Real Decreto 813/2026: Spain’s AML Regulation from 28 Oct
Real Decreto 813/2026 rewrites parts of Spain’s AML Regulation, Real Decreto 304/2014, from 28 October 2026. For payment and e-money institutions the substance is narrower than the headlines: remote onboarding keeps its four routes, but route (d) is now tied to the minimum requirements in SEPBLAC’s published general authorisations; sanctions and countermeasures become a written policy, a risk-analysis input and a mandatory chapter of the AML manual; and the appointment of the SEPBLAC representative moves to a responsible declaration. Below: the final BOE text against the wording it replaces.
1. The instrument and its dates
Real Decreto 813/2026, de 7 de octubre was published in the BOE of 8 October 2026 (BOE-A-2026-20915). It is an omnibus decree amending eleven financial-sector regulations. Its article five amends the Regulation of Ley 10/2010 approved by RD 304/2014, and its article eight amends RD 164/2019 on free basic payment accounts. Under the disposición final cuarta it enters into force twenty days after publication, which the BOE consolidated text records as 28 October 2026.
The disposición final segunda states that it partially incorporates Directive (EU) 2024/1640 (AMLD6). The preamble ties the reform to the FATF mutual evaluation of Spain starting in 2026. The transitional provisions add three dates: 28 April 2027 for gambling operators (DT 1.ª), 28 July 2027 for small non-financial entities to notify a representative (DT 2.ª), and 8 April 2028 for the digital DNI changes (DT 3.ª).
2. Non-face-to-face identification: the new article 21
Article 21.1 keeps its structure. A firm may establish a relationship or execute operations by telephone, electronic or telematic means with a customer who is not physically present if one of four circumstances applies: (a) identity established under the electronic-signature rules; (b) a copy of the article 6 identity document issued by a fedatario público; (c) the first payment comes from an account in the customer’s own name at an entity domiciled in Spain, the EU or an equivalent third country; or (d) another secure remote-identification procedure.
Route (c) survives unchanged. The change is in route (d). The 2014 text required that such procedures had been previously authorised by SEPBLAC. The new text requires that they meet the minimum requirements set in the general authorisations published by SEPBLAC. The preamble presents this as a legal-certainty measure. In practice the benchmark is the videoconference and video-identification authorisations, which already said that procedures built under them need no new authorisation.
The one-month tail is kept and slightly widened. Within a month of a remote relationship starting, the firm must obtain a copy of all the documents needed for due diligence (the old text said “the documents”). The new text also expressly preserves the exception in article 12.1.a) of Ley 10/2010: where identity is established with a qualified electronic signature, no document copy is needed, provided the identification data proving the procedure’s validity are kept.
Article 21.2 is new in substance but aimed at gambling. Online operators must check that the holder of the payment method used for deposits and withdrawals is the gaming-account holder. Existing players have six months to comply (DT 1.ª). The duty sits with the operator, not with the payment institution behind it.
3. Sanctions and countermeasures: articles 31, 32 and 33
Three linked amendments make international financial sanctions a formal part of the AML control framework rather than an adjacent process.
- Article 31.1: the written, approved policies and procedures must now cover not only money laundering and terrorist financing but also the application of international financial sanctions and countermeasures.
- Article 32.1: the prior risk analysis must take into account, as a minimum, the national risk assessment, the EU supranational risk assessment, relevant sectoral risk assessments by competent authorities, and authority-provided information on ML/TF risk and on the risk of non-implementation and evasion of sanctions. The customer, geography, product, channel and transaction dimensions are unchanged.
- Article 33.1: a new letter o) adds a structured procedure for applying international financial sanctions and countermeasures to the minimum content of the AML manual.
The freeze mechanics in Chapter V are adjusted too. Under the new article 48.3, a freeze ordered by an EU regulation or a Council of Ministers agreement is still applied immediately by any natural or legal person. The written communication to the Dirección General del Tesoro y Política Financiera is now expressly the duty of the obliged entities in article 2.1 of Ley 10/2010. Article 49.1 keeps release authorisations with the same Directorate General.
4. The SEPBLAC representative: article 35.1 and DT 2.ª
The new article 35.1 changes how the representative and the authorised persons are appointed:
- the proposal is made by a responsible declaration (declaración responsable) signed by the obliged entity, stating expressly that the appointee meets every requirement of Ley 10/2010 and the Regulation. Authorised persons are proposed by a declaration signed by the representative;
- the entity keeps the supporting evidence for those declarations available for SEPBLAC to examine on request;
- appointments, removals and data updates go through the forms on SEPBLAC’s web portal, and the data must be kept current;
- the representative may still designate up to two authorised persons, or up to three where the obliged entities form a group.
The 2014 text required a proposal with a detailed professional history, on which SEPBLAC could raise reasoned objections. That wording is gone from article 35.1.
The second change sits in article 31.1. Small entities in letters i) to u) of article 2.1 Ley 10/2010 (fewer than 10 staff including agents, and turnover or balance sheet of no more than EUR 2 million) remain exempt from articles 31, 32, 33, 38 and 39. Article 35 has been taken off that list, so they must now appoint a representative. DT 2.ª gives exactly that group nine months from 28 October 2026 to notify the appointment. Payment and e-money institutions are in letter h) and were never covered by the exemption, so the transitional period does not apply to them. Currency-exchange businesses (letter i) and postal giro services (letter j) do fall within it.
5. Before and after, article by article
| Provision | RD 304/2014 before 28 October 2026 | After RD 813/2026 |
|---|---|---|
| Art. 21.1.c | First payment from an own-name account in Spain, EU or equivalent country | Unchanged |
| Art. 21.1.d | Procedures previously authorised by SEPBLAC | Procedures meeting the minimum requirements of SEPBLAC’s published general authorisations |
| Art. 21.1, final paragraph | Copy of the CDD documents within one month | Copy of all CDD documents within one month, without prejudice to the qualified e-signature exception |
| Art. 21.2 | Gambling criteria set by DGOJ in the licensing process | Payment-method holder must match the gaming-account holder |
| Art. 31.1 | ML/TF policies; small i)–u) entities exempt from arts. 32, 33, 35, 38, 39 | Policies also cover sanctions and countermeasures; art. 35 removed from the exemption |
| Art. 32.1 | Documented risk analysis | Must draw on national, EU and sectoral assessments and sanctions-evasion risk information |
| Art. 33.1.o | — | Structured sanctions procedure in the AML manual |
| Art. 35.1 | Proposal with CV; SEPBLAC may object | Responsible declaration; evidence kept; portal forms; up to three authorised persons in groups |
| Art. 48.3 | Freeze communicated in writing to DG Tesoro | Communication expressly by art. 2.1 obliged entities |
| Art. 6.1.a / 28.1 | Physical DNI; ten-year retention of CDD records | Physical or digital DNI; retention includes e-ID information (from 8 April 2028) |
6. Articles 42, 66 bis to 68 ter: mostly the authorities’ side
The new articles mainly organise the public side of the system. Most do not create duties for firms.
- Article 66 bis: annual ML/TF statistics, compiled by the Commission’s Secretariat in the first half of each year. They include STR numbers, supervisory actions by sector, FTF searches and the value of assets frozen under sanctions.
- Article 67 bis: what SEPBLAC must make available to obliged entities, including risk assessments, AMLA guidance and high-risk third-country information. It passes designations under UN, EU or Council of Ministers measures to the representatives immediately. Paragraph 3 matters most: firms must still know and apply that information from the moment it is published.
- Article 67 ter: content of the national risk assessment, including sanctions-evasion risk, updated at least every four years.
- Article 67 quáter: SEPBLAC’s annual report, with FIU statistics, typologies and anonymised supervisory findings.
- Articles 67.7, 68, 68 bis and 68 ter: the Director’s single six-year term, and staff that regional police, central-government departments and the Centro Nacional de Inteligencia may assign to SEPBLAC.
The rewritten article 42 deals with foundations and associations. Its new paragraph 5 does reach payment firms: credit and financial institutions must take adequate measures to identify and assess the ML/TF risk of customers that are associations or foundations, and of their mitigating measures, and record in writing why they reject one as a customer.
7. Digital DNI and basic payment accounts
Article 6.1.a now accepts the DNI in its physical or digital version as defined in Real Decreto 255/2025. Article 28.1 adds information obtained through electronic identification means to the CDD records kept for ten years. Under DT 3.ª both changes apply eighteen months after BOE publication. A ministerial order will set the availability and technical means (disposición final tercera). Until then, the old paper-and-card baseline stands.
Article eight rewrites article 4.2 of RD 164/2019 on free basic payment accounts. Without the standard documents, a local social-services report is accepted and, exceptionally, information from non-profits in the national reception system or Third Sector social-action entities. The provision is addressed to credit institutions, not to PIs or EMIs.
8. Worked case: a video-identification flow
Facts: a Spanish EMI onboards retail customers by unassisted video-identification. Its manual says the procedure is “authorised by SEPBLAC under article 21.1.d”.
What the rule says: from 28 October 2026, article 21.1.d requires the procedure to meet the minimum requirements in SEPBLAC’s published general authorisations. The one-month document duty now covers all CDD documents.
What the compliance officer does: updates the citation and keeps a matrix mapping each specification of the authorisation to a control and its evidence. They also check that the one-month chase covers every CDD document, not just the ID.
Outcome: the flow does not change; the file now proves conformity with a published standard.
9. Worked case: a small bureau de change
Facts: a currency-exchange business with six staff, including agents, and EUR 1.4 million in turnover has never appointed a SEPBLAC representative. It is not part of a larger group.
What the rule says: it falls under letter i) of article 2.1 Ley 10/2010. Article 35 is no longer on the article 31.1 exemption list, and DT 2.ª gives it until 28 July 2027 to notify the appointment.
What the compliance officer does: picks a representative who meets the statutory profile, files the responsible declaration on SEPBLAC’s portal and keeps the evidence.
Outcome: the other exemptions stay, but the business now has a named SEPBLAC contact. A small PI gets no such window: letter h) was never exempt.
10. Worked case: sanctions inside the AML manual
Facts: a PI runs sanctions screening under a separate policy owned by operations. Its risk assessment does not mention sanctions evasion.
What the rule says: articles 31.1, 32.1 and 33.1.o require sanctions in the written policies, sanctions-evasion risk in the risk analysis, and a structured sanctions procedure in the manual. Article 48.3 makes the freeze notice to the DG Tesoro the PI’s own duty.
What the compliance officer does: moves the sanctions procedure into the AML manual, adds a sanctions-evasion section to the risk analysis with references to the sources consulted, and makes the DG Tesoro notification a named step in the freeze workflow.
Outcome: one control framework, not two.
FAQ
When does Real Decreto 813/2026 enter into force?
On 28 October 2026, twenty days after its BOE publication on 8 October 2026. The digital DNI and e-ID record-keeping changes apply from 8 April 2028.
Is the first-payment route for remote onboarding still available?
Yes, unchanged in article 21.1.c, and the one-month document duty still applies.
Do we need a new SEPBLAC authorisation for our video flow?
The new article 21.1.d does not mention a prior authorisation. It requires the procedure to meet the minimum requirements in SEPBLAC’s published general authorisations, so keep evidence that it does.
Does the nine-month representative window apply to payment institutions?
No. DT 2.ª covers only small obliged entities in letters i) to u) of article 2.1 Ley 10/2010. Payment and e-money institutions are in letter h).
Does Real Decreto 813/2026 transpose AMLD6?
Partially. The disposición final segunda states that it partly incorporates Directive (EU) 2024/1640.
Must we wait for SEPBLAC to send us new sanctions designations?
No. Article 67 bis.3 keeps the firm’s duty to know and apply designations from the moment they are published, whatever SEPBLAC sends to representatives.
11. What to do, today
- Manual: update the article 21.1.d citation and add the article 33.1.o sanctions procedure before 28 October 2026.
- Risk analysis: list the national, EU and sectoral assessments you used, and add a sanctions-evasion section.
- Representative: check that the appointment data on SEPBLAC’s portal are current. Groups may now name a third authorised person.
- Freezes: confirm the written notice to the DG Tesoro is a named step, owned by the obliged entity.
- Associations and foundations: make sure rejections of these customers are recorded with reasons.
- Diary 8 April 2028 for digital DNI acceptance and e-ID record retention, subject to the ministerial order.
Related: SEPBLAC video-identification · SEPBLAC representative · Spanish asset-freeze notification
