Spain Beneficial Ownership Register (RCTIR): UBO Data, Access & the Foreign Entity Barrier

Spain has one of the most structurally complex beneficial ownership frameworks in Europe — not because the register doesn't exist, but because UBO disclosure obligations run through multiple channels simultaneously: the Mercantile Registry, the Central UBO Register, and since February 2025, the Spanish Tax Agency. Understanding which obligation applies, to whom, and through which channel, is the first compliance challenge.

The centrepiece is the Registro Central de Titularidades Reales (RCTIR) — the Central Register of Beneficial Ownership — created by Royal Decree 609/2023 of 11 July 2023 and operational since 19 September 2023. Managed by the Ministry of Justice through the General Directorate of Legal Certainty and Public Faith, the RCTIR functions as a central aggregation point, drawing beneficial ownership data from existing sector-specific registries — Mercantile, Foundations, Cooperatives, Associations — and making it queryable via a legitimate interest model.

The register is technically public — Spain did not close public access following the CJEU's November 2022 ruling (Grand Chamber, Joined Cases C-37/20 and C-601/20, WM and Sovim SA v Luxembourg Business Registers), which struck down the provision requiring unrestricted public access under Article 30(5) of the Fourth AML Directive as amended by the Fifth, in the way France or the Netherlands did. Instead, Spain implemented a legitimate interest (interés legítimo) access model from the outset. In practice, however, the register is virtually inaccessible to foreign entities: access requires a Spanish digital identity (DNI, NIE, or empresa digital certificate), all correspondence must be conducted in Spanish, and Transparency International's Spanish subsidiary took six months to be granted access — receiving only partial UBO data even then (Transparency International, September 2025).

The result: Spain's RCTIR exists, is technically accessible, but creates a structural barrier for non-Spanish compliance teams that is as effective as a formal closure in practice.

The UBO definition in Spain flows from Article 4 of Law 10/2010 (the AML Law) and Royal Decree 304/2014. The Spanish term is titular real — literally "real holder." The definition follows the standard EU cascading logic.

A titular real is any natural person who directly or indirectly holds more than 25% of the share capital or voting rights of a legal entity, or who exercises control through other means. Indirect ownership is traced through the full chain — intermediate legal entities are looked through until a natural person is identified.

Where the 25% threshold is not met through ownership, control through binding agreements, rights to appoint or remove majority board members, veto rights over strategic decisions, or other contractual arrangements qualifies a natural person as the titular real.

If no natural person can be identified through ownership or control, the members of the governing body (administradores) are deemed the assimilated UBOs. Where the governing body is a legal entity, its natural person representative is designated. This fallback is required — Spanish entities cannot file with a blank UBO field.

The data held by the RCTIR is more comprehensive than what is accessible to most parties. Access is tiered: authorities get everything, obliged entities get full data, and those with legitimate interest get a significantly restricted subset.

Spain's access model is officially based on legitimate interest — not a blanket public register, but also not a closed authority-only system. In practice, three categories get meaningful access. Everyone else faces a Spanish-language, Spanish-identity barrier that functions as an effective block.

Company information in Spain flows through several sources with different costs and levels of ownership disclosure. The RCTIR provides the most direct UBO data but requires accreditation or a proven legitimate interest.

Spain has one of the most consequential penalty regimes for UBO non-compliance in Europe, combining registry closure — which paralyses corporate operations — with large financial sanctions under Law 10/2010.

Under Law 10/2010 (Arts. 56–57), the penalty framework differentiates between very serious, serious and minor breaches, and it is written for obliged entities — the banks, notaries and advisers that must identify UBOs. Very serious breaches carry fines of at least €150,000 and up to €10,000,000 or 10% of turnover; the managers responsible face €60,000 to €10,000,000 for very serious breaches and €3,000 to €5,000,000 for serious ones, plus disqualification. For an ordinary company that fails to declare its UBO, the sharper sanction is the registry closure: RD 609/2023 ties a missing or blank UBO sheet directly to Article 378.

AMLD6 split its deadline. The beneficial-ownership access articles (11, 12, 13 and 15) were due on 10 July 2026; the rest of the directive, and the directly applicable EU AML Regulation, follow on 10 July 2027. Spain missed the first date: on 25 September 2026 the Commission sent it a letter of formal notice, alongside 17 other member states, with two months to respond. The harmonised rules cover who has a legitimate interest, presumed access for journalists, civil society and academics, historical data and fee limits. Spain already presumes the interest of media and AML-focused civil society; the identity barrier is the part that will have to move.

AMLD6 requires a register to accept a legitimate-interest check already made by another member state’s register, and to answer requests within 12 working days. A foreign applicant cleared in its home register should not have to start again in Spanish. This is the most significant structural change due for the RCTIR — and the one that will matter most for non-Spanish compliance teams.

Article 7 of RD 609/2023 provides for the RCTIR’s connection to BORIS (Beneficial Ownership Registers Interconnection System), the EU platform that links national registers. As BORIS matures — and as 6AMLD harmonises access standards across member states — it will become possible for obliged entities in one member state to query UBO data from another member state's register through a single access point. This will reduce — but not eliminate — the Spanish-identity access barrier for foreign institutions.

The EU's Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt, begins directly supervising the most significant cross-border financial institutions from 2028. AMLA will also coordinate national supervisors and set binding technical standards for UBO register interoperability. For Spain's RCTIR, this will drive API standardisation and data format alignment with the broader EU infrastructure.

The RCTIR portal requires a Spanish DNI, NIE, or corporate digital certificate to access. Non-Spanish entities and individuals without Spanish residency or corporate registration cannot obtain these credentials. This is not a bureaucratic inconvenience — it is a structural exclusion that makes the register operationally inaccessible for the majority of international compliance teams, regardless of the legitimacy of their interest.

Even for those who can demonstrate legitimate interest — such as journalists or civil society organisations with Spanish standing — processing times are unpredictable. Transparency International's Spanish subsidiary took six months to be granted access. This is not a workable timeframe for KYB due diligence or customer onboarding workflows.

Even if access is granted through the legitimate interest route, what you receive is a heavily restricted subset: name, month and year of birth (not full DOB), country of residence, nationality, and nature of control. No address, no identification document number, no email, no historical data. For compliance workflows that require detailed identity verification, this partial disclosure is often insufficient to complete a KYB check.

Spain provides no public shareholder register for S.L. or S.A. companies. Unlike Italy's S.r.l., where shareholders appear in public company extracts, or the UK's Companies House, where all shareholders above 25% are disclosed, Spain's corporate registers show directors and administrators publicly — but ownership data is entirely private. The RCTIR is the only route to UBO data for most entities, making the access barrier even more consequential.

Since February 2025, Spanish companies must file UBO data in two separate places — the Mercantile Registry and the Spanish Tax Agency — on different triggers and timelines. For foreign-owned Spanish subsidiaries where UBO changes are frequent — driven by group-level restructuring — this dual obligation creates a compliance surface that is easy to miss, particularly given the 10-day notification window for Mercantile Registry changes.

The RCTIR records the natural person at the end of the ownership chain — not the intermediate corporate vehicles. A Spanish S.L. owned by a Dutch BV, owned by a UK holding company, controlled by a natural person in Germany: the RCTIR will show the German individual. It will not show the Dutch BV or UK holding company. Resolving the chain requires data from each intermediate jurisdiction.

All RCTIR access requests and correspondence must be conducted in Spanish. For international compliance teams operating in English — or any other language — this adds a translation and operational layer that further slows the process and increases cost.

The "no Spanish ID, no access" framing needs one precision caveat. A non-resident foreign national can apply for a Spanish NIE (Número de Identificación de Extranjero) at a Spanish consulate abroad, via form EX-15, citing an economic, professional, or social interest — Spanish residency is not a legal precondition. The barrier is not that the credential is legally unobtainable; it is that reaching it runs through an in-person consular appointment, a processing queue typically measured in weeks to months, and then a separate step to obtain the FNMT digital certificate or Cl@ve PIN tied to that NIE — which itself typically requires another in-person identity verification. A foreign legal entity faces an equivalent route through a corporate digital certificate requiring a Spanish-registered representative. None of this is a form a compliance team can complete from abroad in a single sitting; it is a multi-step, consulate-dependent process measured in months — which is why, against live KYB onboarding deadlines, it functions as an effective barrier even though it is not, strictly, a legal one.

Spain's access barriers require a sequenced approach that starts with what is available outside the RCTIR and escalates only when necessary.

Spain's RCTIR is technically accessible — but the Spanish digital identity requirement, Spanish-language process, and multi-month processing times mean it is operationally closed for the vast majority of international compliance teams. And even when access is granted, the legitimate interest subset excludes full DOB, address, and identification documents — the exact fields needed for robust KYB verification.

As covered in the workflow above, Zavia.ai bypasses this barrier by connecting directly to the Registro Mercantil Central and the Colegio de Registradores — the primary sources of Spanish company data — and combining that with a cross-border ownership graph that traces the chain above any Spanish entity to its ultimate parent. The result is structured ownership intelligence delivered through a single API endpoint or bulk file, without requiring a Spanish digital certificate or Spanish-language correspondence. Zavia’s Spanish company directory indexes the registered layer.

A foreign team without Spanish e-identification waits months for the RCTIR, if it gets in at all. Zavia follows the chain above a Spanish S.L. across government registries in 173 countries, so you can verify a Spanish UBO in one lookup and keep the counterparty’s own declaration as the cross-check.

Spain stands out as one of the least transparent jurisdictions for shareholder data among major EU economies — no public shareholder register for any standard entity type, and a UBO register that is effectively inaccessible for foreign compliance teams. The Spain, Italy and Switzerland rows were updated in October 2026; the others reflect our March 2026 review.

Spain's structural access barrier makes the ownership graph approach especially valuable. Most significant Spanish entities are subsidiaries of foreign groups — multinational corporations with German, French, UK, or US parent companies where beneficial ownership data is more accessible or even fully public. By tracing the chain upward above the Spanish entity, Zavia.ai identifies the ultimate parent and the jurisdiction where UBO data is most available — turning a blocked RCTIR query into a solvable cross-border ownership problem.

Where Spain's RCTIR is inaccessible, the ownership graph surfaces UBO data through the most accessible node in the chain — whether that's UK Companies House, the German Handelsregister, or the French INPI — combined with Spanish company and director data to produce a complete, primary-source ownership picture.