AML and compliance in M&A transactions: buyer obligations

Anti-money laundering (AML) and compliance obligations in M&A transactions have intensified significantly in recent years. What was once a perfunctory box-ticking exercise has evolved into a substantive component of the transaction process that can affect timelines, costs, and even the viability of a deal.

For buyers operating in Spain’s middle market, understanding these obligations is not optional — it is a prerequisite for professional deal execution.

The regulatory framework

Spain’s AML framework is built on Law 10/2010 on the Prevention of Money Laundering and Terrorist Financing, which transposes the EU’s Anti-Money Laundering Directives. The framework imposes obligations on “obligated subjects” — a broad category that includes financial institutions, lawyers, tax advisors, auditors, and increasingly, corporate entities involved in transactions above certain thresholds.

KYC in M&A transactions

Know Your Customer (KYC) procedures in an M&A context go beyond the standard identity verification. They encompass:

Ultimate beneficial ownership (UBO) identification. The buyer must identify and verify the ultimate beneficial owners of the target company — the natural persons who ultimately own or control the entity, either through direct or indirect ownership of more than 25% of the share capital or voting rights, or through other means of control.

Source of funds. The buyer must be able to demonstrate the legitimate origin of the funds used for the acquisition. This requires documentation of the capital structure, bank references, and in some cases, a detailed flow-of-funds analysis.

Politically exposed persons (PEP) screening. Both the buyer and the seller (including their beneficial owners, directors, and key management) must be screened against PEP lists and sanctions databases.

Ongoing monitoring. AML obligations do not end at closing. The buyer must implement ongoing monitoring of the acquired business, including transaction monitoring, periodic KYC updates, and suspicious transaction reporting.

Enhanced due diligence

Certain circumstances trigger enhanced due diligence requirements:

• Transactions involving parties from high-risk jurisdictions
• Complex corporate structures with multiple intermediary entities
• Transactions involving politically exposed persons
• Unusually large or economically unjustifiable transactions
• Situations where source of funds is difficult to verify

Enhanced due diligence involves more intensive verification procedures, more frequent monitoring, and higher-level approval within the buyer’s organisation.

Practical implications for M&A

Timeline impact. AML compliance can add two to four weeks to the transaction timeline, particularly when complex corporate structures or cross-border elements are involved. Buyers and their advisors should factor this into the transaction schedule from the outset.

Cost. Compliance costs include external screening services, legal advisory fees, and internal compliance team time. While not typically material relative to the transaction value, they should be budgeted.

Deal risk. In rare cases, AML findings can kill a deal — if the due diligence reveals sanctions exposure, criminal connections, or unexplained wealth among the seller’s beneficial owners. While these situations are uncommon in the middle market, they do occur.

Post-closing obligations. The buyer inherits the target company’s AML compliance obligations, including any existing deficiencies. If the target company was an obligated subject with inadequate AML controls, the buyer becomes responsible for remediation.

Best practices

Start early. Initiate KYC and AML screening on the seller as soon as the letter of intent is signed. Waiting until late in the process creates unnecessary risk and potential delays.

Use professional screening services. Automated screening tools for PEP, sanctions, and adverse media are essential. Manual screening is insufficient for complex transactions.

Document everything. Regulators expect comprehensive documentation of the AML procedures followed. Maintain a detailed compliance file for each transaction.

Integrate AML into due diligence. Rather than treating AML as a separate workstream, integrate it into the overall due diligence process. The financial, legal, and tax due diligence will often surface AML-relevant information.

Conclusion

AML compliance in M&A is no longer a peripheral concern — it is a core component of professional deal execution. Buyers who approach it systematically, start early, and integrate it into their overall due diligence process will avoid the surprises and delays that catch the unprepared. The regulatory environment will only become more demanding, making robust compliance practices an investment in operational resilience.