CNMV · Spain

Investment firm authorisation in Spain — CNMV

Fintech Passport

June 21, 2026 · 10-min read

Investment firm authorisation in Spain — CNMV

An Empresa de Servicios de Inversión authorised by CNMV is the Spanish vehicle for MiFID II investment services — execution, portfolio management, advice, dealing on own account. Two things decide most of the work. Which of the four ESI classes you apply for, because the class caps what you may ever do and whether you may touch client money at all. And whether you land in IFR Class 2 or Class 3, because that decides whether K-factors apply. Both are settled before drafting begins, and both are routinely got wrong. This piece walks through the Spanish legal frame, the classes, the capital stack and what CNMV expects in the file — and how the regime relates to where to base a regulated investment business.

1. Who grants, who supervises, and under which law

The competent authority is CNMV. It grants the authorisation and remains the prudential and conduct supervisor. AML supervision sits with CNMV and SEPBLAC. Where the firm’s activity touches payment services, Banco de España is involved.

The domestic frame is newer than most summaries assume. Ley 6/2023, de 17 de marzo, de los Mercados de Valores y de los Servicios de Inversión replaced the previous securities markets law and entered into force on 7 April 2023; its implementing regulation for investment firms, Real Decreto 813/2023, de 8 de noviembre, entered into force on 29 November 2023. Anything drafted against the old consolidated text is citing a repealed instrument.

Two rules in Article 131 of Ley 6/2023 shape the project plan directly. The procedure is conducted by electronic means in all cases. And the reasoned decision must be notified within six months of receipt of the application — or of the moment the required documentation is completed — with an application not resolved in that period understood as refused. The clock restarts on completeness, not on submission, and silence is negative.

2. The four classes of ESI

Article 128 of Ley 6/2023 defines four classes, and the class is stated on the face of the authorisation together with the services, auxiliary services, instruments and accessory activities permitted:

Class	What it may do	Client money and securities
Sociedad de valores	Acts both for clients and on own account; the full catalogue of investment services and activities and auxiliary services	Permitted
Agencia de valores	Acts for clients only, with or without representation; the catalogue less dealing on own account and less underwriting on a firm-commitment basis	Permitted
Sociedad gestora de carteras	Portfolio management and investment advice only, plus two auxiliary services	Prohibited — may never be in a debtor position to a client
Empresa de asesoramiento financiero	Investment advice only, plus two auxiliary services; must be a legal person	Prohibited

Alongside these sits a domestic category, the empresa de asesoramiento financiero nacional, authorised by CNMV under the same procedure with adaptations. The three non-dealing classes may not transact in securities or cash in their own name, save for administering their own assets within the limits set by regulation.

Class selection is therefore not a labelling exercise. A firm that intends, at any point, to hold client money cannot be a sociedad gestora de carteras, and widening scope later means varying the authorisation.

3. Initial capital — and the instrument that sets it

The initial-capital floors are set by Directive (EU) 2019/2034 (IFD), Article 9 — not by the IFR, which is where they are commonly and wrongly cited. The amounts key off the MiFID II Annex I Section A service numbers:

Amount	Applies to
€750,000	Firms authorised for dealing on own account (point 3) or underwriting / placing on a firm-commitment basis (point 6)
€75,000	Firms authorised for reception and transmission of orders, execution, portfolio management, advice or placing without firm commitment (points 1, 2, 4, 5, 7) and not permitted to hold client money or client securities
€150,000	All other investment firms — in practice, the same service set but permitted to hold client money or securities
€750,000	Operators of an OTF (point 9) that deal on own account or are permitted to do so

The line between the €75,000 and €150,000 tiers is permission to hold client assets, not matched-principal dealing. Getting it wrong halves the capital plan.

4. Class 2 or Class 3 — the test that actually decides the regime

The IFR sorts investment firms into three groups. Class 1 covers the largest bank-like firms, which fall back into the CRR framework; very few firms qualify. Everything else is Class 2 or Class 3, and the dividing line is Article 12(1) IFR, which defines the small and non-interconnected (SNI) firm. A firm is SNI only if it satisfies all of the conditions:

Assets under management — discretionary and advisory combined — below €1.2 billion
Client orders handled below €100 million per day in cash trades, or €1 billion per day in derivatives
No client money held, and no client assets safeguarded or administered
No dealing on own account and no market or counterparty risk from trading financial instruments
Balance sheet below €100 million, including off-balance-sheet items
Total gross annual revenues from investment services below €30 million

Three mechanics matter more than the numbers. The AUM, orders-handled, balance-sheet and revenue thresholds are applied on a combined basis across all investment firms in the same group — a deliberate anti-arbitrage rule, so a Spanish subsidiary cannot be sized into Class 3 by splitting a book. The conditions are assessed end-of-day, except client money, which is assessed intraday, and balance sheet and gross revenues, which are taken from the end of the previous financial year. And a firm that loses SNI status regains it only after meeting the conditions and staying below the thresholds for at least six consecutive months.

5. The own-funds stack

Under Article 11 IFR, a Class 2 firm must hold own funds equal to the highest of three amounts: the fixed-overheads requirement (Article 13), the permanent minimum capital requirement (Article 14), and the K-factor requirement (Article 15). For an SNI firm the K-factor limb drops away and the requirement is the higher of the first two.

Class 2 firms calculate the K-factor requirement as the sum of the applicable factors: risk-to-client (K-AUM, K-CMH, K-ASA, K-COH), risk-to-market (K-NPR, K-CMG) and risk-to-firm (K-TCD, K-DTF, K-CON). For a small advisory or management firm the fixed-overheads figure is often the binding constraint, so K-factors matter less to the capital plan than to the reporting build.

6. What goes in the application file

Core sections of a CNMV ESI file, all submitted electronically:

Programme of operations — the MiFID II services and activities, the client segments, the geographies, mapped to the requested class under Article 128
Business plan — three-year projections, capital, profitability under stress; the first-year fixed-overheads line carries prudential consequences
Governance map — board, senior management and key function holders, with fitness and propriety for each
Internal-control framework — risk management, compliance and internal audit, with the conflict-of-interest, best-execution and suitability frameworks
ICT and operational-resilience framework aligned with DORA
Capital plan — initial own funds, the Article 11 stack, and the Article 12(1) SNI assessment with its group-level aggregation shown
AML / CTF programme with a designated SEPBLAC representative
Outsourcing register, conduct framework and complaint handling
Transaction-reporting framework — MiFIR Article 26 report generation, T+1
Shareholder structure — direct and indirect, with fitness and propriety on qualifying holdings

7. Three scenarios

Scenario 1 — the advisory firm that wanted to hold cash. A digital advice business applies as a sociedad gestora de carteras because portfolio management is the core service, and plans a cash wallet so clients can fund allocations directly. Facts to rule: Article 128(1)(c) prohibits that class from holding client funds or securities and from ever standing in a debtor position to a client. What the applicant does: either drop the wallet and route funding through a third-party credit institution, or apply as an agencia de valores and accept the €150,000 tier instead of €75,000. The failure mode is a programme of operations that contradicts the class on its own face.

Scenario 2 — the group that assumed Class 3. A Spanish subsidiary of an EU group projects €600 million of assets under management and models itself as SNI, exempt from K-factors. Facts to rule: Article 12(1) thresholds for AUM, orders handled, balance sheet and gross revenues are applied on a combined basis across all investment firms in the group. What the applicant does: aggregate AUM across the group’s investment firms first — a sister firm with €800 million takes the group past €1.2 billion, making the Spanish entity Class 2 from authorisation. Outcome: the K-factor engine and the fuller IFR/IFD reporting set are in the build from the start. The failure mode is discovering the classification after go-live.

Scenario 3 — the intraday balance nobody looked at. An SNI-qualifying firm receives client subscription money that is swept to a custodian the same day, leaving no overnight balance. Facts to rule: the SNI conditions are assessed end-of-day except client money held, which is assessed intraday. What the compliance officer does: instrument the client-money condition intraday rather than on end-of-day balances, and treat a same-day sweep as a positive CMH observation, not a zero. The failure mode is a Class 3 declaration built on end-of-day reporting the regulation does not accept for that condition.

8. What switches on at grant

MiFIR Article 26 transaction reporting to CNMV, T+1
IFR / IFD prudential reporting — own funds, K-factors, concentration risk and liquidity for Class 2; a reduced set for SNI firms
AML obligations under Ley 10/2010 — FTF, DMO and suspicion reporting — see the SEPBLAC pillar
Conduct reporting — complaints, suitability outcomes, best-execution metrics
Passporting notifications where services extend to other Member States; the CNMV authorisation is valid throughout the Union under Article 131(2)

9. FAQ

How do I know if I’m Class 2 or Class 3?

Run every condition in Article 12(1) IFR, not a subset: AUM under €1.2bn, orders handled under €100m/day cash or €1bn/day derivatives, no client money, no safeguarded assets, no own-account dealing or trading risk, balance sheet under €100m and gross investment-services revenue under €30m. Any single failure makes the firm Class 2. Aggregate the size thresholds across the group first.

What is the statutory timeline?

Article 131 of Ley 6/2023 requires a reasoned decision within six months of the application — or of the moment the file is completed — and provides that an unresolved application may be understood as refused. Realistic end-to-end for a first-time applicant, including pre-application engagement and completeness rounds, runs materially longer than the six-month statutory clock.

Which class should a firm choose?

Start from two questions: will the firm ever deal on own account, and will it ever hold client money or securities. A “yes” to the first points to a sociedad de valores; a “no” to both allows the lighter advisory and management classes with their lower capital floor. The class appears on the authorisation itself, so widening scope later is a variation.

Can I offer crypto-asset services under an ESI licence?

For instruments that qualify as MiFID II financial instruments — security tokens, tokenised securities — yes. For crypto-assets within MiCA scope, a separate CASP authorisation is required. The regimes are separate but increasingly interlocked.

Is the ESI authorisation passportable?

Yes. Article 131(2) of Ley 6/2023 states the CNMV authorisation is valid throughout the European Union, on a branch or freedom-of-services basis. See our branch vs FoS piece.

Can a non-EU firm apply directly?

A non-EU firm cannot hold a Spanish MiFID II authorisation; it must operate through an EU-incorporated subsidiary. Some third-country firms reach Spanish clients on a reverse-solicitation basis without authorisation, but the scope of that is narrow.

10. What to do, today

Fix the class under Article 128 before drafting the programme of operations — client money and own-account dealing are the two questions that decide it.
Cite the initial-capital floors to IFD Article 9, and check whether your services fall in points 3 or 6 of MiFID II Annex I Section A.
Run the Article 12(1) SNI test on a group-aggregated basis, and instrument the client-money condition intraday.
Treat the first-12-months fixed-overheads projection as a prudential number: under Article 13(3) IFR it becomes the fixed-overheads requirement.
Plan for an electronic-only procedure and a six-month clock that restarts on completeness, with negative silence if it expires.
Build the MiFIR Article 26 transaction-reporting layer alongside the application; it goes live on day one.