The Royal Decree transposing, among others, the European Parliament and Council's EU Directive 849/2015 of 20 May (hereinafter "Directive 849/2015") was published at the beginning of September. It contained many amendments to the anti-money laundering and financing of terrorism Act 10/2010 of 28 April. We analyze below the main legislative changes:

Regulated parties

Those persons who, on behalf of third parties, act as secretaries on the Boards of Directors while not being members, and external advisors to an entity, will be considered regulated parties.

Reinforced due diligence

Regulated parties will be required to apply reinforced due diligence measures on any countries showing strategic deficiencies* in their AML/FT prevention systems. Likewise, in any scenarios which are classified under the regulations as presenting a high risk of money laundering or financing of terrorism, as well as all those situations which by their very nature might present a higher risk, in those cases where they concern private banking activities and transactions involving money transfers or exchange of foreign currency over the thresholds set out in the regulations.

Reinforced diligence will also be applied to publicly exposed persons; in these cases, authorization from a superior will be needed in order to establish or maintain business relationships with them. The institution's internal procedures will determine the specific level of responsibility needed to grant authorization, depending on the risk inherent to the transaction or the client. Furthermore, this authorization may only be given by those who are sufficiently aware of the regulated party's level of exposure to the risk of money laundering or the financing of terrorism.

Conserving documents

There is no change in the duty of keeping for ten years the documents attesting to compliance with legal obligations, although there is an amendment from the previous law; after this period the documents must be destroyed.

After 5 years have elapsed since the business relationship or the execution of the one-off transaction, the documents stored should only be accessible to the institution's internal control bodies and, if applicable, to those in charge of its legal defense.

Internal whistleblowers

It will be mandatory to have an internal channel so that employees, managers or agents can, anonymously if they wish, report potential non-compliance in the area of anti-money laundering and the financing of terrorism. This channel may also be incorporated in another channel if one already exists within the institution for reporting other behavior and non-compliance incidents unrelated to AML/FT.

In any event, regulated parties will have to adopt the necessary measures to ensure that employees, managers or agents reporting infractions are protected against possible reprisals, discrimination or unfair treatment.

Internal control body

Regulated parties will now have to appoint as their representative to the Commission's AML/FT Executive Service an individual who is resident in Spain and who is a Director or senior manager of the institution concerned. In the case of groups with several regulated parties, a single person can be appointed to represent all of them, provided this person is a Director or senior manager in the parent company.

Institutions, meanwhile, will have to establish an appropriate internal control organ to take charge of compliance with due diligence policies and procedures, information, conservation of documents, internal control, risk assessment and management, together with communication, to prevent and impede transactions relating to money laundering and the financing of terrorism.

This body should meet as often as stipulated in the internal control procedure and will produce meeting minutes specifically to record the resolutions it adopts. Furthermore, it will be functionally separate from the company's internal auditing unit.

This body will be reviewed every year by an external expert, and the results of this examination will be given in a written report assessing its operating efficacy and proposing, if needed, rectifications and improvements. This report may be replaced by a follow-up report issued by an independent expert during the two years following the issuance of the report in question.

In any event, the report will be presented to the company's board of directors or equivalent body so that it can adopt measures as needed to solve the deficiencies detected.

Service providers’ register

Natural or legal persons who as professionals or businesses provide those third-party services that are listed in article 2.1o) of the Companies and Trustees Act**, are required to file on the Companies' Register corresponding to their address, before starting work.

If they are already engaged in these activities, they have a year's grace in which to register; and those who were already registered will have the same period during which to file a statement in the Registry to the effect that they are subject to the regulations pursuant to this law, together with another statement about who the beneficial owners are, in the event of their being legal persons.

Non-compliance with these obligations will be treated as a minor infraction.

Penalties

Finally, the penalties for minor, serious and very serious infractions have been increased, and new sanctions added, in particular for those persons liable for the infraction who hold posts as directors or senior managers, or as external experts, in the regulated company.

In the case of very serious infractions:

• A fine of between sixty thousand and ten million euros, together with a public warning, is imposed on each person
• Removal from the post and disqualification from holding directorships or senior management positions in any company that is regulated under this law, for a maximum of ten years
• These penalties will also be accompanied by a requirement on the offender to put a stop to their behavior and not repeat it
• In the case of serious infractions
• A fine of at least three thousand euros and up to five million euros, together with a public or private warning
• Removal from the post and disqualification from holding directorships or senior management positions in any company that is regulated under this law, for a maximum period of five years

* Countries with strategic deficiencies will be listed in the decision adopted by the European Commission, pursuant to article 9 of Directive 849/2015.

** Professionals who, according to the specific regulation applicable to them, provide the following third-party services: setting up companies and other legal persons; carrying out the functions of senior management or non-voting company secretaries on the board of directors or external advisory for a company, partner of an association or similar roles relating to other legal persons, or who instruct another person to carry out these functions; providing a registered, commercial or postal address and other services associated with a company, association or any other legal instrument or person; carrying out the functions of a trustee in a trust or a similar legal instrument or instructing another person to exercise these functions; or carrying out the functions of a proxy shareholder. Exemptions apply to companies listed on a market that is regulated in the European Union and that are subject to information reporting requirements in line with EU law or equivalent international regulations ensuring appropriate transparency of information about ownership, and to such companies instructing another person to exercise these functions.