What is SEPBLAC?
SEPBLAC sits at the centre of every AML obligation in Spain — and is unusual in Europe in being both a financial-intelligence unit and a supervisor. If you hold a Spanish licence, or you passport into Spain on Freedom of Services and trip the operator’s threshold, this is the body you report to. This piece walks through what SEPBLAC is, the legal framework it operates under, and the four reporting tracks that obligated subjects have to deliver.
1. What SEPBLAC stands for and does
SEPBLAC — Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias — translates roughly as “Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences”. It performs two functions that are usually split between separate agencies in other EU member states:
- Financial Intelligence Unit (FIU). SEPBLAC receives, analyses and disseminates intelligence on money-laundering and terrorism-financing — the Spanish counterpart of FIU-NL (Netherlands), TRACFIN (France), UIF (Italy) or FIU Germany.
- AML/CTF Supervisor. Independently of any prudential supervision exercised by Banco de España or CNMV, SEPBLAC inspects obligated subjects for compliance with their AML duties and can fine them for breaches.
This dual role matters in practice: the same body that receives your suspicious-activity reports also visits you for AML inspections. There is no informational firewall between intelligence and supervision.
2. The legal framework — Ley 10/2010
The backbone is Ley 10/2010, de 28 de abril, on the prevention of money-laundering and terrorism-financing — the Spanish transposition of the EU AML directives, refreshed regularly to cover the Fourth, Fifth and (in 2025) Sixth Directives. It defines who counts as an “obligated subject” (sujeto obligado), what their core duties are, and who supervises compliance.
Obligated subjects include:
- Credit institutions (banks)
- Payment institutions and electronic money institutions — including those passporting into Spain
- Investment firms and fund managers
- Insurance and reinsurance undertakings
- Crypto-asset service providers (CASPs)
- Notaries, lawyers, real-estate professionals — when handling regulated transactions
3. The four reporting tracks
SEPBLAC compliance breaks into four distinct streams of data:
- Suspicious-activity reports (SARs) — the comunicación por indicio: event-driven, filed when there is a reasonable suspicion of money-laundering or terrorism-financing. More on how to file a SAR in Spain.
- Systematic monthly reporting (DMO) — the Declaración Mensual de Operaciones: scheduled disclosure of operations defined in Article 20 of Ley 10/2010. More on the DMO.
- Financial-ownership file feed (FTF) — the Fichero de Titularidades Financieras: a register of accounts, safe-deposit boxes and authorised representatives, queried by tax and law-enforcement agencies. More on the FTF.
- Risk-based self-assessments and on-site inspections. Periodic submission of internal risk assessments, plus reactive responses to SEPBLAC’s requerimientos when an inspection is opened.
4. How submissions are technically made
SEPBLAC operates two delivery channels for structured reporting:
- EDITRAN — the secure file-transfer system inherited from Banco de España’s reporting infrastructure, used for high-volume systematic reporting (DMO, FTF). More on EDITRAN.
- SEPBLAC web portal — for SAR filings, ad-hoc disclosures, and the F19 form used by non-bank obligated subjects.
The split is mostly historical: banks were the first obligated subjects, so they were plugged into BdE’s existing pipes. Non-bank entrants — EMIs, PIs, CASPs — fill the same gaps via the web portal, generally with less ergonomic tooling.
5. Core AML duties beyond reporting
Reporting is the visible output. Underneath sit the day-to-day obligations every obligated subject runs:
- Customer due diligence (diligencia debida) — KYC at onboarding, ongoing monitoring, enhanced due diligence for higher-risk relationships.
- Internal control framework — written manual, designated representative (representante), training programme.
- Risk assessment — entity-level risk model refreshed at least annually.
- Record retention — ten years.
- External audit of AML controls — annual independent expert review for most categories.
6. Passporting in — when SEPBLAC is your supervisor
An EMI or PI authorised in another EU member state and operating in Spain on Freedom of Services or via a branch is still an obligated subject under Ley 10/2010 for activity carried on in Spain. Branch operations are squarely within SEPBLAC’s supervisory perimeter; FoS activity is in scope on a more case-by-case basis but generally caught above modest volume thresholds. The first practical step on entering Spain is to designate a Spanish AML representative and notify SEPBLAC of the appointment.
7. FAQ
What does SEPBLAC stand for?
Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias — the “Executive Service” of the Commission for the Prevention of Money Laundering and Monetary Offences. It is Spain’s combined FIU and AML supervisor.
Is SEPBLAC the same as Banco de España?
No. SEPBLAC is administratively independent of BdE, although it shares some technical infrastructure (notably EDITRAN). BdE handles prudential supervision; SEPBLAC handles AML.
Do EMIs and Payment Institutions have to report to SEPBLAC?
Yes. Article 2 of Ley 10/2010 lists EMIs and PIs as obligated subjects. The full set of duties — SARs, DMO, FTF, internal controls — applies, regardless of whether the EMI is Spanish-licensed or passporting in.
What is the main law I need to know?
Ley 10/2010, de 28 de abril, on the prevention of money-laundering and terrorism-financing — and its implementing regulation, Real Decreto 304/2014.
Where do I designate my AML representative?
Through Modelo F22 — SEPBLAC’s representative-registration form. The full process and supporting-document list is in our companion piece.
Related: How to file a SAR in Spain · What is the DMO? · What is the FTF? · What is EDITRAN?
