The CNMV’s annual plan is the cheapest document to read and the most expensive to ignore: it anticipates where the supervisor will put its resources. We walk you through the 2026 focus areas (digital advertising, crypto, ESG and retail investors) and how to turn them into an internal gap analysis.
Is your firm where the CNMV will be looking?
Tell us what you do and we will tell you which supervisory priorities hit you directly and where to start.
Six fronts where we turn the CNMV plan into concrete tasks, with owners, deadlines and evidence.
The plan’s priorities turn into thematic requests for information, reviews and on-site visits. We prepare your firm for that moment: organized evidence, reconciled reporting and a team trained to respond without improvising.
In June 2026 the CNMV published guidance on and for finfluencers. If you win clients through social media or content creators, this is the front to review first: contracts, content and a register of materials.
Circulars 2/2020 and 1/2022: balanced messages, an internal register and prior review. The natural complement to the digital focus.
Regulation (EU) 2024/3005 applies from July 2, 2026. If you use or issue ESG ratings, review your position.
With Spain’s transitional period for VASPs closed on December 30, 2025, supervision is concentrating on CASPs and license perimeters.
Costs, suitability and product value for retail clients: the European agenda (RIS) is pushing in the same direction.
Four different firms, one question: which part of the supervisor’s priorities applies to me, and what do I do about it?
“We thought the CNMV plan was for the big players. Then a thematic request for information on costs and suitability arrived, identical to the one received by firms ten times our size.”
“We sell ESG-labeled funds and use external ratings. Between the supervisory focus on greenwashing and the new ratings regulation, we need to get our evidence in order now.”
“We got our authorization, but the work didn’t end there: now the supervisor is looking at advertising, custody and our service perimeter. We want to get there before its checklist does.”
“We are growing through social media campaigns and content creators. With the finfluencer guidance now published, either we professionalize that channel or we become the example in the next report.”
The plan is free information about the exam ahead. Even so, the same three mistakes are made every year when reading it.
Filing it away as a press release: the plan describes where the supervisor will allocate resources during the year. Reading it without deriving tasks is like knowing the exam questions and not studying them.
Waiting for the request for information: when the letter arrives, the margin is gone, and you will have to answer in weeks what could have been prepared over months. The plan’s advantage is its timing; it is lost if you do not use it.
Thinking it does not apply to you: cross-cutting priorities (advertising, conduct toward retail clients, sustainability) reach firms of all sizes. Size is no exemption; sometimes it puts you squarely in the sights.
| Focus area | What it involves | How to get ahead |
|---|---|---|
| Digital advertising and finfluencers | With the CNMV’s June 2026 finfluencer guidance, paid content on social media comes under scrutiny: advertising, investment recommendations and advice are analyzed piece by piece. | Review your advertising workflow (Circular 2/2020), your contracts with creators and your internal register of materials before the next campaign. |
| Crypto-assets and MiCA | With Spain’s transitional period for VASPs over on December 30, 2025, attention is shifting to CASPs: service perimeter, ongoing obligations and crypto advertising (Circular 1/2022). | Check that every service you provide fits within your authorization, including the notification investment firms file for equivalent services, and put your marketing communications in order. |
| Sustainability and ESG | Sustainability preferences built into suitability (2023 ESMA guidelines) and Regulation (EU) 2024/3005 on ESG ratings, applicable from July 2, 2026, raise the standard of proof. | Document how you collect ESG preferences, back every green claim with evidence and review how your providers or your rating activity fit in. |
We carry out the gap analysis with you: we cross-check the CNMV’s priorities against your actual business, score the gaps by risk and leave you with a defensible remediation timeline. First consultation free of charge and a reply within 24 h.
It is the document in which the CNMV announces, each year, its objectives and lines of action: which areas it will review most intensively, which thematic analyses it will launch and which regulatory developments it will push forward.
It is not a rule and does not create new obligations: it is a statement of priorities. That is precisely why it is so valuable: it tells you where the focus will be before the focus finds you.
Because supervisory resources follow the plan: the year’s thematic requests for information, horizontal reviews and a good share of its inspections stem from its focus areas.
Reading it well means knowing months in advance what evidence you will be asked for. Few competitive advantages come this cheap.
Yes. Cross-cutting priorities (conduct rules toward retail clients, advertising, sustainability) are reviewed at firms of all sizes, and horizontal reviews usually include samples of small and medium-sized firms.
For an EAF, moreover, a thematic request for information is a proportionally heavier burden: fewer hands to prepare the same response. The smaller you are, the more it pays to get ahead.
It is one of the most visible lines right now: in June 2026 the CNMV published guidance on and for finfluencers, setting out when content is a marketing communication, when it is an investment recommendation under MAR Art. 20 and when it is advice reserved to authorized firms.
For firms, the message is clear: paid content on social media is your own advertising and must go through the Circular 2/2020 workflow.
Spain’s transitional period for VASPs ended on December 30, 2025, so the ecosystem now operates under the MiCA framework. Supervisory attention is concentrated on authorized CASPs (service perimeter, ongoing obligations) and on crypto advertising under Circular 1/2022.
Remember too that investment firms can provide crypto-asset services equivalent to those covered by their MiFID license by filing a notification: if you provide them without it, you have a gap to close.
Two fronts coexist: integrating the client’s sustainability preferences into the suitability assessment (ESMA guidelines updated in 2023) and scrutiny of greenwashing in products and disclosures. On top of that comes Regulation (EU) 2024/3005 on ESG ratings, applicable from July 2, 2026, with authorization or registration with ESMA and transparent methodologies.
The practical rule: every sustainability claim, with its evidence behind it.
With a four-step method: filter the priorities that affect your business, compare each one against your policies and, above all, against your actual evidence, score the gaps by likelihood of review and impact, and plan remediation with owners and dates.
The result must reach the board of directors: if a thematic request for information arrives tomorrow, the answer will already be half written.
Yes: each year brings its own plan, although the main lines (retail protection, digitalization, sustainability) show remarkable continuity. That is why the useful exercise is not reading a plan but building a routine: an annual review of the document, an update of the gap analysis and follow-up on commitments.
If you want us to do it with you, that is exactly our ongoing support service: start with investment firm internal control and risk.
The process we follow with supervised firms to turn an institutional document into internal decisions with a date and an owner.
Cross-check the plan’s lines against your activity map: which priorities hit you squarely, which only touch you in passing and which do not apply. Out of ten lines, perhaps four are yours: that is where the effort goes.
For each of your priorities, the uncomfortable question: if the request for information arrived tomorrow, what could you show today? Not what your policy says, but what your records, minutes and files prove.
Gaps scored by risk, measures with an owner and a date, approval by the board of directors and quarterly follow-up. The following year, it is updated: it is a routine, not a project.
If you prefer us to lead the exercise, we combine this method with preparation for CNMV inspections and the internal control of your investment firm.
The activity plan has its own language. These nine terms let you translate each institutional line into operational consequences.
The publication in which the CNMV announces its objectives and lines of action for the year. It does not create obligations; it announces reviews.
An area the supervisor declares relevant and to which it will allocate teams and actions during the year.
Simultaneous analysis of the same practice across a group of firms to detect patterns of non-compliance.
A request for information centered on one focus area (costs, advertising, ESG) sent to several firms at once.
An internal exercise that compares what the supervisor would require with what your evidence can prove today.
A financial content creator. The CNMV’s June 2026 guidance draws the lines between advertising, recommendations and advice.
Presenting as sustainable what cannot be proven: the conduct risk at the center of ESG scrutiny.
Retail Investment Strategy: a 2023 proposal, still under negotiation, on value for money, inducements and best interest.
A comparison between the services you provide and those your CASP authorization (or your notification as an investment firm) actually covers.
How you ensure that paid content on social media complies with Circular 2/2020 and the June 2026 guidance.
A prior review workflow, contracts with creators that set out regulatory obligations, and an internal register of materials and withdrawals.
Exactly which crypto services you provide and under which authorization or notification.
An up-to-date service-to-license map, notification of equivalent services if you are an investment firm, and crypto advertising files.
How you collect sustainability preferences and what backs each ESG claim about your products.
Suitability tests with a sustainability module, documentary support for green labels and analysis of your ESG ratings.
What value the client receives for what they pay and how you prove it, product by product.
Reconciled ex-ante and ex-post cost disclosures, product governance with a target market and documented periodic reviews.
Whether your control functions have real resources and your operations match your program of activities.
Compliance and risk budget and reporting, an up-to-date program of activities and minutes proving effective oversight by the board.
We have heard each of these phrases weeks before a request for information. We hope not to hear them from you.
The annual plan does not stand alone: it rests on a European regulatory agenda that is taking shape. These four pieces explain much of the Spanish supervisor’s present and future priorities.
Value for money, inducements and best interest: the reform that will reshape the relationship with retail clients.
From July 2, 2026: ESMA authorization, separation of activities and transparent methodologies.
The European crypto-asset framework, with Spain’s VASP transitional period now closed, defines the new crypto perimeter.
Digital operational resilience, applicable since January 2025: ICT providers, incidents and contractual clauses.
To put all this into practice at your firm, combine reading the plan with our preparation for CNMV inspections, a review of your financial product advertising and monitoring of finfluencers, SFDR and AI in financial advice.
Tell us which services you provide and what controls you have, and we will propose a gap analysis based on this year’s supervisory priorities.
Each year, the CNMV publishes its activity plan: the document in which it announces its objectives, lines of action and priority review areas. It is not a rule and does not create obligations, but it shapes the year of every supervised firm: its lines give rise to thematic requests for information, horizontal reviews and a good share of inspections. In 2026, the priorities revolve around four recognizable pillars, digital advertising and finfluencers, crypto-assets, sustainability and retail investor protection, which also show remarkable continuity with previous years: if you prepare well today, the effort will pay off for several years.
Client acquisition has moved to social media, and supervision has followed. The recent milestone is twofold: the consolidation of the general advertising regime (Circular 2/2020, with its requirement for balanced messages, an internal register and prior review) and the guidance on and for finfluencers published by the CNMV in June 2026, which sets out when content is a marketing communication, when it is an investment recommendation subject to Art. 20 of the MAR Regulation and when it is advice reserved to authorized firms. For firms, the practical consequence is direct: content paid to creators is their own advertising, with contracts, prior review and a register. For creators, the era of apparent regulatory vacuum is over.
On the crypto front, the end of Spain’s transitional period for VASPs on December 30, 2025 completed the transition to MiCA: supervisory attention is now shifting to the real perimeter of CASPs, to the notification that allows investment firms to provide crypto services equivalent to their MiFID license, and to advertising under Circular 1/2022. In sustainability, the integration of ESG preferences into suitability (2023 ESMA guidelines) converges with greenwashing scrutiny and with Regulation (EU) 2024/3005 on ESG ratings, applicable from July 2, 2026. The common denominator of both blocks: verifiable claims and well-drawn perimeters.
Beneath the thematic focus areas, the structural agenda remains: supervision of the organization and conduct rules of investment firms (control functions with real resources, up-to-date programs of activities, well-documented costs and suitability) and retail investor protection, reinforced by the direction set by the European Retail Investment Strategy, still under negotiation. The underlying question the supervisor will bring to every review is uncomfortable and healthy at the same time: what value does the client receive for what they pay, and how do you prove it? Firms that can answer it with evidence have little to fear from any plan.
The activity plan ages quickly; the method for making use of it does not. Our advice is to institutionalize an annual routine: read the plan with your activity map in front of you, filter your own priorities, compare them against the actual evidence available (not the written policies), score the gaps by risk and have the board approve a remediation plan with dates. Besides reducing the likelihood of findings, this exercise leaves the response to any thematic request for information half prepared and demonstrates good governance in any CNMV inspection. Every year the supervisor publishes where it is going to look; the decision to get there first is yours.
Key legislation, linked to the official text:
Legislation and links reviewed in .