What Changes on 10 July 2027

Read this as future law, not current law

Everything in this module applies from 10 July 2027. Until that date, Ley 10/2010 and RD 304/2014 govern what you must do, and you should not substitute the rules below for them. The purpose of this module is so that your firm is not starting from zero in 2027.

A single EU rulebook

Applies from 10 July 2027Regulation (EU) 2024/1624; Directive (EU) 2024/1640; Regulation (EU) 2024/1620

Regulation (EU) 2024/1624 (the AMLR) is directly applicable in every Member State — it does not need to be transposed into Spanish law the way a directive does. It sits alongside Directive (EU) 2024/1640, which does require national transposition and deals mainly with supervision, registers and FIUs, and Regulation (EU) 2024/1620, which creates AMLA, the new EU Anti-Money Laundering Authority. The practical effect is that the detailed customer due diligence rules become more uniform across the EU, with less national variation.

Scope: who is covered, including lettings

Applies from 10 July 2027AMLR, art. 3

Real estate agents and intermediaries remain obliged entities, and the AMLR expressly brings in intermediation in the letting of immovable property for transactions where the monthly rent reaches EUR 10,000 or more. Agencies whose lettings arm has historically considered itself outside the AML perimeter should plan for that changing. The list of obliged entities also expands elsewhere, notably to crypto-asset service providers and certain traders in high-value goods.

Internal policies, controls and the risk assessment

Applies from 10 July 2027AMLR, arts. 9-10

The AMLR sets out obligations on internal policies, procedures and controls, and requires obliged entities to carry out and document a business-wide risk assessment, kept up to date. This is where the terminology differs from Ley 10/2010 art. 26, which speaks of written policies and procedures covering risk assessment and management among other matters. Firms should expect to formalise and document the entity-level risk assessment more explicitly than today.

Compliance function

Applies from 10 July 2027AMLR, art. 11

The AMLR requires a compliance officer at management level and a compliance manager function, with defined responsibilities. In Spanish terms, expect this to map onto — but not be identical to — today's internal control body and representative before SEPBLAC. Small firms retain proportionality, but the roles must be clearly allocated.

Employee training and awareness

Applies from 10 July 2027AMLR, art. 12

The AMLR contains an explicit employee awareness and training obligation: staff must be made aware of the requirements, receive training appropriate to their functions and the risks they face, and the entity must be able to evidence it. This is the provision that makes documented, versioned, per-employee training records — of the kind this platform issues — commercially and practically important, rather than optional.

Customer due diligence under the AMLR

Applies from 10 July 2027AMLR, Chapters III and IV

The core structure is familiar, but more prescriptive and more harmonised:

• Defined CDD measures, with clearer rules on the timing of identification and verification relative to establishing the relationship.
• Explicit requirements on obtaining information on the purpose and intended nature of the relationship.
• Ongoing monitoring obligations set out directly in the Regulation.
• Beneficial ownership rules harmonised across the EU, with a 25% threshold and detailed treatment of multi-layered structures, nominees and control by other means; lower thresholds can be set for higher-risk categories.
• Enhanced due diligence for defined high-risk situations, including high-risk third countries, with a specified minimum set of measures.
• Specific PEP provisions, including senior management approval, source of wealth and funds, and continued treatment after the person leaves office.

The EU-wide cash payment ceiling

Applies from 10 July 2027AMLR (large cash payment limits); Ley 7/2012 as amended by Ley 11/2021

The AMLR introduces an EU-wide limit of EUR 10,000 on large cash payments in the course of a trade or business, with Member States able to keep or set lower limits. Spain already applies stricter limits under Ley 7/2012 as amended by Ley 11/2021 — EUR 1,000 where a party acts as an entrepreneur or professional, and EUR 10,000 for non-resident individuals not acting as such. Two points to hold on to: the Spanish limits are the operative rules today, and none of these ceilings is a due diligence threshold.

Reporting, record keeping and sanctions screening

Applies from 10 July 2027AMLR, Chapters V and VI

The AMLR carries forward the duties you already know — reporting suspicious activity to the FIU, refraining from carrying out suspicious transactions in defined cases, the prohibition on disclosure, and record retention (with a five-year baseline under the Regulation, and the possibility of extension, against the ten years currently required in Spain). It also strengthens the link between AML controls and the implementation of targeted financial sanctions. Do not switch your retention practice: ten years remains the Spanish requirement until the framework changes.

What a Spanish real estate firm should do before 2027

Practical, low-regret preparation:

• Document an entity-level risk assessment now, even though Spanish law frames the duty differently — you will need it.
• Map your OCI and representative roles against the AMLR compliance officer and compliance manager functions.
• Check whether your lettings business will fall inside the perimeter at EUR 10,000 monthly rent.
• Make employee training documented, versioned and per-person, with retrievable evidence.
• Tighten beneficial ownership evidence for multi-layered and nominee structures — that is where the AMLR is most demanding.