Examen externo — Spain’s annual AML audit
Spain requires an outside expert to examine your AML controls every year — and then lets you replace the next two examinations with something much narrower. That three-year rhythm is the part firms most often get wrong, in both directions: some commission a full examination annually and pay three times over; others treat the follow-up years as optional and end up with a two-year gap in evidence. This piece sets out where the obligation comes from, what the report must contain, the incompatibility rule that disqualifies most incumbent advisers, the deadlines that attach to the board, and how the cycle actually works.
1. The obligation
Article 28 of Ley 10/2010, de 28 de abril requires the internal control measures and bodies referred to in Articles 26, 26 bis and 26 ter to be the subject of an annual examination by an external expert. The results are set out in a written report which must:
- describe in detail the existing internal control measures;
- assess their operational effectiveness; and
- propose, where appropriate, rectifications or improvements.
The scope is therefore the whole internal control apparatus — the written policies and procedures, the representante ante el Sepblac, the órgano de control interno, the technical unit where the entity’s size requires one, and the AML manual. It is not a file review, and it is not an opinion on whether the entity has filed the right number of suspicious activity reports.
The obligation is not required of individual entrepreneurs or professionals. Everyone else in scope owes it, including branches of foreign institutions operating in Spain.
2. The three-year cycle
Article 28(1) contains the provision that shapes the entire budget line: in the two years following the issue of the report, it may be replaced by an informe de seguimiento issued by the external expert, referring exclusively to the adequacy of the measures the obliged entity has adopted to remedy the deficiencies identified.
| Year | What is produced | Scope |
|---|---|---|
| Year 1 | Full external examination report | The whole internal control framework: description, effectiveness assessment, proposals |
| Year 2 | Follow-up report (optional substitute) | Only the adequacy of measures adopted to remedy the deficiencies found in year 1 |
| Year 3 | Follow-up report (optional substitute) | As year 2 |
| Year 4 | Full external examination report again | The cycle restarts |
Two consequences follow. First, the cycle is anchored to the first report, not to the calendar: the two substitution years run from the issue of the full report. Second, changing external expert mid-cycle is awkward by design, because a follow-up report is about deficiencies somebody else identified.
3. Who may do it — and who may not
There is no accreditation regime, and this surprises people. An external expert is simply a person who has communicated to SEPBLAC their intention to act as such, before beginning. Neither SEPBLAC nor any other body accredits, registers or authorises external experts, and SEPBLAC expressly warns obliged entities about professionals marketing themselves with phrases such as “expert accredited by SEPBLAC” or similar. The communication to SEPBLAC does not imply the person is suitable.
Suitability is therefore the obliged entity’s problem. The law requires the examination to be entrusted to persons with academic conditions and professional experience that make them suitable for the function, and it is the entity’s responsibility both to select appropriate professionals and to verify that the examination is carried out on the terms set by Orden EHA/2444/2007, de 31 de julio.
Then comes the rule that disqualifies most of the obvious candidates. An obliged entity may not entrust the external examination to natural persons who have provided, or who provide, any other class of remunerated services during the three years before or after the issue of the report.
Note the two unusual features. The prohibition covers any remunerated service, not merely audit or AML-adjacent work. And it extends forwards: engaging your external expert for unrelated paid work in the three years after the report retroactively breaches the condition on which that report was produced. A firm that uses its external expert as a convenient source of consultancy afterwards has damaged the report it already paid for.
External experts carry their own obligation on the other side: they must inform SEPBLAC semi-annually of the list of obliged entities whose internal control measures they have examined, using natural semesters and reporting within the month following the semester’s end.
4. What the report has to contain
Orden EHA/2444/2007 approves a model report in its annex to which the expert’s report must conform, and sets the minimum content. Where a section does not apply, that must be expressly stated in the report with reasons — silence is not an option, and a report with quietly omitted sections is not compliant.
The general data alone tell you how the document is meant to work: identification of the obliged entity with its tax number and any group subsidiaries covered; the reference date; the issue and reference dates of the previous external expert report, with express indication of its author and its general result; and a summary of the main internal control measures implemented, the assessment of their operational effectiveness and the proposed rectifications or improvements.
That third item is a quiet but powerful control: each report names its predecessor and its predecessor’s author and outcome, so a chain of reports is auditable and expert-shopping is visible on the face of the documents.
The assessment of operational effectiveness must cover, at a minimum, three things: the suitability of the internal control measures associated with ML risk-management processes, the rationality of their theoretical design, and their practical operation. And the expert must explain in detail the specific aspects checked, the tests performed, the results obtained and the findings or incidents arising.
The Order goes further and prescribes how sampling is justified:
- For substantive tests selecting specific items: the reasons for the size and characteristics of the sample, indicating the number of branches or agencies affected, the types of customers selected, the types of products chosen, the dates of the contracts or of the start of the business relationship, and the percentage of contracts and business relationships reviewed against the total.
- For procedural tests using statistical sampling: the population and confirmation that it is adequate and complete, the sample size and selection method, the sample design against the test objectives and population attributes and the tolerable error rate expected, the confidence level and whether stratification was used and why, and an analysis of errors detected with causes, likely effect and possible extrapolation.
Read that as a purchasing specification. A proposal that does not explain how sampling will be designed and justified is proposing a document that cannot satisfy the Order.
5. Dates, the board, and retention
Three timing rules bind, and they are separate from each other.
| Rule | What it requires |
|---|---|
| Reference date | Cannot be more than one calendar year after the previous report’s reference date. It need not coincide with the accounting year-end |
| Issue | As soon as possible and in no case more than two months from the reference date |
| To the board | The report goes to the Board of Directors — or the administrative body or principal management body — within a maximum of three months from its issue date, and that body adopts the measures necessary to remedy the deficiencies identified |
| Retention | The report must be at the disposal of the Commission for the prevention of money laundering, or its support bodies, for the five years following its issue |
The board rule is the one that converts the exercise from a compliance artefact into a governance act. The statute does not say the board should note the report; it says the body adopts the measures necessary. In practice that means a minuted decision with owners and dates, because the following year’s follow-up report is defined as being about exactly those measures.
6. Three scenarios
Scenario 1 — the adviser who could not be the expert. A payment institution asks the consultancy that wrote its AML manual eighteen months ago to perform the external examination, on the reasonable-sounding basis that they know the framework. Facts to rule: the examination may not be entrusted to natural persons who have provided any other class of remunerated service in the three years before the report. What the compliance officer does: separate the two roles permanently — one firm builds, another examines — and screen candidates on the three-year window before requesting proposals. The failure mode is a report that is void on its face for a reason the entity chose.
Scenario 2 — the follow-up with nothing to follow. An entity’s year-one report identifies two minor deficiencies, both fixed within a month. In year two it commissions a follow-up report. Facts to rule: the follow-up refers exclusively to the adequacy of measures adopted to remedy the deficiencies identified. What the entity does: recognise that a two-page follow-up on two closed items evidences almost nothing about a framework that has since absorbed a new product line, and commission a fresh full examination instead. The failure mode is three years of documents that, together, examine the framework once.
Scenario 3 — the report that sat with compliance. A report is issued in February, circulated to the compliance function, and actioned there. The board sees a summary at its December meeting. Facts to rule: the report must be raised to the board or principal management body within three months of issue, and that body adopts the measures necessary. What the company secretary does: put the external expert report on the board agenda as a standing item with a fixed slot inside the three-month window, and minute the remediation decisions with owners and dates. The failure mode is a governance breach sitting on top of an otherwise satisfactory report.
Is the external examination the same as an internal audit?
No. It is a distinct statutory obligation under Article 28 of Ley 10/2010, performed by an external expert, on the internal control measures and bodies. An internal audit function does not discharge it, and the external expert’s independence rule is stricter than an internal auditor’s.
Can we really skip the full report for two years?
You can substitute it. In the two years following issue of a full report, the annual deliverable may be a follow-up report addressing exclusively the adequacy of the measures adopted to remedy the deficiencies identified. The examination duty itself remains annual.
Is SEPBLAC’s list of external experts an approved list?
No. Experts communicate their intention to act; no body accredits, registers or authorises them, and SEPBLAC warns against professionals claiming accreditation. Selecting a suitable expert is the obliged entity’s own responsibility.
Must the reference date be our financial year-end?
No. The report describes the entity’s situation at the reference date, which need not coincide with the accounting close — but it cannot be more than a calendar year after the previous report’s reference date, and the report must be issued within two months of it.
Who has to see the report?
The Board of Directors, or the administrative body or principal management body, within three months of issue — and that body must adopt the measures necessary to remedy the deficiencies identified. The report must also be available to the Commission for five years.
7. What to do, today
- Work out where you are in the cycle: date the last full report and count the two substitution years from its issue, not from a calendar year.
- Screen candidate experts against the three-year remunerated-services window — before the tender, and in both directions.
- Stop buying unrelated paid work from your external expert; the prohibition runs three years forwards from the report.
- Put sampling methodology into the scope of work, because the Order requires it to be justified in the report.
- Fix the reference date and diarise the two-month issue deadline and the three-month board deadline as separate events.
- Minute the board’s remediation decisions with owners and dates — next year’s follow-up report is defined as being about them.
- Keep the reports, and their predecessors’ details, retrievable for five years.
Related: What is SEPBLAC? · The SEPBLAC representative and form F22 · How to file a SAR in Spain · The AMLR compliance manager and officer
