EU AML Rules from 2027: Is Your Spanish Subsidiary in Scope?

Not every Spanish subsidiary is an anti-money-laundering obliged entity. The first control is scope. Spain's Law 10/2010 lists the sectors and activities subject to preventive duties; the EU AML Regulation creates a more harmonised rulebook but does not turn every ordinary trading company into a regulated firm.

Step 1: document the scope conclusion

Map the entity's actual activities, licences, customers and transaction flows against article 2 of Law 10/2010 and the categories in Regulation (EU) 2024/1624. Financial businesses, certain professional services, real-estate activities and other listed sectors may be in scope, but a group label or foreign parent's status is not enough on its own.

If the Spanish company is not an obliged entity, it may still need contractual controls because it supplies an obliged group company or falls within group policies. Those contractual requirements should not be described as statutory duties of the subsidiary.

Step 2: compare Spanish and EU requirements

The EU Regulation generally applies from 10 July 2027. Until then, current Spanish law and implementing rules remain operational, subject to later amendments and supervisory guidance. A gap assessment should compare, at minimum:

• business-wide risk assessment and risk classification;
• customer and beneficial-owner identification;
• purpose, ongoing monitoring and enhanced due diligence;
• internal reporting, suspicious-transaction escalation and record keeping;
• governance, staff screening and role-based training;
• group information sharing and data-protection controls.

Step 3: assign evidence and owners

Each control should have a legal basis, owner, system record, approval and test date. The representative before SEPBLAC, internal control body, external-expert review and training population depend on the entity and the exemptions or thresholds in the Spanish framework; generic employee or turnover thresholds should not be invented.

Step 4: monitor the transition

Track Spanish implementing changes, AMLA and SEPBLAC guidance, group-policy updates and the final technical standards. A 2027 project plan should reserve time for data remediation and system testing, not merely rewrite a policy.

NRRO can prepare the Spanish scope memorandum and legal gap assessment. It does not replace a regulated entity's compliance function or a competent authority's interpretation.

Official sources

• Spanish Law 10/2010 on prevention of money laundering.
• Regulation (EU) 2024/1624.
• Regulation (EU) 2024/1620 establishing AMLA.

Reviewed on 27 August 2026. Scope must be determined from the entity's actual activities.