Spain

Art. 31 bis makes legal persons criminally liable for offences by representatives and, where supervision duties were seriously breached, by subordinates. Under Art. 31 bis.2 a legal person is exempt if, among other conditions, it adopted and effectively implemented a compliance and management model before the offence. It is a condition of exemption, not a stand-alone licensing duty.

Under Art. 1 of Real Decreto 609/2023, legal persons not already declared through another registry must file electronically within one month of formation, update data within ten days of any change, and all covered entities make an annual declaration in January (Art. 1.4). Trusts and similar entities not run or registered in the EU must declare before beginning relevant activities in Spain.

Companies with 50 or more workers must have an internal information system (Art. 10), and all public sector entities must have one (Arts. 13 to 15). The system must guarantee confidentiality, allow written or verbal and anonymous reports, name a responsible person, acknowledge receipt within seven calendar days and respond within three months, extendable by up to three more (Arts. 5, 8 and 9).

Arts. 8 and 9 require processing based on legal obligation or public interest to rest on a law-rank norm, and special categories to meet the further conditions. Arts. 12 to 18 set how access, rectification, erasure, restriction, portability, objection and automated-decision rights are exercised; controllers must explain how and prove they responded.

Art. 19 requires operators of essential services and digital service providers to notify incidents with significant disruptive effects to the competent authority through the reference CSIRT. Art. 22 sets initial, intermediate and final notifications, the first to be sent without undue delay; the article gives no fixed number of hours or days.

The AEPD states that the supervisory authority must be notified within 72 hours of the controller becoming aware of a breach likely to risk people's rights and freedoms, citing Art. 33 GDPR, and that individuals must be told where the risk is high (Art. 34 GDPR). Notification is made through the breach form in the AEPD's electronic office.

Entities must identify customers before the business relationship or transaction (Art. 3) and identify and verify the beneficial owner, generally anyone holding more than 25 per cent of capital or voting rights (Art. 4). They must also establish the purpose of the relationship (Art. 5), monitor it (Art. 6), scale measures by risk (Art. 7) and apply enhanced measures to politically exposed persons (Art. 14).

Credit institutions and credit financial establishments must file a prior communication with the Banco de España before delegating essential functions or services, with a board-approved delegation policy, risk analysis, contract or draft and exit plan. Paragraph 58 of the adopted EBA outsourcing guidelines also requires informing the supervisor about planned outsourcing of critical or important functions.

Art. 18 requires entities to report on their own initiative to the Servicio Ejecutivo any transaction or attempt showing indication or certainty of links to money laundering or terrorist financing, and Art. 18.2 says the report is made without delay (sin dilación). Art. 19 requires them to refrain from executing such transactions unless refraining is impossible or would hinder an investigation.

Art. 4 of Ley 21/2011 gives the Banco de España authorisation of e-money institutions, after a report from the SEPBLAC, with a decision due within three months and silence counting as refusal. Art. 9 requires funds received in exchange for e-money to be safeguarded as in Art. 10.1.a of Ley 16/2009, with funds received through a payment instrument safeguarded within five working days of issue.

Per the CNMV, crypto-asset service providers must obtain authorisation, or for certain financial entities send a notification, before providing services; providers from other member states notify their intention to operate. Under Art. 2.1.z of Ley 10/2010 they are also AML/CFT obliged entities. The transitional period ended on 1 July 2026.