Anti-money laundering
Spanish Law 10/2010 · SEPBLAC · EU AMLR 2024
A file that holds up in front of an inspector.
Compliance Lab takes the KYC file from end to end: document intake, classification, field extraction, risk assessment and regulatory reporting. For accountancy firms, notaries, law firms and obliged entities.
No spreadsheets, no loose PDFs and no risk score nobody can trace back to anything.
Residual risk · RBA
41 / 100
Five dimensions, each with its contribution
Customer · PEP/UBO
Adverse media
Product · channel
Geographic
Register · BORME Not verified
A dimension that could not be verified is shown as such, and never averaged in silently.
File sealed · chained SHA-256 hash
47
KYC fields extracted
Each with its confidence level in view
7
Document types recognised
And it explains why it classifies each one
5
Risk dimensions, each one visible
With its contribution to the result
15 min
Target per complete file
From intake to closing
The journey
From loose document to auditable file
The same route for every file, five stages, and at each one it is recorded what was done and why. That is what turns a folder of PDFs into something you can show.
Not sure yet whether Spanish Law 10/2010 makes you an obliged entity? Ask us and we will go through it article by article.
01
Document intake
PDF, DOCX, images and XBRL. Automatic optical recognition and conversion to structured text.
02
Classification
A legal-language engine that recognises seven document types and explains why it classifies each one the way it does.
03
Field extraction
47 fields across seven document types, each one with its confidence level visible field by field.
04
Risk assessment
Five dimensions, with sanctions lists and adverse media checked against specialist sources.
05
Closing and reporting
File sealed, enhanced due diligence where it applies, and a draft report to SEPBLAC.
RBA engine
Risk you can explain dimension by dimension.
The question an inspector asks is not what the customer scores. It is why they score that. A number with no breakdown is not an answer, which is why the engine hands over all five dimensions open, with what each one contributes.
The threshold that triggers a report is yours to set: the risk policy belongs to the obliged entity, not to the supplier.
Customer · PEP and beneficial owner
Identification of politically exposed persons and of beneficial ownership, with several owners per file where there are several.
Adverse media
Checked against specialist sources, with each finding linked back to its origin so it can be read and weighed.
Product and channel
The risk the transaction itself carries: which product, through which channel, and with how much customer presence.
Geographic
Jurisdictions involved, with the FATF criteria and the European Union lists as the reference.
Companies Register · BORME
The company's standing in the Spanish Companies Register: directors, powers granted and whether they are still in force. It is the same source that underpins the review in Bastanteo Lab, and here it comes in as one more dimension of risk.
If a dimension could not be verified, we say so. It is not averaged in silence or filled with a default, because a low risk for lack of data and a low risk we checked are two different things.
The report
The article 18 deadline does not get past you
Reporting on suspicion is the obligation with the heaviest consequences in Spanish Law 10/2010, and the easiest one to lose between files. Here it comes out on its own: the draft, the checklist and the deadline counting.
10 days
Working days, tracked on their own
The system counts the deadline from the moment the suspicion is recorded and warns before it expires, not after. The same as the legal deadlines in the whistleblowing channel.
The draft, already written
A report to SEPBLAC under article 18, assembled from the file itself: what was detected, in which documents and along what route. You review and sign; you do not start from nothing in front of a blank form.
And enhanced due diligence
Where the risk calls for it, the file asks for the enhanced measures that apply and records that they were carried out — which is what you have to be able to evidence afterwards.
Traceability
Every event sealed, and chained to the one before it.
The activity log is append-only: it is written to, not corrected. Each event carries its SHA-256 hash chained to the previous one, so the integrity of the whole file is checked by walking the chain.
You do not have to take our word for it: you verify it.
Append-only
A recorded action is not deleted or rewritten. Correcting is done by adding, which is how you correct an entry in a register.
Isolated per organisation
Each organisation sees its own files and only its own. The isolation is enforced in the database itself, row by row, not in the application layer.
And the analysis happens in Europe
Document processing is restricted in code to European destinations, and there is an automated test that fails if anyone changes it. It is the same guarantee as in the whistleblowing channel, and for the same reason: Chapter V of the GDPR.
The limits
Where the machine ends and you begin
Being an obliged entity is not something you delegate to a supplier. These boundaries are written down so it is clear what the system takes on and what stays yours.
You sign the report
The system prepares the draft and tracks the deadline. Deciding whether there is a suspicion and reporting it to SEPBLAC is for the obliged entity and its appointed representative before the Service.
The risk policy belongs to the entity
Thresholds and weights are set to your criteria, with ours documented as a starting point. We do not impose a risk appetite you would later have to defend as your own.
An unverified dimension is declared
Never averaged in silence, never replaced with a default value. A low risk for lack of data and a low risk we checked are two different things, and they arrive labelled as such.
The trail is not erased
The activity log is append-only, for us as well. That is what lets the file still mean something two years later, when somebody asks.
Pricing
By file, and right now in pilot
Compliance Lab charges per file processed, not per user or per seat: what you pay tracks the work it takes off you, not how many people in your office open the application.
Founding pilot
No charge
A limited number of places for law firms and accountancy practices willing to use the product in earnest and tell us what is wrong with it. No charge during the pilot and no commitment to buy afterwards.
In exchange we ask for the one thing we cannot buy: real files and a straight opinion.
Ask about a placeWe tell you within 24 h whether any are left
After the pilot
Bands by volume of files
On request
The rate is set by the number of files processed in the period, with bands agreed when you sign and in force from a specific date: an invoice reissued two years later comes out at the price in force that day, not today's.
- We bill the file that reached a decision, not the one left as a draft
- Monthly billing, with sequential numbering and no gaps
- No per-user charge: the whole team can log in
Why we build it this way
A low risk we checked and a low risk for lack of data are not the same thing
That an unverified dimension comes out flagged, instead of being averaged in silence, is not a detail of this one screen: it is the same decision that runs through all three products. We build systems that know when they do not know, and say so.
The JRV Lab paradigm →Getting started
Your trial starts with a file of your own
With your own documents, assembled in front of you: where each field comes from, which dimensions score and why, and how the file looks sealed once you close it. We show the whole process, not a prepared demo.