What is AML (anti-money laundering)?

Who is covered in Spain (Art. 2.1 of Law 10/2010)

Among others:

• Credit institutions, investment firms and fund and venture capital managers (letters a, c, d and f).
• Real estate developers and brokers in sales, and in leases of at least EUR 10,000 a month or EUR 120,000 a year (letter l).
• Notaries and registrars (letter n), and lawyers when they take part in sales of real estate or businesses or in managing funds or securities (letter ñ).
• Crypto-asset service providers (letter z, as worded by Royal Decree-Law 25/2026, in force since October 1, 2026 and pending validation by the Permanent Deputation of Congress, as Parliament has been dissolved).

What it requires: due diligence, special review and reporting to Sepblac

Customer due diligence, that is, KYC (Arts. 3 to 16); special review of unusual transactions (Art. 17); reporting to Sepblac any transaction with signs of laundering, even a mere attempt (Art. 18); and keeping records for ten years (Art. 25). Crypto-asset transfers are also subject to the travel rule, which has applied since December 30, 2024 (Art. 40 of Regulation (EU) 2023/1113).

The EU package: regulation, directive and the AMLA authority

• Regulation (EU) 2024/1624: common rules that apply from July 10, 2027 (Art. 90). It treats crypto-asset service providers as financial institutions (Art. 2(1)(6)).
• Directive (EU) 2024/1640: Member States must generally transpose it by July 10, 2027 (Art. 78). Directive (EU) 2015/849 is repealed on that date (Art. 77).
• Regulation (EU) 2024/1620: creates the EU authority AMLA, based in Frankfurt (Art. 4) and applicable since July 1, 2025 (Art. 108). According to its recital 86, direct supervision of selected entities will start from 2028.

AML vs. KYC

KYC is one part of AML: the part that identifies and gets to know the customer. AML also covers monitoring transactions, reporting suspicious ones and keeping records of everything. Under Law 10/2010:

AML in Argentina, Mexico and Colombia

In all three countries the obligations fall on those who provide virtual asset services, known in Spanish as PSAVs (VASPs), and on financial institutions. In Argentina and Colombia the list of activities includes financial services related to an issuer's offer, so a firm that provides those services when a token is placed may also be covered.

Argentina. VASPs are obliged entities before the Financial Information Unit (UIF) (Art. 20(13) of Law 25,246, as worded by Law 27,739) and must register with the National Securities Commission (CNV) before operating (Art. 37 of Law 27,739; CNV General Resolution 1058/2025). UIF Resolution 49/2024 requires a risk-based prevention system (Art. 3), a compliance officer and an alternate (Art. 11), biometric techniques for remote customer identification (Art. 22), reporting a suspicious money laundering transaction within 24 hours of concluding that it is suspicious (Art. 36), the travel rule (Art. 37) and keeping records for ten years (Art. 17). Under the CNV tokenization regime (Title XXII of its Rules, created by CNV General Resolution 1069/2025), participating VASPs must also follow the prevention rules in Title XI (Art. 20). The Central Bank (BCRA) bars financial institutions from carrying out or facilitating for their customers transactions in digital assets not authorized by a regulator (Communication A 7506, item 1.1).

Mexico. The law does not use the VASP concept: since 2018, the regular and professional offering of virtual asset exchange through platforms, or of means to hold or transfer virtual assets, by anyone other than a financial institution is a vulnerable activity (Art. 17(XVI) of the LFPIORPI, Mexico's anti-money laundering law). Whoever carries it out must identify its customers and their beneficial owner, register in the official roll, file notices with the Ministry of Finance (SHCP) and keep the information for ten years (Art. 18(I), (III), (IV), (IV Bis) and (VI)). The notices are received by the Tax Administration Service (Art. 4(II) of the LFPIORPI Regulations). A notice is due for a customer's transactions from 210 times the daily UMA value, or for fees from 4 times that value (Art. 17(XVI), amended on July 16, 2025). Financial technology institutions (ITFs) apply the prevention rules issued by the SHCP, subject to the prior opinion of the National Banking and Securities Commission (CNBV), which supervises them (Arts. 58 and 71 of the Fintech Law); brokerage firms apply those under Art. 212 of the Securities Market Law. SHCP Agreement 115/2026, which amends the registration rules for virtual asset service providers, enters into force on November 30, 2026.

Colombia. The Financial Superintendence (SFC) warns that it neither regulates nor supervises business models based on virtual assets (statement of July 26, 2024). Even so, anyone providing virtual asset services, including financial services related to an issuer's offer, must report to the Financial Information and Analysis Unit (UIAF) suspicious transactions, immediately, and every month its customers and individual transactions from $150 or multiple transactions totaling $450 or more (UIAF Resolution 314 of 2021, Arts. 1, 2, 4 and 6). If it is a company, a branch of a foreign company or a single-member company and exceeds the thresholds in section 9.5.7 of the Basic Legal Circular of the Superintendence of Companies, it must also implement that authority's self-control and money laundering risk management system (External Circular 100-000020 of 2026, chapter IX; firms already covered have until May 31, 2027 to adapt). If the offering goes through an entity supervised by the SFC, such as a trust company, that entity applies its own system, SARLAFT (SFC Basic Legal Circular, part I, title IV, chapter IV; Arts. 102 to 107 of the Organic Statute of the Financial System).

Country details are in VASP registration in Argentina, Mexico's Fintech Law and asset tokenization in Colombia. Each offering is reviewed with local legal counsel.

AML in a tokenized offering

The token does not exempt anyone. If a credit institution or an investment firm places the offering, it is an obliged entity, and in real estate tokenization so is the sponsor, if it is in the business of real estate development (Art. 2.1.l). We explain who runs each control in AML/KYC in a security token offering.

How we work. We build KYC/KYB onboarding, allowlists of authorized addresses and transaction records into the platform. The prevention policy and reports to Sepblac or, in Latin America, to each country's financial intelligence unit remain the responsibility of each obliged entity, with its local legal counsel.

Official sources: Law 10/2010 (BOE, in Spanish); Royal Decree-Law 25/2026, first final provision (BOE); Regulation (EU) 2024/1624 (EUR-Lex); Directive (EU) 2024/1640 (EUR-Lex); Regulation (EU) 2024/1620 (EUR-Lex); Regulation (EU) 2023/1113 (EUR-Lex); Law 25,246, updated text (InfoLEG, in Spanish); UIF Resolution 49/2024 (argentina.gob.ar, in Spanish); LFPIORPI (Chamber of Deputies, in Spanish); UIAF Resolution 314 of 2021 (UIAF, in Spanish). Framework verified as of October 15, 2026. Need a platform with built-in AML? Talk to us.