Police and Tax Authorities to Gain Access to Database of Crypto Account Holders

The Spanish Government, in line with European Union directives, is intensifying its fight against money laundering, and crypto assets have become a primary focus of attention. The Ministry of Economy is about to launch the first state registry that will require cryptocurrency operators to report account openings and closings, as well as the identity of their holders.

This new registry, which will integrate with the current financial ownership file managed by the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Infractions (Sepblac), represents a significant expansion compared to the information collected until now, which was mainly focused on traditional bank accounts. The new regulation extends these obligations to investment fund managers, venture capital companies, agencies, and securities firms, and notably, to crypto asset platforms.

Once the law is in force, all these entities must report not only account openings and closings but also the nature of those accounts: whether they are cash, securities, or crypto assets. The holder, the entity where the account is located, the type of asset, the opening and closing dates, and co-holders will be recorded. It is important to note that this registry will not include information on balances or fund movements, but its main objective is to facilitate the location of accounts during investigations. As José María Olivares, a partner at finReg360, explains, while this measure imposes an additional burden on entities, it is consistent with the goal of preventing and detecting money laundering and terrorist financing.

Crypto assets are particularly attractive for illicit activities due to their ability to anonymize users. The data is compelling: last year, illicit flows moved around $158 billion in crypto assets, according to a TRM Labs report. Dirty money is channeled through less controlled methods, such as crypto ATMs, peer-to-peer transactions, or platforms with little oversight or located in lax jurisdictions. In Spain, police operations have already taken place against networks using ATMs to introduce cash from drug trafficking.

The financial ownership file, which will be publicly accessible and managed by the new National Authority for Financial Integrity (Anifi), will allow judges, prosecutors, security forces, and intelligence agencies to locate accounts swiftly, avoiding the tedious task of inquiring bank by bank. The reform also introduces the obligation for entities to indicate whether the account holder is, in turn, a subject obligated by anti-laundering law, and in which category they fall. Furthermore, the information will remain in the registry for five years after account closure, with a possible extension of another five years, thus extending the retention period.

Spanish legislation already includes anti-money laundering obligations for providers of virtual currency exchange services and electronic wallet custody, leading most of these platforms to register first with the Bank of Spain and now with the CNMV. With the new law, these companies must communicate user data to Anifi, and the spectrum of crypto services subject to this obligation will expand to eight additional categories, including trading platform management, crypto asset exchange, order execution, placement, receipt, and transmission of orders, advisory services, portfolio management, and custodial transfer services.

This expansion of activities is crucial because the exchange of one crypto asset for another, according to FATF and Europol reports, is one of the most common techniques used to sever the trail of money, jumping from one asset to another and one platform to another until traceability is lost. Although services already covered by Spanish law require customer identification and reporting of suspicious transactions, there was no requirement to send information to a centralized registry.

The Tax Agency (AEAT) has been receiving information on cryptocurrencies for two years, with Spanish entities reporting holders, authorized users, and closing balances. However, this information is protected by tax secrecy and cannot be accessed by other authorities during an investigation. The new measure seeks broader surveillance, as the Spanish file will integrate with registries of other EU countries, allowing access to information regardless of where the account was peine. This will bring over 300 crypto platforms authorized in the European Union under scrutiny.