Customer Due Diligence

The five due diligence duties

In force nowLey 10/2010, arts. 3-7

Spanish law splits customer due diligence into distinct duties. Treat them as a checklist for every file — you need all five, not just the ID copy.

• Formal identification of the customer, and of anyone acting on their behalf (art. 3)
• Identification of the real owner — the titular real (art. 4)
• Obtaining information on the purpose and intended nature of the business relationship (art. 5)
• Ongoing monitoring of the relationship (art. 6)
• Applying all of the above to a degree proportionate to risk (art. 7)

Formal identification — and when it must happen

In force nowLey 10/2010, art. 3; RD 304/2014, arts. 4-7 and 21

Identify and verify the customer with reliable documentary evidence before establishing the business relationship or carrying out the operation. In practice, for a real estate file, that means before you accept a reservation or sign a mandate — not at the notary.

• Spanish natural persons: DNI. Foreign natural persons: passport, or the identity card of their state, plus NIE where applicable.
• Documents must be in force and you must keep a copy on file.
• Legal entities: escritura de constitución, current registry extract, tax identification (CIF/NIF), and identification of the directors and of the natural persons holding effective control.
• Non-face-to-face onboarding requires additional measures — this is common with foreign buyers and must be handled deliberately, not informally.

Representatives and powers of attorney

In force nowReal Decreto 304/2014, art. 6(2)

When someone acts on behalf of the buyer or seller — a lawyer with a poder, a family member, a company director, a gestor — you must verify three separate things documentarily. Missing any one of them is a common and easily-avoided failure in property files.

• The identity of the representative themselves (their own ID document).
• The identity of the person or entity being represented.
• The public or documentary evidence of the powers granted — the escritura de poder or equivalent instrument, checked for scope and for whether it is still in force.

The real owner (titular real)

In force nowLey 10/2010, art. 4; RD 304/2014, arts. 8-9

Behind every corporate buyer there is a natural person. You must identify and take reasonable measures to verify who ultimately owns or controls the customer. Do not stop at the first company in the chain.

• Natural persons who ultimately own or control, directly or indirectly, more than 25% of the capital or voting rights.
• Where no such person exists, natural persons who exercise control by other means — shareholder agreements, veto rights, funding control, or de facto control.
• Where neither can be identified after exhausting all reasonable means, the directors or senior management, with the steps taken recorded on file.
• For trusts and similar arrangements: settlor, trustee, protector, beneficiaries and any other person exercising effective control.
• Consult the customer's declaration and, where available, corporate registry and beneficial ownership sources — a client declaration alone is thin evidence in a high-risk file.

Purpose and intended nature of the relationship

In force nowLey 10/2010, art. 5

This is a separate legal duty, and the one most often skipped. You must obtain information on what the client actually wants and why — and it must make commercial sense. It is also what gives you a baseline: without a stated purpose, you have nothing to compare later behaviour against.

• What is the property for — main residence, holiday use, letting, investment, resale?
• Why this location, this price band, this structure?
• Who will occupy or use it, and who will fund it?
• Record the answers. When the transaction later departs from the stated purpose, that inconsistency is itself an indicator.

Risk classification of the customer

In force nowLey 10/2010, art. 7; RD 304/2014, art. 32

Classify each customer and operation — typically low, standard or high risk — using factors from the customer, the countries involved, and the operation itself. The classification is what justifies the level of due diligence you then apply, so record the reasoning, not just the label.

• Customer factors: legal form, complexity of structure, PEP status, adverse media, reluctance to provide information.
• Geographic factors: residence, nationality, location of funds, high-risk third countries.
• Operation factors: value, funding route, third-party payments, speed, off-market character, cash element.
• Channel factors: face-to-face or remote, introduced or direct.

Simplified due diligence — reduced, never absent

In force nowLey 10/2010, arts. 9-10; RD 304/2014, arts. 15-16

In defined lower-risk situations, Spanish law permits simplified measures. Simplified does not mean 'no due diligence': you must still identify the customer, you must still monitor, and you must be able to justify why the case qualified as lower risk. Simplified measures are unavailable — and must be dropped immediately — whenever there is any indication of money laundering or terrorist financing, or where the risk profile changes.

• Applies only to categories of customer or product with demonstrably lower risk, as set out in the regulation.
• Typical simplification: reduced verification of certain data or reduced frequency of review — not skipping identification.
• Document the justification. If you cannot explain in one paragraph why the case was lower risk, apply standard measures.

Enhanced due diligence — what 'enhanced' actually means

In force nowLey 10/2010, arts. 11-16; RD 304/2014, arts. 19-24

Enhanced measures are mandatory in higher-risk situations, including non-face-to-face business, private banking, funds or clients linked to high-risk third countries, politically exposed persons, and any case your own risk analysis flags. Concretely, expect to do several of the following:

• Obtain additional documentation on the source of funds and, where required, source of wealth.
• Verify identity through additional independent sources rather than a single document.
• Unwrap the full ownership chain of corporate buyers, with supporting registry evidence.
• Obtain senior management authorisation before establishing or continuing the relationship.
• Increase the intensity and frequency of ongoing monitoring, and set a review date.
• Record the whole reasoning: what you were worried about, what you obtained, and why you were satisfied.

Ongoing monitoring

In force nowLey 10/2010, art. 6

Due diligence does not end at onboarding. Keep the file current for the life of the relationship, and refresh documentation when it goes out of date. In practice, in real estate, most relationships are transaction-length — but developers, letting agencies and advisors often hold multi-year relationships where monitoring genuinely bites.

• Scrutinise operations to check they match the purpose and the risk profile you recorded.
• Re-examine the file when ownership, the funding route, the buying entity or the counterparty changes mid-transaction.
• Keep identification documents in force; expired documents are an open finding in an inspection.

When you cannot complete due diligence

In force nowLey 10/2010, art. 7.3

If you cannot complete the required due diligence measures, you must not establish the relationship or carry out the operation, and you must terminate an existing relationship. Consider whether the circumstances also warrant the special examination and, where indications exist, a report — see Module 6.