What is the FTF? Spain’s Fichero de Titularidades

Spain’s bank account register is not a bank-only obligation — payment and e-money institutions declare to it too, and most of them under-declare. The Fichero de Titularidades Financieras — the FTF — lets Spanish judges, prosecutors, police and the tax agency find, in one query, every account a person holds in Spain. It runs on a fixed-width text file sent monthly over a dedicated transmission network, and the commonest scoping error is treating the safeguarding ledger as out of scope. This piece covers who declares, what counts as a declarable product, the file mechanics and four worked cases.

1. What the FTF is

The FTF is created by article 43 of Ley 10/2010, de 28 de abril and its operation set out in articles 50 to 57 of Real Decreto 304/2014. Article 50 describes it plainly: a file of an administrative nature, created to prevent and impede money laundering and terrorist financing. Article 43 adds a second purpose — the detection, investigation and prosecution of serious crime.

Ownership and processing are split. The Secretaría de Estado de Economía y Apoyo a la Empresa is the controller; SEPBLAC, Spain’s financial intelligence unit, is processor and sets the technical characteristics. SEPBLAC writes the instructions and runs the validation, but the register is not its own intelligence database. It is Spain’s version of the centralised automated mechanism EU anti-money-laundering law requires of every Member State.

2. Who declares — and the wording trap in the regulation

Article 43(1) of Ley 10/2010 names the declaring entities directly: las entidades de crédito, las entidades de dinero electrónico y las entidades de pago — collectively las entidades declarantes. SEPBLAC’s instructions expand that into an operational list: banks, savings banks and credit cooperatives; e-money institutions; payment institutions; and the Spanish branches of foreign credit, e-money and payment institutions.

Here is the trap. Article 51 of Real Decreto 304/2014 still says only entidades de crédito. The primary law was widened; the implementing regulation’s wording was not conformed to it, so a firm reading only the reglamento can reach the sincere but wrong conclusion that an EMI or payment institution has nothing to file.

Branch status is the second scoping point. A branch in Spain of an EEA payment or e-money institution declares. What it does not declare, under both articles, are the accounts of the foreign branches and subsidiaries of Spanish declaring entities. The perimeter is products booked in Spain, not products booked by the Spanish group.

3. What counts as a declarable product

Article 43 lists current accounts, savings accounts, deposits, any other type of payment account, and safe-deposit box rental contracts with their rental period. A declarable “other payment account” is any account in the name of one or more payment service users, used to execute payment operations as defined in Real Decreto-ley 19/2018. Then comes the sentence that decides most implementations:

• All payment accounts opened by payment and e-money institutions for their clients are declarable — including accounts used exclusively to record each client’s individual balance and movements within the safeguarding account, where they are not themselves used to settle transactions with third parties through payment systems.
• Credit cards and prepaid cards are not payment accounts for FTF purposes and create no declarable product on their own. Where a card is attached to a declarable account, the account is declared and the card is not.
• Safe-deposit boxes are declared as rental contracts, with the rental type and, where applicable, period.

Numbering is prescribed: current accounts in IBAN format; savings accounts, term deposits and safe-deposit boxes in IBAN where one exists, otherwise — with justification — in a structured alternative built from the bank code.

4. Which people are declared

The declaration carries identifying data for everyone with a relationship to the product, not only the customer. SEPBLAC defines five intervener types, declared separately:

For each intervener the file carries full name or corporate name, document type and number, country of issue, date of birth or incorporation, nationality and country of residence. For products, article 43 requires the identifying numbering, the product type and the opening and cancellation dates.

So the FTF extract cannot be built from the account table alone. It needs account joined to party joined to role — plus the beneficial-ownership record, which in most payments firms lives in the onboarding system, not the core ledger.

5. Cadence, channel and the negative file

The declaration is monthly. Article 51(2) of Real Decreto 304/2014 sets the window: the file must be sent within the first seven business days of the following calendar month, covering openings, cancellations and modifications of products, and changes in intervener data, recorded in the immediately preceding calendar month.

Business days are counted SEPBLAC’s way, not the Spanish administrative default: every day is a business day except Saturdays, Sundays and national holidays that are non-substitutable or unsubstituted, as published in the Boletín Oficial del Estado. Regional holidays do not extend the window — a Madrid or Barcelona holiday in the first week is a working day for FTF purposes.

An entity with nothing to declare does not stay silent. It sends a negative monthly file — type N — within the same seven business days. One narrow exemption exists: an entity that markets no declarable product notifies that on the annex 1 model, signed by its representative before SEPBLAC, at least a month before its obligation starts, and then sends no files at all.

Transmission is exclusively telematic and exclusively over EDITRAN, on TCP/IP, encrypted with the public-key software SEPBLAC specifies — currently RSA with TD3 under EDITRAN 5.0 and AES-256 under EDITRAN 5.2. One text file per transmission, character set ISO 8859-1. Connection parameters come from the EDITRAN FTF parameters document; annex 4 identifies the entity’s destination for SEPBLAC’s return traffic.

6. File types and record structure

Four file types exist, and the wrong one is a common cause of rework:

• Monthly file — the ordinary return, which may be split across several files for one month.
• Negative monthly file (N) — nothing to declare. It may not answer a SEPBLAC requirement, except one caused purely by late submission of the monthly file.
• Complementary file — corrects errors and omissions already sent, and declares the deferred cases below once they mature. Sent immediately, not held to the next month.
• Transfer file to a non-declaring entity — where a portfolio moves to a non-declarant.

Inside a file, information is organised as typed fixed-width records. A header, type 00, must be the first line and appear exactly once, carrying the declaring entity, the file identification and type and, where relevant, the SEPBLAC requirement reference. Products are type 10, renumbering 11, interveners 20, name changes 21, document changes 22, intervention type 30, end-of-product 19, end-of-file 99. Each carries an action: A add, M modify, X delete something declared in error.

7. What happens after you send

SEPBLAC returns an acknowledgement over EDITRAN with the outcome of a preliminary validation phase, in one of three states:

• Admitted — the file passes straight to processing.
• Pending processing — the file needs e-mail confirmation. This is the only state in which a file can still be deleted, and it is triggered by a delete action (X), by a declared transfer to a non-declaring entity, or by a file received after one already in either state.
• Not accepted — reasons are given and the file is not processed.

Processing then produces total acceptance, partial acceptance or rejection, with a .txt acknowledgement over EDITRAN. Two points follow. Every file received is logged, including files not accepted or deleted at the entity’s request — so filenames must never be reused. And SEPBLAC publishes a validation tool that checks formats and conditions before submission; running it is the difference between a partial acceptance you discover afterwards and one you never create.

Miss the article 51(2) window and SEPBLAC sends a requirement in .txt over EDITRAN. The entity must send the file quoting the requirement reference and e-mail a reasoned justification within ten business days; SEPBLAC audits these late submissions. Article 51(3) uses the same clock for omitted or erroneous data, and puts responsibility for the quality, integrity and truthfulness of declared data on the declaring entity, which must validate at source.

8. Four worked cases

Case 1 — the safeguarding ledger. An EMI holds client funds in one safeguarding account and keeps per-client sub-ledgers that never touch a payment system directly. The implementation team reads them as internal bookkeeping and leaves them out. Wrong: SEPBLAC’s definition names exactly this case. The rule is one declarable product per client relationship with its own balance, regardless of external settlement. Outcome: the population is the client base, not the externally-settling accounts.

Case 2 — remote onboarding not yet complete. A customer completes video identification on 20 March but the file still awaits one of the conditions in article 12(1)(a), (b) or (c) of Ley 10/2010. Instinct says declare the opening in the March file; the instructions say the opposite — products contracted by telephone, electronic or telematic means with customers not physically present must not be declared while none of those conditions has occurred. When the condition is met it goes in a complementary file immediately, not the next monthly one.

Case 3 — the company still being incorporated. An account is opened for a sociedad en constitución with no tax identification number yet. If the product has other holders (TIT), the opening is declared that month, omitting the incorporating company, which is added by complementary file once its mandatory data exists. If it is the only holder, the whole product is omitted and declared later the same way. Outcome: two answers from one fact pattern, decided by whether another holder exists.

Case 4 — a deletion you want back. An analyst finds fifty accounts declared against the wrong product type and builds a complementary file of X actions. The acknowledgement returns pending processing — the only moment the file can still be pulled. Confirm the deletions against the source extract before replying: once confirmed, the file processes and the only route left is another correction cycle.

9. Who can query the register

Declaring is one half of the FTF; being queried is the other, which is why data quality is enforced so tightly. Article 43(3) gives access, in money-laundering or terrorist-financing investigations, to the competent courts, the Ministerio Fiscal and the European Public Prosecutor’s Office, and to:

• State security forces and autonomous police forces with statutory competence over serious crime.
• Asset-recovery bodies, including the Oficina de Recuperación y Gestión de Activos.
• The secretariat of the terrorist-financing monitoring commission, for freezing measures under Ley 12/2003.
• The Centro Nacional de Inteligencia.
• The Agencia Estatal de Administración Tributaria and the Haciendas Forales, against fraud.

Every request goes through a designated single access point, must be reasoned, and is logged for five years. Article 52 of Real Decreto 304/2014 adds the constraint that matters most: requests must identify the person, persons or account number concerned, and open, generic or approximate searches are not admissible. Article 51(4) confirms the declaration displaces no other AML obligation — in particular the suspicious-activity report under article 18.

10. What to do, today

• Settle scope in writing — article 43 of Ley 10/2010 puts EMIs and payment institutions in, including Spanish branches; article 51 of the reglamento is narrower only in wording.
• Count the declarable population from the client ledger, not the payment rails. Per-client safeguarding sub-accounts are in; cards, on their own, are out.
• Build the extract as a three-way join — product, party, role — and check the beneficial-ownership system can supply TRE records for every corporate holder.
• Calendar the seven-business-day window using national holidays only, with an internal cut-off at day four to leave room for a rejection and a resend.
• Run SEPBLAC’s validation tool before every transmission, and never reuse a filename.
• Schedule the negative file rather than treating it as an exception.
• Keep a deferred-declaration register for remote onboardings pending article 12(1) conditions and companies in formation.

Related: What EDITRAN is and how SEPBLAC files move · What SEPBLAC is and what it supervises · Bank account registers compared across the EU · FICOBA, the French account register · ITA — file exchange with the Banco de España · Modelo 170 — Spain’s monthly card and mobile-payment return