Before changing an identification process, establish what activities the organisation carries out, which obligations apply and who is responsible for each decision. RD 813/2026 introduces changes with different dates and scopes. This guide helps organise documents and questions for a review without confusing technology, compliance and operational needs.
By the Advixy editorial team ·
What changes in the AML/CFT framework?
RD 813/2026 amends several royal decrees concerning the financial sector and, through article 5, changes aspects of Spain’s anti-money laundering and counter-terrorist financing regulations (AML/CFT, known in Spanish as PBC/FT). The changes cover different matters, from non-face-to-face identification to policies and internal organisation. They do not all call for the same action.
Points worth identifying include policies on sanctions and countermeasures under amended article 31, and the consideration of national, European Union and sectoral risks under article 32. The amendment to article 35 removes the former exception from appointing a representative for certain small obliged entities. Narrowly defined exceptions concerning some internal control measures remain; these are not a general exemption from AML/CFT. Check their scope in RD 813/2026 as published in the BOE.
Do not group these changes into a single task called ‘update KYC’: identification, policy and organisational matters may have different owners. Record each affected process and the conclusions still needing confirmation separately. That way, a decision about the digital channel will not obscure a question about representation or internal controls.
Who needs to review their obligations?
The answer depends on the specific activity, not on whether a company is small, works online or receives requests for documents. Law 10/2010 covers certain professional activities, including auditing, external accounting and tax advice. A company providing information to a bank may be helping with the bank’s checks without thereby assuming the bank’s obligations.
Check each activity against article 2 of Law 10/2010, rather than relying on a commercial label. If you provide several services, you may need to distinguish between them. Also separate your own tasks from those entrusted to third parties: external support does not, in itself, remove the obliged entity’s responsibility under article 8 of that law.
Prepare a record for each activity: service, type of relationship, channel, people making decisions and outstanding questions. Client names and copies of identity documents are unnecessary. The aim is to describe how things actually work so that applicability can be assessed without forcing a premature conclusion.
Which deadlines must be distinguished?
RD 813/2026 was published on 8 October 2026 and is scheduled to enter into force generally on 28 October. Its second and third transitional provisions address different situations. Before assigning a date to a task, identify both the provision and the activity or amendment to which it refers.
| Milestone | Scope to check |
|---|---|
| 28 October 2026 | General entry into force of RD 813/2026. |
| Second transitional provision: nine months from entry into force | Period for communicating the appointment of a representative for entities covered by article 2.1(i) to (u) of Law 10/2010 that have fewer than ten people, including agents, and annual turnover or an annual balance-sheet total not exceeding two million euros. Being an SME alone does not qualify an entity. |
| Third transitional provision: eighteen months from publication on 8 October | Specific regime for the amendments in article 5, paragraphs 3 and 6, concerning articles 6.1(a) and 28 of the regulations, applicable within that period. It does not cover the entire reform or article 21. |
The conditions appear in the BOE — RD 813/2026. The table provides guidance but does not, by itself, determine when an action must be completed within a transitional regime. Record who will confirm whether each set of conditions applies. Do not use the period for communicating a representative as the timetable for reviewing digital identification.
How should digital identification be reviewed?
A screen for uploading files does not, by itself, define an identification procedure. You need to understand which route is used, what is checked, who resolves discrepancies and what happens when elements are missing. Amended article 21 provides for different options in non-face-to-face relationships, each subject to its own conditions.
Article 21 covers electronic signatures, copies issued by a notary or other authorised public official, an initial payment from an account held by the same customer under the prescribed conditions, and other secure procedures subject to minimum requirements and general authorisations from Sepblac. A selfie or PDF alone is not enough. The authorisation to issue a ministerial order on technological means does not describe a solution already available. Consult the conditions in the royal decree.
Follow an application from its start through the decision to proceed, request clarification or stop. Include problems such as an illegible document or conflicting information. At each step, identify what information is missing and who decides. You can use fictional scenarios to find gaps without sharing personal documents in an exploratory meeting.
Consider the user experience alongside the quality of the checks. Requesting material without a clear purpose increases friction; simplifying without reviewing decisions can leave gaps. Define what information is requested, who needs to see it and how discrepancies are clarified. Sepblac’s page on due diligence places identification, beneficial ownership, purpose and ongoing monitoring within a risk-based approach.
What documents help prepare the review?
The most useful documentation makes it possible to reconstruct a decision, rather than merely show that a folder exists. Keep three things separate: a description of what happens today, questions about the applicable framework and improvements the organisation considers worthwhile. The following table suggests roles and working documents; it does not add legal requirements.
| Question | Role that can provide context | Suggested working document |
|---|---|---|
| Which activities and channels are being reviewed? | Management and activity leads | Map of services, channels and outstanding questions. |
| Where is the decision made when information is missing? | Team managing the relationship | Decision flow with fictional incidents. |
| Are the same documents requested more than once? | Teams requesting and receiving information | Inventory of requests and their purposes, without client data. |
| What needs specialist assessment? | Person coordinating the review | List of questions, relevant background and responses received. |
If a company is planning a remote channel while also receiving a request for documents from a bank, it is worth separating the two issues. One question concerns its own channel; the other concerns how to respond to the request. Sharing the label ‘KYC’ does not make them the same obligation.
Check whether teams describe the activity consistently. Different tax, corporate and commercial explanations can appear contradictory without context. A shared description makes duplicate requests easier to spot. If third parties are involved, indicate what information they receive and which decisions remain within the organisation.
Finish with a list of confirmed facts, retrievable documents, responsible people and questions requiring assessment. Sepblac’s guidance on internal control measures helps prepare the review; where there have been recent changes, compare its content with the applicable legal text.
How can Advixy help?
Advixy can help turn a broad concern into a defined document-review project. The starting point would be to agree which activities and processes to examine, what information the company can provide and which questions need specialist assessment. Deliverables and coordination would be defined according to that scope before the review begins.
Advixy’s Spain 360 consulting approach can connect discussions about tax, accounting, people, strategy and internationalisation with process analysis. This can be useful when several departments describe an activity differently or request similar information. Organising those connections is not the same as deciding which specific obligations apply.
Depending on the agreed scope, the work could include a map of activities and channels, a document inventory and a prioritised list of questions. If a question calls for specialist judgement, the engagement would need to expressly define coordination, roles and their limits.
A summary for management and teams would help distinguish known facts, descriptions needing alignment and open decisions before changing technology or documentation. The depth of the review would depend on the process: responding to an external request does not necessarily require the same work as designing your own channel.
To start the conversation, describe the activity and why you are seeking advice without sending identities or sensitive files. You can learn about the Advixy team’s approach and then agree on participants, relevant documents and the expected outcome.
Frequently asked questions
Three situations commonly cause confusion when preparing an enquiry: receiving a request for information, interpreting a transitional period and choosing a digital solution. In all three, it is worth pausing before drawing general conclusions. A precise question about the activity and process is usually more useful than a standard task list.
Does a request from my bank make me an obliged entity?
Not by itself. You may be providing information for the bank’s checks. Check separately whether any of your own activities fall within Law 10/2010.
Does the nine-month period allow the entire review to be postponed?
No. It concerns communicating the appointment of a representative in the situation defined by the second transitional provision. Other matters require their own assessment of scope and dates.
Is buying an identification tool enough?
A tool can be part of the process, but its name or advertised features do not establish which procedure is used or how incidents and decisions are handled.
Sources and next step
Confirm dates, conditions and obligations against the official texts before deciding on changes. Sepblac’s pages help locate relevant topics but do not amend what is published in the BOE; if an earlier explanation does not yet reflect the reform, check it against the law. Keep confirmed conclusions separate from open questions.
- BOE — Royal Decree 813/2026
- BOE — Law 10/2010, articles 2 and 8
- Sepblac — Due diligence
- Sepblac — Internal control measures
Need to organise activities, documents and responsibilities before making decisions? Explore Advixy’s Spain 360 consulting offering to define a review scope suited to your situation.
