How to file a SAR in Spain

Filing a Suspicious-Activity Report in Spain looks straightforward on paper — but the channel you use depends on what you are licensed as, and the experience differs sharply between banks and everyone else. Banks plug into a mature interface inherited from Banco de España. EMIs, Payment Institutions, CASPs and other non-bank obligated subjects file the same content through a manual web form known as F19, with much less ergonomic tooling. SEPBLAC has signalled a 2026–2027 modernisation; until then, the gap is real.

1. Legal basis

The SAR obligation — comunicación por indicio — is set out in Article 18 of Ley 10/2010. An obligated subject must report any operation, attempted operation, or relationship for which there are indicia or certainty of money-laundering or terrorism-financing. The wording is broad on purpose; SEPBLAC’s “Catálogo Ejemplificador” gives sectoral examples that help calibrate what crosses the bar.

Reporting is owed to SEPBLAC alone — the obligated subject does not contact the police directly. Tipping-off the customer is a criminal offence under Article 24.

For the equivalent regimes in other jurisdictions, see TRACFIN in France, FIU-Nederland in the Netherlands and §43 GwG in Germany.

2. The bank channel

Credit institutions file SARs through SEPBLAC’s structured electronic channel — historically tightly integrated with Banco de España’s reporting infrastructure. This means automatic ingest from internal transaction-monitoring systems, structured fields, file-level acknowledgements, and a known operator-side workflow. Most large Spanish banks have been on this pipe for fifteen years; the tooling is mature.

3. The non-bank channel — F19

For a non-bank obligated subject filing more than a handful of SARs a quarter, this is operationally painful: each report is a manual data-entry pass, with re-typing of customer data already held internally. Small EMIs typically dedicate a named officer to F19 work; larger ones build internal tooling that ends in copy-paste at the boundary.

4. The 2026–2027 modernisation

SEPBLAC has publicly signalled a programme to replace the F19 web form with a structured intake channel comparable to the bank pipe — and to consolidate fragmented portals. Concrete dates have moved before, but the direction is clear: structured submission for non-banks during 2026–2027, harmonised with EU AMLA tooling. Until that channel is live, F19 remains the reality.

5. What goes in a SAR

• Identification of the obligated subject and the named representative
• Identification of the customer(s) and any beneficial owners
• Description of the operation(s) — amounts, dates, channels, counterparties
• The indicators of suspicion — narrative explanation, not just a tick-box
• Internal investigation steps already taken (transaction-monitoring alerts, KYC review)
• Whether the relationship has been frozen or terminated

6. What to do, today

• Designate your AML representative with SEPBLAC before going live in Spain — without a representative on file you cannot submit anything.
• Document your internal SAR workflow end-to-end: detection → investigation → decision → submission → record. Audits in Spain pull on this thread first.
• If you expect SAR volume above ~5 per month, build a structured internal log feeding the F19 form, even if the boundary itself is manual.

7. FAQ

Related: What is SEPBLAC? · What is the DMO? · Registering your AML representative (Modelo F22)