KYC (Know Your Customer)

The four measures in the law.

• Formal identification (Art. 3): verify identity with reliable documents before the business relationship starts. For Spanish nationals, the national ID card (DNI); for foreigners, the residence card or foreigner identity card, a passport or the official ID document of their EU or EEA country; for companies, public deeds or a Commercial Registry certificate (Art. 6 of Royal Decree 304/2014). Royal Decree 813/2026 adds an express reference to the digital DNI, applicable from April 8, 2028.
• Beneficial owner (Art. 4): the individual who directly or indirectly owns or controls more than 25% of the capital or voting rights, or who controls the company by other means.
• Purpose and nature (Art. 5): understand the customer's business and take reasonable steps to verify it.
• Ongoing monitoring (Art. 6): check that transactions match the customer's profile, including the source of funds, and keep data up to date.

The surrounding rules. The intensity of the measures in Arts. 4 to 6 depends on risk, based on a prior written risk analysis (Art. 7.1). If due diligence cannot be applied, the relationship is not started or is ended (Art. 7.3). Remote onboarding is allowed, for example with a qualified electronic signature (Art. 12 of the law and Art. 21 of Royal Decree 304/2014). Records are kept for ten years (Art. 25). From July 10, 2027, Regulation (EU) 2024/1624 will apply directly: its Art. 20 sets these measures across the EU and includes checking whether the customer or its beneficial owners are subject to targeted financial sanctions.

KYC in security token offerings. It has two layers:

• Legal: it is done by the obliged entity that brings in the investor, such as the credit institution or investment firm placing the offering (Art. 2.1, letters a and c). The ERIR also manages the identification of the securities' holders (Art. 8.4 of Law 6/2023).
• Technical: the smart contract only lets verified addresses receive tokens. Under the ERC-3643 standard, the receiver must be listed in the identity registry and verified; otherwise the transfer does not go through.

The split of tasks is covered in AML/KYC in a security token offering, and the general framework in the AML entry.

How we work. We connect the identity verification provider chosen by the client to the token's identity registry. The decision to accept each investor belongs to the obliged entity.

Official sources: Law 10/2010, Arts. 3 to 7, 12 and 25 (BOE, in Spanish); Royal Decree 304/2014, Arts. 6 and 21 (BOE); Law 6/2023, Art. 8.4 (BOE); Regulation (EU) 2024/1624, Art. 20 (EUR-Lex). Framework verified as of October 13, 2026. Preparing an offering with built-in KYC? Talk to us.