Cut False Positives, Still Pay €552K: Spain’s New AML Fine

Spain just fined a company €551,952 and a bank €3.9 million for AML failures that had nothing to do with how many alerts their screening tools generated. The UAE fined DNFBPs more than AED 42 million in six months for the same kind of gap. None of these fines mention a false-positive rate — and that is exactly the point.

Every AI-assisted sanctions and AML screening tool on the market leads with the same pitch: fewer false positives, less analyst fatigue, more alerts closed per hour. It is a real problem and a real number — compliance teams drown in low-value alerts, and cutting that noise saves genuine analyst hours. But none of the AML enforcement actions published in Spain or the UAE in the last eighteen months were about alert volume. They were about whether the one alert that mattered got the monitoring, the examination, or the escalation the law requires. A tool that is excellent at suppressing noise and silent about the signal it buried is not solving the problem regulators are fining on.

What Spain just fined, and why “fewer alerts” was not the defense

On 26 June 2026 the Secretariat of Spain’s Commission for the Prevention of Money Laundering published its resolution against 888 Online Games España SA: two fines of €275,976 each, totaling €551,952, plus a public reprimand (BOE-A-2026-15121, published 10 July 2026). The two infractions, both classified as graves under articles 52 and 57 of Ley 10/2010, were specific: the operator failed to apply the ongoing monitoring the law requires over a business relationship, and separately failed to carry out the mandatory special examination of an operation that showed risk indicators. Neither infraction is about how many alerts the operator’s systems raised. Both are about what happened — or did not happen — after a relevant signal existed.

888 is not an isolated case. On 6 March 2025 Spain’s BOE published a €3.9 million fine against ING España for a muy grave infraction of the same law: failing to report, under article 18 of Ley 10/2010, a suspicion that had already been raised internally by one of its own staff. An employee or manager flagged a fact or operation as potentially linked to money laundering or terrorist financing, and the bank did not escalate it to Spain’s financial intelligence unit, SEPBLAC. The sanction had been approved by the Council of Ministers back in July 2023; it took until March 2025 to reach publication. Different mechanism from 888’s case, same underlying failure: a real signal that existed inside the institution did not travel the distance the law requires.

The Gulf number is bigger, and it is still climbing

The UAE’s Ministry of Economy (now Ministry of Economy and Tourism) has imposed more than AED 130 million in administrative fines on Designated Non-Financial Businesses and Professions since late 2022. The first half of 2025 alone accounts for AED 42 million of that, spread across 1,063 separate violations: precious-metals and gemstone traders took 473 violations and AED 20 million in fines, real-estate brokerages took 495 violations and AED 18.5 million, and corporate service providers and auditors took 95 violations worth more than AED 4 million. Inspections are up more than 300% since 2021 — this is not a one-off sweep, it is a sustained enforcement program that keeps accelerating.

The ceiling just moved higher. Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering raised the maximum corporate fine for a legal entity from AED 50 million to AED 100 million, with administrative penalties for individual violations now running from AED 50,000 up to AED 5 million each. None of the thousand-plus violations counted above were framed around alert-reduction metrics. They were counted the way regulators always count them: did the business do the checks the law requires, on the businesses it was required to check.

The trap: optimizing the number nobody is fining you on

This is the gap an “AI-powered” screening tool’s marketing rarely mentions. A lower false-positive rate is a genuine cost saving — fewer analyst hours spent closing alerts that lead nowhere. It is not a compliance control, and it is not what any of the fines above were about. A tool tuned hard to suppress noise is, by construction, a tool that will occasionally suppress the one alert that was real. If that happens on the business relationship 888 Online Games was supposed to monitor, or the operation it was supposed to examine, or the suspicion ING’s own employee had already raised internally, the fine lands exactly the same whether the alert was buried by a careless analyst or by an algorithm tuned to show fewer alerts.

What the AML-screening vendor sells	What the regulator actually fines on
“Cuts false positives by up to X%”	Whether the business relationship got the ongoing monitoring the law requires (888’s first infraction)
“Fewer alerts, same coverage”	Whether a flagged operation got the mandatory special examination before being closed (888’s second infraction)
“AI-assisted triage, less analyst fatigue”	Whether an internally-raised suspicion was actually escalated to the regulator (ING’s infraction)
A dashboard showing alert-volume reduction	A named compliance officer’s documented decision trail, inspected firm by firm (the UAE’s 1,063 traced violations)

What this means if you run AI-assisted sanctions or AML screening

1. Measure what the regulator measures, not what the vendor demos. Alert-reduction percentages do not appear in a single one of the fines above; continuous monitoring, special-examination completion, and escalation timing do. If your current reporting only tracks the first number, you cannot show an inspector you are passing on the three that count — the same gap we flagged from the regulator’s side in our piece on AI compliance and sanctions screening in the Gulf. 2. Keep the human sign-off attributable to a name, not to “the system.” Every case above eventually comes down to one question an inspector asks a specific person: did you see this, and what did you do about it. That is the same exposure we described when Microsoft’s own leadership started treating AI agents as insider risks rather than as neutral tools. 3. Audit the alerts your tool is not showing you, not only the ones it is. A “noise reduction” feature is, from a regulator’s seat, an undocumented filtering decision — precisely the kind of unsanctioned control gap we documented in shadow AI tools deployed without sign-off. If you want an outside, no-cost look at what your current screening stack might be filtering out before an inspector finds it, that is exactly what our free security audit is for.

FAQ

What exactly did Spain fine 888 Online Games España for? €551,952 in total (two fines of €275,976 each) plus a public reprimand, for two serious infractions of Ley 10/2010: failing to apply ongoing monitoring of a business relationship, and failing to carry out the mandatory special examination of an operation with risk indicators. Published as BOE-A-2026-15121 on 10 July 2026.

Was ING España fined for the same kind of failure? No. ING’s €3.9 million fine, published in the BOE on 6 March 2025, was for a muy grave infraction under article 18 of Ley 10/2010: failing to escalate to SEPBLAC a suspicion of money laundering or terrorist financing that had already been raised internally by its own staff.

How large is the UAE’s AML enforcement now? More than AED 130 million in fines on DNFBPs since late 2022, including over AED 42 million across 1,063 violations in the first half of 2025 alone. Inspections have increased more than 300% since 2021.

Does the UAE’s new AML law raise the stakes further? Yes. Federal Decree-Law No. 10 of 2025 raised the maximum corporate fine for a legal entity from AED 50 million to AED 100 million, with per-violation administrative fines now ranging from AED 50,000 to AED 5 million.

Does a lower false-positive rate protect a company from fines like these? Nothing in the Spanish or UAE enforcement record published so far ties a fine to a company’s false-positive rate. Every case above turns on whether a real signal was monitored, examined, reported, or escalated — not on how many alerts the screening tool suppressed to get there.

If your screening tool’s headline feature is “fewer alerts,” do you actually know whether the ones it is hiding would survive a BOE or Ministry of Economy inspection? Tell us in the comments.