FINANCIAL INTELLIGENCE UNIT REPORTING UNDER SPANISH ANTI-MONEY LAUNDERING LAW

1. INTRODUCTION

Financial Intelligence Unit (FIU) reporting is a fundamental component of anti-money laundering (AML) and counter-terrorist financing (CFT) regulation. It requires financial institutions and other legally designated entities to identify, investigate and report suspicious financial activities to the competent national authority.

In Spain, the Financial Intelligence Unit is SEPBLAC (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias). It operates as the country's financial intelligence authority and performs functions relating to the receipt, analysis and dissemination of financial intelligence.

FIU reporting helps detect money laundering, terrorist financing, organised crime, corruption, tax-related financial offences and suspicious cross-border transactions. Spanish reporting obligations must balance effective financial crime prevention with customer confidentiality, data protection, procedural fairness and protection against unjustified financial exclusion.

2. LEGAL FRAMEWORK GOVERNING FIU REPORTING IN SPAIN

A. LAW 10/2010 ON THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING

Law 10/2010 establishes the principal Spanish legal framework for AML reporting.

Its important requirements include:

Customer identification and verification.

Identification of beneficial owners.

Examination of suspicious transactions.

Internal compliance procedures.

Reporting suspicious activities to SEPBLAC.

Record retention.

Employee training and internal controls.

Article 18 establishes the obligation to report indications or certainty of money laundering or terrorist financing to SEPBLAC.

Article 17 establishes the obligation to examine operations that may be connected with money laundering or terrorist financing.

Article 21 addresses the obligation to provide information to SEPBLAC when legally required.

Article 24 establishes restrictions on disclosing information concerning reporting and related investigations.

B. ROYAL DECREE 304/2014

Royal Decree 304/2014 implements Law 10/2010 and provides detailed rules concerning customer due diligence, internal controls, reporting procedures and compliance responsibilities.

It requires regulated entities to establish effective procedures for identifying and managing suspicious transactions.

C. DIRECTIVE (EU) 2015/849

The Fourth Anti-Money Laundering Directive establishes European requirements concerning suspicious transaction reporting, customer due diligence and financial intelligence cooperation.

D. DIRECTIVE (EU) 2018/843

The Fifth Anti-Money Laundering Directive strengthens transparency requirements, beneficial ownership arrangements and certain financial intelligence mechanisms.

E. REGULATION (EU) 2024/1624

This regulation establishes a harmonised EU AML framework. Its principal application date is 10 July 2027, subject to specific transitional provisions.

F. REGULATION (EU) 2024/1620

This regulation establishes the European Anti-Money Laundering Authority (AMLA), strengthening coordination and supervision across the EU.

3. ROLE AND FUNCTIONS OF SEPBLAC

SEPBLAC performs several important functions under Spanish AML legislation.

A. RECEIVING SUSPICIOUS TRANSACTION REPORTS

SEPBLAC receives reports from obligated entities concerning transactions suspected of involving criminal proceeds or terrorist financing.

B. FINANCIAL INTELLIGENCE ANALYSIS

It analyses submitted information to identify financial patterns, suspicious relationships and possible links between transactions.

C. DISSEMINATION OF FINANCIAL INTELLIGENCE

Where appropriate, SEPBLAC communicates relevant intelligence to competent judicial, prosecutorial, law enforcement or other authorised authorities.

D. AML SUPERVISION

SEPBLAC exercises supervisory functions concerning compliance with applicable AML requirements.

E. INTERNATIONAL COOPERATION

SEPBLAC cooperates with foreign FIUs and relevant international institutions through legally established information-exchange mechanisms.

4. TYPES OF FINANCIAL INTELLIGENCE REPORTING

A. SUSPICIOUS TRANSACTION REPORTING

Reporting entities must communicate transactions involving indications or certainty of money laundering or terrorist financing.

The reporting obligation is not restricted to completed transactions. Attempted transactions may also fall within the statutory reporting framework.

B. SYSTEMATIC REPORTING

Certain information must be reported periodically where the applicable legislation and regulatory requirements prescribe systematic reporting.

C. INTERNAL SUSPICION REPORTING

Employees who identify suspicious financial activity must follow their institution's internal reporting procedures so that the designated compliance function can assess the matter.

D. CROSS-BORDER FINANCIAL REPORTING

Cross-border transactions may require additional scrutiny depending on customer risk, transaction characteristics and applicable legal requirements.

5. REPORTING OBLIGATIONS OF FINANCIAL INSTITUTIONS

Spanish banks and other obligated entities must maintain an effective reporting framework.

Their principal responsibilities include:

Establishing internal AML compliance procedures.

Identifying suspicious financial transactions.

Conducting appropriate customer due diligence.

Examining unusual or complex transactions.

Reporting qualifying suspicions to SEPBLAC.

Maintaining supporting documentation.

Protecting confidential reporting information.

Training employees in suspicious-activity identification.

Cooperating with competent authorities.

Maintaining appropriate internal audit and control mechanisms.

Reporting obligations are triggered by statutory suspicion criteria, not merely by a bank's preference or general commercial risk classification.

6. CONFIDENTIALITY AND DATA PROTECTION REQUIREMENTS

FIU reporting involves the processing of sensitive financial and personal information.

Consequently, Spanish institutions must comply with applicable data protection legislation, including:

General Data Protection Regulation (GDPR).

Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights.

Law 10/2010.

Applicable EU and Spanish AML regulations.

Article 24 of Law 10/2010 establishes important restrictions on disclosure of suspicious transaction reporting information.

The prohibition against tipping off prevents institutions from revealing information that could compromise an investigation.

However, confidentiality does not remove the requirement to process personal information lawfully, securely and proportionately.

7. RELEVANT CASE LAWS

The following judicial decisions are relevant to FIU reporting, AML compliance, financial confidentiality and the proportionality of financial investigations. Their authority is distinguished according to their actual subject matter.

CASE 1: SAFE INTERENVÍOS, C-235/14 (2016)

Authority: Direct AML authority.

The Court of Justice of the European Union examined enhanced due diligence requirements under European anti-money laundering legislation.

The judgment addressed the relationship between risk assessment and additional customer verification obligations.

Legal relevance: Financial institutions must undertake appropriate risk-based assessments when examining transactions and applying AML controls. Reporting systems should be based on legally relevant indicators rather than arbitrary customer classifications.

CASE 2: JYSKE BANK GIBRALTAR, C-212/11 (2013)

Authority: Direct AML authority.

The CJEU examined anti-money laundering obligations imposed on a financial institution operating in a cross-border context.

The judgment addressed the compatibility of national AML requirements with the European legal framework.

Legal relevance: FIU reporting must operate within the applicable European framework, taking account of the legitimate supervisory responsibilities of national authorities.

CASE 3: LAURENTIUS AND OTHERS V. FINLAND (ECtHR, 2009)

Authority: Analogous confidentiality authority.

Confidentiality and fair-procedure principles are important in financial investigations, but this case should not be cited as a direct precedent establishing Spanish FIU reporting obligations.

Legal relevance: It illustrates why confidential information and procedural safeguards must be considered when public authorities exercise investigative powers.

CASE 4: M.S.S. V. BELGIUM AND GREECE, APPLICATION NO. 30696/09 (2011)

Authority: Analogous fundamental-rights authority.

The European Court of Human Rights examined state responsibility and fundamental-rights protections in the context of migration and asylum arrangements.

Legal relevance: Although unrelated directly to FIU reporting, the judgment illustrates the importance of effective legal safeguards when public authorities exercise powers affecting vulnerable individuals.

CASE 5: ROMAN ZAKHAROV V. RUSSIA, APPLICATION NO. 47143/06 (2015)

Authority: Analogous privacy authority.

The ECtHR examined secret surveillance measures and the safeguards required under Article 8 of the European Convention on Human Rights.

Legal relevance: Financial intelligence collection and subsequent use of personal information should be subject to appropriate legal safeguards, oversight and protection against arbitrary interference with privacy.

CASE 6: BIG BROTHER WATCH AND OTHERS V. UNITED KINGDOM, APPLICATION NOS. 58170/13, 62322/14 AND 24960/15 (2021)

Authority: Analogous data-protection and surveillance authority.

The Grand Chamber of the ECtHR examined bulk interception systems and safeguards against abuse.

Legal relevance: Financial intelligence systems should incorporate effective safeguards, appropriate oversight and proportionality when processing personal information.

8. REGULATORY ENFORCEMENT AND PENALTIES

Failure to comply with FIU reporting obligations may result in administrative sanctions under Law 10/2010.

Potential violations include:

Failure to report suspicious transactions.

Failure to examine suspicious operations.

Inadequate internal AML controls.

Failure to maintain required documentation.

Obstruction of supervisory inspections.

Unlawful disclosure of confidential reporting information.

Depending on the nature and seriousness of the infringement, sanctions may include financial penalties, public warnings, professional consequences and other statutory enforcement measures.

The competent authority determines liability according to the relevant statutory provisions and applicable procedural safeguards.

9. PRACTICAL COMPLIANCE REQUIREMENTS

Spanish financial institutions should implement the following measures:

Appoint an appropriately qualified AML compliance function.

Establish documented internal suspicion-reporting procedures.

Maintain effective transaction-monitoring systems.

Investigate unusual transactions promptly.

Submit reports to SEPBLAC where statutory reporting conditions are met.

Preserve relevant transaction records and supporting evidence.

Ensure employees receive regular AML training.

Maintain confidentiality and prevent unlawful tipping off.

Conduct independent compliance reviews.

Ensure personal data is processed lawfully and securely.

Cooperate with SEPBLAC and competent authorities.

Review reporting systems to prevent excessive or discriminatory de-risking.

10. CONCLUSION

Financial Intelligence Unit reporting is an essential instrument for preventing money laundering and terrorist financing in Spain. Law 10/2010 and Royal Decree 304/2014 establish the central national reporting framework, with SEPBLAC acting as the principal financial intelligence authority.

Financial institutions must identify suspicious operations, conduct appropriate examinations, maintain internal controls and communicate relevant suspicions to SEPBLAC.

Nevertheless, effective financial intelligence reporting must remain consistent with confidentiality, privacy, proportionality and procedural safeguards. AML reporting should not become a justification for arbitrary account closures, discriminatory treatment or unnecessary financial exclusion.

A balanced FIU reporting system therefore requires effective cooperation between banks, SEPBLAC, supervisory authorities, law enforcement agencies and European institutions while protecting legitimate financial activity and individual rights.