Due Diligence on an International Buyer on the Costa del Sol: The File You Must Keep for 10 Years

In Málaga province, 32.80% of all home purchases in 2025 were made by foreign buyers — second only to Alicante (43.29%) and more than double the 13.8% national average, according to the Colegio de Registradores figures published in April 2026. If your agency works between Estepona and Nerja, the international file is not an exception you handle twice a year. It is your standard file.

And here is the gap almost every "due diligence on the Costa del Sol" article leaves open: they all audit the property — nota simple, charges, licences, IBI, community debts. Very few audit the other side of the table. Under Ley 10/2010, a real estate intermediary is a *sujeto obligado*: you must identify the buyer, establish who the beneficial owner is, understand where the money comes from, and keep that file for 10 years. The property audit protects your client. The buyer audit protects your agency.

Try it right now — free, no signup →

This guide is the second one: what to ask an international buyer, in what order, and what breaks if you ask late.

Two due diligences, two owners

Use this as your decision criterion when a lead lands on WhatsApp at 9pm:

Property due diligence — owned by the buyer's lawyer. Registry status, charges, licences, urban planning, community debt, energy certificate. If it goes wrong, the buyer loses money.
Buyer due diligence (KYC/AML) — owned by you, the intermediary. Identity, residence, beneficial ownership, source of funds, risk profile. If it goes wrong, you are the one facing the inspection, and the client is long gone.

They run in parallel, but only one of them is your legal obligation. Agencies that confuse the two end up with a beautiful legal report on the villa and an empty folder on the person paying for it.

The document pack for a non-resident buyer

For a straightforward individual buyer from outside Spain, the file should contain:

Passport (or national ID for EU citizens), valid, full data page. Not a photo of a photo.
NIE — the Spanish foreigner tax number. Requested at a Spanish consulate abroad or at a *Oficina de Extranjería* in Spain, with passport, the relevant form and the reason (the purchase itself).
Proof of address abroad — utility bill, bank statement or tax residence certificate, recent.
Source of funds evidence — bank statements, the sale deed of a previous property, a bank certificate, a tax return, a dividend or bonus statement. "He is a doctor in Munich" is not evidence.
Matrimonial regime, when the buyer is married. Foreign matrimonial regimes are not obvious to a Spanish notary and this is a classic day-of-signing blocker.
Power of attorney, apostilled and with a sworn translation, when someone signs on the buyer's behalf.
Corporate chain, when the buyer is a company: incorporation documents, shareholder structure and the beneficial owner behind it. Our step-by-step for that case is here: how to verify the beneficial owner of a corporate client.

The scope of what SEPBLAC expects from an agency — risk analysis, internal procedure, retention — is covered in more detail in the anti-money-laundering duties of real estate agencies.

When each document must exist (the part people get wrong)

The file is not something you assemble the week before completion. Map it to the transaction:

Before the reservation — passport and basic identification. You are already intermediating.
Before the arras (deposit contract) — NIE requested, source-of-funds conversation had, beneficial owner identified if a company is buying. This is also when the property paperwork must be complete; see the document checklist for a deposit contract without surprises.
Before the escritura — NIE issued, means of payment documented, powers of attorney apostilled and translated.
After the escritura — Modelo 600 for ITP within 30 working days of signing. In Andalucía the general rate on a resale home is 7%, with AJD at 1.2%. Late filing without a prior request from the tax office triggers surcharges of 5%, 10% or 15% depending on the delay, and 20% plus interest beyond twelve months.

That last line is why a missing NIE is not an administrative detail. On a €450,000 villa, ITP at 7% is €31,500; a delay past six months adds a 15% surcharge — €4,725 — for a document that takes one appointment to obtain.

Cash: the two limits, and the one that gets misquoted

Spain's cash payment rules under Ley 11/2021 have two thresholds, and the international file is exactly where they get confused:

€1,000 when one of the parties acts as a business or professional.
€10,000 when the payer is an individual not resident in Spain and is not acting as a business or professional.

The penalty for breaching the limit is 25% of the amount improperly paid in cash, and both payer and recipient can be liable. A party that reports it to the tax office within three months of the payment is exempt from the penalty.

Two practical consequences. First: your agency commission is never covered by the €10,000 rule — you are acting as a professional, so your limit is €1,000. Second: from 10 July 2027, Regulation (EU) 2024/1624 (the AMLR) applies directly across the EU with a harmonised €10,000 cash ceiling and real estate operators explicitly named as obliged entities. The direction of travel is fewer exceptions, not more.

Three mistakes that cost real money

Selling a golden visa that no longer exists. Spain's residence-by-investment route was repealed by the Ley Orgánica 1/2025 and stopped accepting new applications on 3 April 2025. Buying property in Spain no longer grants a residence permit. Applications filed before that date continue under the old rules, and existing permits can still be renewed — but a listing or a WhatsApp reply that dangles a golden visa in 2026 is a misrepresentation.

Repeating the "100% tax on non-EU buyers" as if it were law. The measure was announced in January 2025 and admitted for parliamentary processing in May 2025, but it has not been approved and has no implementation date. Telling a Norwegian or British buyer they must close before an imaginary deadline is a fast route to a complaint.

Collecting ID copies and storing them badly. WhatsApp threads, phone galleries, a shared Drive folder anyone can open. The AML file has to survive an inspection ten years from now, and the GDPR side has its own rules — that tension is unpacked in how to store client ID copies without breaking GDPR.

What the file actually costs you in time

Run your own numbers rather than trusting a benchmark. Count the documents in one international file: passport, NIE, proof of address, two or three bank statements, a POA, the corporate chain if there is one. Call it eight documents. Now time yourself once, honestly, on the full loop — download from WhatsApp, rename, read the fields, type name, document number, date of birth, nationality, expiry and address into your CRM, file it.

If that loop takes 10 minutes per document, one file is 80 minutes of pure transcription. Twelve international files a month is 16 hours — two working days, spent copying data that is already printed on the documents. The same arithmetic applied to a whole agency is in how many hours a month your agency really loses to paperwork.

The transcription is also where the errors live: a misread passport number or an expiry date typed as the issue date is the kind of thing that turns a clean file into a finding. Automating that specific step — buyer forwards the photo to a WhatsApp number, the fields come back structured — is what we cover in the guide to automating KYC and client identification via WhatsApp.

FAQ

Does the buyer need the NIE before signing the arras? Not strictly, but it must be requested by then. The NIE is required to sign the deed and to file the tax, and consulate appointment times vary a lot by country — starting it after the arras is how completion dates slip.

Can I rely on the notary's identification instead of my own? No. The notary has their own obligations; yours are separate and start when you begin intermediating, well before the deed.

What if the buyer is a non-EU company? You need the ownership chain up to the natural person who ultimately controls it, plus a rationale for the structure. Trust and nominee layers raise the risk level and the documentation you should demand.

How long do I keep the file? Ten years. That includes identification, beneficial ownership documents, your risk analysis, contracts and deeds.

---

Building the file is not optional; retyping it is. Try it free — no signup: send one passport or nota simple to the extractor and get the fields back as structured data in seconds.