Records, Internal Control & Your Responsibilities

Document retention — ten years

In force nowLey 10/2010, art. 25

Retain the documentation obtained through due diligence and the records of operations for ten years from the end of the business relationship or the execution of the operation. Records must be stored in a way that allows them to be retrieved and produced to SEPBLAC promptly, and protected against loss, destruction and unauthorised alteration.

What you actually have to keep

In force nowLey 10/2010, art. 25; RD 304/2014

For a property file, the retained set should let a reviewer reconstruct the whole decision without asking you anything:

• Copies of the identification documents of the customer, of any representative, and of the beneficial owners.
• The documentary evidence of any powers of attorney relied on.
• The recorded purpose and intended nature of the relationship.
• The risk classification and the reasoning behind it.
• Source of funds (and, where applicable, source of wealth) evidence.
• Screening results for PEP, sanctions and adverse media, dated.
• Any special examination note and the conclusion reached.
• The transaction documentation itself.

Written internal policies and procedures

In force nowLey 10/2010, art. 26

Ley 10/2010 art. 26 requires obliged subjects to approve and apply written policies and procedures, appropriate to the nature and size of the firm. Note the Spanish terminology: the law speaks of written policies and procedures covering a defined set of matters — it does not use the AMLR's 'business-wide risk assessment' language, which arrives separately in 2027 (Module 8). The matters covered include:

• Due diligence
• Reporting and provision of information
• Retention of documents
• Internal control
• Risk assessment and risk management
• Compliance
• Communication

The internal control body and the representative before SEPBLAC

In force nowLey 10/2010, art. 26

Firms must have an internal control body (órgano de control interno, or OCI) responsible for applying the prevention procedures, and must appoint a representative before SEPBLAC (representante ante el SEPBLAC) — the person through whom communications with the FIU are made. The appointment is notified to SEPBLAC. Smaller firms may operate a simplified structure, but the functions must still exist and be identifiable.

• You should know, by name, who your OCI and representative are. If you do not, that is the first thing to fix after this course.
• Escalations go to them. They decide on examination outcomes, abstention and reporting.
• Their decisions and the reasons for them must be recorded.

External review

In force nowLey 10/2010, art. 28; RD 304/2014, art. 38

Obliged subjects are required to have their internal prevention measures reviewed annually by an external expert, who issues a written report on the adequacy of the measures and identifies deficiencies and remedial measures. Reduced frequency is available for certain smaller firms under the conditions set in the regulation. Deficiencies identified must actually be corrected — the report is not the end of the process.

Employee training — and what this course is

In force nowLey 10/2010, art. 29

Art. 29 requires obliged subjects to adopt appropriate measures so that employees are aware of the requirements of the legislation, including participation in specific, ongoing training courses aimed at detecting operations that may be related to money laundering or terrorist financing, and instructing them on how to proceed in such cases. Training is planned annually by the firm.

• The obligation sits with the firm, not with you individually.
• This programme is designed to form part of the evidence your firm relies on for the employee-training component. It does not, by itself, discharge everything art. 29 requires of your employer — the firm still needs its own training plan, tailored to its risk profile and roles.
• Nothing in this programme is an official accreditation, and it is not approved by SEPBLAC, the Tesoro or any EU body.

Your personal responsibilities

Whatever your role, the day-to-day expectations are the same:

• Complete due diligence properly, and before the relationship or operation — not afterwards.
• Write things down at the time.
• Escalate concerns to the OCI or representative rather than resolving them yourself.
• Never reveal an examination or a report to a client or third party.
• Keep your training current and follow your firm's manual, which may go further than the legal minimum.