Asset freezes in Spain — Tesoro and article 42 Ley 10/2010
In Spain, the asset-freeze rulebook sits in article 42 of Ley 10/2010, and it was rewritten on 20 March 2026. The new text keeps the core — freezes apply to everyone, immediately, from designation — and adds a Treasury protocol for companies caught only through a sanctioned owner, explicit SEPBLAC supervision and a duty to assess sanctions-evasion risk. This guide covers the article as it now reads, how to notify a freeze to the Dirección General del Tesoro, how homonyms and releases work, and what a payment firm should change.
1. What Real Decreto-ley 7/2026 changed
Final provision six of Real Decreto-ley 7/2026, of 20 March, rewrote article 42 of Ley 10/2010 on the prevention of money laundering and terrorist financing. The decree-law was published in the BOE on 21 March 2026, applied from 22 March and was validated by the Congreso de los Diputados by a resolution of 26 March 2026. Its preamble ties the change to the war in Iran and to supply-chain continuity: companies that are not themselves sanctioned can stall because a sanctioned person owns them. It says Spanish law had no mechanism for this, while other Member States did.
The article now has six paragraphs. Paragraphs 1 and 2 carry the freezing rule and the Council of Ministers’ power to adopt countermeasures. Paragraphs 3 to 6 deal with protocols, supervision and risk assessment.
| Paragraph | What it says | Who acts |
|---|---|---|
| 42.1 | EU restrictive measures (art. 29 TEU / art. 215 TFEU) and UN Security Council resolutions on terrorism, terrorist financing and proliferation that impose freezes or bans on making funds available bind any natural or legal person, with immediate effect from designation | Everyone |
| 42.1, second subparagraph | A UN measure binds until an EU regulation takes it over; if the EU has not done so within one month, keeping the freeze requires an express resolution of the Director General of the Treasury | DG Tesoro |
| 42.2 | The Council of Ministers may adopt countermeasures against higher-risk third countries — from prior authorisation of transfers and systematic reporting to freezes and limits on correspondent relationships | Council of Ministers |
| 42.3 | DG Tesoro may agree protocols with companies that are subject to measures only because a sanctioned person owns or controls them, certified by an independent third party; it may recognise equivalent foreign protocols | DG Tesoro, the company, an independent certifier |
| 42.4 | SEPBLAC supervises and inspects compliance with the article, including protocol conditions | SEPBLAC |
| 42.5–42.6 | Obliged entities must have proportionate policies and procedures, including an assessment of the risk of evasion and non-implementation of financial sanctions; SEPBLAC may waive the assessment for a sector whose risks are understood — never for financial entities | Obliged entities |
Breaching the duty to apply financial sanctions or countermeasures under article 42 is a serious infringement under article 52.1.u of Ley 10/2010, and the Treasury’s own guidance notes that evading sanctions can also be a criminal offence.
2. The freeze and the notification: article 48 RD 304/2014
The operating rules are in the AML regulation, Real Decreto 304/2014. Article 48 names the Dirección General del Tesoro y Política Financiera as Spain’s competent authority for executing freezes. Once the EU regulation is in force, or the Council of Ministers agreement takes effect, any natural or legal person must freeze immediately. The freeze must then be notified immediately, in writing, to DG Tesoro, with all data on the holder, the amount and nature of the funds or economic resources frozen, and the surrounding circumstances.
The Treasury’s guidance note on international financial sanctions sets out the mechanics. The notification goes to the Subdirección General de Inspección y Control de Movimientos de Capitales, using the Treasury’s single notification template (plantilla única de notificaciones), through one of three routes:
- the electronic registry, addressed to the Subdirección General (DIR3 code EA0043022);
- e-mail to sancionesfinancieras@economia.gob.es;
- post or hand delivery to Paseo del Prado 6, 28014 Madrid, for the attention of the Subdirección General.
The same note applies the duty to a person who receives a payment from a sanctioned person, not only to one who holds funds at the moment of designation. For a payment institution, an inbound SEPA credit from a listed payer is therefore a freeze-and-notify event in its own right.
The Treasury also points to the separate reporting duties inside some EU regimes — such as the recurring reporting of deposits and transfers above set thresholds under Regulation (EU) No 833/2014 on Russia. Those run alongside the freeze notification and do not replace it.
3. Homonyms: freeze first, then ask
When a customer’s name matches a designated person, the Treasury’s note allows the firm to ask for help in verifying identity — without prejudice to the immediate freeze. The request goes through the same three channels. The Treasury then asks the Guardia Civil, the Policía Nacional and the Ministry of Foreign Affairs for information. Where data exist, it passes the answer back to the firm, which decides on that basis whether to release the funds.
Two points follow. First, the firm does not wait for the Treasury before freezing; the order is freeze, notify, verify. Second, the final decision to unblock a cleared homonym stays with the firm, so the case file must show what evidence supported it.
4. Releases and authorisations: articles 47 and 49
EU regimes allow the competent authority to release frozen funds or authorise specific payments in defined cases — basic needs, legal fees, prior contracts. In Spain these requests go to the same Subdirección General, under articles 47 and 49 of RD 304/2014.
| Request | Who files | What it must contain | Decision |
|---|---|---|---|
| Release of frozen funds (art. 49) | The depositary entity, at the holder’s request | The rule relied on, the circumstances justifying the request, authentic copies of supporting documents | Within six months; appeal (alzada) to the Director General |
| Authorisation of a transfer under countermeasures (art. 47) | The financial entity sending or receiving the transfer | Payer, payee, entities involved and purpose | Refused if any party is frozen or the purpose breaches the measure; six months; alzada |
The Treasury’s note states that release requests must go through the electronic registry. E-mail is accepted for notifications and homonym queries, not for release requests.
5. The new protocols for owned-or-controlled companies
Under EU sanctions practice, a company that a listed person owns or controls is generally treated as subject to the freeze, even if the company is not listed. Article 42.3 now lets DG Tesoro agree a protocol with such a company so it can keep trading. The company must put in place mechanisms ensuring nothing is made available to designated persons, and an independent third party must certify compliance. DG Tesoro may also recognise protocols or equivalent mechanisms approved by a third country’s authorities.
For a payment firm, a protocol changes how you treat the customer, not whether you screen. Ask for the protocol, check that it covers the activity running through your accounts, and keep the certification on file. SEPBLAC supervises compliance with protocol conditions under article 42.4, so expect examiners to ask how you know the customer is still within them.
6. Three worked scenarios
Scenario one — a listing on a Friday, a batch screen on Monday. An EU implementing regulation enters into force on a Friday and lists a person who holds an e-money account with a Spanish branch. The weekly screen runs on Monday. Rule: art. 42.1 Ley 10/2010 — immediate effect from designation; art. 48.3 RD 304/2014 — immediate freeze and written notification. What compliance does: freezes the account on Monday, finds a card payment and an outgoing transfer executed over the weekend, and notifies DG Tesoro by e-mail on the template, listing the balance and both transactions. It then moves screening to run on every list update. Outcome: the notification is complete, but the weekend transactions show a control gap that SEPBLAC can examine under article 42.4.
Scenario two — a credit from a listed payer. A SEPA credit transfer arrives for a business customer; the payer’s name matches a designated entity. Rule: the Treasury’s note — a person who receives a payment from a sanctioned person freezes it and notifies at once. What the analyst does: holds the credit and confirms the match against the list entry and the payer’s BIC and address. They notify through the electronic registry and record the case. Outcome: the funds stay frozen until the Treasury authorises otherwise. The business customer is told the credit is held under an administrative freeze.
Scenario three — a subsidiary with a protocol. A corporate customer is 60% owned by a newly listed individual and presents a Treasury protocol under article 42.3 with a third-party certificate. Rule: arts. 42.3 and 42.4. What compliance does: checks the protocol’s scope against the account activity and diarises the certificate renewal. It sets monitoring for payments to the owner or connected parties and records the review. Outcome: the account stays open within the protocol. Any payment outside it is frozen and notified.
7. FAQ
Who is the competent authority for asset freezes in Spain?
The Dirección General del Tesoro y Política Financiera, acting through the Subdirección General de Inspección y Control de Movimientos de Capitales (art. 48 RD 304/2014). SEPBLAC supervises compliance (art. 42.4 Ley 10/2010).
How do I notify a freeze?
Immediately and in writing, on the Treasury’s single notification template, through the electronic registry (DIR3 EA0043022), by e-mail to sancionesfinancieras@economia.gob.es, or by post to Paseo del Prado 6, Madrid.
Do UN designations bind before the EU acts?
Yes. Under article 42.1 they bind until an EU regulation takes them over. If the EU has not done so within one month, keeping the freeze needs an express resolution of the Director General of the Treasury.
Can I wait for the Treasury to confirm a homonym before freezing?
No. The Treasury’s note says verification requests are without prejudice to the immediate freeze. Freeze, notify, then ask.
Is the freeze notification the same as a report to SEPBLAC?
No. The notification goes to the Treasury under article 48 RD 304/2014. A suspicious-activity communication to SEPBLAC under article 18 of Ley 10/2010 is a separate decision, taken on its own facts.
What is the penalty for not applying sanctions?
Failing to apply financial sanctions or countermeasures under article 42 is a serious infringement under article 52.1.u of Ley 10/2010; evasion can also be criminal.
8. What to do, today
- Update the sanctions policy to cite article 42 as rewritten by Real Decreto-ley 7/2026.
- Write and approve the sanctions-evasion risk assessment required by article 42.5.
- Load the Treasury’s notification template, the DIR3 code and the mailbox into the freeze procedure.
- Re-screen on every list change, not on a weekly batch.
- Add a protocol check to onboarding and periodic review for companies owned or controlled by designated persons.
Related: EU asset-freeze reporting under Article 8 · What is SEPBLAC · Registre national des gels (France) · UIF freeze communications (Italy)
