Spain’s financial sandbox, reformed — year-round applications, filings in English, and the 30-working-day clock
Spain’s financial sandbox is being reopened to applications all year round, in English if you want, with a 30-working-day supervisory clock — and two new hard gates on data protection and money laundering that will stop a project before anyone looks at the idea. The proyecto de ley de digitalización y modernización del sector financiero, published in the Boletín Oficial de las Cortes Generales on 27 July 2026, rewrites much of Ley 7/2020 after nearly five years of the espacio controlado de pruebas. This is a bill in parliamentary passage, not law, and the numbering can still change — but the procedure it sets out is the one a promoter should be planning against.
1. Applications all year, except two months
The headline change is the end of the periodic call. Under the rewritten Article 6(3) of Ley 7/2020, promoters may file an access application at any time of the year, except in August and December, which are treated as non-working months for this purpose, through the electronic office of the Ministry of Economy, Trade and Enterprise. The Secretaría General del Tesoro y Financiación Internacional may still set thematic periods by resolution, after agreement of the Coordination Commission, and where it does so expressly it may exclude projects outside the chosen theme.
Two mechanics sit alongside it. Applications go in on a mandatory standardised form approved and published on the Treasury’s electronic office under Article 66(6) of Ley 39/2015 — filing off-form is a ground for inadmission, not a correction. And applications may be filed in English, although the file itself is then processed in Spanish. Each application carries a memoria justificativa explaining the project, how it meets Article 5, and how the promoter intends to comply with the guarantees and participant-protection regime, with proportionality applied by reference to the nature, scale and risks of the project.
2. Two new gates that sit in front of the merits
A new Article 5(6) states that projects failing the data protection and AML/CFT requirements may in no case access the sandbox, on the terms set out in the documento de requisitos de acceso published by the Treasury on its website. The two gates are evidenced differently, and the difference is the whole point.
- Data protection is a declaración responsable — a responsible declaration in the form set out in that access-requirements document, filed with the Article 6(2) documentation. Where the Treasury asks the Agencia Española de Protección de Datos for an assessment by reasoned report, the promoter can be asked for additional information to evidence compliance.
- AML/CFT is an assessment by the financial intelligence unit. The promoter supplies the information requested in the access-requirements document, and that information is evaluated by SEPBLAC’s Servicio Ejecutivo by reasoned report, sent to the Treasury within the Article 7(2) period.
The compensating move is the one worth using: promoters may go through the Article 20 specific communication channels to obtain advice from SEPBLAC on meeting those requirements before they are judged on them. Article 20 as rewritten obliges the Treasury, SEPBLAC’s Servicio Ejecutivo and the supervisory authorities to establish direct channels for queries on new applications, processes, products and business models, and on the sandbox access requirements themselves.
3. The clock, and the two ways an application dies of silence
The Treasury forwards applications immediately to the supervisory authorities competent by subject matter, which evaluate by reasoned report — including a favourable or unfavourable rating — within a maximum of 30 working days of receiving the application. Where a project touches several authorities’ competences, a single joint reasoned report must be obtained rather than several.
| Stage | Period | What happens if it runs out |
|---|---|---|
| Supervisory reasoned report | 30 working days from receipt | Suspended during a remedy request; extendable by up to 15 additional working days where applications rise substantially on the same month a year earlier |
| Promoter’s remedy (subsanación) | Max 15 days | Suspends the 30-working-day clock while it runs |
| Coordination Commission meets | Within 10 days of the report reaching the Treasury | — |
| Publication of a favourable evaluation | Within 5 days of that meeting | Names the supervisor responsible for monitoring; evaluation is provisional and has no effect until the protocol is signed |
| Commission takes cognisance of the evaluations | 3 months from filing | The Treasury must notify applicants that applications are deemed rejected |
| Express resolution notified | 3 months from entry in the electronic register | The application is deemed rejected |
| Testing protocol signed | 3 months from publication of the favourable evaluation | The project lapses, declared expressly by reasoned resolution |
An unfavourable report from any competent authority obliges the Treasury to reject the application by express reasoned resolution, and the unfavourable content must itself be reasoned by reference to Article 5. Applications that are manifestly unfounded against Article 5, or not filed on the approved form, are inadmitted by reasoned decision notified within ten days. These resolutions end the administrative route under Article 114(1)(g) of Ley 39/2015, with an optional recurso de reposición within one month or a contentious-administrative appeal within two.
Facts: a payments firm files in early July for a project touching both payment services and investment services, and books the launch for the autumn on the assumption that a favourable evaluation is the finish line.
What the rule says: a multi-competence project needs a single joint reasoned report from all the competent authorities, the favourable evaluation is expressly provisional with no effect until the Article 8 protocol is signed, and the protocol has its own three-month window after publication — after which, if the delay is down to the promoter or the promoter withdraws, the project lapses.
What the practitioner does: treats protocol negotiation as a project phase with named owners on both sides rather than a formality after the win, and keeps the remedy capacity to answer a subsanación inside 15 days — because that period suspends the supervisors’ clock rather than extending anyone’s patience.
Outcome: the plan has two milestones, evaluation and protocol, and the launch date hangs off the second.
4. Guarantees and cost, both reduced
The guarantee regime is the change that most alters who can realistically apply. Under the rewritten Article 13, promoters must hold financial guarantees at the start of testing, as set out in the protocol, to cover liability for material and financial damage — proportionate to the risks, and capable of being formalised through insurance, bank guarantees or fianzas among other instruments. Then the exemption: projects whose tests involve no flows of funds and carry no risk of economic or material loss, or which incorporate measures adequately mitigating those risks for participants, need no financial guarantees at all — and that must be recorded in the testing protocol.
A new Article 9(2) adds a fee exemption. Promoters are exempt from documentation-examination fees, registration fees and supervision and inspection fees for activities carried out or services provided in the course of tests under a project for which the CNMV has signed a protocol.
Facts: a firm wants to test a machine-learning transaction-monitoring model against historical data, with no customer money moving at any point, and has assumed a bank guarantee is the price of entry.
What the rule says: where the tests involve no fund flows and no risk of economic or material loss, Article 13(2) removes the financial-guarantee requirement outright, and the protocol records that this is the case.
What the practitioner does: designs the test perimeter deliberately to stay inside that description — no live flows, mitigations documented for any participant exposure — and argues the point in the memoria justificativa rather than leaving it to the protocol negotiation.
5. What counts as innovation, and what can stop a live test
The definition in Article 3(e) is rewritten to cover an action or set of actions that, using new or existing technology, may give rise to new applications, processes, products or business models with an impact on financial markets, on the provision of financial and ancillary services, or on the performance of public functions in the financial sphere. Two things widen here: existing technology applied in a new way is expressly in, and the public-function limb brings supervisory and administrative processes inside the concept.
At the other end, the rewritten Article 16(1) lets the monitoring authority suspend or terminate the pilot or any test, with reasons, where it finds manifest or repeated deficiencies, evidence that the project does not meet the access requirements or the protocol, or possible risks to financial stability, the integrity of financial markets or customer protection. Alongside it, Article 21 keeps the written-query route to supervisors through their innovation hubs, with an answer due as soon as possible and in any event within one month, extendable by a further month for especially complex queries, and binding effects where sectoral legislation so provides.
6. FAQ
When can I apply?
Under the bill, at any time of year except August and December, which are treated as non-working months for this purpose. The Treasury may additionally set thematic periods by resolution and, where it says so expressly, exclude projects outside the theme.
Can we apply in English?
Yes — the rewritten Article 6(4) allows applications in English, but the file is then processed in Spanish. Plan for Spanish-language correspondence and remedies even if the initial filing is in English.
Do we always need a financial guarantee?
No. Guarantees must be proportionate to the risks, and projects whose tests involve no fund flows and no risk of economic or material loss — or which adequately mitigate those risks for participants — are exempt, with that fact recorded in the testing protocol.
What happens if nobody answers?
Silence is negative in two separate ways. If three months pass from filing without the Coordination Commission taking cognisance of the supervisors’ evaluations, the Treasury must notify applicants that their applications are deemed rejected; and if three months pass from entry in the electronic register without a notified express resolution, the application is likewise deemed rejected.
Is a favourable evaluation the same as admission?
No. The published favourable evaluation is expressly provisional and produces no effect until the testing protocol under Article 8 is signed, which must happen within three months of publication or the project lapses.
Is this in force?
No. It is a bill before the Cortes under the urgent procedure, with the amendment window closing on 9 September 2026 and a Senado stage afterwards. Commencement is twenty days after publication in the Boletín Oficial del Estado.
7. What to do, today
- Use the advisory channel before you are judged on the gate. Article 5(6) makes AML/CFT a pass/fail access condition assessed by SEPBLAC, and Article 20 obliges SEPBLAC to run a channel for exactly those questions. Asking first is free; failing the gate costs a cycle.
- Design the test perimeter around the guarantee exemption. No fund flows and no risk of economic or material loss removes the financial-guarantee requirement entirely — which is often the difference between a fundable pilot and an abandoned one.
- Staff the remedy window. Fifteen days is the maximum for a subsanación, and it suspends the supervisors’ 30-working-day clock while it runs.
- Plan to the protocol, not to the evaluation. The favourable evaluation has no effect on its own, and the three-month protocol window is where projects lapse.
One point of relief worth knowing if it goes wrong: where the protocol is not signed despite the promoter having complied in time and form, a fresh application for the same project need not re-file documentation already held by the Treasury, beyond updates and any additional information required.
Related: where to base an EMI in the EU · EMI licence in Spain · payment institution licence in Spain · What is SEPBLAC?
