Update (May 10 2025): Following a detailed review of Royal Decree 253/2025, the official BOE text, and multiple independent fact‑checks, we determined that an earlier version of this article inaccurately claimed Spaniards must give 24‑hours’ notice to tax authorities before withdrawing more than €3,000 in cash and could face fines of up to €150,000 for non‑compliance. In reality, the reporting duty falls on banks and fintechs—not on individual savers—and the €150 k penalty applies only to institutions that fail to file the required data. The article has been fully updated to correct these points and provide a comprehensive, sourced explanation of the new rules.
The short version: the decree targets banks and fintechs, not ordinary account‑holders—but it still pushes Spain closer to total financial transparency.
Where the rumor came from
The story began with an April‑28 article in Madrid Informa, echoed by several English‑language blogs and a Fintechnews CH syndication. A thread by CitizenX CEO Alex Recouso snowballed on X, drawing an expletive‑laden reply from podcaster Peter McCormack. None of those posts linked to the Boletín Oficial del Estado (BOE) where the law was actually published.
What Royal Decree 253/2025 actually does
- Amends Articles 37, 38 and 38 bis of Spain’s General Tax Management Regulations (Real Decreto 1065/2007) and adds a new Article 38 ter. (BOE‑A‑2025‑6599)
- Requires banks, e‑money institutions and card issuers to file:
- Monthly reports of cash deposits, withdrawals, loans and account balances over €3,000.
- Monthly reports of merchant card payments (the old €3,000 annual threshold disappears).
- Annual reports on all card activity—charges, reloads and ATM cash—unless the card moves less than €25,000 a year.
- Extends the duty to foreign fintechs serving Spanish residents.
- Shifts most of the workload from yearly to monthly filings, tightening AEAT’s risk‑analysis window from 12 months to roughly 30 days. (KPMG summary)
Myth‑busting: no 24‑hour notice, no €150k fine for private savers
Fact‑checkers at InfoVeritas debunked the claim that citizens must “pre‑notify” withdrawals. Article 38 merely obliges financial institutions to include any cash movement above €3,000 in their information return. There is no language in Royal Decree 253/2025 compelling an individual to file a form or wait 24 hours before touching their own money.
The headline €150,000 figure is the maximum administrative penalty the AEAT can impose on entities that systematically fail to file or falsify the new reports—roughly 0.5 % of their annual revenue under Spain’s graduated sanctions regime (Law 58/2003, Article 199). Private customers are not in scope.
Who can really be fined—and for what
| Obligated party | Trigger | Potential fine |
|---|---|---|
| Bank / fintech / card issuer | Late, incomplete or false monthly or annual file | €150 – €150,000 (Art. 199 LGTT) |
| Individual customer | None under Royal Decree 253/2025 (usual AML/KYC rules still apply) | N/A |
Why privacy advocates (and Bitcoiners) still care
Even without a pre‑notice mandate, Spain’s reporting overhaul means the tax agency will receive granular, near‑real‑time data on every sizable cash movement and virtually every card transaction. Civil‑liberties groups argue that such mass data collection flips the presumption of innocence, while crypto proponents see it as yet another advertisement for self‑custodied digital money.
“When state authorization is required to access your money, it’s no longer your money.” —Alex Recouso, CitizenX
Recouso’s post misstates the law but captures a sentiment echoed across Bitcoin Twitter: every new reporting layer nudges users toward censorship‑resistant rails.
Part of a broader EU clamp‑down
Spain’s move parallels the EU’s draft Anti‑Money‑Laundering Authority package, which seeks a €10,000 pan‑EU cap on cash payments and mandatory transaction‑monitoring APIs. Italy, France and Portugal already enforce sub‑€3,000 cash limits for commercial payments. The European Commission wants the final rules enacted before the 2026 AMLA launch.
Takeaways for Spanish savers—and for crypto markets
- You can still walk into your branch and withdraw €3,001 tomorrow. Expect questions and ID checks, but no pre‑filing duty.
- Your bank—not you—will tell AEAT about it in its next monthly file.
- Penalties target the institution if it hides or delays that data.
- The decree turbo‑charges a surveillance trend that makes bearer‑less, peer‑to‑peer assets like Bitcoin look increasingly attractive.
Bottom line: the cash‑ban apocalypse headlines are exaggerated, but Spain’s new rules do shrink the remaining pockets of financial privacy. Crypto’s “be your own bank” narrative just got another tail‑wind—minus the misinformation.
