One KYC file per customer with formal identification, beneficial owner, PEP status, purpose of the relationship, source of funds and risk level: the customer due diligence required in Spain by Law 10/2010 (the anti-money-laundering act), run as a process rather than kept in a folder. Rules enforce enhanced due diligence when it applies, the compliance officer approves or rejects with a reason, and everything is kept for ten years with a full history for SEPBLAC, the Spanish financial intelligence unit. A free module of Dokuflex, the low-code BPM platform with AI.
A KYC file (know your customer) is the set of documents, checks and decisions with which an obliged entity proves the due diligence applied to each customer: formal identification, beneficial owner, PEP status, purpose of the relationship, source of funds and risk level, with periodic review and ten-year retention.
Law 10/2010 on the prevention of money laundering, Spain's anti-money-laundering act, requires every obliged entity to apply customer due diligence measures to all its customers and to be able to prove it. Each customer's file must evidence at least five things:
Article 7 allows the measures to be graded according to risk (simplified due diligence under Article 9 for low-risk customers and products, standard, or enhanced under Article 11), but requires the analysis to be documented in writing; Article 25 requires the documentation to be kept for ten years from the end of the relationship. Royal Decree 304/2014, the implementing regulation, adds the €1,000 threshold for occasional transactions, the AML manual, the internal control body and the documented risk assessment.
From 10 July 2027, Regulation (EU) 2024/1624 (AMLR) applies directly: a single rulebook across the EU, a €10,000 limit on cash payments, new obliged entities (traders in luxury goods, credit intermediaries and, from 2029, professional football clubs) and a harmonised sanctions regime under Directive (EU) 2024/1640, with fines of at least €10 million or 10% of annual turnover for financial institutions and at least €1 million for the rest.
Most accounting practices, law firms, estate agencies and small financial firms "comply" with a folder per customer, a spreadsheet with the risk level and the ID card scanned into an email. It works until SEPBLAC asks for one specific customer's file and you have to reconstruct in an afternoon what was decided three years ago.
The problem is not one of will: a spreadsheet has no rules, no workflow and no history. A process does. If you need the spreadsheet for now, download the free Excel KYC file template with the Law 10/2010 fields, the beneficial owner and the calculated review date (the template is in Spanish).
The KYC file and customer due diligence (AML/AMLR) module is a complete process that you activate from the module catalogue of your account, in the "Regulatory compliance" group. It is not identity-verification KYC software: it is the automated KYC file in which each customer's due diligence is recorded, decided and approved, with the evidence and the history that SEPBLAC reviews. This is exactly what it brings:
Customer identification (customer type, name or company name, tax ID, document type and number, date of birth or incorporation, nationality, address, economic activity, risk sector, identity document and deeds attached). Beneficial owner and PEP (beneficial owner's name, tax ID and percentage, PEP status and public office, high-risk country, "Sanctions and PEP lists checked" box). Operations and source of funds (purpose of the relationship, source of funds, expected annual volume, cash payments of €10,000 or more, supporting document attached). Due diligence and review (type of due diligence, compliance officer, onboarding date, next review, rejection reason, remarks and the ten-year retention reminder). Each file receives a KYC-{seq} number.
If the customer is a legal entity (the KYB file of a company), the deeds and the three beneficial owner fields appear, and the beneficial owner's name becomes mandatory. If the customer is a PEP, the public office is requested (mandatory) and the risk level is forced to High. If they operate from a high-risk country, High risk as well. With High or Very high risk, the type of due diligence is set to Enhanced. If there are cash payments of €10,000 or more, the source-of-funds supporting document is mandatory. And if the status is Rejected, the rejection reason is shown and mandatory.
The Start review button sends the file into the flow: it moves to Pending, the requester is notified and the approver sees the Approve and Reject buttons. Approving marks the file as Approved and closes it; rejecting marks it as Rejected and requires the reason. Who, when and with what outcome stays in the record's history.
Four cards that filter on click (Under review, High risk, Approved, Awaiting documentation), a grid exportable to Excel with customer, tax ID, type, risk, PEP, due diligence, next review, status, flow and officer, a kanban view by status and a dashboard with six charts: customers by risk level, customer type, risk sector, file status, onboardings per month and declared source of funds.
It installs in under a minute from the module catalogue of any Dokuflex account and can be modified with the low-code designer. It brings:
Four panels, attachments for identity, deeds and source of funds, KYC-{seq} numbering and the 13 visibility, mandatory-field and value rules.
Start review, approve or reject with a mandatory reason, notifications and the Pending, Approved, Rejected and Closed statuses.
Under review, high risk, approved and awaiting documentation; filterable grid exportable to Excel; kanban view by status.
Risk level, customer type, risk sector, status, onboardings per month and source of funds, ready for the internal control body's annual report.
An approved estate agency, a foreign PEP under enhanced review, a jewellery purchase in cash awaiting its supporting document, a rejected crypto-asset company, an art gallery and an expired file.
One per screen (form, list and dashboard) so the team learns to use it without prior training.
Full guide to preparing the file for an inspection in the article customer due diligence: what the KYC file must contain (in Spanish). Module sheet in the template catalogue.
The KYC file module does not verify identity remotely and does not query sanctions and PEP lists: it records the result, the compliance officer's decision and its history. If you already work with a specialised verification or screening provider, the file can be connected to it through the REST API and the 200+ connectors of the low-code iPaaS.
If you do not have a screening provider yet, the module works all the same: the check is ticked by hand in the box and the officer's approval stays in the record's history. Anti-money-laundering (AML) software is not only about verifying: it is about being able to show, ten years later, what was decided and why.
The same file serves very different sectors; what changes is the risk sector, the review frequency and who approves.
Customer onboarding with beneficial owner, PEP and source of funds, periodic reviews by risk level and evidence for SEPBLAC and the Bank of Spain. See Dokuflex for banking.
Company formations, property sales and management of client funds: one file per client with the deed, the beneficial owner and the approval of the partner in charge. See Dokuflex for the legal sector.
A dedicated risk sector in the form, control of cash payments of €10,000 or more with a mandatory supporting document and a file closed before signing. Links with the electronic signature of the contract.
Policyholders and beneficiaries identified, PEP and high-risk country under control, and the documentation kept for ten years in the document management system. See Dokuflex for insurance.
Anti-money-laundering (AML) software for an accounting practice or a law firm does not need to verify identities remotely: it needs each client's file to apply the manual. In Spain, accounting practices and tax advisers are obliged entities under Article 2 of Law 10/2010, and law firms are too when they take part in certain transactions that are very common in their day-to-day work: forming companies, taking part in property sales or managing client funds. Their AML programme rests on the elements required by Royal Decree 304/2014: a manual, a documented risk assessment and an internal control body. The manual sets the criteria; the KYC file applies them at every onboarding.
The module does not replace the AML manual or the annual external review: it provides the evidence that the manual is applied, file by file. For the rest of the firm's operations, see Dokuflex for law firms and legal services.
In Spain, all obliged entities under Article 2 of Law 10/2010: financial institutions and insurers, but also accounting practices, tax advisers, auditors, lawyers and notaries in certain transactions, property developers and estate agents, jewellers and dealers in high-value goods, art galleries, casinos and crypto-asset service providers. Regulation (EU) 2024/1624 extends the list from 10 July 2027 (traders in luxury goods, credit intermediaries, and professional football clubs from 2029).
Ten years from the end of the business relationship or the transaction, under Article 25 of Law 10/2010 and Articles 28 and 29 of Royal Decree 304/2014. Regulation (EU) 2024/1624 sets in its Article 77 a harmonised five-year period, extendable case by case; until it applies and its coordination with Spanish law is clarified, the prudent course is to keep the ten years. The module reminds you of this in the form itself.
No. The free module records the check ("Sanctions and PEP lists checked" box, the PEP's public office and the high-risk country) and applies the consequences: High risk and Enhanced due diligence automatically. Queries to external lists or to a screening provider can be integrated later with the low-code designer or through the Dokuflex API.
Yes. It is what the market calls KYB (know your business): when you select "Legal entity", the form shows and makes mandatory the beneficial owner's name, with tax ID and shareholding percentage, and adds the field for the deeds of incorporation. For natural persons those fields do not appear. It is the obligation of Article 4 of Law 10/2010 (more than 25% of the capital or voting rights, or control by other means), which the obliged entity checks against the information of Spain's Central Register of Beneficial Ownership.
The workflow marks the file as Rejected, the "Rejection reason" field becomes mandatory and the record is kept with its history: who created it, who reviewed it, when and why. Rejecting rather than deleting is what Article 7.3 of Law 10/2010 requires: if due diligence cannot be applied, the relationship is not established, but the evidence is kept.
Yes. The module installs as an ordinary Dokuflex process: form, list, dashboard and workflow are edited with the low-code designer without coding. You can add risk sectors, change the review frequency, include a second approver or connect the file with the electronic signature of the contract.
It is a KYC file manager. The module does not verify identity remotely and does not query sanctions lists: it records the identification, the beneficial owner, the PEP, the source of funds and the risk level, applies the 13 rules, runs the compliance officer's approval and keeps the history. Your verification or screening provider can be integrated with the low-code designer or the Dokuflex API.
Nothing: the module is free and is activated from the module catalogue of any Dokuflex account, with no card and no implementation project. The low-code BPM platform it runs on has a Starter plan from €25 per user per month with an annual subscription and a free 14-day trial environment set up by our team. See the Dokuflex pricing.
Yes. Property developers and estate agents are obliged entities under Article 2 of Law 10/2010. The module brings a dedicated risk sector for estate agencies, requires the source-of-funds document when there are cash payments of €10,000 or more, includes a sample file of an approved estate agency and links with the electronic signature of the contract so the file is closed before signing.
It is designed with the AMLR in mind: the form collects the beneficial owner, the PEP, the high-risk country and cash payments of €10,000 or more with a supporting document. Regulation (EU) 2024/1624 applies from 10 July 2027 and, since the module is edited with the low-code designer, fields and rules are adjusted without coding. Compliance is evidenced by each organisation.
Leave evidence of every step: formal identification, beneficial owner, PEP, purpose of the relationship, source of funds and risk level. It has to apply enhanced due diligence for a PEP or a high-risk country, record who approves or rejects and why, set the next review and keep the file with its history for ten years. That is what the Dokuflex KYC file module covers; the risk assessment and the manual remain the responsibility of each obliged entity.
With that customer's complete record: identity document and deeds attached, beneficial owner, PEP, source of funds, risk level and type of due diligence, plus the history of who reviewed it, who approved it and when. In Dokuflex everything sits in a single KYC-{seq} file, and the grid exports to Excel the list of customers with their risk, their status and their next review.
Guidance prepared by the Dokuflex Editorial Team. For your specific case, consult your legal adviser, your external AML expert or SEPBLAC.
The KYC file is one of the modules in the "Regulatory compliance" group of the Dokuflex catalogue. All of them follow the same pattern as customer due diligence: a file with rules, deadlines or evidence to prove and a history of who did what. They install from the same account and run on the Dokuflex low-code BPM software with AI, with the same document management, the same electronic signature and the same connectors.
24 h, 72 h and one-month deadlines counted in the file and closure approved by the CISO. Free module.
Rights requests answered within one month and breaches notified to the AEPD within 72 h, with the deadline always in view.
The same catalogue also holds the AI systems register for the AI Act, ISO 9001 nonconformities and corrective actions and AICA food supply contracts.
Activate the free module in your Dokuflex account, review the six sample files and adapt sectors, reviews and approvers to your AML manual. No card and no implementation project.