Crypto AML Lawyer in Spain for Crypto-asset Service Providers

Since 1 October every crypto-asset service provider is an obliged entity. Is your internal control ready?

Royal Decree-law 25/2026 made every crypto-asset service provider an obliged entity under Law 10/2010, Spain’s Anti-Money Laundering Act, not only exchange and custody providers. We prepare your risk assessment, your AML manual and your due diligence and Travel Rule procedures, and we work with you before Sepblac, which reports on your internal control in the CNMV authorisation.

Request a free initial assessment. We’ll tell you what Law 10/2010 requires from you, what you already have and what is missing.

No commitment · We reply the same day

YEARS OF EXPERIENCE

+ 0

CLIENTS ADVISED

+ 0

PROJECTS COMPLETED

+ 0

PRACTICE AREAS

+ 0

WHAT SETS US APART

Your AML Controls Are Examined at Authorisation and Every Year

Sepblac reports to the CNMV on the adequacy of your internal control when you apply for MiCA authorisation, and an external examiner reviews it every year after that.
That is why we design your policies with both reviews in mind. We work with your compliance officer on the manual, the risk assessment and the Travel Rule, and with your technical team on how they fit into your systems.
If you provide crypto-asset services in Spain, your AML controls need to fit MiCA and Regulation 2023/1113 from day one.

We reply the same day

CRYPTO AML LEGAL SERVICES

What Does Your Crypto Company Need to Comply with Law 10/2010?

Legal advice on anti-money laundering and counter-terrorist financing for crypto-asset service providers operating in Spain.

Risk assessment and AML manual

We prepare the risk assessment of your business and the AML manual required by Articles 32 and 33 of the Regulation implementing Law 10/2010, approved by Royal Decree 304/2014. We tailor them to your services, customers, channels and the countries you work with, and leave them approved in writing, as Article 26 of the law requires.

Customer due diligence and acceptance

We design your express customer acceptance policy and your due diligence flow, from formal identification and beneficial ownership to ongoing monitoring of the relationship. This includes enhanced measures for high-risk customers and politically exposed persons, and remote identification procedures.

Travel Rule and self-hosted wallets

We prepare the procedures of Regulation (EU) 2023/1113 so that every crypto-asset transfer carries the originator and beneficiary information, with no minimum amount. This covers what to do when information is missing and how to assess whether a self-hosted address belongs to the customer in transfers above 1,000 euros.

Internal control body and Sepblac representative

We help you set up the internal control body and appoint your representative before Sepblac, the Executive Service of the Commission for the Prevention of Money Laundering. Article 26 ter of Law 10/2010 requires a person resident in Spain who holds a management or director position, and the appointment is notified to Sepblac.

External review, training and suspicious activity reporting

We prepare the annual external review of Article 28, the annual staff training plan of Article 29 and the procedure for special review and suspicious activity reporting to Sepblac under Articles 17 and 18. We also set up the record-keeping, as documentation is kept for ten years.

SECTORS AND COMPANIES

Is Your Company an Obliged Entity under Law 10/2010?

We advise companies with these profiles on anti-money laundering.

Exchanges and brokers

Exchange and order execution

Custody and wallets

Obliged entities since 2021

Management and advice

Obliged entities since October

Crypto ATM operators

Identification with no threshold

Projects seeking a licence

Sepblac reports to the CNMV

PROCESS AND TIMELINES

How We Work

From diagnosis to external review, in 4 steps

1 –

Obligations check

We review your services and customers and tell you what Law 10/2010 and Regulation 2023/1113 require from you. No cost or commitment.

2 –

Risk assessment

We assess the risks of your services, customers, channels and geographies, which are the basis for every later measure.

3 –

Manual and procedures

We draft the AML manual, the acceptance policy, the Travel Rule procedures and the training plan.

4 –

Control and follow-up

We support you during authorisation, in the annual external review and through regulatory changes such as the 2027 EU Regulation.

REVIEWS AND RATINGS

What Our Clients Say

Reviews from real clients and companies about our crypto-asset and MiCA services.

Marta combines impeccable professionalism with a remarkable ability to explain complex legal concepts in simple terms...

Impeccable personal attention, availability and human touch. Broad knowledge and experience in the sector. Outstanding at solving problems. 100% recommended...

I have no words to express my sincere gratitude. Marta is a very dedicated and empathetic professional. She also works fast...

Thank you so much, Marta, for your invaluable advice. Without your knowledge of NFT technology in the art market, a new and promising field but one exposed to a lot of fraud, I would have got myself into serious trouble. Marta …

REGULATORY FRAMEWORK

Crypto Anti-Money Laundering Rules in Spain and the EU

Law 10/2010 on the prevention of money laundering and terrorist financing (in Spanish) has included crypto-asset service providers among its obliged entities since 1 October 2026. This was done by Royal Decree-law 25/2026, which amended letter z) of its Article 2.1 and was validated by the Standing Committee of the Congress of Deputies on 16 October. Until then, under Royal Decree-law 7/2021, only providers exchanging virtual currency for fiat currency and custodian wallet providers were covered. The same reform made any breach of the crypto Travel Rule a serious infringement, with fines of at least 60,000 euros that can reach 10% of annual turnover or 5 million euros, and gave Sepblac a report on internal control in the authorisation of providers. That internal control is part of the application we prepare in our MiCA legal services. Since 28 October 2026, every transaction at a crypto ATM also requires customer identification, with no minimum amount, as we explain in our article on identification at crypto ATMs (in Spanish). The framework will change again on 10 July 2027, when Regulation (EU) 2024/1624 starts to apply and treats crypto-asset service providers as financial institutions subject to its rules across the EU.

FAQ

Frequently Asked Questions about Crypto Anti-Money Laundering

Since when have all crypto-asset service providers been obliged entities in Spain?

Since 1 October 2026, when Royal Decree-law 25/2026 entered into force. Its first final provision amended letter z) of Article 2.1 of Law 10/2010, which now refers to «crypto-asset service providers». Before that, only fiat exchange and custody providers were obliged entities, since 2021.

What documents does Law 10/2010 require from a crypto-asset service provider?

Written policies and procedures, an express customer acceptance policy, a risk assessment and an AML manual. They are required by Article 26 of the law and Articles 32 and 33 of its implementing Regulation. Add the annual training plan, the external review report and each customer’s documentation, kept for ten years.

What is the fine for breaching the Travel Rule?

It is a serious infringement since 1 October 2026, under Article 52.5 of Law 10/2010. The minimum fine is 60,000 euros and the maximum is the highest of several amounts, including 10% of annual turnover or 5 million euros. It is always imposed together with another sanction under Article 57, such as a public or private reprimand.

Is an external review needed every year?

Yes. Article 28 of Law 10/2010 requires an annual external review of internal control measures and bodies. The report describes the measures, assesses how well they work and proposes improvements. In the following two years it can be replaced by a follow-up report on the shortcomings found.

What role does Sepblac play in MiCA authorisation?

It reports on the adequacy of your internal control measures in the authorisation procedure for crypto-asset service providers. Royal Decree-law 25/2026 added this task to letter l) of Article 45.4 of Law 10/2010. Weak internal control can slow down the CNMV authorisation.

What will change with the EU Anti-Money Laundering Regulation?

Regulation (EU) 2024/1624 applies from 10 July 2027 across the EU, with no transposition needed. It treats crypto-asset service providers as financial institutions and therefore as obliged entities. The manual you prepare now should be able to adapt to it without being rewritten.

REQUEST YOUR ASSESSMENT

Request a free initial assessment and receive a review of what Law 10/2010 requires from you, what you already have and what is missing in your risk assessment, your manual and your Travel Rule procedures.