CNMV · Spain

Investment firm authorisation in Spain — CNMV under MiFID II and IFR

Fintech Passport

June 21, 2026 · 6-min read

Investment firm authorisation in Spain — CNMV under MiFID II and IFR

An Empresa de Servicios de Inversión authorised by CNMV is the Spanish vehicle for MiFID II investment services — execution, portfolio management, advice, dealing on own account. The prudential framework is the Investment Firm Regulation (IFR) and the Investment Firm Directive (IFD), not the bank-CRR regime. The Class 2 / Class 3 threshold test determines which sub-regime applies. This piece walks through what CNMV expects in the application file, how the K-factor calculation drives capital and how the regime relates to where to base a regulated investment business.

1. Who grants and who supervises

The competent authority is CNMV. CNMV grants the authorisation and remains the prudential and conduct supervisor. AML supervision sits with CNMV and SEPBLAC. Where the investment firm offers services that touch payment activity, Banco de España is involved.

2. Legal basis

Directive 2014/65/EU (MiFID II) — the services framework
Regulation (EU) 600/2014 (MiFIR) — markets and transaction-reporting framework
Regulation (EU) 2019/2033 (IFR) and Directive (EU) 2019/2034 (IFD) — the investment-firm-specific prudential regime
Spanish Securities Markets Law and its implementing decrees — domestic implementation
CNMV Circulars and ESMA guidelines — operational rules

3. MiFID II services catalogue

Annex I MiFID II lists the investment services and activities an ESI can be authorised to provide:

Reception and transmission of orders
Execution of orders on behalf of clients
Dealing on own account
Portfolio management
Investment advice
Underwriting and placing of financial instruments
Operation of multilateral trading facilities (MTF) and organised trading facilities (OTF)

The selection determines the capital floor, the operational requirements, and the conduct rules that apply.

4. The IFR classification — Class 1, 2 or 3

Class 1 — the largest investment firms with bank-like risk profiles. Subject to CRR / CRD as if they were credit institutions. Very few firms qualify; usually applies only to systemic investment houses.
Class 2 — the standard IFR regime. Applies where the firm exceeds defined thresholds (assets under management, client money held, daily trading flow, balance-sheet total, total annual income).
Class 3 — small and non-interconnected investment firms (SNI). All five threshold tests below the IFR limits. Lighter regime on own funds, reporting and remuneration.

5. Capital floors

IFR Article 9 sets the minimum permanent own-funds requirement based on the services offered:

€75,000 — for firms not authorised to hold client money or deal on own account, providing limited services
€150,000 — for firms authorised to hold client money or to deal on own account on a matched-principal basis
€750,000 — for firms dealing on own account on an unmatched-principal basis and the largest firms

Ongoing own funds must be the higher of the floor, the fixed-overheads requirement (a quarter of the previous year’s fixed overheads), and the K-factor requirement (Class 2 firms only).

6. K-factors — the IFR calculation

Class 2 firms calculate own funds against a set of risk-to-customer, risk-to-market and risk-to-firm factors, multiplied by IFR-defined coefficients:

Risk-to-customer K-factors — assets under management (K-AUM), client money held (K-CMH), assets safeguarded and administered (K-ASA), client orders handled (K-COH)
Risk-to-market K-factors — net position risk (K-NPR), clearing margin given (K-CMG)
Risk-to-firm K-factors — trading counterparty default (K-TCD), daily trading flow (K-DTF), concentration risk (K-CON)

The K-factor own-funds requirement is the sum of the applicable K-factors. Class 3 firms are exempt from K-factor calculation but still face the fixed-overheads requirement.

7. What goes in the application file

Core sections of a CNMV ESI file:

Programme of operations — the MiFID II services and activities, the client segments, the geographies
Business plan — three-year projections, capital, profitability under stress
Governance map — board, senior management, key function holders, with fitness-and-properness for each
Internal-control framework — risk management, compliance, internal audit, with the MiFID II conflict-of-interest, best-execution and suitability frameworks
ICT and operational-resilience framework — aligned with DORA
Capital plan — initial own funds, ongoing own-funds methodology, K-factor calculation where Class 2
AML / CTF programme with designated SEPBLAC representative
Outsourcing register
Conduct framework — suitability and appropriateness assessment, best execution policy, conflict-of-interest policy, inducements, complaint handling
Transaction-reporting framework — MiFIR Article 26 transaction-report generation
Shareholder structure — direct and indirect, with fitness-and-properness on qualifying shareholders

8. MiFIR transaction reporting (post-grant)

From day one of operations the firm must report transactions in financial instruments under MiFIR Article 26 to CNMV. The reports follow the ESMA-coordinated schema and feed the EU-wide market-surveillance database. Reporting timing is T+1 by default. Building the transaction-reporting layer is part of the operational readiness; CNMV will look at it during the file review even though formal go-live is post-grant.

9. What switches on at grant

MiFIR Article 26 transaction reporting to CNMV (daily)
IFR / IFD prudential reporting — own funds, K-factors, concentration risk, liquidity (for Class 2)
Reduced ESMA / EBA-coordinated FINREP set
AML obligations under Law 10/2010 — FTF, DMO, SAR — see the SEPBLAC pillar
Conduct-related reporting — complaints, suitability outcomes, best-execution metrics
Passporting notifications where services extend to other member states

10. FAQ

How do I know if I’m Class 2 or Class 3?

Run the five IFR threshold tests at the projection level: AUM, client money, daily flow, balance-sheet total, total annual income. All five below the IFR limits = Class 3. Any one above = Class 2. The classification can change year-to-year as the business grows.

Can I offer crypto-asset services under an ESI licence?

For services that fall within MiFID II financial instruments (security tokens, tokenised securities) — yes. For crypto-assets within MiCA scope (most utility tokens, ARTs, EMTs) — a separate CASP authorisation is required. The two regimes are separate but increasingly interlocked.

Is the ESI authorisation passportable?

Yes. MiFID II passport rules apply. CNMV notifies the host competent authority; the firm can offer services cross-border on either Freedom of Services or branch basis. See our branch vs FoS piece.

How does the firm hold client money?

Client money rules under MiFID II Article 16 — segregated in dedicated accounts, reconciled daily, with the segregation arrangement evidenced in the application file. The accounts typically sit at credit institutions; the rules and operational reality differ from EMI safeguarding.

What is the typical timeline?

Statutory review under MiFID II is six months for complete files. Realistic end-to-end including pre-application engagement and feedback rounds: nine-to-twelve months for a first-time applicant. Pre-application meetings with CNMV are standard.

Can a non-EU firm apply directly?

A non-EU firm cannot hold a Spanish MiFID II ESI authorisation; it must operate through an EU-incorporated subsidiary. Some third-country firms operate into Spain on a reverse-solicitation basis without authorisation; the scope is narrow.

11. What to do, today

Run the IFR Class 2 / Class 3 threshold test against your business plan; the outcome shapes the entire prudential framework.
Pick the MiFID II services carefully — each one changes capital, conduct and operational obligations.
Pre-engage CNMV before the formal submission; the agency runs structured pre-application meetings.
Build the transaction-reporting layer alongside the application; it goes live on day one.
Plan the post-grant reporting catalogue (IFR/IFD prudential, MiFIR transaction reporting, AML, FINREP) before submission.