Europe's New Anti-Money-Laundering Rulebook (AMLR and AMLA): Cash Limits and Criminal Exposure in Spain

The European Union has rewritten its anti-money-laundering rules from top to bottom. A directly applicable single rulebook, a new European supervisor based in Frankfurt and an EU-wide cash payment limit are on their way. For anyone doing business or holding assets in Spain — and especially for foreign investors and companies operating across borders — the shift matters, because the administrative rulebook sits directly on top of the criminal offence of money laundering in Article 301 of the Spanish Criminal Code (CP). This article explains what is changing, what remains merely administrative, and where the criminal line actually falls.

The New EU Anti-Money-Laundering Package

In 2024 the EU adopted a package that replaces the old system of successive directives with a harmonised regime:

• The AML Regulation (AMLR), Regulation (EU) 2024/1624 — the "single rulebook": directly applicable rules on customer due diligence, beneficial ownership and reporting that apply the same way in every Member State.
• The sixth AML Directive (AMLD6), Directive (EU) 2024/1640 — rules that Member States transpose, covering national supervisors and financial intelligence units.
• AMLA, Regulation (EU) 2024/1620 — a new Authority for Anti-Money Laundering based in Frankfurt, which will coordinate national supervisors and directly supervise the highest-risk cross-border entities.

The bulk of the single rulebook becomes applicable from 10 July 2027, with AMLA taking up direct supervision of selected obliged entities later still. The direction of travel is uniformity: the same due-diligence and transparency standards, enforced consistently, with less room for firms to shop for the softest jurisdiction.

The EU-Wide Cash Limit — and Spain's Stricter One

One of the most visible measures is an EU-wide ceiling of 10,000 euros on cash payments for goods and services, applying from 2027. Spain, however, already runs a stricter domestic regime under Law 11/2021: payments in which at least one party acts as an entrepreneur or professional may not be made in cash for 1,000 euros or more. A higher 10,000-euro limit applies where the payer is a natural person who is not tax-resident in Spain and is not acting in a business or professional capacity.

It is essential to be precise here: breaching the cash limit is an administrative infringement under Law 11/2021, not a crime in itself. It becomes criminal only when the cash movement is a vehicle for something else — laundering the proceeds of an offence (Article 301 CP) or evading tax above the penal threshold (Article 305 CP). The regulatory breach and the criminal offence are two different planes.

Where the Criminal Line Falls: Article 301 CP

Article 301 CP punishes whoever acquires, possesses, uses, converts or transmits assets knowing that they originate in criminal activity, or performs any act to conceal or disguise their unlawful origin, or to help the person who committed the underlying offence to evade the legal consequences. The penalty is six months to six years' imprisonment and a fine of one to three times the value of the assets. There is also a negligent form (Article 301.3 CP) for serious carelessness — relevant precisely to professionals and businesses who look the other way.

Two features make Article 301 CP unusually broad. First, self-laundering is punishable: the person who committed the predicate offence can also be convicted of laundering its proceeds. Second, a conviction requires proof of a predicate offence — the criminal origin of the funds — although Spanish case law accepts that this origin can be established by circumstantial evidence (unjustified wealth, the absence of lawful economic activity, concealment structures) rather than a prior separate conviction. We develop these lines of defence in our guide to defending a money-laundering case in Spain.

Aggravated Laundering and the Obliged Professional (Art. 302 CP)

Article 302 CP imposes the penalty in its upper half on those who belong to an organisation devoted to laundering, and a higher penalty on its leaders. Crucially for the new rulebook, the same aggravation applies to "obliged subjects" — the banks, notaries, real-estate agents, and now crypto-asset service providers, that the AML rules require to carry out due diligence — when they commit the conduct of Article 301 CP in the exercise of their professional activity. The more the AMLR expands the perimeter of obliged entities, the wider the circle of professionals exposed to this aggravated form.

Obliged Entities, SEPBLAC and Due Diligence

In Spain the AML framework (Law 10/2010) requires obliged entities to identify their customers, monitor operations and report suspicious transactions to SEPBLAC, the Spanish financial intelligence unit. The AMLR harmonises and tightens these duties across the EU and reinforces beneficial-ownership transparency. For a compliant business the practical takeaway is not fear but diligence: robust customer identification, documented source-of-funds checks and timely suspicious-transaction reports are what separate an administrative world from a criminal one — and, under Article 301.3 CP, what separates diligence from punishable negligence.

The Classic Vehicle: Property

Real estate remains the textbook laundering channel because it absorbs large sums and appreciates over time, which is why cash limits and beneficial-ownership rules bite hardest there. If illicit funds are funnelled into Spanish property, the buyer, the intermediary who turns a blind eye and the structure used can all fall within Article 301 CP. We examine this in detail in our page on money laundering through real estate.

Beneficial Ownership and the End of Opacity

A central plank of the single rulebook is harmonised transparency of beneficial ownership: the natural persons who ultimately own or control companies, trusts and similar structures must be identified and recorded, with a lower control threshold and interconnected registers across the EU. For legitimate businesses this is a compliance task; for those who relied on layered corporate structures to obscure who really stands behind an asset, it removes a favoured tool. In criminal terms it also strengthens the circumstantial case: the deliberate use of interposed entities to hide ownership is exactly the kind of concealment that Spanish courts weigh when inferring the unlawful origin of funds under Article 301 CP.

What It Means for Foreign Companies Operating in Spain

Because the AMLR is a directly applicable regulation, a company operating across several Member States will face the same due-diligence and reporting standard in each, supervised with growing consistency and, for the highest-risk cross-border entities, ultimately by AMLA itself. For a foreign business with a Spanish footprint the practical implication is that a compliance failure is no longer a purely local, administrative matter: the same conduct that breaches the rulebook can, where funds of criminal origin are involved, expose the entity and its managers to Article 301 CP — and, for a legal person, to corporate criminal liability under Article 31 bis CP where an adequate compliance programme is absent. Building and documenting that programme before an inquiry begins is the decisive protection.

How We Handle These Cases

In our money-laundering defence practice we act for individuals and companies facing investigations by the AEAT, SEPBLAC or the courts, and we advise obliged entities on the boundary between an administrative breach and criminal exposure. As the EU single rulebook comes into force, the decisive work is documentary: proving the lawful origin of funds and evidencing genuine due diligence before an inquiry hardens into a prosecution.