EU AML Protocol: What Banks, Lawyers and Asset Managers Must Review in 2026

Key data

Banks, law firms, notaries and asset management companies face a new obligation on the horizon. The EU Council approved on 13 October 2026 Decision (EU) 2026/2356, which authorizes the signing of the Additional Protocol to the Council of Europe Convention on money laundering, search, seizure and confiscation of the proceeds of crime and financing of terrorism—known as the Warsaw Convention.

This protocol is not a minor formal change: it updates the international legal framework by incorporating strengthened measures against money laundering required by current FATF (Financial Action Task Force) standards. The practical result for Spain is that Law 10/2010 on the prevention of money laundering could be modified following ratification.

What does this regulation establish?

The Council Decision is not the final regulation: it is the preliminary step that authorizes the EU to sign the Protocol. The process has two clearly differentiated phases:

The Additional Protocol updates the Warsaw Convention by incorporating the latest FATF recommendations, which are the global standard in combating money laundering and financing of terrorism. This means that Member States will have to align their national legislation with the new protocol requirements.

In Spain, the affected regulatory instrument is Law 10/2010, which regulates the obligations of obligated entities: customer identification, enhanced due diligence, reporting of suspicious transactions and document retention.

Economic and operational impact

The impact is not immediate in terms of new sanctions, but it does generate anticipated adaptation costs for obligated entities. Organizations that do not update their AML systems before transposition will face an urgent and costly review when the Spanish development regulation arrives.

The main vectors of operational cost are:

• Review of due diligence procedures: updating of KYC forms, risk matrices and beneficial owner identification protocols.
• Update of reporting systems: internal procedures for communicating suspicious transactions (ROS) to SEPBLAC will need to be reviewed to align with new FATF standards.
• Staff training: compliance teams and professionals with direct AML obligations (lawyers, notaries) will need specific training on new requirements.
• Internal controls audit: financial entities with established AML programs will need to perform a gap analysis between their current situation and the new protocol standards.

Entities already working with updated FATF standards will have lighter adaptation. Those operating with outdated procedures will assume the highest review cost.

Who does it affect?

The regulation affects all obligated entities under Law 10/2010 and its European equivalents. Specifically:

• Financial entities: banks, savings banks, credit institutions, insurance companies, investment service companies and fund managers.
• Lawyers: when advising on real estate transactions, fund management, company formation or financial transactions on behalf of clients.
• Notaries: in all transactions involving transfer of assets, company formation or significant capital movements.
• Asset managers: portfolio management companies, family offices and wealth managers.
• Other professionals subject to AML: auditors, tax advisors, real estate agents and service providers to companies and trusts.

Practical example

A law firm that regularly advises on company purchase and sale transactions and corporate structuring is subject to Law 10/2010. It currently applies due diligence procedures based on the current version of that law.

With the signing of the Additional Protocol to the Warsaw Convention and its subsequent ratification, Spain will have to transpose the new FATF standards into its domestic legal system, likely through an amendment to Law 10/2010. That firm will then have to:

1. Update its money laundering prevention manual to incorporate new enhanced due diligence requirements.
2. Review customer identification and beneficial owner forms.
3. Update the internal protocol for detecting and reporting suspicious transactions to SEPBLAC.
4. Train all lawyers with AML compliance functions on the changes introduced.

If the firm waits for the Spanish transposition regulation to be published to initiate these changes, it will have very tight deadlines and risk of non-compliance during the transition period.

What should companies do now?

1. Identify if you are an obligated entity under Law 10/2010: if your activity includes financial services, legal advice on capital transactions, asset management or notarial functions, you are affected.
2. Perform an AML gap analysis: compare your current due diligence and suspicious transaction reporting procedures with current FATF recommendations (available at fatf-gafi.org). Identify gaps before the transposition regulation arrives.
3. Review the money laundering prevention manual: update or commission a review of your internal AML compliance document to reflect current FATF standards.
4. Monitor the ratification process: signature is the first step; ratification will generate concrete obligations. Follow progress in the EU Official Journal and in the BOE to detect when the Spanish transposition regulation is published.
5. Plan compliance team training: do not wait to have the final regulation to train your staff. FATF concepts are stable and prior training reduces adaptation costs.
6. Consult with the compliance officer (or designate one if you do not have one): obligated entities without an identified AML officer are the most vulnerable to SEPBLAC inspection.

Official source

View complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026D2356