Financial regulation

Regulatory bodies

Which bodies regulate the provision of fintech products and services?

The regulator in charge of supervision of fintech products and services is the Spanish Securities Market Commission (CNMV) together with the Bank of Spain and the General Directorate for Insurance and Pension Funds, depending on the type of entity intending to provide services in Spain and the exact nature of those services.

Regulated activities

Which activities trigger a licensing requirement in your jurisdiction?

There are a large number of activities that, when carried out in Spain on a professional and ongoing basis in respect of specified financial instruments, trigger licensing requirements. These are set out in a number of different regulations, including those implementing the second Markets in Financial Instruments Directive in Spain as well as legislation that governs activities carried out by financial institutions, such as credit entities.

The most common activities that may require a licence with respect to specified financial instruments include:

  • the reception and transmission of orders;
  • the execution of orders on behalf of clients;
  • portfolio management;
  • providing investment advice (which requires that specific recommendations are made as opposed to providing generic advice only);
  • the underwriting or placing of financial instruments, or both;
  • dealing in investments as the principal or agent;
  • arranging or bringing about deals in investments; and
  • making arrangements with a view to transactions in investments.


To carry on any of these activities in relation to specified financial instruments on a professional and ongoing basis in Spain, the relevant entity or natural person must obtain the appropriate authorisation or passport. In addition to this authorisation, registration is a requirement to operate in Spain. Authorisation is also required to carry out marketing or canvassing of clients on a professional basis, as well as prior or preliminary activities related to investment services and offering of financial instruments.

A similar regime applies to the provision of services that are typical activities carried out by credit entities. The Spanish implementing text of the Capital Requirements Directive expressly states that the activity of taking repayable funds from the public (whether in the form of deposits, loans or temporary transfers of financial assets or other analogous actions) is a licensable activity that can only be carried out by credit entities that are authorised to operate in Spain and duly registered with the Bank of Spain. Taking repayable funds from the public using capital markets through the issuance and placement of instruments with the aim of giving credit is a reserved activity.

Notably, the provision of loans does not trigger licensing requirements, even though it is a typical activity of credit entities. However, while the activity of extending credit is not a reserved activity, it is usually connected to other regulated activities that trigger licensing requirements.

Regarding payment services, it is prohibited for entities or natural persons who are not payment service providers (apart from certain exceptions derived from the second Payment Services Directive (PSD2)) to provide payment services in Spain on a professional basis.

Consumer lending

Is consumer lending regulated in your jurisdiction?

Although it has traditionally been an activity carried out in Spain by credit institutions and financial credit establishments, in the case of a non-financial institution (ie, neither a credit institution nor a financial credit establishment) that is dedicated solely to the activity of granting consumer loans, this non-credit institution (formed as a company) may carry out this activity without a licence. The number of persons who tend to get credit from non-financial institutions offering personal loans rather than other traditional means (eg, banking credit cards and banking loans) is increasing.

The regulatory regime for consumer credit is governed by Act 16/2011, of 24 June, on Credit Agreements for Consumers. This regulatory regime applies to all contracts where entities or natural persons in the course of their business activity, profession or craft, grant or promise to grant a consumer credit in the form of a deferred payment, loan, opening credit or any other equivalent means of financing, with the aim of covering personal needs outside of his or her professional or business activity and amounting to at least €200. This regulation broadly sets out the requirements that lenders need to comply with in relation to the provision of information, documents and statements, and the detailed requirements as to the form and content of the credit agreement itself, including advertising, information to consumers, content, form of the contracts, cases of null-and-void contracts, right of withdrawal and costs.

In addition, Spanish Legislative Decree 1/2007, of 16 November, for the Protection of Consumers and Users also applies to consumer lending. Depending on the circumstances, other Spanish supplementary regulations may also be relevant.

Secondary market loan trading

Are there restrictions on trading loans in the secondary market in your jurisdiction?

Provided that the loan itself is being traded, and not the loan instrument (the financial instrument creating or acknowledging indebtedness), there are no restrictions on trading loans in the secondary market.

Collective investment schemes

Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

The general regulatory regime for collective investment schemes (CISs) in Spain consists of the transposition of the Undertakings for Collective Investment in Transferable Securities Directive and the Alternative Investment Fund Managers Directive (AIFMD), in addition to the regime that applies specifically to Spanish CISs.

CISs are a regulated product in Spain and must be locally registered. Management and distribution of CISs (ie, marketing, promotion and advertising) may only be carried out by licensed entities in Spain as these activities trigger licensing requirements. Marketing of CISs is defined as those activities aimed at raising funds from clients by way of any advertising activity for their investment into the CIS. Advertising activity consists of targeting the public through telephone calls initiated by the CIS or its management company, home visits, personalised letters, emails or any other electronic media forming part of a dissemination, promotional or marketing campaign.

Whether a fintech company falls within the scope of this regulatory regime will depend on the exact nature of its business and the type of activities being carried out.

Alternative investment funds

Are managers of alternative investment funds regulated?

Managers of alternative investment funds are regulated in Spain under the AIFMD, which was implemented in Spain by Act 22/2014, of 12 November, governing private equity entities, other closed-ended collective investment undertakings, and the management companies of closed-ended collective investment undertakings, which amended Act 35/2003, of 4 November, on Collective Investment Schemes.

Peer-to-peer and marketplace lending

Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

Peer-to-peer lending is considered a crowd-lending activity under Spanish legislation and is regulated by Act 5/2015, of 27 April, on the Promotion of Business Financing.


Describe any specific regulation of crowdfunding in your jurisdiction.

Crowdfunding is regulated by Act 5/2015, of 27 April, on the Promotion of Business Financing. This Act affects reward-based crowdfunding, equity crowdfunding and crowd lending, and governs, among others, the normal operating model and regime of platforms, the accreditation of the investor and the limits established for the amount of the investment. These limits, which are some of the most restrictive elements established in the Act, include limitations on:

  • raising funds for start-ups that amount to €5 million for accredited investors (ie, professional investors) and to €2 million for non-accredited investors;
  • equity crowdfunding projects, which cannot exceed 125 per cent of the project’s projected target; and
  • platforms and projects to be invested in by non-accredited investors, which are capped at €10,000 and €3,000 respectively.


It is expressly established that these types of investments are not covered by the guarantee fund.

Additionally, Regulation (EU) 2020/1503 of the European Parliament and of the Council, of 7 October 2020, on European crowdfunding service providers for business, which regulates and tries to harmonise the functioning of these alternative financing systems, shall enter into force on 10 November 2021.

Invoice trading

Describe any specific regulation of invoice trading in your jurisdiction.

There is no specific regulation of invoice trading in Spain. As a general rule, there are no restrictions on invoice trading; however, the activities and structure of a firm engaged in invoice trading should be analysed to determine whether a regulated activity that requires permission or authorisation is taking place.

Payment services

Are payment services regulated in your jurisdiction?

Payment services are regulated by Royal Decree 736/2019, of 20 December, on the legal regime on payment services and payment entities, which completes the transposition of PSD2 in Spain, which was partially implemented by means of the Royal Decree 19/2018, of 23 November, on payment services and other financial measures.

Payment services include:

  • services enabling cash to be placed on a payment account, as well as all the operations required for operating a payment account;
  • services enabling cash withdrawals from a payment account, as well as all the operations required for operating a payment account;
  • execution of payment transactions;
  • transfers of funds on a payment account with the user’s payment service provider or with another payment service provider;
  • execution of payment transactions where the funds are covered by a credit line for a payment service user;
  • issuing and acquiring of payment instruments;
  • money remittance; and
  • execution of payment transactions where the consent of the payer to execute a payment transaction is given by means of any telecommunication, digital or IT device, and a payment is made to the telecommunication, IT system or network operator, acting only as an intermediary between the payment service user and the supplier of the goods and services.


To provide payment services in Spain, a firm must fall within the definition of a ‘payment service provider’, which includes:

  • credit institutions;
  • electronic money institutions;
  • the national postal service of Spain;
  • the Bank of Spain; and
  • the Spanish general government administration, autonomous communities and local bodies.


A firm that provides payment services in or from Spain as a regular occupation or business activity (and is not exempt) must apply for registration as a payment institution. Sanctions may be imposed on any natural or legal person providing payment services without authorisation. Since December 2019, entities wishing to act as payment institutions must follow the specific procedure established under the aforementioned Royal Decree 736/2019, of 20 December, and submit a request with the Bank of Spain to obtain relevant authorisation. The cross-border business of payment institutions will be possible in Spain as far as relevant passports to set up a local branch or agents have been received by the Bank of Spain from entities located within the territory of the European Union. The provision of services without the presence of these entities in Spain will be also available if relevant notifications are received by the Bank of Spain. Spanish entities will provide services abroad if the Bank of Spain has received relevant notifications. In the case of the provision of activities in or from entities located out of the European Union, express authorisation is needed. In certain cases, the Bank of Spain may reject this authorisation.

Open banking

Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?


Insurance products

Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

Selling or marketing insurance products in Spain is a regulated activity and entities providing this service fall under the relevant Spanish regulation. In this regard, a fintech company must act under the form of a regulated entity (eg, insurance company or insurance intermediary as broker or agent). The Association of Fintech and Insurtech has published a white paper on fintech regulation in Spain, aimed at creating an adequate framework for these types of entities and to encourage alternatives to the existing Spanish regulations for financial services providers in Spain, including insurance services providers. In addition, there is draft legislation relating to the distribution of insurance products in Spain, which will make significant changes to the insurance product market sector.

Credit references

Are there any restrictions on providing credit references or credit information services in your jurisdiction?

The rules on credit ratings laid down in Regulation (EC) 1060/2009 (as amended) apply in Spain. A credit-rating agency is required to adopt, implement and enforce adequate measures to ensure that its credit ratings are based on a thorough analysis of all the information that is available and that is relevant to its analysis according to its rating methodologies. At present, there are only two credit-rating agencies domiciled in Spain and included in the official register of the CNMV.

Law stated date

Correct on:

Give the date on which the above content is accurate.

26 May 2020