- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Canada
- China
- Cyprus
- Egypt
- Estonia
- Eswatini
- Ethiopia
- France
- Germany
- Greece
- Haiti
- Hong Kong
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Portugal
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- Uganda
- Ukraine
- UK
- Uruguay
- USA
- Uzbekistan
- Vatican City
- Vietnam
- Venezuela
- Vanuatu
SPAIN KYC, KYB AND AML
Scale Identity Verification and KYC Operations in Spain
Verify Spanish customers and businesses through the DNIe, NFC, QES, identity documents, biometrics and KYB. Reduce manual review, maintain consistent audit evidence and run one connected workflow designed to support the Ley 10/2010 framework today and AMLR from 10 July 2027.
Operational Performance for Spain KYC
Our Numbers Speak Volumes
99.73%
First-Pass
Verification Rate
< 10 sec
Median
Verification Time
5+
Spanish ID Methods
Supported
Spain IDV/KYC Challenges
The Foreigner Document Mix
Foreign customer journeys break when the document set changes by user type. The TIE, the EU registration certificate, passports and NIE-linked records do not arrive in one standard format, so manual review spikes.
Spanish Names Break Global Matching
Two surnames, accents, the ñ character and regional-language variants such as García and Garcia or Muñoz and Munoz trigger false positives when diacritics are stripped in international databases.
Ownership Is Hard to See Through
Spanish holding structures and non-resident owners slow UBO identification. AMLR's test is 25% or more, plus control by other means, a limb Ley 10/2010 already has. RCTIR entries can still need supporting evidence for layered or foreign-owned structures.
Registry Data Is Not Verification
The Registro Mercantil confirms a company exists, not who controls it or whether they are sanctioned. KYB needs screening layered on top of registry lookups.
Regulatory Update
What AMLR Changes for Identity Verification in Spain
The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Spain from 10 July 2027, with no transposition period. Ley 10/2010 will be amended alongside it, and AMLA directly supervises selected cross-border entities from 2028.
Timeline
- End of 2026 Member State wallet issuance deadline, eIDAS 2.0
- 10 July 2027 AMLR applies
- December 2027 Wallet acceptance, eIDAS 2.0 Art 5f, defined relying parties
- 2028 AMLA direct supervision
eIDAS Routes Gain Recognition
Article 22(6) sets two valid routes, an identity document with reliable independent sources, or eIDAS eID at substantial or high level with qualified trust services. DNIe and QES use the eIDAS route, SEPBLAC video identification stays under national law, and firms should log their route and why.
The Ownership Test Tightens
AMLR sets 25% or more. Control also counts, as under Ley 10/2010. The Commission may lower it, not below 15%, for riskier categories.
Existing Customers Get Re-Checked
AMLR expects existing customer records to be brought up to standard on a risk basis, not just new onboarding. Continuous monitoring keeps back-book files current between reviews.
Accountability Stays With You
Article 18 keeps customer due diligence accountable with the obliged entity even when verification is outsourced, so vendor evidence and clean audit trails matter more under AMLR.
FOR BUSINESSES SUPERVISED BY SEPBLAC
Streamline SEPBLAC-Supervised Onboarding in Spain
Connect identity verification, qualified electronic signing and account confirmation in one flow, and capture the document copies due within one month of remote onboarding.
Verify the Customer
Confirm identity through the DNIe, NFC chip reading or document-plus-biometric checks with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness.
Complete Qualified Signing
Apply and validate the QES within the same journey, keeping the signed document, verification result and supporting evidence together. For Spain the signing identity check runs through NFC and face biometrics.
Confirm the Payment Account
Use Penny Drop Verification as a supporting fraud and account-ownership control, recording the result with the identity and signing evidence.
Shufti's IDV/KYC Solutions for Spain
KYC Solutions
Clear Ley 10/2010-aligned onboarding for Spanish customers, with age and address checked in the same flow as identity. Each check completes in seconds.
Explore MoreFace Verification
Face verification binds the live person to the document with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness, stopping spoofs, masks and deepfakes.
.Age Verification
Selfie-based age estimation with document verification where sectors like gaming or e-commerce need an age check. Youth-protection compliance stays with the operator.
.Bank Account Verification
Confirms a Spanish bank account (ES IBAN) belongs to the customer, returning the registered account holder name for matching against the verified identity.
.Address Verification
Shufti verifies any Spanish address-bearing document, including the padrón certificate, utility invoices and bank statements from major Spanish issuers. This matters in Spain where proof-of-address checks remain common in regulated onboarding.
.Document Verification
Verification of the DNI, TIE residence permits and Spanish ePassports, including NFC chip reading and Spanish-language OCR extraction. Remains a permitted route for remote verification under AMLR.
.Identity Verification
Shufti confirms every customer is real and present, not spoofed or synthetic. Biometric face matching and liveness detection run against 10,000+ actively processed document types.
.KYB Solutions
Every business you onboard undergoes the same scrutiny as the people behind it. Shufti checks registry records, beneficial ownership and VAT details in real time, then screens UBOs against global watchlists for sanctions and adverse media exposure.
Explore MoreBusiness Verification
Automated validation of Registro Mercantil data, the entity NIF, the intra-EU VAT number (NIF-IVA), directors and signatory authority. Reduces manual registry lookups and onboarding delays.
.Enhanced Due Diligence (EDD)
Structured risk profiling for complex ownership chains, cross-border entities and high-risk sectors, supporting Spain's risk-based AML obligations under Ley 10/2010.
.AML Screening
Shufti screens customers and transactions in 240+ countries and territories, flagging sanctions, PEP, and adverse media matches as they happen. Ongoing monitoring surfaces suspicious activity in time to meet local reporting obligations.
Explore More
AI Compliance Copilot
Helps compliance teams review verification and AML data, investigate alerts, and understand the reasoning behind risk signals. It brings relevant case information together to support faster, more consistent compliance decisions.
.
Transaction Monitoring
Ongoing transaction monitoring calibrated to Spanish financial flows flags anomalies against AML rules, supporting the risk-based controls SEPBLAC expects.
.Supported Verification Methods for Spain
Every Verification Route Spain Uses, in One Platform
Shufti supports the full range of remote verification routes used in Spain, from the EUDI Wallet and the DNIe to video identification, document and biometric checks. Each method below shows what is live today and what is ready for the 2027 rollout.
Listed from newest to most established.
EUDI Wallet
Wallet-ready · from 2027AMLR Article 22(6) recognises eIDAS eIDs, the EUDI Wallet included, for verification. Spain's wallet, Cartera Digital Beta, launched for age checks with a state-issued over-18 credential for adult sites. Shufti is built to accept it once live.
Notified eID
LiveeIDAS HighThe DNIe, the electronic identity function of the Documento Nacional de Identidad, is Spain's notified eID at the highest eIDAS assurance level, and the only Spanish scheme on the Commission's notified list (notified 7 November 2018). Shufti verifies it today.
Docless Database (eIDV)
LiveDatabase-driven verification confirms identity in seconds for low-risk onboarding with no document upload, using permitted reference data sources. Shufti escalates to stronger checks as risk rises.
NFC Chip Verification
LiveShufti reads the secure chip in the DNIe, the TIE residence permit and the Spanish ePassport. This is the high-assurance capture route where eID activation is still ramping.
Document and Face Biometric
LiveA route expressly permitted by AMLR Article 22(6)(a). DNI, TIE and ePassport authentication, paired with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness to confirm a real, present person.
Video Identification
LiveRD 304/2014 Art 21.1 allows remote identification by SEPBLAC-authorised procedures, videoconference (from 1 March 2016) and video-identification (from 1 June 2017). Each is separately specified and outsourceable, the obliged entity fully responsible. Due diligence document copies are due within a month of onboarding. Shufti specialists run live document, face and liveness checks.
Independent Validation
Shufti's Recognition Across Independent Evaluations

Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader across four G2 Summer 2026 reports
View ReportEvidence-Ready Checks Across People & Businesses
Verifications with robust evidentiary support
Individual Documents We Verify
Shufti supports 16+ Spanish document routes across DNI, MiDNI, TIE, EU registration certificates, passports and driving licences.
View All Supported DocumentsDocumento Nacional de Identidad (DNI)
The physical card, primary identity document for Spanish nationals under Ley 10/2010. Cards carry the DNIe function (below) with an NFC chip for high-assurance remote verification.
MiDNI (Digital DNI)
Spain's app-based DNI under Royal Decree 255/2025, mandatory to accept for in-person identification since 2 April 2026. Not yet valid for remote capture, online authentication, signing or travel.
Tarjeta de Identidad de Extranjero (TIE)
Primary resident card for many foreign nationals in Spain. It is separate from the NIE, which is a foreigner identity number rather than a card, and onboarding must handle newer and legacy card formats.
Certificado de Registro de Ciudadano de la Unión
Registration certificate for EU nationals resident in Spain. It has no photograph and does not evidence identity, so it supports residency with a passport or EU ID card.
Pasaporte Español (Spanish ePassport)
Machine-readable Spanish passport. Biometric and ICAO-compliant, with an NFC chip that supports chip-based checks for non-residents and cross-border onboarding.
Permiso de Conducir (Spanish Driving Licence)
Spanish driving licence, supporting evidence only, as Article 6.1.a) of RD 304/2014 admits other photo IDs only exceptionally. Verified for authenticity, and miDGT presentation is valid in Spain.
DNIe (electronic identity function)
NFC-enabled digital identity tied to the DNI, Spain's eIDAS-notified eID at the highest assurance level. Recognised for identity verification in AMLR Article 22(6)(b).
Entity Identity
Registro Mercantil Extract
Commercial register extract from the Registro Mercantil. Confirms a company's legal name, registered office, legal form and appointed administrators for KYB.
Escritura de Constitución (Deed of Incorporation)
Public deed of incorporation confirming legal constitution and core company particulars used in Spanish KYB review.
Poder de Representación (Power of Attorney)
Signatory authority document confirming the onboarding representative can bind the company, especially in delegated, group or non-resident structures.
Tax Identity
NIF de la Entidad (Entity Tax ID)
Core tax identifier for Spanish and non-resident entities with tax-relevant activity in Spain. Confirms the business is registered for tax and supports KYB checks.
NIF-IVA (VAT ID) and VIES Status
Intra-EU VAT number verified through VIES for EU VAT reporting and to confirm a business is trading legitimately, with Modelo 036 census registration as supporting evidence.
Ownership & Control (UBO)
RCTIR Beneficial Ownership Certificate
Certificate or extract from the RCTIR, which obliged entities obtain under RD 609/2023. Shufti checks control data against it, applying 25% or more and control below that line.
Directors and Administrators List
Listing of administrators and legal representatives from the company registry record. Screened against sanctions, PEP and adverse media lists during KYB.
Languages We Cover
Spanish and co-official regional parsing
Native Castilian Spanish parsing, with support for Catalan or Valencian, Galician and Basque records, so onboarding stays accurate across Spain's official languages.
Name matching logic
Name and address matching handles two surnames, accents, the ñ character and regional variants, cutting false mismatches when records are checked against official sources.
Cross-document consistency checks
Cross-document consistency checks reconcile names and identifiers across the DNI, TIE, Registro Mercantil and RCTIR to catch mismatches.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Optimised capture for Spanish ID formats and the NFC-enabled DNIe cuts avoidable re-submissions and manual review from front-and-back misses or older card variants.
Cleaner Audit Trails
Structured logs aligned to Ley 10/2010 record retention and SEPBLAC reporting obligations keep every onboarding decision audit-ready.
Better Name Matching Outcomes
Matching handles two surnames, accents, the ñ character and regional-language variants common in Spain, reducing false positives and manual review.
One Workflow, One Back Office
KYC, KYB and AML screening are consolidated in one operational case view, so one back office team works on every customer file.
National ID-First Flow Design
DNI, TIE and passport-first onboarding reflects Spain's national identity ecosystem and the way customers actually verify.
Continuous Compliance
Compliance that does not stop at onboarding
AMLR treats customer due diligence as a continuing obligation. Perpetual monitoring keeps the customer picture current between reviews, so risk is caught when it appears, not at the next annual check.
Surface Changes as it happens
DetectPerpetual monitoring flags risk when it appears, not at the next annual review. Behavioural biometrics, background fraud signals, and ongoing sanctions and PEP screening watch every active relationship.
Step up when the signal fires
VerifyWhen a signal fires, re-verification confirms the person or the ownership change using the same live methods above, so a flag turns into a resolved decision.
Keep the file audit-ready
ComplyEvery check and decision is logged to Ley 10/2010 record-keeping standards, so files are organised and retrievable for internal and supervisory review.
Perpetual KYC
pKYCKeeps individual customer risk current with behavioural biometrics, background fraud signals and ongoing AML screening, so back-book records stay standard-ready.
Perpetual KYB
pKYBMonitors the RCTIR and the Registro Mercantil, so a shift past the 25%-or-more UBO threshold, or a control change below it, is caught between reviews.
Built To Fit Spain's Compliance Landscape
Banco de España
Supervises banks, payment institutions and e-money firms. Shufti helps evidence customer due diligence, ongoing monitoring, review outcomes and recordkeeping in supervised onboarding flows.
SEPBLAC
Spain's FIU and AML supervisor under Ley 10/2010. Shufti supports risk-based CDD, special-examination workflows, suspicious reporting preparation, retention controls and evidence logs.
Comisión Nacional del Mercado de Valores (CNMV)
Supervises securities markets and investment firms. Shufti helps document customer risk analysis, screening outcomes, review actions and record retention where AML controls are examined.
Agencia Tributaria (AEAT)
Administers entity tax registration and VAT standing. Shufti supports validation of NIF, census registration evidence, VAT identifiers and tax-record consistency in KYB files.
AMLA (EU Anti-Money Laundering Authority)
The new EU-level supervisor has been established in Frankfurt since July 2025. It begins direct supervision of selected high-risk cross-border entities from 2028 and shapes technical standards under AMLR.
Deployment Option
Cloud in EU and Spain regions, or on-premise. Spanish customer data is hosted in-region, with any onward access governed by the relevant transfer mechanism. Supports GDPR accountability.
Regulatory Alignment
Aligned with Ley 10/2010 due diligence obligations, UBO verification and record-keeping duties, as well as GDPR and LOPDGDD principles and AMLR requirements applying from July 2027.
Retention Controls
Ten years after the relationship ends (Ley 10/2010 Art 25). AMLR Art 77 sets five from 10 July 2027, which authorities may extend. Ten years is then open.
Encryption & Security
Encryption in transit and at rest, with access controls and audit logging, supports Article 32 GDPR obligations, under our ISO 27001 certification.
Biometric Processing
The lawful basis for processing is set by the controller. Biometric data used to uniquely identify a person engages Article 9 GDPR, and human review is available in the workflow.
AI Act Position
Article 50 transparency duties apply since 2 August 2026, Annex III high-risk duties from 2 December 2027 (Reg. (EU) 2026/1744). Shufti's classification position for biometrics and age estimation is documented.
Scope of Our Role
Shufti is a data processor providing verification technology, not legal or regulatory advice. Due diligence and the verification method remain the obliged entity's responsibility, documented in its risk assessment.
Data and Privacy Controls in Spain
Spain AML Sources That Strengthen Decisions
We screen against 215+ sanction regimes, 3,500+ watchlists, 100,000+ adverse-media sources, and 6M+ PEPs across Spain and globally. A few of them are shown below.
SEPBLAC
Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias
Banco de España
Comisión Nacional del Mercado de Valores (CNMV)
Dirección General de Seguros y Fondos de Pensiones (DGSFP)
Consejo General del Notariado - Órgano Centralizado de Prevención
Colegio de Registradores - Centro Registral Antiblanqueo
Agencia Estatal de Administración Tributaria (AEAT)
Centro de Inteligencia contra el Terrorismo y el Crimen Organizado (CITCO)
Fiscalía Especial contra la Corrupción y la Criminalidad Organizada
FATF
EU Consolidated Financial Sanctions List
UN Security Council Consolidated List
European Banking Authority (EBA)
EU AMLA (Anti-Money Laundering Authority)
SEE SHUFTI IN YOUR SPAIN WORKFLOW
Turn Spanish Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB, QES, Penny Drop and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
Frequently Asked Questions
Is the DNI accepted for identity checks under Ley 10/2010?
Yes. The DNI is the primary identity document for Spanish nationals under Ley 10/2010, and its DNIe electronic function adds higher assurance when used. Shufti reads the chip directly where eID activation is still ramping.
Can EU nationals onboard with their national ID card?
Yes. EU and EEA national identity cards are recognised for Spanish onboarding under the EU AML framework, and AMLR keeps them valid from July 2027. Shufti verifies them with document, biometric and chip-based checks in one flow.
Where are suspicious activity reports filed in Spain?
Suspicious activity reports in Spain go to SEPBLAC, the national Financial Intelligence Unit, through its official reporting channels. Shufti structures verification and screening evidence so those reports can be filed without a manual scramble.
What documents are required for KYB in Spain?
Typically a Registro Mercantil extract, the entity NIF, the intra-EU VAT number, directors and beneficial ownership evidence from the RCTIR. Shufti verifies these in real time and screens the UBOs behind them against sanctions and PEP lists.
How are Spanish name variants handled in screening?
Matching accounts for two surnames, accents, the ñ character and regional-language variants, so names such as García and Garcia resolve correctly and false positives stay low.
How long must AML records be retained?
Ten years under Ley 10/2010 Article 25. From 10 July 2027, AMLR Article 77 sets five, extendable by competent authorities. Whether ten years stays is open.
Is EU-region data hosting available?
Yes, in EU cloud regions including Spain. Spanish data is hosted in-region under GDPR and the LOPDGDD, with onward access under the relevant transfer mechanism. On-premise suits stricter residency rules.
What changes for Spain under AMLR from July 2027?
AMLR applies directly, so no Spanish transposition law is needed. It sets two permitted routes, document-based and eIDAS-based, recognising notified eIDs, the EUDI Wallet and qualified trust services alongside document and biometric checks. The ownership test is 25% or more, control included.
Will QES alone satisfy identity verification under AMLR?
A qualified electronic signature is a qualified trust service AMLR recognises for remote verification. Shufti runs QES flows that work under Ley 10/2010 today and carry over when AMLR applies.
How does Shufti support businesses supervised by SEPBLAC?
Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one configurable workflow. This helps obliged entities within SEPBLAC's supervisory remit reduce manual hand-offs, standardise compliance records and prepare clearer evidence for internal audit and applicable supervisory review.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
16 August, 2025
5 minutes read
Guide — Identity Verification in Europe: eIDAS 2.0 & EUDI Wallet
A practitioner's guide to verifying identity in Europe, covering eIDAS 2.0, the EUDI Wallet, docless eIDV and how to choose an eID provider for onboarding in the EU.
whitepapers

