CNMV Publishes Findings of First AML/CFT Report Review for Securities Firms, Asset Managers, and Cry

Key Takeaways

• The CNMV has completed its review of the first AML/CFT information reports (BCFT1, covering 2025) submitted by securities firms and agencies, asset managers, and crypto asset service providers.
• Overall report quality was adequate, but the CNMV found erroneous and inconsistent data and signs of possible compliance gaps, particularly in alert generation and special examinations.
• Compliance teams should expect these findings to inform further supervisory work.

Deep Dive

The CNMV has completed its review of the first AML/CFT information reports (BCFT1, covering 2025) submitted by securities firms and agencies, asset managers, and crypto asset service providers. Overall report quality was adequate, but the CNMV found erroneous and inconsistent data and signs of possible compliance gaps, particularly in alert generation and special examinations. Compliance teams should expect these findings to inform further supervisory work.

The review assessed whether entities met the reporting obligation, the quality and consistency of the data submitted, and compliance with AML/CFT rules. It covered SAV, SGIIC, SGEIC, and PSC entities and forms part of the CNMV's 2026 Activity Plan. The CNMV also used the results to build an updated view of the sector to support ongoing monitoring. Some reported data were flagged as erroneous or inconsistent, and some responses suggested possible incidents of non-compliance. Entities should therefore treat the findings as an early signal of supervisory focus rather than a purely administrative exercise.

The CNMV reminded entities of three core requirements. First, prevention bodies and systems: a risk analysis covering inherent risk, control measures, and residual risk; written policies and procedures providing adequate human and technical resources, an internal control body, and a representative to Sepblac; and an annual examination by an external expert. Second, monitoring: alerts must be set by transaction type, participants, and amount, and reviewed to decide whether a special examination is warranted. Third, training: an annual training plan ensuring regular staff training, awareness of legal obligations, and the ability to detect suspicious transactions.

The most significant finding is that a large number of entities reported no alerts, and few reported special examinations or indicative communications. The CNMV said this will be considered when planning additional supervisory actions. Zero or very low alert volumes are likely to be read as a sign of poorly calibrated or ineffective monitoring, not as evidence of low risk. The CNMV also said it will complete the content of the reporting manual "in the coming weeks," which suggests clearer data definitions and possibly revised expectations for future reports. No formal deadlines or penalties were announced.

Recommended actions: (1) Reconcile the data submitted in BCFT1 against internal records and correct or document any errors; (2) test alert scenarios and thresholds, and document the rationale where alert volumes are low or nil; (3) confirm that the risk analysis shows inherent risk, controls, and residual risk, and that the external expert review is current; (4) verify that the Sepblac representative, internal control body, and resourcing are in place and documented; (5) update the annual training plan and keep evidence of completion; (6) monitor the revised reporting manual and prepare for the next reporting cycle.

Risk implications: Entities with reporting inaccuracies, no alerts, or weak governance face a higher chance of targeted inspections, supervisory follow-up, and potential sanctions under Spanish AML/CFT law. Crypto asset service providers, as newer supervised participants, may face particular scrutiny. Strengthening monitoring effectiveness and data quality now should reduce regulatory and reputational exposure.

Source: Comisión Nacional de Mercado de Valores