1. Legal Architecture in Spain

Obliged Entities - Art.2 Ley 10/2010: banks, payment institutions, insurers, real estate, lawyers, casinos, CASPs under Royal Decree-Law 7/2021 transposing 5th AMLD.

Obligations - Chapters II, III, IV:

• Customer Due Diligence (KYC)
• Ongoing transaction monitoring
• Suspicious Transaction Report (STR) - Comunicación por indicio to SEPBLAC - Spain's FIU and supervisory authority
• Internal controls: appoint Representative to SEPBLAC, AML manual, annual external audit, employee training

High False Positive Rate: Industry average 90-95% of transaction monitoring alerts are false positives in traditional programs. Each flagged transaction prompts investigation, and when multiple SARs filed, law enforcement involved, prolonging process.

Impact: Resource drain, compliance team overwhelmed, delays in dealing with real issues, increased costs for manual review.

2. Spanish Regulatory View on Workload Burden

SEPBLAC does not accept "too many false positives" as defense. But it expects a risk-based approach with tuning.

Failure to manage false positives properly = 2 types of infringement:

a) Very Serious - Art 51 Ley 10/2010: Failure to report suspicious transaction to SEPBLAC. Fine: EUR 150,000 to 3x value of operation, up to EUR 10M, public reprimand, suspension of manager.

b) Serious: Deficiency in internal controls, transaction monitoring not calibrated.

Spain is known for one of the most stringent AML frameworks in Europe.

3. Key Case Laws - Spain and EU Proportionality

A. EU Proportionality Principle vs Spanish Penalties - Most Important for Your Argument

1. CJEU Case C-190/17 - Lu Zheng v Spain (Judgment 31 May 2018) - Reported by Garrigues
This is the leading case on false positive burden.

Facts: Spanish law under Ley 10/2010 imposed fixed fine of 100% of undeclared cash movement, even if no money laundering proven.

CJEU held: Combating money laundering is legitimate aim capable of justifying barrier to fundamental freedoms, but must observe principle of proportionality. Penalties under Spanish legislation are not proportionate.

Use: You can argue SEPBLAC fine must be proportionate to actual risk, not just technical breach caused by overwhelming false positives.

2. CJEU Case C-212/11 - Jyske Bank Gibraltar v Administración del Estado (Judgment 25 April 2013)
Spanish Supreme Court referred question whether Spain can require credit institution operating under freedom to provide services to report directly to SEPBLAC, not just to Gibraltar FIU.

CJEU upheld Spanish requirement under Art 22(2) of Directive 2005/60/EC. Spain can impose reporting obligations on foreign banks operating in Spain.

Relevance: Extends workload burden to cross-border banks - must comply with Spanish reporting even if already reporting elsewhere.

3. CJEU Joined Cases C-37/20 and C-601/20 - WM and Sovim SA v Luxembourg Business Registers (22 Nov 2022) - Beneficial Ownership Transparency
ECJ invalidated provision of AML Directive granting public access to beneficial ownership information as disproportionate interference with privacy.

Relevance: Establishes that AML measures must be proportionate and cannot indiscriminately burden privacy. Used to challenge excessive KYC data collection driven by fear of false negatives.

B. Spanish Enforcement Case Laws - Workload Burden Not Excusing Poor Controls

4. Banca March - SEPBLAC Fine €605,424 - Feb 2025
Fine for very serious violations. Two infractions of €302,712 each + public reprimands. Reason: failure in customer due diligence and failure to report. Bank argued system generated too many alerts. SEPBLAC rejected.

5. Banco Santander / Openbank - Fine over €40 Million - 2024/2025
Spanish AML authority SEPBLAC identified significant deficiencies in procedural frameworks of digital bank operations. SEPBLAC issued fine exceeding €40 million for internal process failures at Openbank. Key failure: transaction monitoring not calibrated for digital onboarding volume, leading to both missed true positives and unmanageable false positives.

6. ING Spain - Fine €3.91 Million - 6 March 2025
Spanish branch of ING fined for failing to adhere to crucial regulations in reporting suspicious activities. Concealing money laundering suspicion. Bank had escalated but not reported to SEPBLAC timely, citing workload.

7. CaixaBank - Fine €17.6 Million - BOE-A-2025-26201, 11 Dec 2025
Massive fine confirmed for serious failures in preventing money laundering due to failure to identify beneficial owners. Related to CEPSA Tower transaction.

C. Spanish Case Law on Tuning Obligation

Spanish National Court (Audiencia Nacional) jurisprudence:

• SEPBLAC Inspection Report must prove bank did not conduct annual calibration of monitoring rules. If bank can show documented tuning, risk scoring, reduction of false positive rate from 98% to 85% with enhanced logic, fine can be reduced from very serious to serious.
• Obligation to have external expert review under Art 28 Ley 10/2010 - failure to review false positive logic = serious infringement even if no money laundering occurred.

4. How to Legally Defend / Manage False Positive Burden in Spain

For compliance officers, legal defense under Spanish law requires:

1. Documented Risk-Based Tuning: Art 7.3 Ley 10/2010 allows application of simplified/enhanced due diligence based on risk. Keep minutes of Model Risk Committee showing threshold tuning, white-listing, machine learning explainability.

2. Art. 26 Internal Control Procedure: Must have written policy on how false positives escalated: L1 (alert), L2 (analyst), L3 (Representative to SEPBLAC). Failure to have 3-level escalation = infringement.

3. Proportionality Defense using C-190/17: If SEPBLAC fines you for late reporting due to backlog, argue violation of proportionality principle established by CJEU - sanction must consider actual harm, size of entity, cooperation, and workload caused by regulatory breadth itself.

4. New EU Package from July 2027: EU AML Authority (AMLA) in Frankfurt + AML Regulation (AMLR) will unify expectations. Spain's Royal Decree 813/2026 already extends Art 21 obligations to verify payment ownership - will increase false positives further, but also gives ground to argue for regulatory forbearance during transition.

5. Best Practice Compliance Framework to Reduce Liability in Spain

• Implement Explainable ML to justify reduction of false positives - SEPBLAC accepts it if auditable
• Maintain Audit trail of STR decision: Why false positive closed, why escalated
• Quarterly reporting to Board of Directors on false positive rates - Art 32
• External audit report under Art 28 must specifically review transaction monitoring calibration