligation on how the duty is organised. When establishing the internal control measures under Article 26, entities must specify how this duty will be discharged, and that specification must include three things:
- preparing and circulating among directors, employees and agents a list of operations susceptible of being related to ML or TF;
- periodically reviewing that list; and
- using appropriate IT applications, having regard to the type of operations, the business sector, the geographic scope and the volume of information.
That first item is often missing entirely. It is not the transaction-monitoring rule set; it is a plain-language list, distributed to the people who meet customers, of what should prompt an internal report.
2. What the process must look like
Article 25 of Real Decreto 304/2014 turns the duty into a specified process, and the specification is unusually prescriptive.
The examination must be conducted in a structured way, documenting the phases of the analysis, the enquiries carried out and the information sources consulted. And it must be integral in nature: it has to analyse all the related activity, all the parties to the operation, and all relevant information held by the obliged entity and, where applicable, within the group.
The documentation requirement is equally specific. It is not enough to record what was concluded; the file must show the phases of analysis, what enquiries were made and which sources were consulted — including, by implication, the sources that produced nothing.
3. Who decides, and how
Once the technical analysis concludes, the decision is not the analyst’s. Under Article 25(2), the representante ante el Sepblac adopts the decision on whether a communication is due — with reasons and without delay — based on whether the activity presents indications or certainty of a link to ML or TF.
The entity’s internal procedure may provide that the decision is first put to the órgano de control interno. Where it does:
- the OCI decides by majority; and
- the minutes must expressly record the sense and the motivation of each member’s vote.
That last requirement is stricter than most committee practice. A minute recording that “the committee agreed not to report” does not satisfy it; each member’s position and reasoning has to be on the record. In a contested case that is precisely the evidence a supervisor will want.
Two further rules govern the decision itself. Decisions must respond to homogeneous criteria, with the reasoning recorded in the examen especial file — in other words, two comparable cases should be decided the same way, and the file must demonstrate the basis. And where the detection came from an internal report by an employee, agent or director, the final decision on whether to communicate must be put to that person.
The feedback rule is easy to overlook and cheap to implement, and it is the difference between an internal reporting culture that improves and one that quietly stops reporting because nothing ever seems to happen.
4. The register and the ten-year file
Article 25(3) requires a register kept in chronological order, capturing for each examen especial file, among other data:
| Field | Why it matters |
|---|---|
| Opening and closing dates | Establishes how long the analysis took — the evidence for or against “without delay” |
| The reason it was opened | Distinguishes an alert-driven file from an internal report, a media hit or an external enquiry |
| A description of the activity analysed | Shows the perimeter the examination actually covered |
| The conclusion reached, and the reasons for it | The homogeneity test lives here |
| The decision on whether to communicate, and its date | Separates the analytical conclusion from the reporting decision |
| The date the communication was made, where applicable | Closes the loop against the “without delay” obligation |
Files are retained for ten years. Note the register covers every examen especial file — including, and especially, those that concluded in no report. The population of cases you examined and did not report is exactly the population a supervisor will sample.
5. What happens on either side of the decision
Where the examination concludes in indications or certainty, Article 26 of the Regulation requires the comunicación por indicio to be made without delay, in the medium and format established by SEPBLAC — and it attaches two further duties.
The entity must immediately adopt additional risk management and mitigation measures, which must take into account the risk of tipping off. Those two requirements pull against each other on purpose: doing nothing is not an option, and doing something conspicuous is a disclosure. The resolution is a documented decision about what was done and why it was judged not to reveal the report.
And under Article 18.2(f) of the Law, the communication itself must carry information about the decision the entity has taken, or foreseeably will take, about the business relationship. The FIU is asking, in effect: are you keeping this customer? That question has to be answered inside the file before the report goes out.
Where the examination concludes in no report, the file simply closes — but it closes into the ten-year register, with its reasons, and it is discoverable.
6. Sufficiency: the test SEPBLAC applies
The examen especial is not judged only by the entity. SEPBLAC states that every comunicación por indicio must be preceded by a structured examen especial process, and that where it considers the examination carried out to be insufficient, it will return the communication to the obliged entity so the operation can be examined in more depth — setting out briefly the reasons for the return and the content to be examined.
Article 18 of the Law is what makes that judgement possible, because it requires the communication to state, among other things, the enquiries carried out by the reporting entity to investigate the operation. That single requirement is where an inadequate examination becomes visible: the transactions can be described perfectly while the investigation section is empty.
7. Three scenarios
Scenario 1 — the examination that stopped at the alert. A payment institution reviews the six transfers that triggered a rule, concludes they are inconsistent with the customer’s stated activity, and files. Facts to rule: Article 25 requires the examination to be integral — all related activity, all parties, all relevant information held by the entity and the group. What the analyst does: widen to the customer’s full operativa in the period, identify and analyse the counterparties, and pull whatever the group holds on those parties before concluding. The failure mode is a report returned for insufficiency, with the clock still running on a duty that says without delay.
Scenario 2 — the committee minute that said “agreed”. A case goes to the internal control body, which decides by majority not to report. The minute records the outcome and the attendees. Facts to rule: where the OCI decides, the minutes must expressly record the sense and motivation of each member’s vote. What the secretary does: restructure the minute template so each member’s vote and reasoning is captured individually, and hold the file open until it is. The failure mode is a defensible decision with indefensible evidence.
Scenario 3 — the threshold in the escalation rule. A firm routes only cases above a value into examen especial, on materiality grounds. Facts to rule: Article 17 applies regardless of amount, reaches behaviour patterns as well as operations, and expressly covers indications of simulation or fraud. What the compliance officer does: remove the value floor from the examen especial trigger — keeping prioritisation, which is legitimate, but not exclusion — and add pattern-level detection so fragmentation is visible. The failure mode is a structuring case that is invisible because every leg was immaterial.
Is the examen especial the same as investigating an alert?
Not quite. It is a regulated process with prescribed properties: structured, documented as to phases, enquiries and sources consulted, integral in scope, decided by the representative before SEPBLAC with reasons, registered chronologically and retained for ten years. An alert investigation becomes an examen especial when it meets those conditions.
Do we open a file for every alert?
The duty attaches to any act or operation which by its nature may be related to ML or TF, regardless of amount. Firms in practice triage, but the triage rule has to be about the nature of the activity, not its value — and where a file is opened, the register requirements apply whether or not it ends in a report.
Who signs off the decision not to report?
The representative before SEPBLAC, with reasons and without delay. The internal procedure may route the decision through the internal control body first, in which case it decides by majority and each member’s vote and motivation must be minuted.
What do we tell the employee who raised the concern?
The final decision on whether the operation is communicated. Article 25(2) requires it to be put to the employee, agent or director whose internal communication led to detection.
How long do the files have to be kept?
Ten years, together with a chronological register recording the opening and closing dates, the reason for the file, the activity analysed, the conclusion and its reasons, the decision on communication and its date, and the date any communication was made.
8. What to do, today
- Check that your examen especial template captures phases of analysis, enquiries made and sources consulted — including the ones that returned nothing.
- Make the analysis integral by design: all related activity, all parties, and group-held information, not just the alerting transactions.
- Remove value floors from the trigger and add pattern-level detection; the statute says regardless of amount and reaches behaviour patterns.
- Produce and circulate the plain-language list of susceptible operations to directors, employees and agents — and diarise its periodic review.
- Rebuild the OCI minute template so each member’s vote and motivation is recorded individually.
- Add the feedback step to internal reporters into case closure.
- Audit the register against Article 25(3) field by field, and confirm ten-year retention covers files that ended in no report.
Related: How to file a SAR in Spain · What is SEPBLAC? · Examen externo — Spain’s annual AML audit · Mule-account aggregated reporting in Spain
