Real Decreto 813/2026

Spain has mandated identity verification for all crypto-ATM transactions and given operators 18 months to install electronic ID systems, closing the last regulatory loophole ahead of a Financial Action Task Force review of its anti-money-laundering framework scheduled for 2026-2027. The move exposes institutional crypto platforms to heightened compliance costs as Europe’s largest crypto-ATM market aligns with international standards.

• Real Decreto 813/2026, published October 7, requires identity checks for every crypto-ATM transaction in Spain, ending anonymous access entirely.
• Operators have 18 months to deploy electronic identification systems linked to Spain’s digital national ID infrastructure.
• Spain also incorporated crypto-asset service providers into its 2010 anti-money-laundering law on September 30, subjecting them to full AML/CTF obligations.

• 18 months Deadline for crypto-ATM operators to install electronic identity verification systems
• 2026-2027 Scheduled period for FATF mutual evaluation of Spain’s AML and counter-terrorist-financing framework
• 2.48M euros Budget Spain’s Treasury allocated for FATF evaluation methodology consultancy earlier this year

Spain’s government has eliminated anonymous crypto-ATM transactions across the country, the largest such fleet in Europe, by enacting Real Decreto 813/2026 on October 7. The decree mandates identity verification for every transaction and requires all operators to install electronic identification systems within 18 months, linked to Spain’s digital national ID platform. The measure targets a compliance gap exposed ahead of the Financial Action Task Force’s upcoming mutual evaluation of Spain’s anti-money-laundering and counter-terrorist-financing systems, scheduled across 2026 and 2027.

Days before the ATM decree, Spain adopted Real Decreto-ley 25/2026 on September 29, folding crypto-asset service providers into the country’s 2010 anti-money-laundering law as obligated entities subject to full AML/CTF compliance.

Spain frames regulatory tightening as defense against FATF weakness findings

The government explicitly linked the new requirements to its preparation for the FATF evaluation, citing an earlier review that flagged gaps in customer identification, supervision and resources. According to the decree’s preamble, Spain risked being perceived as “a jurisdiction with weaknesses regarding criminal financing and evasion of international sanctions” if it failed to act.

The law firm Gómez-Acebo & Pombo, in analysis of the decree, warned that unchecked crypto-asset service providers created “elevated reputational risk” for Spain under international scrutiny.

To address resource concerns, Real Decreto 813/2026 adds personnel to Sepblac, Spain’s financial intelligence unit, and assigns it a new mandate: to assess the adequacy of internal control measures in crypto-asset service provider authorization procedures.

The decree also partially transposes the European Union’s 2024 anti-money-laundering directive, signaling broader alignment with EU standards beyond the immediate FATF calendar.

Crypto providers transition from unregulated to fully obligated under travel rule

Real Decreto-ley 25/2026, which took effect on September 30, accomplishes two shifts in crypto regulation. First, it designates crypto-asset service providers as obligated entities under Spanish AML law, a status previously limited to banks, money-changers and payment service providers. Second, it transposes Regulation (EU) 2023/1113, known as the travel rule, which requires sender and recipient information to accompany all crypto transfers.

The European Commission had opened an infringement case against Spain in 2025 for failing to implement the travel rule, a case now at the reasoned-opinion stage. The decree incorporates travel-rule definitions, cryptocurrency, self-hosted addresses, correspondent relationships, directly from the regulation and extends existing banking correspondent rules to crypto transactions.

A material open question remains: whether crypto platforms operating across EU borders will face divergent national implementations of correspondent-banking obligations before the Commission harmonizes enforcement guidance.

Spain aligns with global enforcement trend but leaves compliance timeline uncertain

Spain is not leading this shift, it is catching up to peer enforcement.

Canada announced in April 2026 plans to ban crypto ATMs outright, citing them as a “primary method” for fraud and money laundering. Indiana and Tennessee have already prohibited the machines entirely. Coinme agreed on Thursday to shut its kiosks across 34 U.S. states and pay $2.5 million to settle Bank Secrecy Act allegations. Spain’s approach, mandatory ID and electronic verification within 18 months, is stricter than pre-regulation but stops short of outright closure.

The decree does not specify how Sepblac will evaluate provider applications or what standards will trigger denial. It also leaves ambiguous how Spain’s digital national ID system will interoperate with non-resident users, a critical question given Barcelona and Madrid’s roles as cross-border crypto hubs.

Institutional platforms must prepare for higher operational cost and audit burden without clarity on enforcement priorities or cross-border procedural harmonization.

The CCS read. We see this as compliance theater ahead of a predictable FATF exam, not a fundamental shift in Spain’s risk stance. The 18-month implementation window allows operators to build compliance infrastructure; enforcement intensity will signal whether Spain intends this as genuine AML hardening or a checkbox to pass international review. The absence of a token ban, unlike Canada’s position, suggests Spain still values the ATM market’s tax and tourism revenue.

Watch for Sepblac’s first batch of provider authorization decisions under the new decree, due within months, and whether Spain publishes enforcement guidance on travel-rule compliance for cross-border transfers before the FATF mutual evaluation officially opens in 2026.