The essentials
- No investor can subscribe without having completed their identification. It is not a recommendation: it is a legal obligation.
- The beneficial owner also has to be identified when the investor is a company.
- Due diligence documentation is kept for ten years (Art. 25 of Law 10/2010), with data protection obligations running in parallel.
- The issuer sees the status of the verification, not the investor's documentation. That separation is design, not courtesy.
What it actually requires
Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing, and its implementing regulation, Royal Decree 304/2014 of 5 May, impose due diligence measures on obliged entities. In an issuance, those measures translate into three things that have to happen before money is accepted.
- Formal identification. A valid identity document and a check that it corresponds to the person on the other side.
- Identification of the beneficial owner. When the investor is a company, you have to get through to the natural person in control.
- Knowledge of the purpose and the source of funds, to the depth that corresponds to the risk of the transaction.
To that you add the checks on politically exposed persons and against sanctions lists, and ongoing monitoring that does not end on the day of onboarding.
Who is responsible for doing it
This is the question to settle in the first meeting, because it shapes the calendar and the budget. An issuance involves several parties and the obligation does not automatically fall on the brand.
What usually happens is that the verification is carried out by a specialist provider under the supervision of the authorised entity involved in the transaction, and that the brand never sees the identity documentation at any point. The brand sees the status: pending, verified or rejected.
Where the conversion is lost
KYC is, by a wide margin, the step where most people abandon a subscription process. And almost always for reasons that have nothing to do with the rules.
- It is asked for too early. Asking for an identity document before the person knows how much they are going to invest and what they get is asking for a lot of effort for a reward they don't yet understand.
- Everything is asked at once. A form with twelve fields and two file uploads on the same screen gets abandoned.
- The why isn't explained. One sentence saying the law requires every investor to be identified completely changes how the step is perceived.
- The work done is lost. If the verification fails and the form empties, the person does not come back.
- There is no visible status. A verification that takes hours without saying anything reads as an error.
The order that works
The process that produces the least abandonment spreads the effort out and leaves the friction for the end, once the person has already decided.
- Understanding the offer. What it is, what they get, what risk it carries.
- Choosing an amount. With the limits of the issuance visible and explained at the time, not as a later error.
- Basic personal details. The minimum, with the right keyboard and validation.
- Identity verification. Now, with the investment already decided and the reason explained.
- Confirmation and payment. With the status of the verification always in view.
- Registration in the register. It is here, and not at payment, that ownership is born.
Retention and data protection
Article 25 of Law 10/2010 requires the documentation evidencing compliance with the due diligence obligations to be kept for ten years, with restricted access from the fifth year onwards. That period sits alongside the data protection obligations: minimisation, a specified purpose, security and erasure when the basis justifying the processing falls away.
In practice this means deciding from the design stage who is the controller, who is the processor, where each item of data is stored and for how long. It is cheaper to decide that before raising from the first investor than after having five hundred.
Frequently asked questions
Can someone invest while their verification is pending?
No. The identification has to be completed before the funds are accepted. A well built process prevents it in the form itself, and explains the reason instead of simply disabling the button.
Does the issuer see their investors' identity documentation?
In a correct design, no. The issuer sees the status of the verification, pending, verified or rejected, and the documentation stays with the provider that processes it under the supervision of the authorised entity. Less data in fewer places is less risk for everyone.
What happens if an investor fails the verification?
They cannot subscribe, and any funds they had contributed are returned. The process should say so clearly and offer a way to get in touch, because a rejection can be down to something as simple as an illegible photograph of the document.
Does verification have to be repeated for a second round?
It depends on how much time has passed and on the ongoing diligence policy the entity applies. What does have to be reviewed in every transaction is that the information is still current: the obligation is one of ongoing monitoring, not of one-off onboarding.
Legislation and sources cited
- Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing (BOE-A-2010-6737). Due diligence measures and Art. 25, retention of documents.
- Royal Decree 304/2014 of 5 May approving the Regulation implementing Law 10/2010 (BOE-A-2014-4742).
Updated 16 Sep 2026. This article is for general information and does not constitute legal or financial advice. The specific terms of each transaction depend on its structure and should be reviewed with professional advice.
