Spain ends crypto ATM anonymity ahead of FATF review

Spain, the country with the largest fleet of crypto ATMs in Europe, will now require identity checks for every crypto ATM transaction, ending an era in which people could use the machines anonymously ahead of an anti-money-laundering regime review by the Financial Action Task Force (FATF).

Days before this new decree, on 29 September, Spain passed Real Decreto-ley 25/2026, a separate measure meant to fold crypto-asset service providers into the country’s 2010 anti-money-laundering law. 

The urgency of the country’s recent moves was expressed by the law firm Gómez-Acebo & Pombo, which wrote that Spain risked being “percibida como una jurisdicción con debilidades” in criminal financing and the evasion of international sanctions.

Spain is preparing for FATF examination 

The text in the new Real Decreto 813/2026 decree, which appeared in Spain’s Official State Gazette (BOE) on October 8, referenced the FATF’s upcoming mutual evaluation. The agency’s evaluation, scheduled across 2026 and 2027, covers a full audit of Spain’s anti-money-laundering (AML) and counter-terrorist-financing (CTF) framework.

Spain has been preparing to ace this exam since at least February, when its Treasury called for expert help on FATF evaluation methodology via a consultancy contract worth up to 2.48 million euros. The procurement notice also framed the tender around the FATF evaluation calendar. 

The FATF flagged weaknesses in an earlier review of Spain’s legal framework, which it passed as sound at the time. The agency noted areas of improvement in customer identification, supervision and resources committed to oversight. 

Real Decreto 813/2026 addressed the last concern by adding new personnel to Spain’s financial intelligence unit, Sepblac.

What Royal Decree 813/2026 changes

The new gazette, dated October 7 and published one day later, makes it compulsory to verify users’ identities and also gives crypto ATM operators 18 months to install electronic identification systems. 

Spain’s digital national ID received the mandate to process it, per the new decree.

Decree 813/2026 also contains text tightening rules for online gambling, notaries and nonprofits, and partially transposes the EU’s 2024 anti-money-laundering directive, Directive (EU) 2024/1640.

Before Decree 813/2026, Real Decreto-ley 25/2026 took effect on September 30, adapting Spanish law to the EU “travel rule,” Regulation (EU) 2023/1113, which requires sender and recipient information to accompany crypto transfers. 

The European Commission had opened an infringement case against Spain in 2025 for failing to transpose it, a case now at the reasoned-opinion stage, according to Gómez-Acebo & Pombo. 

In a matter of days, the two measures are now moving crypto firms from outside the system to full obligated-entity status.

Europe’s biggest market, late to tighten

Coin ATM Radar figures put the number of crypto ATMs in the country ahead of any other European nation, clustered around Barcelona, Madrid and Andalusia. It is now ramping up scrutiny in the same way others have in the past. 

Canada said in April it plans to ban crypto ATMs, calling them a “primary method” for fraud and money laundering. 

In the United States, Indiana and Tennessee have outlawed the machines entirely. Coinme agreed on Thursday to shut its kiosks across 34 states and pay 2.5 million dollars to settle Bank Secrecy Act allegations, the Conference of State Bank Supervisors said.