Illustration of Juan Esteban's runic monogram rendered in a three-dimensional architectural style within a frame, set against a light background.

Why a gallery may ask for your ID when you buy a work

Verified as of 28 September 2026.

A gallery asking for identification does not necessarily mean it distrusts you personally. In certain transactions and business relationships it must carry out due diligence, identify the customer and establish the beneficial owner.

Who may be subject to the rules

Law 10/2010 covers persons and professional activities subject to anti-money laundering rules. In the art market, whether it applies depends on the activity, the amount and the structure of the transaction.

What they may ask for

Depending on the case:

  • an identity document;
  • address and contact details;
  • the beneficial owner of a company;
  • authority to act for someone else;
  • the source of funds or wealth;
  • the relationship between payer, buyer and recipient;
  • the purpose of the transaction;
  • further information where the risk is higher.

Formal identification is not an accusation. The business must assess the risk and keep records as the law requires.

The art market threshold

Spanish law covers those who trade professionally in works of art or antiques and those who act as intermediaries when the value of the transaction, or of a series of linked transactions, is 10,000 euros or more. It also covers certain storage or intermediary services in free zones above that threshold. Always check the consolidated text and the specific structure of the deal.

Payers and companies

If someone else pays, a company is involved or there is a chain of representatives, the gallery may need to identify the relationships and the beneficial ownership. Concealing or splitting a transaction can make the concerns worse.

Data protection

Ask for information on the controller, purpose, legal basis, retention period, recipients and your rights. Do not send sensitive documents through insecure channels. The gallery must restrict access and meet its data protection obligations.

If you refuse

A professional subject to these rules may decline to enter into, or end, a relationship when it cannot carry out due diligence. If a request seems disproportionate, ask for its legal basis and a secure channel, but do not assume it can be skipped.

Keep a record

Record which documents you provided, to whom, when, through which channel, and keep the privacy notice. Do not send more information than necessary without asking what it is for.

On the open conversation

This guide explains general obligations under Spanish law and does not determine which documents are needed in a particular transaction.

If you spot an error, a broken link or a relevant change, write to me.

Sources


Discover more from Juan A. Esteban

Subscribe to receive the latest entries via email.

Español English (UK)