SEPBLAC · Spain

How to file a SAR in Spain

Fintech Passport

April 29, 2026 · 10-min read

Spain does not have one suspicious-activity channel. It has a gate and then a fork. The gate is the examen especial — a structured, documented, integral analysis that must be completed before anything is transmitted, and which SEPBLAC can send back if it judges it insufficient. The fork is which route the resulting communication takes: the individual comunicación por indicio on form F19, the mandatory telematic application for credit institutions, or the separate aggregated channel for confirmed mule cases. Choosing wrongly does not just misfile a report — it can strip out the very structure the receiving analyst needs. This piece walks the gate, the fork and what each route requires.

1. Where the obligation comes from

Two articles of Ley 10/2010, de 28 de abril do the work, and they operate in sequence rather than in parallel.

Article 17 — examen especial. Obliged entities must examine with special attention any act or operation, regardless of amount, which by its nature may be related to money laundering or terrorist financing, recording the results of that examination in writing. The article singles out complex or unusual operations and behaviour patterns, those without an apparent economic or lawful purpose, and those showing indications of simulation or fraud.

Article 18 — comunicación por indicio. Obliged entities communicate to SEPBLAC, on their own initiative, any act or operation — including a mere attempt — in respect of which, after the Article 17 examination, there is an indication or certainty of a link with ML or TF. The article expressly catches cases showing an obvious lack of correspondence with the customer’s nature, volume of activity or operating history, where the examination finds no economic, professional or business justification.

The sequencing is not decorative. SEPBLAC states that every comunicación por indicio must be preceded by a structured examen especial process — and that where it considers the examination insufficient, it will return the communication to the obliged entity so the operation can be examined further, briefly stating the reasons for the return and the content to be examined.

2. The gate: what the examen especial must be

Article 25 of Real Decreto 304/2014 converts the duty into a process with four properties:

Structured and documented — the phases of analysis, the steps taken and the information sources consulted must all be recorded.
Integral — it must analyse all related activity, all parties to the operation, and all relevant information held by the entity and, where applicable, by the group.
Decided by a named person, with reasons. On concluding the technical analysis, the representante ante el SEPBLAC decides, reasoned and without delay, whether to communicate. The internal procedure may route the decision through the internal control body first, in which case the OCI decides by majority and the minutes must record the sense and motivation of each member’s vote.
Registered and retained. A chronological register records, for each file, its opening and closing dates, the reason it was opened, a description of the activity analysed, the conclusion and its reasons, the decision on communication and its date. Files are kept for ten years.

Two further rules matter operationally. Decisions must respond to homogeneous criteria, recorded in the file — which means two analysts facing the same facts should reach the same answer, and the file has to show why. And where the detection came from an internal report by an employee, agent or director, the final decision must be communicated back to that person.

3. The fork: which route the communication takes

Once the examination concludes in suspicion, Article 26 of the Regulation requires the communication to be made without delay, in the medium and format established by SEPBLAC. What that medium is depends on who you are and what you are reporting.

Route	Who uses it	What it carries
Telematic — CTL 2.3	Mandatory for banks, cajas de ahorro, credit cooperatives, branches of foreign credit institutions in Spain, and the payment-institution body referred to in Article 27	Individual comunicaciones por indicio
Electronic — F19 via the Banco de España electronic register	Obliged entities other than credit institutions — payment and e-money institutions among them	Individual comunicaciones por indicio, electronically signed by the representative or an authorised person
Aggregated mule channel	Entities with confirmed mule-account casework	Structured, case-level reporting on confirmed mule accounts rather than free-standing narratives
Written / in person	Exceptionally, non-credit institutions only	Individual communications through the representative

4. The F19 route, in detail

Form F19-1 sets the structure a comunicación por indicio must take. It is not a covering note: Article 18 fixes what the communication must contain in every case, and the form exists to make sure it does.

The list and identification of the natural or legal persons participating in the operation, and the nature of each one’s participation.
The known activity of those persons, and the correspondence between that activity and the operation.
The list of linked operations and the dates they relate to, with their nature, currency, amount, place or places of execution, purpose, and the payment or collection instruments used.
The steps the reporting entity took to investigate the operation being communicated.
An exposition of the circumstances of every kind from which the indication or certainty of a link to ML or TF may be inferred, or which show the absence of economic, professional or business justification.
Any other relevant data determined by regulation — including, under Article 18.2(f), information on the decision the entity has taken or foreseeably will take about the business relationship.

The fourth item is the one most often thin, and it is the item SEPBLAC uses to judge whether the examen especial was sufficient. A communication that describes the transactions well but says nothing about what the entity did to understand them invites the return described above.

For attempted operations, the rule is explicit: the entity registers the operation as not executed and communicates to SEPBLAC whatever information it was able to obtain. An attempt is not a non-event.

5. When the aggregated mule channel applies instead

Mule casework broke the individual-narrative model: one recruitment network can produce dozens of accounts whose stories are near-identical and whose value to the FIU lies in the pattern, not the prose. Spain’s answer is a separate structured channel for confirmed mule cases — covered in our piece on mule-account aggregated reporting.

The routing question is best answered by asking what the receiving analyst needs.

One subject, one case, a reasoned narrative — the individual comunicación por indicio. This includes a single customer holding several accounts or virtual IBANs: multiple identifiers do not make a network.
Confirmed mule accounts at volume, structurally similar — the aggregated channel, where the structure is the intelligence.
A network — two or more distinct subjects with a demonstrable operational connection between them — is reported as a connected group rather than as unrelated singles, so the relationship survives transmission. The channel’s own guidance governs how the linkage is expressed; the test to apply internally is whether you can actually evidence the connection, not whether you suspect one.

Both failure directions are real: splitting a network into unconnected singles destroys the link the FIU most needs, while pushing an individual reasoned case into an aggregated structure discards the narrative that justified it.

6. Getting the channel working before you need it

Both routes require set-up that cannot be done on the day a suspicion arises.

For credit institutions. CTL 2.3 is distributed by SEPBLAC together with the rules governing its use and a user guide. The application generates its own digital certificate for encryption, authentication and signature, producing three files: a .der to be emailed to the Banco de España’s telematics address, and a .doc and .jpg to be emailed to SEPBLAC’s obliged-entities address. Those certificates are valid for four years, so the generation exercise repeats on expiry. First use additionally requires the one-off form F22-5, the data communication for inclusion in the telematic exchange system.

For everyone else. Filing depends on a representante ante el SEPBLAC — and on that person, or an authorised delegate, holding a working electronic signature and access to the Banco de España’s Oficina Virtual electronic register. Entities operating in Spain under freedom of services must also designate a representative, who in that case may be non-resident.

7. Three scenarios

Scenario 1 — the report returned for insufficiency. A payment institution files an F19 setting out four transfers, the amounts and the counterparties, concluding that the pattern is inconsistent with the customer’s declared activity. SEPBLAC returns it. Facts to rule: Article 18 requires the communication to state the steps the entity took to investigate, and SEPBLAC returns communications where it considers the examen especial insufficient. What the analyst does: add what was actually done — customer contact attempted, documents requested and received or not, open-source checks, group-wide internal data reviewed — and what each produced. The failure mode is a report that describes the transactions and is silent on the investigation.

Scenario 2 — the vIBAN customer mistaken for a network. An e-money institution detects mule-like inflows across eleven virtual IBANs, all belonging to one customer, and prepares a network report. Facts to rule: a network requires two or more distinct subjects with an operational connection; multiple identifiers held by one person are one subject. What the MLRO does: file it as an individual case, with the eleven identifiers listed as linked operations under the customer. The failure mode is a network report containing one person, which tells the FIU nothing about connections.

Scenario 3 — the decision that never went back. An account manager escalates a customer internally; the file is analysed, the OCI votes not to communicate, and the matter is closed. Facts to rule: where detection derives from an internal communication by an employee, agent or director, the final decision must be put to that person; and the OCI’s minutes must record the sense and motivation of each member’s vote. What the compliance officer does: build the feedback step into the case-closure workflow and record the individual votes in the minute rather than a collective conclusion. The failure mode is an internal reporting culture that learns nothing, and a file that cannot show how the decision was reached.

8. FAQ

Is there a threshold for filing?

No. Article 17 requires special examination of any act or operation regardless of amount, and Article 18 covers mere attempts. Amount-based rules belong to the separate systematic reporting obligations, not to the suspicion channel.

Which channel does a payment or e-money institution use?

The electronic route: the communication, structured per form F19-1, electronically signed by the representative before SEPBLAC or an authorised person, scanned and submitted through the Banco de España’s Oficina Virtual electronic register. CTL 2.3 is mandatory for credit institutions, not for payment firms.

What happens if SEPBLAC thinks our analysis was too thin?

It returns the communication so the operation can be examined further, briefly stating the reasons for the return and the content to be examined. The way to avoid it is to evidence the investigation, not only the transactions.

Do we tell the customer, or freeze the account?

Neither follows automatically. Article 26 of the Regulation requires the entity to adopt additional risk management and mitigation measures immediately, taking into account the risk of tipping off — and the communication itself must state the decision taken or foreseeably to be taken about the relationship.

How long do we keep the file?

Examen especial files are retained for ten years, and the chronological register must show, for each file, the dates, the reason, the activity analysed, the conclusion and its reasons, and the communication decision and date.

9. What to do, today

Check that your examen especial template forces a record of sources consulted and steps taken — that section is what SEPBLAC judges sufficiency on.
Make the analysis integral by design: pull all related activity, all parties and group-held information into the file, not just the alerting transactions.
Record the representative’s reasoned decision, or the OCI’s vote-by-vote minute, in every file — not only in the ones you report.
Build the feedback loop back to internal reporters into case closure.
Confirm which channel your category actually requires, and stand it up before you need it — including certificate validity and the one-off enrolment forms.
Write the routing test into the procedure: one subject is an individual case however many identifiers it holds; a network needs two or more subjects with an evidenced connection.
Diarise certificate expiry — four years outlasts most of the people who set it up.