Skip to main content
Didit Raises $2M and Joins Y Combinator (W26)
Didit
Europe

Identity verification
built for Spain Flag of Spain

DNI, DNIe, NIE/TIE and Spanish passport on one session, cross-checked against the Dirección General de la Policía — $0.33 full KYC, 500 free every month.

Backed by
Y Combinator
GBTC Finance
Bondex
Crnogorski Telekom
UCSF Neuroscape
Shiply
Adelantos

Trusted by 2,000+ organizations worldwide.

Country brief

How identity verification works in Spain.

The fraud surface and the frameworks an engineering or compliance lead needs before scoping an integration.
Fraud landscape
Spanish identity fraud is shaped by DNI and passport forgery feeding cross-border crypto and neobank onboarding, deepfake and injection attacks on remote video-ID flows, and synthetic identities built on stolen NIE numbers. Didit scores 200+ real-time fraud signals on every session — face morph, replay, injection, document tampering, device intelligence, IP geolocation.
Compliance frameworks
  • SEPBLAC remote onboarding (attested)
  • AMLD6 (6th Anti-Money Laundering Directive)
  • MiCA (Markets in Crypto-Assets Regulation)
  • eIDAS 2.0
  • DORA (Digital Operational Resilience Act)
  • GDPR / Ley Orgánica 3/2018
Regulators

Who supervises identity verification in Spain.

These are the supervisors a Spain verification flow has to answer to. One Didit hosted flow + one audit log covers every one of them — no separate integration per agency.
  • SEPBLAC

    Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales — the Anti-Money Laundering (AML) supervisor and Spain's Financial Intelligence Unit. Authorises the remote-onboarding procedure Didit uses.

  • Banco de España

    Central bank and prudential supervisor — covers banks, payment institutions (EP), and electronic money institutions (EDE). Formally attested Didit's remote onboarding.

  • CNMV

    Comisión Nacional del Mercado de Valores — securities and crypto-asset supervisor under the Markets in Crypto-Assets (MiCA) Regulation.

  • AEPD

    Agencia Española de Protección de Datos — General Data Protection Regulation (GDPR) and Ley Orgánica 3/2018 supervisor for Spain.

  • Tesoro Público

    Spanish Treasury — formally attested Didit's remote onboarding as safer than in-person verification on the public record.

Verification flow · One API

Four modules. One verification.

ID, biometric, AML, and a Spain database cross-check — composed on one workflow, billed per success, returned in one report.
01 · ID

Capture and read the ID.

The user takes a photo of their document on their phone, or shares their MiDNI credential directly from the official wallet. The hosted flow figures out which document it is, reads every field, and checks whether the document is real (not a screen capture, not a print, not a tampered template).

  • Works for every active Spanish credential — DNI (3.0 / 4.0), MiDNI, NIE / TIE, Spanish passport (with the chip read on e-Passports), plus every EU/EEA national identity card.
  • Returns the name, DNI / NIE number, date of birth, place of issue, and expiry.
Read the docs
Stage 01Capture and read the ID
  • DNI / DNIe / DNI 4.0
  • MiDNI — digital wallet credential
  • NIE / TIE · Spanish passport — chip read on e-Passport
02 · Biometric

Match the face. Prove it's a real person..

Selfie confirmed live and matched against the ID portrait.

  • Duplicate check: 1:N face search across existing users. Free.
  • Active liveness ($0.15) for elevated-risk flows — user turns or blinks. This is the configuration SEPBLAC attested as safer than in-person verification.
Read the docs
Stage 02Match the face. Prove it's a real person.
  • Selfie on any phone or laptop camera
  • Mobile-handoff QR when the user starts on desktop
03 · AML

Screen for sanctions, PEPs, and adverse media.

1,300+ global sanctions, PEP, and adverse-media lists — plus Spanish watchlists:

  • Congress of Spain (Pep Level 1) — Diputados, Senadores, and senior congressional officials.
  • SPAIN - CNMV - Comisión Nacional del Mercado de Valores (SIE) — CNMV sanctions for regulatory irregularities against securities firms and crypto-asset service providers.
  • Agencia Mayorista de Viajes a Cuba - Guama (SIE) — enforcement actions under international trade-sanction regimes.
  • SPAIN - ESGC-MW - Guardia Civil - Most Wanted (SIP) — Guardia Civil's most-wanted fugitives register.
  • La Voz de Gran Canaria (SIP) — regional adverse-media and enforcement signals.
  • The Guardian — Most Wanted (Warnings) — international adverse-media warnings.
  • SEPBLAC — enforcement actions — Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales AML/FT enforcement actions.
  • Banco de España — Sanctions and Enforcement Register — central-bank sanctions against banks, payment institutions and EMIs.
  • Tesoro Público (Spanish Treasury) — National and EU Sanctions Register — Spanish Treasury implementation of EU and UN sanctions.

Severity-scored. Ongoing monitoring ($0.07/user/yr) re-checks daily and fires a webhook on new hits.

Read the docs
Stage 03Screen for sanctions, PEPs, and adverse media

Screen for sanctions, PEPs, and adverse media — see the docs for the full module surface.

04 · Registry

Cross-check against the Dirección General de la Policía.

Cross-checked against the authoritative civil registry.

  • The DNI / NIE check (esp_dni) hits the Dirección General de la Policía records directly and validates the personal number against the document type and expiration date — the authoritative-source check SEPBLAC expects.
  • The Residential (esp_residential, ~60% coverage) and Utility (esp_utility, >35% coverage) services match name + address against aggregated government, public, and consumer records — the proof-of-address signal AMLD6 calls for.
  • Phone (esp_phone, >10%) and Phone 2 (esp_phone_2, >60%) match the user's mobile or landline against telco and mobile-network-operator records.
  • Consumer (esp_consumer, $0.08) is the cheapest first-pass lead-quality signal.
Read the docs
Stage 04Cross-check against the Dirección General de la Policía

Cross-check against the Dirección General de la Policía — see the docs for the full module surface.

Documents covered

Every Spain document Didit accepts.

One row per accepted credential — flag, document name, document type. Live from the Didit Business Console.
Compliant by design

Open a new country in one click. We do the hard work.

We open the local subsidiaries, secure the licenses, run the penetration tests, earn the certifications, and align with every new regulation. To ship verifications in a new country, flip a toggle. 220+ countries live, audited and pen-tested every quarter — the only identity provider an EU member-state government has formally called safer than in-person verification.
Read the security & compliance dossier
EU financial sandbox
Tesoro · SEPBLAC · BdE
ISO/IEC 27001
Information security · 2026
SOC 2 · Type I
AICPA · 2026
iBeta Level 1 PAD
NIST / NIAP · 2026
GDPR
EU 2016/679
DORA
EU 2022/2554
MiCA
EU 2023/1114
AMLD6 · eIDAS 2.0
EU-aligned by design
FAQ

Common questions about Spain.

Infrastructure for identity and fraud.

One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.

Ask an AI to summarise this page