Órgano de control interno (OCI): Spain’s AML control body

Spain’s órgano de control interno (OCI) is the internal AML body that every payment and e-money institution operating in Spain must set up under Article 26 ter of Ley 10/2010, and no size exemption reaches them. It is a collective body, separate from the representante ante el Sepblac, that applies the AML policies and keeps minutes of its decisions. Article 35 of Real Decreto 304/2014 sets the detail, and Real Decreto 813/2026 rewrites the representative half of that article from 28 October 2026. Below: who needs an OCI, how it must work, how it splits the job with the representative and the technical unit, and three cases.

1. The texts

The OCI rules are spread across one law, one regulation and SEPBLAC guidance:

• Ley 10/2010, de 28 de abril, Article 26 ter, inserted by Real Decreto-ley 11/2018. It creates both the representative before the Servicio Ejecutivo de la Comisión (SEPBLAC) and the internal control body, and lets the Regulation set exemptions and decide who needs a technical unit.
• Real Decreto 304/2014, de 5 de mayo, the AML Regulation. Article 35 (“Órganos de control interno”) covers the representative (35.1), the OCI (35.2) and the technical unit (35.3). Articles 25.2, 31.2, 33.1.h) and 34.j) give the OCI specific roles.
• Real Decreto 813/2026, de 7 de octubre (BOE-A-2026-20915), whose article five, point ten, replaces Article 35.1 from 28 October 2026. Paragraphs 35.2 and 35.3 are not amended.
• SEPBLAC’s recommendations on internal control measures, published on its website as guidance for Articles 26, 26 bis and 26 ter. They list what the AML manual should say about the OCI.

The Law also gives the OCI other roles: it approves the annual training plan (Art. 29), and records more than five years old are accessible only to the internal control bodies (Art. 25.1).

2. Who must have an OCI

Article 35.2 RD 304/2014 makes the OCI the default for every obligated subject. The only exemption covers obligated subjects in letter i) onwards of Article 2.1 Ley 10/2010, plus insurance brokers, that have fewer than 50 staff (agents included) and annual turnover or balance sheet of no more than EUR 10 million. In those cases the representative carries out the OCI’s functions. The exemption does not apply to a firm in a group that exceeds those figures.

Payment institutions, e-money institutions and their agents sit in letter h) of Article 2.1. They are outside the exemption at any size. A five-person e-money institution needs an OCI just as a large one does.

Foreign firms are covered by the closing paragraph of Article 2.1. Non-resident persons or entities that carry out the same activities in Spain through branches, agents or cross-border services are subject to the Law. A Spanish branch of an EU institution is therefore an obligated subject in its own right, with its own representative and its own OCI. Article 26 ter.3 then distinguishes two other cases:

• an EU firm operating through agents or another permanent establishment that is not a branch must appoint a representative resident in Spain, who acts as the central contact point;
• an EU firm operating under the freedom to provide services must also appoint a representative before SEPBLAC, but residence in Spain is not required.

3. How the OCI has to work

Article 26 ter.4 makes the OCI responsible for applying the policies and procedures in Article 26. The Law and the Regulation then add these conditions:

• Composition. Where relevant, the OCI includes people from the firm’s different business areas (Art. 26 ter.4).
• Meetings and minutes. It meets as often as the internal control procedure provides, and it takes express minutes (acta) of the decisions it adopts (Art. 26 ter.4).
• Resources. The OCI and the representative must have the material, human and technical resources they need (Art. 26 ter.5).
• Independence from audit. AML bodies work with functional separation from the internal audit department or unit (Art. 26 ter.6).
• Written description. The AML manual describes how the internal control bodies work, including their composition, powers and meeting frequency (Art. 33.1.h) RD 304/2014).
• Line to the business. Internal procedures must keep a direct line of communication between the OCI and the sales network (Art. 34.j)).
• Approving procedures. The board approves the AML policies and procedures. Where annual turnover exceeds EUR 50 million or the balance sheet exceeds EUR 43 million, the procedures that implement those policies may be approved by the OCI instead (Art. 31.2).

SEPBLAC’s recommendations add that the manual should state the members and their positions, where the OCI sits in the organisation chart, and its functions. Minutes should record everything discussed and decided. At least once a year the OCI should produce a report with the main AML events and statistics, such as alerts, special examinations, reports filed and progress on the external expert’s recommendations.

Failing to set up adequate internal control bodies, or to resource them, is a serious infringement under Article 52.1, letters ñ) and o), Ley 10/2010.

4. OCI, representative and technical unit compared

The representative must be resident in Spain and hold an administration or management position in the company (Art. 26 ter.1). Where a group contains several obligated subjects, there is a single representative, who must hold such a position in the group’s parent company. Under Article 30.1 the representative is also the person who appears in any administrative or judicial proceedings about the content of reports to SEPBLAC.

5. The reporting decision: representative or OCI

Article 25.2 RD 304/2014 sets the default. Once the technical analysis of a special examination is finished, the representative decides, with reasons and without delay, whether to report the case to SEPBLAC. The internal control procedure may instead send that decision to the OCI first. If it does, the OCI decides by majority, and the minutes must record how each member voted and why.

With the second route every vote is on the record. The manual should say which route the firm uses and, if only some cases go to the OCI, which ones. Our piece on the examen especial covers the analysis that comes before this decision.

6. What Real Decreto 813/2026 changes

Real Decreto 813/2026 was published in the BOE on 8 October 2026 and enters into force twenty days later, on 28 October 2026. For Article 35 it rewrites paragraph 1 only:

• Responsible declaration. The obligated subject proposes the representative, and any authorised persons, through a declaración responsable stating that the appointee meets every requirement of Ley 10/2010 and the Regulation. The representative signs the declaration for authorised persons.
• Evidence on file. The firm keeps the documents supporting the declaration available for SEPBLAC to examine and check on request, as part of its Article 25 record-keeping.
• Portal forms. Appointments, removals and data updates go through the procedures and forms on SEPBLAC’s website, and the data must be kept up to date. SEPBLAC’s procedures page lists two: the proposed appointment of the representative and the notice of persons authorised by the representative.
• Three authorised persons in groups. The representative may still designate up to two authorised persons, or up to three where the obligated subjects form a group.

The 2014 wording, which required a detailed professional history and let SEPBLAC raise reasoned objections, is no longer in Article 35.1. Article 26 ter.2 of the Law still refers to a professional history and to objections, subject to exceptions set by regulation. The safe reading is to keep the CV in the evidence file. The nine-month transitional period for small entities to notify a representative does not apply to payment or e-money institutions. Our full RD 813/2026 article sets out the rest of the reform.

Nothing in the decree changes the OCI itself, its exemption or the technical unit thresholds.

7. Worked case: a new EU e-money branch

Facts: an EU e-money institution opens a Spanish branch with 30 staff and proposes to treat its head-office AML committee as the branch’s OCI.

Applicable rule: the branch is an obligated subject under the closing paragraph of Article 2.1 Ley 10/2010. As a letter h) entity it cannot use the Article 35.2 exemption at any size. It needs its own representative, resident in Spain and holding a management position, and an OCI responsible for applying the AML procedures in Spain.

What the compliance officer does: sets up a Spanish OCI with the representative, the branch’s business heads and compliance, and writes its composition, powers and meeting frequency into the Spanish manual. Reporting lines from the Spanish OCI to the group committee are documented separately. The OCI approves the branch’s annual training plan.

Outcome: the external expert and SEPBLAC find a Spanish body with its own minutes.

8. Worked case: a group with two Spanish entities

Facts: a group runs a Spanish payment institution and a Spanish e-money institution. Each has its own representative and two authorised persons.

Applicable rule: under Article 26 ter.1, a group with several obligated subjects has a single representative, who holds an administration or management position in the parent. From 28 October 2026, Article 35.1 RD 304/2014 lets that representative designate up to three authorised persons, by a signed responsible declaration.

What the compliance officer does: confirms the parent under Article 42 of the Commercial Code, moves to one representative there through the SEPBLAC portal forms, picks three authorised persons across both businesses and builds an evidence file for each declaration.

Outcome: one accountable person for SEPBLAC and a file ready when SEPBLAC checks the declarations.

9. Worked case: a split OCI vote

Facts: a payment institution’s manual sends high-value cases to the OCI for the reporting decision. In one case, three members vote to report and two vote not to. The draft minutes say only that the OCI decided to report.

Applicable rule: Article 25.2 RD 304/2014. When the OCI takes the decision, it decides by majority, and the minutes state how each member voted and why.

What the compliance officer does: sends the minutes back to record each member’s name, vote and reasoning. Checks that the report goes to SEPBLAC without delay, as Article 26.1 requires, and does not wait for the minutes to be signed. Files the minutes with the special-examination record.

Outcome: a decision trail that holds up in inspection and in the annual external review under Article 28 Ley 10/2010.

FAQ

What to do, today

• MLRO / representative: check that the manual describes the OCI’s composition, powers and meeting frequency, and says whether the representative or the OCI takes reporting decisions.
• OCI secretary: review a year of minutes; every OCI reporting decision should show each member’s vote and reasons.
• Compliance: before 28 October 2026, prepare the evidence file behind the representative’s and authorised persons’ responsible declarations. Groups should decide whether to use the third authorised person.
• Finance: check turnover and balance sheet against the EUR 50 million / EUR 43 million thresholds for the technical unit, and diary the check each year.
• EU branches: confirm the Spanish OCI is a branch body with its own minutes.

Related: SEPBLAC representative appointment · Real Decreto 813/2026 amendments · Examen externo annual AML review · The SEPBLAC EP/EDE questionnaire (RIE)