Law · Spain
E-Signature, KYC and AML Rules for SMEs in Spain
Spanish SMEs onboarding a new client work under EU electronic-signature law, a national trust-services act, and Spain's own anti-money-laundering statute for obliged professions. This guide covers when an electronic signature holds up, who has AML duties under Spanish law, what due diligence looks like in practice, and the data-protection points that come up when a client's DNI is involved.
- eIDAS applies directly, and Ley 6/2020 covers Spanish trust services
- Ley 10/2010 lists who has AML duties, supervised by SEPBLAC
- LOPDGDD sets the national detail for handling a DNI copy
Is an electronic signature valid on a Spanish contract
Yes, for the great majority of private-law documents. The eIDAS Regulation applies directly in Spain, so an electronic signature cannot be refused legal effect solely for being electronic, and a qualified electronic signature has the same legal weight as a handwritten one. Ley 6/2020, which replaced Spain's earlier 2003 electronic signature law, regulates trust service providers operating in Spain and complements eIDAS at the national level, including the list of qualified providers maintained by the ministry for digital transformation. For a standard commercial contract or engagement letter, that framework already gives an advanced electronic signature full standing without needing anything beyond it.
When does Spanish practice actually require a qualified signature
The documents Spanish law traditionally routes through a notary, an escritura pública for certain real-estate transfers, company formation deeds and specific formal acts, are the ones most likely to sit outside what an advanced electronic signature covers on its own. Outside that set, standard commercial paperwork, service agreements, engagement letters and consent forms between a business and its client, does not require a qualified signature or a notarial act. Check with a local lawyer or your professional body if a specific document type in your practice is unclear, since notarial requirements are set by Spanish civil and commercial law rather than by eIDAS itself.
Which professions in Spain have AML duties
Ley 10/2010, Spain's anti-money-laundering law, applies to banks and financial institutions and to a wide range of other professions and businesses acting in their normal course of work: auditors, external accountants and tax advisors; notaries and lawyers, for certain transactions; real-estate agents; and dealers in high-value goods such as jewellery, where cash payments cross a set threshold. If your firm falls into one of these categories, client due diligence before starting work is a legal duty, not a courtesy step.
What does due diligence actually involve in Spain
SEPBLAC, the Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales, is Spain's central authority for preventing and supervising money laundering, and Ley 10/2010 sets the standard obliged entities must meet: verify the client's identity before starting the business relationship or a significant transaction, understand the ownership structure if the client is a company, form a view of the purpose of the relationship, and keep watching for anything that does not fit the client's profile. Anything that looks like laundering gets reported to SEPBLAC rather than handled quietly inside the firm.
Do smaller firms actually get inspected on this
Yes, in practice, professional bodies and SEPBLAC itself carry out supervision across the obliged sectors, and Spain has updated Ley 10/2010 more than once to tighten obligations and expand which businesses it reaches. A firm without a documented client-acceptance process, an ID check on file, and a record of when it was done has nothing to show if a client relationship is later examined for an unrelated reason, which is a real exposure even for a small practice that has never handled a genuinely suspicious client.
What about data protection when a client sends a DNI copy
The LOPDGDD, Ley Orgánica 3/2018, is Spain's law implementing the GDPR domestically, and it applies fully to copies of a client's DNI or NIE collected during onboarding. Collecting the copy is generally justified either by the legal duty to run due diligence, where AML rules apply, or by the contract with the client otherwise, but the copy should be minimised and retained only for as long as the applicable record-keeping period requires, not kept indefinitely by default. A DNI photo forwarded by WhatsApp or sitting in a personal inbox, with no access control or deletion plan, is a more common exposure than the collection step itself.
How this looks as one onboarding flow
Put together, a new client in Spain opens one link, completes the client-acceptance questionnaire, declares any beneficial owner if they represent a company, uploads a DNI, verifies identity where the firm requires it, reads the data-protection notice, and signs the engagement letter with an advanced electronic signature sealed and evidenced. Screening and a risk score run automatically where the firm's policy calls for it. For a Spanish accounting or law practice with AML duties, Practice at €149 a month adds hosted identity checks; screening runs on your own provider key at every tier, including Solo at €29 a month.
In Braigest
Client acceptance, identity checks and the signed contract, one link
For a Spanish accounting or law practice with AML duties, Practice at €149 a month adds hosted identity checks; sanctions screening runs on your own Dilisense key at every tier, including Solo at €29 a month.
Frequently asked questions
Is an electronic signature legally valid in Spain?
Yes, for most private-law documents. The eIDAS Regulation applies directly, and Ley 6/2020 regulates trust service providers and complements it at the national level for contracts and everyday business agreements.
Which Spanish professions must run AML checks?
Ley 10/2010 covers financial institutions, auditors, accountants, tax advisors, notaries and lawyers for certain transactions, real-estate agents, and dealers in high-value goods, among several other regulated professions and business sectors.
What is SEPBLAC?
SEPBLAC is Spain's executive service for preventing money laundering, the central authority obliged entities report suspicious activity to under Ley 10/2010, and the sector's main day-to-day supervisor across all of Spain.
Can a Spanish firm keep a copy of a client's DNI under LOPDGDD?
Yes, generally justified by the AML duty to verify identity or by the contract, provided the copy is minimised and kept only for the required retention period, not indefinitely by default.
Explore more of the platform
Ready to fix your onboarding?
See the whole flow in a 30-minute call, or explore the full Braigest platform.