How to file a SAR in Spain

Filing a Suspicious Activity Report in Spain looks straightforward on paper — but the channel you use depends on what you are licensed as, and the experience differs sharply between banks and everyone else. Credit institutions plug into a mature structured interface inherited from decades of Banco de España reporting plumbing. EMIs, Payment Institutions, CASPs and the rest of the non-bank obligated subjects file the same substantive content through a manual web form known as F19, one report at a time. SEPBLAC has signalled a 2026–2027 modernisation of the non-bank channel; until it lands, the gap between the two worlds is real, and your SAR operating model has to be designed around it. This walkthrough covers the legal basis, the prerequisites, both channels, and two worked cases showing how a filing decision actually gets made.

1. Legal basis — where the SAR obligation comes from

The SAR obligation — comunicación por indicio — sits in Article 18 of Ley 10/2010, Spain’s core AML/CFT statute, developed by its implementing regulation, Real Decreto 304/2014. An obligated subject must report to SEPBLAC any operation, attempted operation, or business relationship for which there are indicia or certainty of money laundering or terrorist financing. The wording is deliberately broad; SEPBLAC’s Catálogo Ejemplificador gives sectoral example typologies that help calibrate what crosses the bar.

Article 18 does not stand alone. It is the end point of a sequence the law itself prescribes: Article 17 requires a documented examen especial — a special examination of any operation that is complex, unusual, or without apparent economic purpose — and the SAR is filed when that examination fails to dispel the suspicion. Alongside the suspicion-based report, Article 20 creates a separate, threshold-based systematic reporting stream (the DMO), which must not be confused with the SAR: one is periodic and mechanical, the other is case-by-case and analytical.

Reporting is owed to SEPBLAC alone — the obligated subject does not contact the police or courts directly. Telling the customer, or anyone outside the need-to-know circle, that a report has been filed or is being considered is the tipping-off offence under Article 24, sanctionable against individuals as well as the entity.

2. Before you can file anything

SEPBLAC only deals with obligated subjects through a registered AML representative. Appointing that person — via Modelo F22 — is a hard prerequisite: without a representative on file, there is no recognised interface and no way to submit a SAR at all. For a passporting EMI or PI, the F22 belongs in the Spanish market-entry plan, not in the incident-response plan. The representative signs the filings and receives SEPBLAC’s follow-up requests, so the internal SAR workflow has to terminate on that named person’s desk.

3. The bank channel

Credit institutions file SARs through SEPBLAC’s structured electronic channel, historically integrated with Banco de España’s reporting infrastructure. In practice this means structured fields, file-level acknowledgements, the ability to feed submissions from internal transaction-monitoring case tools, and an operator-side workflow that large Spanish banks have been running for well over a decade. For a bank MLRO, the marginal cost of one more SAR is low.

4. The non-bank channel — F19

For a firm filing more than a handful of SARs a quarter, this is operationally painful: each report is a manual data-entry pass, re-typing customer and transaction data the firm already holds in its case-management system. Small EMIs typically dedicate a named officer to F19 work; larger ones build internal tooling that assembles a complete filing pack and accept that the last metre is copy-paste. The discipline that pays off is preparing the narrative, the party identification and the transaction list to a fixed internal template before anyone opens the form.

SEPBLAC has publicly signalled a modernisation programme to replace the manual form with a structured intake channel comparable to the bank pipe during 2026–2027, aligned with the tooling direction of the new EU Anti-Money Laundering Authority. Dates in this space have moved before; treat them as indicative and build for F19 as it exists today.

5. Worked example — a mule account at a passporting EMI

Facts: an EMI passported into Spain onboards a Spanish resident who, three weeks after opening, receives four incoming credit transfers totalling €9,400 from unrelated payers in another Member State, each followed within hours by card spending and ATM withdrawals until the balance is near zero. A fraud-victim bank sends a recall request on one of the transfers.

What the rule says: the pattern — rapid in-and-out flows inconsistent with the customer’s profile, third-party fraud reports, immediate cash-out — is a classic mule typology reflected in SEPBLAC’s example catalogue. Article 17 requires a documented special examination; if the review cannot find a legitimate explanation, Article 18 requires a SAR to SEPBLAC because the activity occurred in Spain, regardless of where the EMI is licensed.

What the practitioner does: the MLRO completes the examen especial on the file, restricts the account under internal procedures (not because SEPBLAC requires a freeze — it does not — but to stop further victim funds), and files an F19 with the full transaction list, the recall correspondence referenced in the narrative, and the identification of the account holder. The customer is told nothing beyond neutral service messaging, to stay clear of Article 24.

6. Worked example — structuring below thresholds at a payment institution

Facts: a Payment Institution offering money remittance sees a customer send twelve transfers of €900–€990 each to three different beneficiaries in a high-risk jurisdiction over one month, having declared expected monthly volume of €500. When asked for source-of-funds evidence, the customer supplies a payslip that does not match the volumes.

What the rule says: deliberate fragmentation to stay under identification or reporting thresholds is itself an indicator of suspicion — the amounts individually are unremarkable, but the design of the behaviour is the red flag. The failed source-of-funds explanation converts an unusual pattern into unresolved suspicion under Article 18.

What the practitioner does: file the SAR describing the structuring pattern as a whole — dates, amounts, beneficiaries, the customer’s explanation and why it fails — rather than reporting any single transfer. The firm then decides, under its own acceptance policy, whether to exit the relationship; exiting does not extinguish the duty to report what already happened.

7. What goes in a SAR

Whatever the channel, the substantive content is the same:

• Identification of the obligated subject and its registered representative
• Identification of the customer(s) and any beneficial owners
• Description of the operations — amounts, dates, channels, counterparties
• The indicators of suspicion, explained in a narrative, not a tick-box
• Internal investigation steps already taken — monitoring alerts, KYC refresh, the examen especial itself
• Whether the relationship has been restricted or terminated

The narrative is what SEPBLAC’s analysts actually work from. A good one states the typology up front, walks the money, and separates fact from inference. A bad one dumps raw transaction data and lets the analyst guess the theory.

8. The two channels, side by side

For confirmed mule cases with multiple linked subjects, note that Spain also operates an aggregated reporting route — see our mule-account aggregated reporting piece. For the equivalent regimes elsewhere, see TRACFIN in France, FIU-Nederland and §43 GwG in Germany.

9. FAQ

10. What to do, today

• MLRO: confirm your AML representative is registered with SEPBLAC before any Spanish activity — no F22, no filings.
• Compliance ops: document the SAR workflow end-to-end — detection, examen especial, decision, submission, record — because inspections pull on that thread first.
• Team leads: build a fixed internal template for F19 filings (narrative, parties, transaction list) so the manual form becomes transcription, not drafting.
• COO: if you expect more than a handful of SARs a month, budget dedicated F19 capacity now and track the 2026–2027 modernisation for the tooling upgrade.

Related: AMLA’s harmonised STR format · What is SEPBLAC? · What is the DMO? · Registering your AML representative (Modelo F22) · How to file a SAR in Luxembourg (CRF, goAML) · Funds transfer information under Reg 2023/1113