SEPBLAC closures without reporting: How to document them
By Arturo Navarro · 7 November 2026
A case reported to SEPBLAC (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias) is Spain's Financial Intelligence Unit and its supervisor for the prevention of money laundering and terrorist financing. Obliged entities file suspicious transaction reports with it (Law 10/2010).Read more → SEPBLAC leaves a trace outside the institution. A case closed without reporting leaves only the trace the institution chose to write down. That is why, in an anti-money laundering review, a closure without reporting can only be defended with what is on file. The regulation implementing Law 10/2010 does not treat them as the absence of a decision: not reporting is a conclusion with reasons, a date and an owner, and it is kept for ten years.
Two outcomes of the same special examination
Article 17 of Spain's Law 10/2010 requires obliged entities to examine with special attention any fact or transaction, regardless of its amount, that may be related to money laundering or terrorist financing, and to record the results of that examination in writing. When setting its internal control measures, each entity specifies how it meets that duty: a list of transactions likely to be related to money laundering, circulated and reviewed periodically, and the use of appropriate IT applications, taking into account the type of transactions, business sector, geographical scope and volume of information.
Article 18 sets the outcome everyone knows: if, after the special examination, there is indication or certainty of a link to money laundering or terrorist financing, the entity reports the fact or transaction, even a mere attempt, on its own initiative and without delay. The report must be preceded by a structured special examination process, and the Commission's Executive Service (SEPBLAC) can send it back if the examination is insufficient.
The other outcome is closure without reporting. The law requires a written result in both cases. What changes is who will read it: SEPBLAC reads the report when it arrives; the closure is read by an inspector or an external expert months or years later, once everyone knows what happened to that customer.
What the implementing regulation requires
Royal Decree 304/2014 turns the special examination into concrete requirements. Its Article 25 does not distinguish between reported and closed cases: everything it requires applies to both.
| Paragraph | What it requires | What it means for a closure without reporting |
|---|---|---|
| 25.1 | A structured process, documenting the stages of analysis, the steps taken and the sources of information consulted, with a comprehensive scope: all related activity, all parties involved and all relevant information held by the entity and, where applicable, its group. | The closure has to show what was looked at, not only what was concluded. |
| 25.2 | The representative before the Executive Service decides, with reasons and without delay, whether to report, applying consistent criteria and recording the reasoning in the case file; the procedure may provide for a prior decision by the internal control body, with minutes recording how each member voted and why. The employee who escalated the transaction is informed. | The reasoning for not reporting is as necessary as the reasoning for reporting, and two similar cases should not be closed differently without an explanation. |
| 25.3 | A chronological record per case: opening and closing dates, reason, description of the activity, conclusion and reasons, and the decision to report or not, with its dates. | The closed case sits in the same record as the reported one. |
| 25.4 | Special examination files are kept for ten years. | The closure should remain readable in ten years, by someone who was not there. |
Article 25 of Law 10/2010 backs the current retention period: ten years for the documentation that evidences compliance with its obligations.
Why closure without reporting is the weak point
A closure is always read in hindsight. If the customer is later reported by another institution, investigated or sanctioned, the question is no longer whether the decision was reasonable but whether you can show it was, with what was known at the time. Six failures worth looking for in an internal review:
- Generic reasoning. "Activity consistent with the customer profile" does not say which profile, with which data or as of which date.
- Unrecorded sources. The analyst checked the due diligence file, group information and transaction history, but only wrote down the conclusion.
- Partial scope. The transaction that triggered the alert was analysed, not all related activity or all parties involved, which is what Article 25.1 requires.
- Criteria that do not repeat. Two cases with similar facts end one reported and one closed, and nothing explains the difference.
- Decision without an owner. There is no record of who decided or when, or the signature is the analyst's rather than that of the representative or body that held the authority.
- Closures that never reopen. New information arrives about a customer with a closed case and nobody links it to the earlier analysis.
Anatomy of a defensible closure
The six questions below are practice, not a regulatory checklist: the first five develop what Article 25 of RD 304/2014 already requires to be documented. A case closed without reporting survives a retrospective reading when it answers them without relying on anyone's memory:
- Why it was opened. System alert, escalation by an employee or a request from an authority, with the alert reference and the version of the rule or scenario that generated it.
- What was analysed. Related activity, parties involved and period, with the criterion that set that scope.
- What was consulted. Each step and each source, with its date: due diligence, group information, documentation provided by the customer.
- What justifies the closure. The economic, professional or business justification that was found, checked against data. This is the condition the second paragraph of Article 18(1) sets for a specific case: an obvious mismatch with the nature, volume of activity or transaction history of the customer is reported when the special examination finds no such justification.
- Who decided and when. The representative before the Executive Service or the internal control body, with the reasoning and, if there was a vote, the minutes.
- What happens next. Whether the closure carries enhanced monitoring, a review of the customer's risk level or a condition that forces the case to reopen.
Document without tipping off
Asking the customer for documentation is part of many examination steps. Article 24 of Law 10/2010 prohibits disclosing to the customer or third parties that information has been reported to the Executive Service, and also that a transaction is being or may be examined. The step is recorded in the case file; the conversation with the customer does not give it away.
Between the alert and the case there is usually a prior filter: alerts dismissed without opening a special examination. Article 33.1.f) of the implementing regulation requires a procedure for detecting facts or transactions subject to special examination, describing the tools and the alerts. That dismissal is part of the procedure and should leave the same kind of trace: which alert, who dismissed it and why.
What a system can automate and what it cannot
Many of those failures are about capture, not judgement. A well-designed system can:
- Set the case scope with related activity and parties involved, instead of leaving it to the analyst's manual search.
- Record each source consulted with its date at the moment of consultation, not when the closure is written.
- Keep the Article 25.3 timeline without manual steps: opening, steps taken, conclusion, decision and dates.
- Require structured reasoning: specific questions instead of a free-text field.
- Flag criteria that do not repeat, pointing to similar cases with different outcomes.
- Keep the file unalterable for the ten years and link it to any later information about the same customer.
What it does not automate is the decision. Article 25.2 places it with the representative before the Executive Service or the internal control body. A system can prepare the case, propose a conclusion and record everything, but deciding and giving reasons is for people. It is the same boundary we draw in agentic AI AML triage.
Regulation (EU) 2024/1624, applicable from 10 July 2027, requires in Article 77(1)(b) a record of the assessment carried out, whether or not it leads to a report to the FIU, and changes the retention period; we cover it in what changes with AMLA.
Conclusion: A closure is defended with what was written the day it closed
Reporting to SEPBLAC and closing without reporting are two outcomes of the same special examination, with the same obligation to put it in writing. The difference is that the closure is read later, by someone who was not there and already knows how the story ended. An institution that documents scope, sources, reasons and owner at the moment of closure can defend its judgement; one that keeps only the conclusion will have to rebuild it from memory.
BlueUPALM covers the record-keeping side with an immutable audit trail of compliance actions and decisions and special examination for SEPBLAC; the judgement remains the institution's. A good first step is to read five closures from the last quarter the way an inspector would.
Related reading
- SEPBLAC software: Automated, traceable AML reporting — The other outcome of the special examination: the report.
- Agentic AI AML triage: What the machine decides — Where the system ends and the human decision begins.
- The EU AML regulation and AMLA: What changes in 2027 — The assessment record that arrives with the AMLR.
Want to see how a special examination is traced?
We show you the special examination and the BlueUPALM audit trail with a scenario from your sector.