In short.
- Law 5/2014 on Private Security (Ley de Seguridad Privada) requires every security company, in order to obtain authorisation and be registered, to hold two distinct guarantees: liability insurance (or another financial guarantee) and a bank guarantee or surety bond held at the disposal of the authorities solely to answer for its penalties (art. 19(1)(e) and (f)). The amounts are set by the 1994 Regulations, which remain in force insofar as they do not conflict with the Act.
- The Regulations require minimum liability cover of €300,506.10 per claim and year for guarding services and €601,012.10 for close protection or cash-in-transit, plus a guarantee of between €120,202.42 and €240,404.84 per activity at national level, increased by 25% for each additional activity where there are more than two (art. 6 and annex of Royal Decree 2364/1994). These are minimums for authorisation, not the limit a major contract requires.
- The client is also exposed: knowingly engaging an unauthorised company is a very serious infringement by the user, punishable by a fine of €20,001 to €100,000 (arts. 59(1)(a) and 63(1)(a)), and the contract must be made in writing and notified before the service starts (art. 9).
Spain's private security legislation requires a guarding company to carry two forms of cover that are frequently confused: liability insurance for the damage it causes to third parties —including you, its client— and a bank guarantee or surety bond that does not protect you at all: it is held at the disposal of the authorities to collect the company's own fines.
That is why asking a supplier for "the insurance" is not enough. You need to know which one, for how much and to whom it answers.
What does the Private Security Act regulate and who does it apply to?
The governing statute is Law 5/2014 of 4 April on Private Security, which came into force two months after its publication (fourth final provision). It repealed Law 23/1992 (sole repealing provision).
Article 5 reserves to security companies the guarding and protection of property, close protection of persons, the storage and transport of cash, valuables and explosives, the installation and maintenance of systems connected to alarm receiving centres and the operation of those centres (letters a to g). Private investigation (letter h) belongs to private detective agencies, which article 24(2) also requires to hold insurance and a guarantee.
Two definitions in article 2 mark out who falls within its scope:
- Private security company (art. 2(7)): the company that provides those services.
- Private security user (art. 2(10)): whoever buys services or adopts security measures, whether voluntarily or because they are required to. The client also has obligations and its own penalty regime.
This is one of the cases in which sector legislation imposes compulsory insurance; we set it alongside others in insurance required by law.
Is there a new private security law?
No. The Act in force is the 2014 one, and the regulation that sets the amounts is still Royal Decree 2364/1994 approving the Private Security Regulations (Reglamento de Seguridad Privada), in force insofar as it does not contravene the Act (sole repealing provision, paragraph 2).
Requirements to operate: authorisation, registration and guarantees
The company needs administrative authorisation —or a responsible declaration if it only installs and maintains systems (art. 5(1)(f))— and is entered automatically in the National Private Security Register or in the relevant regional register. Authorisation is valid indefinitely (arts. 18 and 20), but it is not unconditional.
Article 19(1) requires the company to be incorporated with private security as its sole object (a); to have the nationality of an EU or EEA State (b); to have adequate human, material, financial and technical resources (c); to have the security measures laid down by regulation (d); to hold liability insurance or other financial guarantees (e); to provide a bank guarantee or surety bond for penalties (f); and not to have certain criminal convictions (g and h).
If it ceases to meet any of them, the authorisation lapses and the registration is cancelled (art. 19(8)). Companies from another EU or EEA State may evidence the insurance and guarantee of their home country, provided they reach the amount required in Spain; if they fall short, they must be topped up or extended (art. 19(5); Regulations arts. 5(1)(c)(6) and 7(4)). We compare this twofold requirement with that of other activities in compulsory guarantees by sector.
Critical infrastructure
In strategic sectors, before providing the service the company must hold a certificate from an accredited body confirming its administrative, employment, Social Security and tax compliance (art. 19(4)). It is one more document a large account should request.
Compulsory liability insurance: what it covers and how much
Article 19(1)(e) requires liability insurance or other financial guarantees in the amount set by the Regulations. Royal Decree 2364/1994 specifies its scope (art. 5(1)(c)(6)): civil liability for injury to persons or damage to property arising from carrying on the authorised activities, placed with an insurer authorised in the EU or the EEA. The minimums are in section I of its annex:
| Activity | Minimum liability cover (annex to RD 2364/1994) |
|---|---|
| Guarding and protection | €300,506.10 per claim and year |
| Close protection | €601,012.10 per claim and year |
| Storage of valuables | €601,012.42 per claim and year |
| Storage of explosives | €601,012.10 per claim and year |
| Transport of valuables | €601,012.10 per claim and year |
| Transport of explosives | €601,012.42 per claim and year |
| Installation and maintenance | €300,506.05 per claim and year |
| Alarm receiving centres | €300,506.05 |
The cents come from converting 50 and 100 million pesetas (€300,506.05 and €601,012.10); the annex is not consistent and also uses €300,506.10 and €601,012.42. The amounts have not been updated since 1994.
Three rules complete the picture:
- Several activities (Regulations art. 6): the highest amount applies; with more than two, +25% for each remaining activity.
- Regional scope (annex, II.1): the insurance and the guarantee are reduced to 75% or 50% depending on the population of the autonomous community.
- Continuity (Regulations art. 139): an annual certificate of cover in force, 30 days' notice of any termination and a new policy with no break in cover. Failing to file the certificate is a serious infringement by the company (art. 57(2)(i) of the Act).
Where liability is covered by insurance (the Act also allows other financial guarantees), the injured party additionally has the direct action against the insurer under article 76 of the Insurance Contract Act (Ley de Contrato de Seguro).
That said, the legal minimum serves to obtain authorisation. The limit required by a guarding contract at a logistics centre or a hospital is set by the tender specifications or the contract, which usually demand more, and it is also worth looking at limits and sub-limits: a generous main limit may conceal a per-victim sub-limit that is far lower. Insurance for logistics and transport companies is a typical case of a client that should require that adjustment. How this fits with the rest of the programme is covered in our page on liability insurance for companies.
Is your liability policy sized for the contracts you sign, not just for authorisation? Request a review.
The bank guarantee or surety bond: it answers for fines, not for damage
Article 19(1)(f) requires a bank guarantee or surety bond at the disposal of the authorities "to meet exclusively the administrative liabilities for infringements" of the company. Under the Regulations (art. 7), it is lodged with the General Deposit Fund (Caja General de Depósitos) or a similar body in the EU or the EEA; in autonomous communities with devolved powers, with the fund designated by the community (first additional provision, rule 4, of the Regulations). It must be maintained in full for as long as the authorisation lasts, and any amount drawn must be replenished within one month (art. 7(3)).
| Activity | National scope | Regional scope |
|---|---|---|
| Guarding and protection | €240,404.84 | €48,080.97 + €12,020.24 per province |
| Transport of valuables | €240,404.84 | €48,080.97 + €12,020.24 per province |
| Storage of valuables | €240,404.84 | €60,101.21 + €12,020.4 per province |
| Close protection | €240,404.84 | €240,404.84 (no separate regional amount; section II reductions apply) |
| Explosives | €120,202.42 | €30,050.61 + €6,010.12 per province |
| Installation and maintenance | €120,202.42 | €30,050.61 + €6,010.12 per province |
| Alarm receiving centres | €120,202.42 | €120,202.42 (no separate regional amount; section II reductions apply) |
The regional figures are subject to the reduction to 75% or 50% under section II.1. In addition, the guarantee of regional companies is reduced to 50% if they have fewer than 50 employees when they register and, likewise, where they subsequently do not exceed €601,012.10 in turnover for two consecutive years (annex, II.2); this reduction is not cumulative with that of II.1. The per-province amounts are not counted for provinces with fewer than 250,000 inhabitants (II.3). Regional companies devoted exclusively to installation and maintenance have their own regime: a guarantee of €6,101.21 (€12,020.24 if they are not incorporated) and liability cover of €60,101.21 (II.4).
The consequence for the client is direct: this guarantee is not available to you. If the guarding company causes you loss, you claim against its liability insurance, not against the guarantee.
For the security company, the alternative to a bank guarantee is the surety bond: the insurer guarantees to the authorities any payment the company fails to make, subject to an assessment of its financial standing. We explain these guarantees and bonds and what happens on the calling of a surety bond, for instance to collect a fine.
What liability does the company that hires private security take on?
No service may be provided without a prior contract (art. 9(1)), and the contract must be made in writing and notified to the Ministry of the Interior or the regional authority before the service begins (art. 9(2)).
Article 59 sets out the infringements by users. The most relevant for a large company:
- Very serious: knowingly engaging unauthorised companies (59(1)(a)) or unlicensed personnel (59(1)(h)); failing to adopt compulsory security measures (59(1)(f)); requiring licensed personnel to carry out other duties (59(1)(k)).
- Serious: not having a security director where the rules require one (59(2)(h) and art. 36(2)) or failing to have compulsory systems inspected (59(2)(a)).
| User infringement (art. 63) | Penalty |
|---|---|
| Very serious | €20,001 to €100,000 and, where applicable, closure of premises lacking the compulsory measures for six months and one day to two years |
| Serious | €3,001 to €20,000 |
| Minor | Warning or €300 to €3,000 |
Penalties are graded under article 64, and infringements become time-barred after six months, one year or two years depending on whether they are minor, serious or very serious (art. 56(2)). In store and warehouse networks, where guarding is a routine service, insurance for retail and distribution companies should take this perimeter into account.
As regards third parties, if a security guard injures a visitor, the injured party may bring a claim against the security company and, depending on the facts, against the owner of the premises (Spanish Civil Code, arts. 1902 and 1903). Whether the owner ends up liable would depend on the circumstances: negligent selection of the supplier, direct instructions to the guard or failings in its own measures. We develop this in contractual and non-contractual liability and in the liability of the principal contractor.
In public security contracts, the tender specifications may set special performance conditions of an employment nature and contractual penalties (second additional provision of the Act). The guarantee for the contract itself is a separate piece: the definitive guarantee.
Before awarding the security service, we review the supplier's policy against your contract. Talk to us.
How to check your supplier
- Registration in the National Private Security Register or the regional register (art. 11): request the authorisation decision or the certificate of registration.
- Authorised activities that match exactly the service contracted.
- Current certificate for the liability policy, showing limit, sub-limits and activity. How to read it is covered in liability insurance certificate.
- Notification of the contract to the authorities before the start.
- Licensing of the personnel who will provide the service.
All of this fits with the contractor documentation required for the coordination of business activities.
Penalties on the security company: why they affect you as a client
Providing services without authorisation (art. 57(1)(a)) and failing to meet the requirements of article 19(1) to (3), including the insurance and the guarantee (art. 57(1)(l)), are very serious infringements. Article 61 punishes them with a fine of €30,001 to €600,000 and the termination of the authorisation, with no possibility of obtaining it again for one to two years. Serious infringements carry €3,001 to €30,000 and suspension for six months to one year; minor ones, a warning or €300 to €3,000.
For the client, a suspension or termination leaves the service without a provider overnight. The contract should provide for an obligation to report any proceedings affecting the authorisation and a replacement mechanism.
The role of an independent broker
For the security company, the task is to size its liability cover above the regulatory minimum according to the contracts it signs, coordinate the surety with its guarantee facility and keep track of the annual certificate. For the client, it is to review the supplier's policy against the contract: limit, activity and, where appropriate, its own inclusion as an additional insured. As an independent brokerage we act on the client's mandate, not the insurer's.
We will review, without obligation, the liability and guarantee programme of your security company, or the cover you should require from the one you hire. Contact us.
Frequently asked questions
What insurance is compulsory for a private security company? Liability insurance (or another financial guarantee) and, separately, a bank guarantee or surety bond to answer for administrative penalties (art. 19(1)(e) and (f) of Law 5/2014). The minimum amounts are set out in the annex to Royal Decree 2364/1994.
Does the security company's guarantee cover the damage it causes me? No. It answers exclusively for administrative penalties (art. 19(1)(f) of the Act and art. 7(1) of the Regulations). Damage is claimed under the company's liability insurance.
What happens if I hire an unauthorised security company? If you do so knowingly, you commit a very serious infringement as a user (art. 59(1)(a)), punishable by a fine of €20,001 to €100,000 (art. 63(1)(a)).
Does a private security contract have to be notified? Yes. It must be made in writing and notified to the Ministry of the Interior or the competent regional authority before the service begins (art. 9(2)). Providing the service without having notified it is a serious infringement by the security company.
Are the 1994 Private Security Regulations still in force? Yes, insofar as they do not contravene Law 5/2014 (sole repealing provision, paragraph 2). They are what sets the minimum amounts for the insurance and the guarantee.
Sources and legislation
- Law 5/2014 of 4 April on Private Security (consolidated text), arts. 2, 5, 9, 11, 13, 18, 19, 20, 24, 36, 56, 57, 59, 61, 63 and 64; second additional provision, sole repealing provision and fourth final provision.
- Royal Decree 2364/1994, Private Security Regulations (consolidated text), arts. 5, 6, 7 and 139, first additional provision (rule 4) and annex (sections I and II).
- Spanish Civil Code, arts. 1902 and 1903.
- Law 50/1980 on Insurance Contracts, art. 76.
Texts consulted in the Spanish Official State Gazette (BOE) on 12 October 2026.
The amounts cited are the regulatory minimums for obtaining authorisation; the appropriate limit depends on the contracts and the risk of each service, and is set by the tender specifications or the contract. Autonomous communities with devolved powers over private security (art. 13 of Law 5/2014) handle authorisation, registration and penalties for companies within their remit: the competent authority may not be the Ministry of the Interior. The client's liability to third parties depends on the facts and the contract in each case.
This information is for guidance only and does not constitute legal or binding advice. Covers, limits and exclusions are governed in every case by the specific terms of each policy. New Brokers Correduría de Seguros, S.L., registered with the DGSFP under reference J0140.
