Spain's revised anti-money-laundering rules take effect on October 28 with an explicit requirement to identify and verify people using cryptoasset cash machines, regardless of the amount involved. The change puts crypto ATM transactions among the activities for which the regulation requires identity checks in all cases, rather than relying on its general monetary threshold for occasional transactions.

The provision is part of Royal Decree 813/2026, dated October 7 and published in the official state gazette on October 8. Its final provision sets commencement at 20 days after publication. October 28 is therefore the start of the rule, not the date on which the government first announced or published it.

Crypto ATMs are outside the general threshold

Article five of the decree amends Spain's existing anti-money-laundering regulation. The revised Article 4 requires covered businesses to identify and verify customers establishing a business relationship, as well as people taking part in occasional transactions worth at least 1,000 euros. Identity must be established using reliable documentation.

The same paragraph expressly puts transactions at cryptoasset ATMs in a separate group requiring identification and verification in every case. Money remittances and transfer-management operations are also in that group. For a crypto ATM transaction, the general 1,000-euro occasional-transaction threshold is consequently not an exemption from the identity requirement.

There is an important qualification for customers whose identity has already been checked when a business relationship was established. The text says verification need not be repeated for an operation if there are no doubts about the person's identity and their participation is evidenced by a handwritten signature or an electronic signature meeting the specified requirements. All those conditions must be satisfied; the exception is not simply based on having used the machine before.

The decree also revises the regulation's treatment of suspicious activity. Where there is suspicion or knowledge of money laundering or terrorist financing, the customer and beneficial owner must be identified and verified regardless of any threshold. The text allows those steps to be omitted where the business reasonably considers they would reveal the examination or reporting of the transaction to the customer. That provision belongs to the wider due-diligence framework, separately from the new express reference to crypto ATMs.

The 18-month transition covers different provisions

A separate transitional provision gives an 18-month period from publication for two specified amendments concerning identification documents and the retention of due-diligence documentation. It refers only to paragraphs three and six of Article five, which amend Articles 6.1(a) and 28. The crypto ATM wording is in paragraph two, so it is not included in that transition.

The identification-document amendment recognises Spain's national identity document in physical or digital form. It also specifies identification documents for foreign nationals. The decree empowers the economy minister to determine the availability and technological means needed for these identification and documentation changes. They should not be confused with a general postponement of the ATM requirement.

The revised record provision expressly includes information obtained through electronic identification, alongside identity-document copies, customer statements, contractual documents, independent-source information and analysis results. It sets retention at ten years after a business relationship ends or an occasional transaction takes place. This describes the amended provision, not a claim that every part of Spain's ten-year retention framework is newly created.

Remote verification remains subject to safeguards

The decree also replaces the rule on business relationships and transactions conducted without the customer physically present. Its permitted routes include identification under the applicable electronic-signature rules, a publicly certified identity-document copy, or a first payment from an account in the same customer's name at an institution in Spain, the European Union or an equivalent third country.

Other secure remote-identification procedures must meet minimum requirements in general authorisations published by Spain's anti-money-laundering executive service, Sepblac. Subject to the statutory exception cited in the provision, covered businesses must obtain copies of the documents needed for due diligence within a month of establishing a non-face-to-face relationship.

These provisions address identification and compliance processes. They are not approval of an individual cryptoasset or an assurance about a provider's services. The decree's preamble presents the amendments as modernisation of the anti-money-laundering framework, including its adaptation to technological developments, rather than an investment measure.

Related regulatory coverage includes FINRA's timetable for outside crypto-work rules and Brazil's customer marketing-choice requirements. Those measures concern different jurisdictions and obligations.

Basado en datos de la Agencia Estatal Boletín Oficial del Estado. Independent English-language summary of the decree published on October 8, 2026, not an official translation or legal or investment advice. No official endorsement is implied.