Orden ECM/531/2026: the CIR threshold from January 2027

For a year, the rules that Spanish declaring entities were applying to the CIR did not legally exist. The Supreme Court annulled them in May 2025 on a procedural defect, and the Ministry re-enacted them, word for word in substance, with Orden ECM/531/2026, de 27 de mayo (BOE of 29 May 2026). It matters to anyone filing to the Central de Información de Riesgos because it carries a dated step in the threshold governing what comes back to you: €3,000 today, €1,000 from 2 January 2027. This guide separates the two thresholds the order actually contains — they are not the same one — sets out the 21st-calendar-day service commitment, and shows how the change lands on a payment or e-money institution.

1. Why an order had to be re-enacted

Sentencia del Tribunal Supremo 519/2025, de 6 de mayo de 2025 (Sala de lo Contencioso-Administrativo, Sección 3.ª, recurso 853/2022) declared null the artículos primero y segundo of Orden ETD/699/2020, de 24 de julio, the revolving-credit order. The defect was procedural — the text changed substantially after the public hearing and no fresh hearing was held. The Court found no fault with the policy.

The consequence was still real. Two blocks of law disappeared: the amendments Orden ETD/699/2020 had made to Orden ECO/697/2004, de 11 de marzo, on the CIR, and the new drafting of article 4 of Orden EHA/1718/2010, de 11 de junio, on the advertising of banking services and products. Orden ECM/531/2026 restores both, which is why it reads like a re-issue rather than a reform: two articles, one transitional provision, one repealing provision and two final provisions.

2. Two thresholds that are easy to confuse

Read quickly, the order looks like it sets one €1,000 figure. It sets two, in different places, with different wording and different dates.

The difference between superior a and igual o superior a is not drafting noise. A holder with exactly €1,000 of accumulated risk at your institution is below the declaration threshold and at the return-report threshold. One comparison operator cannot serve both. Article tercero.4 also states that risk amounts are declared in whole euro units.

The transitional provision is the part to diarise. Until 2 January 2027, the reports under article cuarto.1 must carry consolidated information for each holder with accumulated risk «igual o superior a 3.000 euros». The final provision defers exactly one piece of the order to that date — apartado cuatro del artículo primero, which rewrites article cuarto.1 and .2. Everything else took effect the day after publication.

3. Who this actually reaches

The CIR is not a credit-institution-only obligation, and that is the point most English-language coverage misses. Circular 1/2013, de 24 de mayo, of the Banco de España lists the declaring entities in its first norma, expressly including entidades de pago and entidades de dinero electrónico, «incluidas las que operen en España, en el ejercicio del derecho de libertad de establecimiento y en régimen de libre prestación de servicios». Branches in Spain of foreign credit institutions, financial credit establishments, mutual guarantee companies, real-estate lenders under Ley 5/2019 and the SAREB are also in scope.

So a payment institution passporting into Spain, and a Spanish branch of an EEA e-money institution, are both declaring entities. Most declare very little, because most carry no credit risk — but “very little” is a filing, not an absence of one, and the return report is a data source they are entitled to under article 61.2 of Ley 44/2002, de 22 de noviembre.

4. Three worked cases

The threshold step is small in money and awkward in systems. These three cases are the shapes it takes in practice.

Case A — a consumer-credit book that sits just under the old floor

An e-money institution has begun offering a small instalment product. At the December 2026 reference date, 4,100 holders have an outstanding balance between €1,001 and €2,999. Those holders have been declared individually since 30 May 2026 — the €1,000 figure in article tercero.1 was not deferred. But until 2 January 2027 none appears in the consolidated return report, which is still built at €3,000.

What the firm does: treats the two sides as separate projects. Outbound extraction is already at €1,000 and needs no change. Inbound does: from the January 2027 report onwards, roughly 4,100 additional holders arrive with consolidated data from other declaring entities, and the creditworthiness process consuming the report has to read that as a designed step change, not a feed defect.

Case B — a branch that files an empty declaration

A Spanish branch of an EEA payment institution holds no credit risk at all. It is nonetheless a declaring entity under Circular 1/2013, and its obligation is to file, not to be silent. The threshold change does not alter its position on the outbound side.

What the firm does: nothing to the filing, but one check. If the branch later launches a product that generates accumulated risk — an overdraft facility, a deferred-debit card, a buy-now-pay-later arrangement booked in Spain — the individual declaration obligation bites above €1,000, not above €3,000, from the first reference date on which the exposure exists. The €3,000 figure, still quoted in much secondary material, is the wrong number for that test and always was.

Case C — a risk team that plans around the 21st

The order inserts a new article cuarto.3 requiring the Banco de España to establish processing and supply procedures that ensure declaring entities and real-estate credit intermediaries have the latest declared information by the twenty-first calendar day of the month following the one the data refers to — or the next working day where that day is not one.

What the firm does: stops treating the return report as “available at some point mid-month” and writes the 21st into the credit-decision calendar. A firm running monthly affordability re-assessments on the 15th is, by design, working from information one month older than it is entitled to. Moving the run to the 22nd costs nothing and gains a full cycle of freshness. The commitment sits on the Banco de España’s side, which makes it a service level to plan against, not a deadline to meet.

5. Where the filing calendar actually lives

This is the easiest thing to get wrong when writing about the order. Its preamble recounts that Orden ETD/699/2020’s main novelty was a new entry-into-force calendar for the duty to file the monthly CIR declaration within the first seven calendar days of each month. That is history, not the operative rule.

In the text as re-enacted, article primero.2 and the new article primero bis.2 both delegate the procedure, form and time limit for periodic declarations to the Banco de España. The submission calendar therefore lives in Circular 1/2013 and its amendments, not in the ministerial order. Do not quote a day-of-month from the order; check the circular’s timetable for the modules you actually file.

Both provisions also carry a standing correction duty: complementary declarations go in «a la mayor brevedad» as soon as the entity knows that data it declared is wrong, so that the CIR reflects the true position at the reference date. There is no monthly window for that one — it is a fix-it-when-you-find-it obligation, and it is the provision a supervisor reaches for when a firm has sat on a known error until the next cycle.

6. The quieter structural change: two purposes, two regimes

The first article does something beyond moving a threshold. It splits the treatment of information the Banco de España receives for its supervisory and inspection functions from the treatment of information gathered to pass back to declaring entities for their own business. Article primero is rewritten for the first purpose; a new article primero bis is inserted for the second.

Article tercero.4 then lets the Banco de España set different declaration thresholds and data types by holder and risk class, according to the sector the declaring entities or the holders belong to — and identify the thresholds below which a holder’s data is declared exclusively for supervisory purposes. In plain terms: some of what you declare will never come back to anyone, and the order now says so in structure rather than by implication. For a firm mapping data-protection lawful bases onto its CIR extract, that separation belongs in the record of processing.

Article cuarto.1 keeps the protections that make the return report usable without being disclosive: the consolidated information does not name the reporting entities, and it is restricted as to default, insolvency proceedings and risks overdue by more than 90 days.

7. The advertising half, in one section

The second article rewrites article 4 of Orden EHA/1718/2010, restoring the criteria for the representative example in credit advertising. Two sets of numbers matter.

• Mortgage credit (the example under article 6.2 of Ley 5/2019, de 15 de marzo): initial capital of at least €100,000 or, above that, a multiple of €50,000 up to €300,000; term of at least ten years or, above that, a multiple of five years up to thirty.
• Revolving credit (article 33 bis of Orden EHA/2899/2011): an available credit limit of €500, €1,000 or €1,500, a term of at most four years, and repayment in constant instalments. The lender may present one or more of those limits.

Where a promotional rate or temporary special conditions are mentioned, the example must illustrate the normal conditions of the contract, and must say that it is a representative example.

8. What else moved in the CIR at the same time

The threshold step is not the only CIR change in flight. Circular 1/2025, de 19 de diciembre, of the Banco de España amended both Circular 4/2017 and Circular 1/2013 to carry the dimensions and values needed for granular CIR data to replace two reserved statements: the last data credit institutions file for FI 131 and FI 141 is that of reference date 30 June 2026. Payment and e-money institutions do not file the FI series, but the direction matters to them — the Banco de España is retiring aggregated reserved statements and rebuilding the same supervisory view from granular CIR records. A lower declaration threshold is part of that movement, not a standalone consumer-credit measure.

9. What to do, today

• Check which comparison operator your CIR extract uses. The declaration test is strictly above €1,000; the return-report test is at or above €1,000. One rule cannot serve both.
• Put 2 January 2027 in the change calendar as an inbound change. Size the extra holder population that will appear in the report and tell whoever consumes it, so the jump is not investigated as a feed defect.
• Move any monthly affordability or exposure run that currently sits before the 21st to just after it, and record the twenty-first-calendar-day commitment as the assumption behind the schedule.
• If you are a passporting payment or e-money institution, confirm in writing that you are on the declaring-entity list under Circular 1/2013 and that someone owns the filing — including in the months when there is nothing to declare.
• Point any internal procedure that cites the ministerial order for a filing deadline at Circular 1/2013 instead.
• If you advertise consumer credit in Spain, re-check the representative example — the €500 / €1,000 / €1,500 limits and the four-year maximum term for revolving credit are back in force.

Related: What is the CIR (CIRBE)? · Spain reporting calendar for payment and e-money institutions · AnaCredit for payment firms · Account registers compared across the EU