What is the AML prevention manual?

The document setting out in writing the entity's anti-money laundering policies and procedures: how customers are accepted and classified, what due diligence applies, how unusual transactions are detected and examined, who decides on a report to SEPBLAC, how records are kept and how staff are trained. It does not have to be sent to SEPBLAC: you must have it, apply it and be able to show it.

The AML manual: what it must contain — and why many fail

Q: Is there an official template for the manual?

No. SEPBLAC publishes Recommendations on internal control measures that indicate what must be covered — but it expressly warns they are not a document to be used as-is: each point must be developed according to the entity's activity, size and risk. A generic manual downloaded from the internet ticks the box exactly until somebody reads it.

The prevention manual sets out in writing the entity's anti-money laundering policies and procedures: how customers are accepted and classified, what due diligence is applied, how unusual transactions are detected and examined, who decides on a report to SEPBLAC, how records are kept and how staff are trained. It does not have to be sent to SEPBLAC: you must have it, apply it and be able to show it.

There is no official template. SEPBLAC publishes Recommendations on internal control measures (in the publications section of its website) that set out what must be covered — but it expressly warns that they are not a document to be used as-is: each point must be developed according to the entity's activity, size and risk. A generic manual downloaded from the internet ticks the box exactly until somebody reads it.

Why manuals get rejected. In exams and enforcement files, three failures repeat: (1) missing obligations — the law requires points the manual does not even mention; (2) misunderstood obligations — the eternal example is confusing systematic reporting (DMO) with the suspicious transaction report; and (3) no practical application — the manual should not be a transcription of the legislation, but a description of how compliance actually happens: who does what, when, and with which tool.

What about the internal control body (OCIC)? Depending on the entity's size and activity, the rules require setting up an internal control body — with representation from the business areas — in addition to the representative before SEPBLAC. Its composition does not have to be notified; its existence and its minutes, however, are among the first things an external expert reviews. Small entities exempt from the exam do not need this formal structure either — you can check your case in the exemptions.

The acid test we apply after more than 900 exams: ask whoever deals with your customers to explain, without opening the manual, what they would do about an odd transaction. If the answer does not resemble what the manual says, you do not have a procedure — you have a document.

Legal basis and official sources:

Art. 26 of Ley 10/2010 (policies and procedures)
RD 304/2014 (internal control measures)
"Recommendations on internal control measures for AML/CTF" — sepblac.es → Publications

Reviewed: August 2026 · PBK Asesores — external experts in AML/CTF before SEPBLAC since 2010, more than 900 exams performed.

Does this affect you? We will confirm it in a two-minute call → Contact · +34 91 110 28 29

Related:

The AML manual: what it must contain — and why so many fail the test