Revised on 7 November 2026. Should any information have changed, please notify me and I shall update it.
When you purchase an artwork and the gallery requests your ID, a declaration regarding the source of funds, or the name of the individual behind the purchasing entity, it is not a matter of personal distrust: it is a legal obligation, with limitations on what they may request and how they must handle your data.
The obligation
Law 10/2010 on the prevention of money laundering includes among its obligated subjects those who professionally trade in works of art or antiques and those who act as intermediaries in such trade, including galleries and auction houses. In the art market, this requirement applies to transactions or operations linked by an amount equal to or greater than 10,000 euros, whether executed in a single payment or in instalments. The law also extends to certain storage and intermediation services for art in free zones at the same threshold.
Obligated parties must apply due diligence: identify the client using a reliable document, identify the beneficial owner when the purchaser is a company, understand the purpose of the relationship in ongoing cases, and examine operations that do not align with the client's profile. If they detect indications of illicit activity, they must report them to the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences (SEPBLAC), without notifying you.
Smaller entities may be exempted from certain internal control measures under regulatory terms. They are not, however, exempted from identifying their clients or retaining the relevant documentation.
What they may request from you
Proof of identity. If you purchase through a company, its deed of incorporation, tax identification number (NIF), and the identity of the person who controls it. In high-value operations or those presenting risk factors, information regarding the source of funds. They may refuse the sale if you do not provide this: the law prohibits them from proceeding with the operation without applying due diligence.
They may not, however, request data unrelated to this purpose. Data protection regulations apply in full. Enquire about the secure channel for submitting documents, do not send them via insecure means, and maintain a record of what you submitted, to whom, and when.
Cash
Irrespective of this law, cash payments to a professional for an operation of 1,000 euros or more are prohibited, even if divided into multiple payments. This limit is established in Law 7/2012, and non-compliance is sanctioned for both the payer and the recipient.
How long your data is retained
Due diligence documentation is retained for ten years. You possess the rights of access and rectification under data protection regulations, subject to the limitations established by this law, particularly regarding communications to SEPBLAC.
The European regulation
The European Union has approved an anti-money laundering regulation directly applicable in all Member States, Regulation (EU) 2024/1624, which will supersede a significant portion of these rules once it becomes applicable. It maintains art dealers among the obligated subjects. Please review this guide when that date arrives.
Further reading
- Buying art at auction: estimation, commission, and delivery
- How to sell a work from your collection
- Restitution and responsible acquisition: the provenance of a work
On the open conversation
If you work in regulatory compliance within the art market and identify a nuance that is missing, please write to me. This notebook remains open.
Sources
- Law 10/2010 on the prevention of money laundering and terrorist financing, arts. 2, 3 to 16, 18 and 25.
- Royal Decree 304/2014, regulation of Law 10/2010, art. 31.
- Law 7/2012, art. 7.
- Regulation (EU) 2024/1624 of the European Parliament and of the Council.