Programme of Operations for the Bank of Spain

The program of operations is the document in which the applicant describes which operations it intends to carry out and how it will organize itself to carry them out. It is a mandatory document in the authorization application for the four types of entity that the Bank of Spain supervises or processes: payment institutions, electronic money institutions, financial credit establishments and banks.

It is worth understanding its real function, because its job is not to sell the project. The program of operations serves three legal functions at the same time, and all three have consequences:

• It defines the scope of the authorization. The authorization allows you to provide the specific services listed in the program, not to provide services in general. Whatever is left out stays out.
• It sets the boundary of the EU passport. Article 10(1) of Royal Decree 736/2019 states it precisely: the authorization “shall be valid in all Member States and shall allow the provision of payment services that are covered by the authorization.” If a service is not in the program, it does not travel.
• It is a stand-alone ground for refusal. When an entity wants to open a branch abroad, the supervisor may refuse “where the program of operations provides for the provision of payment services not authorized to the institution.” The program is checked against the authorization, and any discrepancy comes at a price.

Hence the practical rule that governs all the work: the program of operations is not drafted at the end, once the rest of the application is already in place. It is drafted at the start, because it is the document all the others hang from. If the program says you will provide four services and the business plan projects revenue from a fifth, the application contains an internal contradiction that the supervisor will find.

The comparison in the table above leads to a very common mistake: believing that for payment and electronic money institutions the program of operations is a light document because the provision that requires it is short. The correct reading is the opposite, and it has to do with how the regulation is built.

Under the payments regime, Article 2(1) of Royal Decree 736/2019 lists eighteen documents, from letter (a) to letter (r). The program of operations is only letter (a). Everything that under the EFC and bank regime goes inside the program —administrative and accounting organization, internal control procedures, complaints and claims handling, anti-money laundering bodies— goes outside it under the payments regime, spread across letters (e), (f), (k), (l) and (q). What changes is not the amount of information required: it is where it goes.

This has a very specific practical consequence. In a payment or electronic money institution application, the risk is not that the program falls short: it is that the eighteen documents contradict each other. Each one is often drafted by a different team —the business side writes the program, technology the security policy, compliance the AML manual— and the supervisor reads them together. In an EFC or bank application, by contrast, the risk is concentrated: the program is a long document with five mandatory blocks and, if one is missing, the gap is plain to see.

Two documents deserve a separate mention because they surprise first-time applicants. The first is the prior deposit: both an EFC and a bank must show that they have made a deposit equal to 20% of the minimum capital —with the General Deposit Fund (Caja General de Depósitos), at the disposal of the General Secretariat of the Treasury, for an EFC, and with the Bank of Spain for a bank. It is not a later requirement: it goes in the application.

The second is the customer protection regulations (Reglamento para la defensa del cliente), drawn up under Order ECO/734/2004. For payment and electronic money institutions it is a document expressly required in the application —letter (q)—, not something put together after obtaining the license. It is one of the most frequent omissions in applications prepared by teams that come from the product world rather than the regulatory one.

Under the payments and electronic money regime, the distinction is in the rule itself, in two consecutive letters. Letter (a) is the program of operations: what you are going to do. Letter (b) is the business plan: with what numbers. In that letter (b), Royal Decree 736/2019 requires “a business plan relating to the activities referred to in the preceding letter, including a calculation of the budget forecasts for the first three financial years of the payment institution’s activity, demonstrating that it will be able to use adequate and proportionate systems, resources and procedures to operate properly.”

Note the clause: “relating to the activities referred to in the preceding letter.” The rule is expressly requiring consistency between the two documents. If the program describes three services and the business plan projects revenue from four lines, the application contradicts itself on two consecutive pages. That is exactly the kind of discrepancy that triggers a request for information and, with it, the suspension of the time limit.

The Information Guide for Applicants published by the Bank of Spain is useful here because it describes what it expects to find in each document: for the program, “a report identifying the services intended to be provided and how they fit, where applicable, into any of the legal categories”; for the business plan, “a marketing plan, as well as a business plan covering all the activities the Entity will carry out,” with three-year forecasts under a normal scenario and a stress scenario. The Bank of Spain itself publishes a forecast template in spreadsheet format.

The guide is no accident: Article 2(5) of Royal Decree 736/2019 requires the Bank of Spain to include on its website “a guide for applicants, which will provide detailed information on the procedures, legal requirements and criteria applied in the authorization and registration procedures,” available “in Spanish and in English.” If you are going to file an application, that guide is required reading before you write the first line.

The two middle rows of that table are the ones that catch most projects off guard. A financial credit establishment is not authorized by the Bank of Spain: it is authorized by the Ministry, and the application is filed —in duplicate— with the General Secretariat of the Treasury and International Finance. The Bank of Spain takes part with a mandatory report and, afterwards, with registration in the Special Register of EFCs. Preparing the application on the assumption that you are dealing with the banking supervisor is starting off on the wrong foot.

And the banking authorization is decided by the European Central Bank, as a result of the Single Supervisory Mechanism: the Bank of Spain processes the application and submits the proposal. The official procedure sheet says so plainly: the ECB decides and, in the event of a rejection under national law, the Executive Committee of the Bank of Spain does. That shapes the language, the timetable and the strategy for dealing with the authorities.

A point on time limits worth taking on board: the clock does not start with the filing but with receipt of the complete documentation. The regulations say so —“upon receipt [...] or at the time the required documentation is completed”— and the Bank of Spain’s Guide confirms it: three months “from receipt of the application if complete.” An incomplete application does not use up time: it restarts the clock. That is why a well-built program of operations is not a matter of form but of timing.

There are also five sector templates that the Bank of Spain publishes for payment and electronic money institutions, and they match one to one letters (f), (g), (h), (i) and (j) of Article 2(1): security incidents, sensitive payment data, business continuity, payment and fraud statistics, and security policy. Using those templates saves an entire round of requests for information, because it ensures that each letter of the regulation has its document and that the document answers the question asked.

The pre-application is worth a closer look. The Bank of Spain’s Guide states that “applicants are offered the possibility of holding a meeting before formally filing the application.” That meeting is the best moment to test how the services fit into the legal categories, which is precisely the decision that later shapes the program, the passport and any future extension. Arriving with the program of operations already drafted, even in draft form, completely changes the quality of the conversation.