CIRBE explained — Banco de España’s credit register
CIRBE — the Central de Información de Riesgos del Banco de España — is Spain’s central credit register, and payment institutions and e-money institutions are named in it by law. Not as a footnote: Norma primera of Circular 1/2013 lists them as declaring entities in their own right, alongside banks and specialised lenders, and it catches firms passporting into Spain as well as those established there. It also puts them in a regime most summaries get wrong — the declaración reducida, which is not a concession for small filers but the reporting model for your entity type. This is the full walkthrough: what CIRBE records, exactly who files, what the €1,000 rule means, what a lender sees, and how to obtain and correct your own report.
1. What CIRBE is — and what it is not
CIRBE records the credit exposures of lenders operating in Spain: loans, credit lines, guarantees given, leasing, factoring and similar risks. Aggregated by debtor, it shows a person’s or company’s borrowing position across the Spanish financial system.
The register serves two purposes, and that distinction drives almost every threshold in the circular: a supervisory one, letting Banco de España use the data in supervision and inspection, and a commercial one, giving declaring entities what they need to assess borrowers. Some data is collected for the first purpose only and never reaches a lender.
2. The legal stack, and which version is in force
Ley 44/2002 sets the basic criteria — what must be declared, how it may be used, and the rights of access, rectification and cancellation. It was developed by Orden ECO/697/2004 of 11 March, and the operating rules sit in Circular 1/2013 of 24 May, which replaced the 1995 circular.
Circular 1/2013 has been amended repeatedly, and the consolidated text in force reflects the amendment published on 25 March 2023, effective 1 July 2023. If your procedure cites the 2013 original it is several thresholds out of date — the return threshold below was originally set higher and has since been lowered.
3. Who reports — and the two lines that catch payment firms
Norma primera lists the declaring entities. Two of them are the reason this page belongs on a payments site:
| Letter | Entity | Condition |
|---|---|---|
| a) | Credit institutions — the ICO, banks, savings banks, credit cooperatives | Including Spanish branches of foreign credit institutions and those operating in Spain under freedom of services |
| b) | Specialised lending establishments (EFC) | — |
| c) | Payment institutions, including those operating in Spain under freedom of establishment and freedom of services | Only those carrying on the credit activity in Article 20.3 of Real Decreto-ley 19/2018 |
| d) | E-money institutions, including those operating under freedom of establishment and freedom of services | Only those carrying on the credit activity in Article 8.1(b) of Ley 21/2011 |
| e)–i) | Mutual guarantee and counter-guarantee companies, Sareb, Banco de España, the deposit guarantee fund, Saeca | — |
| j) | Real-estate lenders under Ley 5/2019 | Where not already in an earlier category |
The trigger is not “are you a bank” but “has your licence-permitted lending activity switched on”. A payment institution or EMI granting no credit is outside the list; the moment it grants credit under the provision named for its licence type, it is a declaring entity with a monthly filing obligation.
4. Reduced declaration is not a small-filer concession
This is the point most often stated incorrectly. Circular 1/2013 defines entities subject to reduced declaration by category, not by size: freedom-of-services credit institutions (letter a), payment institutions (letter c), e-money institutions (letter d) and real-estate lenders (letter j). Every payment institution and EMI in scope is therefore a reduced-declaration entity whatever its volume — no threshold to cross, no election to make.
Mechanically that means Norma decimotercera and módulo I, Datos dinámicos sobre la actividad de las entidades sujetas a declaración reducida — filed instead of the full modular set the banks file, with the general rules on splitting operations across joint holders disapplied in favour of the module I criteria. Reduced-declaration entities also do not declare indirect-risk holders acting as counterparty to a purchased credit derivative, as guarantor without the holder’s knowledge, or as a third party committed to pay in a leasing operation.
5. What passporting changes
The circular draws a scoping line between the two passporting modes:
- Spanish branches of foreign credit institutions, and payment institutions and EMIs operating in Spain under freedom of establishment, declare only the business of their offices in Spain;
- credit institutions, payment institutions and EMIs operating under freedom of services declare only business carried out with residents in Spain.
The second limb surprises people. A lender with no Spanish establishment at all, serving Spanish residents cross-border, is a declaring entity for that book — customer residency is the filter, and it has to be a maintained attribute rather than one inferred at report time.
6. What is recorded, per exposure
- Holder identification — tax number, sector and connected persons. Holders can be natural or legal persons, and also entities without legal personality holding a tax identification code, such as securitisation funds
- Direct risks — the borrower, debt issuer, person guaranteed, counterparty to other commitments; and indirect risks — guarantors, protection sellers in synthetic securitisations, insurers and others answering for the risk if the direct holder defaults
- Exposure type, amount, currency and maturity; collateral and guarantees attached
- Default status, and for legal-person borrowers probability-of-default data in a dedicated prudential module
Who counts as the direct holder is defined operation by operation: in commercial credit with recourse it is the assignor of the receivables; without recourse it is the parties obliged to pay them; in finance leases it is the lessee, for the amounts committed. Getting this mapping wrong is the commonest cause of a rejected first submission.
7. The €1,000 rule, stated precisely
The €1,000 figure is not a “don’t report below this” rule but a disclosure threshold, and the circular puts it both ways round:
- data on holders whose accumulated risk in the declaring entity is below €1,000 is declared exclusively for the purpose in Article 60(4)(a) of Ley 44/2002 — supervisory use. It is still declared; it simply never travels to another lender;
- the monthly return to each declaring entity carries system-wide consolidated information for holders with an accumulated risk equal to or greater than €1,000 at month end.
Two refinements sit inside the calculation. Amounts are returned in thousands of euro, rounded upward at the midpoint; and in building the reports, guarantees given to other declaring entities are excluded and a guarantee given jointly by several is counted once — so the figure reflects the credit risk the system actually carries, not the sum of the paperwork.
8. What a lender actually sees — worked example 1
Facts: an SME applies to a Spanish EMI for a €40,000 working-capital line. The EMI, as a declaring entity, requests the applicant’s CIRBE position.
What comes back: aggregate exposures grouped by product type and maturity, with the declaring entities not identified and the nature in which the holder intervenes shown. Because this is a potential customer, the circular provides two reports — the last closed monthly declaration and the one closed six months earlier.
What the analyst does: reconciles the totals against the debt the applicant declared, then reads the two dates against each other. A static position is a different credit story from one that grew by half in six months on the same declared turnover — a trend visible only because the second report exists. The pull, the comparison and the rationale all go in the credit file.
9. When a fintech falls into scope — worked example 2
Facts: a Spanish-licensed EMI that has never reported to CIRBE launches a “pay in 3” instalment feature. Each split purchase creates a short-term credit exposure to the customer.
What the rule says: if the feature is the credit activity permitted under Article 8.1(b) of Ley 21/2011, the EMI is now within letter (d) of Norma primera and is a declaring entity — and, being an EMI, a reduced-declaration entity filing módulo I.
What the practitioner does: maps the instalment book to the CIRBE risk categories, confirms the direct risk holder for each product variant, joins the monthly cycle, and builds the exposure data model once so it also serves AnaCredit where that applies. The clean pattern is a launch-checklist item — “does this create a credit exposure?” — because product teams rarely flag that a checkout feature moves the reporting perimeter.
10. Your own report, and the six-month disclosure right — worked example 3
The right of access can be exercised electronically through Banco de España’s Oficina Virtual, where the only indispensable requirement is a digital signature Banco de España accepts, or in person before the CIR or any Banco de España branch, or by signed written request.
What comes back is two risk reports: the first carries the same information given to declaring entities at the end of each monthly process; the second breaks it down operation by operation, naming the declaring entity and expressing amounts in units of euro rather than thousands. There is also a rarely used right worth knowing — natural persons may request the name and address of the recipients to whom the CIR communicated their data in the last six months, with the information passed in each case.
Facts: a founder preparing a mortgage application requests her report and finds a €25,000 credit line shown as drawn — a line she cancelled a year ago.
What the practitioner does: she uses the operation-level report to identify which entity declared it and raises the rectification with that entity directly or through Banco de España, which channels the claim. A confirmed error is corrected and flows through the next monthly cycle — which is why you check before a lender does.
11. CIRBE and AnaCredit — one national source, two outputs
Spain implemented AnaCredit as an evolution of CIRBE rather than a parallel pipeline: entities file into the national collection and Banco de España derives the ECB dataset from it. One data model serves both — but CIRBE data quality is AnaCredit data quality, and the data-quality follow-up returns down the same pipe. The two use different thresholds, so neither tells you your obligation under the other.
FAQ
Are EMIs and payment institutions really in CIRBE?
Yes — they are named in Norma primera of Circular 1/2013 at letters (c) and (d), but only where they carry on the credit activity referred to for their licence type: Article 20.3 of Real Decreto-ley 19/2018 for payment institutions, Article 8.1(b) of Ley 21/2011 for EMIs. A firm granting no credit is outside the list.
Does passporting into Spain without a branch avoid CIRBE?
No. Entities operating under freedom of services are expressly included, and they declare the business carried out with residents in Spain. Freedom-of-establishment operations declare the business of their Spanish offices.
Is the declaración reducida a concession for small filers?
No — it is defined by entity category, not by size. Payment institutions, EMIs, freedom-of-services credit institutions and real-estate lenders are reduced-declaration entities and file módulo I under Norma decimotercera regardless of volume.
What is the €1,000 threshold exactly?
It governs disclosure, not collection. Holders whose accumulated risk in the declaring entity is below €1,000 are declared solely for Banco de España’s supervisory purpose under Article 60(4)(a) of Ley 44/2002; the monthly return to lenders carries consolidated data for holders at or above €1,000.
What to do, today
- Product and legal, jointly: test any new credit feature against Article 20.3 of Real Decreto-ley 19/2018 or Article 8.1(b) of Ley 21/2011 before launch — that test, not your balance sheet, decides whether CIRBE starts.
- Reporting teams: if you are a payment institution or EMI, build for módulo I under the reduced-declaration regime — not the full bank modular set — and confirm the direct-risk-holder mapping per product before the first submission.
- Cross-border lenders: if you serve Spanish residents under freedom of services, carry customer residency as a maintained attribute, not a derived one.
- Credit teams: request both reports on potential customers and read the six-month trend, not just the latest position.
- Anyone with a Spanish credit footprint: pull your own two reports through the Oficina Virtual before any significant application and correct errors through the entity named in the operation-level report.
Related: AnaCredit phases 1, 2 and 3 · AnaCredit for payment firms · FINREP for Spanish PIs and EMIs · What is EDITRAN? · EMI licence in Spain · Modelo 196 is monthly now · Centrale dei Rischi — the Italian credit register · FICP — the French credit-incident register · Central Credit Register — Ireland · Orden ECM/531/2026 and the CIR threshold · Belgium — the Centrale des Crédits aux Particuliers
