Spain's 18-month crypto-ATM ID deadline runs past the FATF review it cites

Eighteen months from the decree's appearance in the Official State Gazette on October 8 is early April 2028 ^[6][5][20]. The FATF's mutual evaluation of Spain is a full audit of its anti-money-laundering and counter-terrorist-financing framework, and it is scheduled across 2026 and 2027 ^[7]. The decree's own text refers to it ^[7]. The report does not say whether the operators' clock starts at publication or at a later entry-into-force date. If it starts at publication, the assessors will finish their scheduled work before the machines have to carry electronic identification ^[20].

In an earlier review, the FATF passed Spain's legal framework as sound but flagged customer identification, supervision and the resources committed to oversight ^[15]. Decree 813/2026 deals with resources at once by adding staff to Sepblac, the financial intelligence unit ^[12]. Customer identification gets a statute with a transition. Verification runs through Spain's digital national ID ^[13], and the exemptions that let smaller operations proceed without full identification end ^[16]. The law firm Gómez-Acebo & Pombo wrote that Spain risked being "percibida como una jurisdicción con debilidades" (perceived as a jurisdiction with weaknesses) in criminal financing and the evasion of international sanctions ^[11].

Operators have roughly three paths. They can fit electronic ID early, so Spain can show assessors working machines during 2027, or they can use the full window and retrofit in 2028 ^[20]. Some may leave instead. Coinme took that route in the United States, agreeing to shut its kiosks across 34 states and pay $2.5 million to settle Bank Secrecy Act allegations, according to the Conference of State Bank Supervisors ^[19].

Spain has kept the machines legal on condition that they identify every user ^[4]. Indiana and Tennessee have outlawed them outright ^[18]. Canada said in April it plans a ban, calling the machines a "primary method" for fraud and money laundering ^[17].

Counted by machines, the anonymous channel is small. The most recent count in the report comes from Coin ATM Radar figures that Gulf News published in 2021: 158 machines across Spain ^[2], clustered around Barcelona, Madrid and Andalusia ^[3].

I think Decree 813/2026 is written first for the evaluation file. The Sepblac staffing answers an old FATF criticism immediately, while the ATM rule runs on a timetable that ends after the scheduled review ^[12][20]. That view is wrong if Spanish operators switch on ID checks during 2027, or if the fleet falls well below its 2021 count before the deadline ^[2].