Requests for information, on-site inspections and findings letters: we prepare you so that every action the supervisor takes finds an orderly firm, with evidence you can locate quickly and consistent answers.
Have you received a request from the CNMV?
Tell us what you have received (a request for information, notice of a visit or a findings letter) and we will set out the next steps.
Before, during and after the supervisory review: six workstreams so that supervision does not turn into sanctioning proceedings.
We review your internal control system through the supervisor’s eyes: compliance and risk functions with real resources, versioned policies and proof that they are applied. The goal is simple: the CNMV should find what it expects to find.
When the findings point to an infringement, the game changes: rights of defense, written submissions and evidence. We design the strategy from the very first filing so that you do not hand the investigating officer facts for free.
Suitability, costs, conflicts and inducements: the area that attracts the most requests for information. We make sure it is applied in practice, not just written down.
The supervisor can ask you for calls and messages that may result in transactions. We set up the archive so you can hand them over on time.
We rehearse the inspection before it happens: sampling of files, interviews and the time it takes to locate evidence.
If the focus is anti-money laundering, the supervisor is different and so is the script. Prepare that front in parallel.
Four situations we often handle: each one calls for a different pace and response strategy.
"We are a small financial advisory firm (EAF) and we have received a request for information on suitability and costs. We do not know whether it is routine or they are looking for something specific, and we do not want to answer blindly."
"The CNMV has announced an on-site inspection. We have weeks, not months: we need to put our files in order, prepare the team and decide who speaks to the inspector."
"We have found errors in confidential returns we have already submitted. We want to correct them in an orderly way before the supervisor cross-checks them and asks why nothing matches."
"They are asking us for information about a transaction and how it was disclosed to the market. Every word of our answer could open or close a market abuse case."
Many sanctioning proceedings do not stem from the original issue but from how the supervisory review that uncovered it was handled.
Improvising your answers: answering a request for information without reconciling it with your previous reporting and your own manuals creates contradictions that the supervisor spots, notes down and asks about again.
Paper policies: the inspection compares what your manual promises with what your team does. A perfect procedure that nobody applies is worse than a modest one that is followed.
Preparing once they are already inside: putting files in order and training the team after the visit has been announced is too late. Useful preparation is done in peacetime, with mock inspections.
| Phase of the review | What happens | How to prepare |
|---|---|---|
| Off-site supervision | Requests for information and analysis of periodic reporting: the supervisor cross-checks your returns, your website and your manuals, looking for inconsistencies. | Reconcile every answer with what you have already reported, appoint a single point of contact and keep a versioned copy of everything you send. |
| On-site inspection | A visit to your offices: interviews with the team, access to systems and sampling of real client files. | Mock inspections beforehand, evidence that can be found in minutes and a team that knows how to answer without speculating or improvising. |
| Findings and follow-up | A letter setting out weaknesses and observations; it may ask for a remediation plan or, where appropriate, lead to sanctioning proceedings. | Calm, technical submissions, a remediation plan with dates and owners, and documented follow-up of every commitment. |
We support you throughout the review: analysis of the request, response strategy, preparation for the visit and, if needed, defense in any subsequent sanctioning proceedings. First consultation free of charge and a reply within 24 h.
Off-site supervision is ongoing: the CNMV analyzes your periodic reporting and your public information, and sends requests for information when something does not add up. An on-site inspection is a one-off, intensive exercise: the inspection team comes to your offices, interviews key people and reviews files and systems.
The first largely determines whether the second follows: inconsistencies detected off-site are the classic trigger for a visit.
In general terms, Law 6/2023 gives the supervisor broad powers of verification and investigation: to require information and documents, take statements, access offices and systems, examine records and recordings, and adopt the supervisory measures provided for in the legislation.
Cooperation is mandatory: obstructing the review is in itself a breach that worsens your position. The right strategy is not to resist but to respond in an orderly and consistent way.
Yes. MiFID II Art. 16(7) requires firms to record orders and communications that may result in transactions, even if they are not executed, and to keep them for 5 years, extendable to up to 7 at the supervisor’s request.
In practice, the CNMV uses recordings to compare what is in the client file with what the client was actually told. Check how your archive is set up in MiFID communications recording.
Three rules: deadline, consistency and control. Always answer within the deadline granted (or request a reasoned extension before it expires), reconcile every figure with your reporting and your manuals, and send the response through a single point of contact after a prior legal review.
What you submit becomes part of the file and binds you: a hasty answer that later needs qualifying is worth two more requests.
It depends on the scope: a one-off request can be closed with a single well-built answer; a thematic review or an on-site inspection can run for months, with several rounds of requests.
What you do control is your part of the timetable: answering on time, with data that does not prompt follow-up questions, shortens reviews considerably.
You will usually receive a letter setting out the findings and weaknesses identified, sometimes with a request for a remediation plan with measures and dates. If the facts are serious, the CNMV may decide to open sanctioning proceedings.
That step changes the rules of the game: rights of defense, evidence and procedural strategy. We discuss it in CNMV sanctions.
With three habits: an evidence repository organized by obligation (suitability, costs, conflicts, records), versioned policies that reflect how you actually operate and regular mock inspections that measure how long it takes you to find any document.
A firm that finds its evidence in minutes conveys control; one that asks for more time for everything invites further digging. Our investment firm internal control and risk management service works on exactly this.
No. The CNMV supervises compliance with securities market rules (Law 6/2023, MiFID II, conduct, organization, prudential); SEPBLAC supervises anti-money laundering. They are separate reviews, with different teams and consequences, although they may take place at the same time.
If your firm is an obliged entity, prepare for both: we explain the second in SEPBLAC inspection.
The method we apply with our clients: prepare in peacetime, control the pace during the review and close it with no loose ends.
Map of obligations, evidence repository and an annual mock inspection. The difference between an uncomfortable visit and sanctioning proceedings is decided months before the supervisor knocks on the door.
A single point of contact, version control of everything you hand over and complete consistency between answers, reporting and manuals. The goal: not to open new fronts with every submission.
Submissions on the findings, a realistic remediation plan and evidence of every improvement. A well-documented close counts in your favor if things escalate.
If you would like us to review your preparation before the supervisor arrives, start with internal control and risk management at your investment firm or an internal audit run as a mock inspection.
The 10 conduct controls the CNMV expects to see working at an EAF or investment firm, with the typical evidence for each one. Ideal as a quarterly self-assessment with your team.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Message us directly:
The terms you will see in the supervisor’s letters and in your answers. Using them precisely avoids costly misunderstandings.
Ongoing analysis of the firm’s reporting, public information and communications, with requests for information when something does not fit.
An in-person review with interviews, access to systems and sampling of real files to compare the manual with practice.
A written request for information or documents, with a deadline. Your answer becomes part of the file and binds you.
Financial and prudential information you submit on a recurring basis. The supervisor cross-checks it against everything else you say.
A document setting out weaknesses and observations after the review; it may require a remediation plan with dates.
Measures, owners and dates to correct what was flagged. Compliance with it is also supervised afterwards.
An internal exercise that reproduces the inspection: surprise requests, interviews and measurement of response times.
The person who centralizes incoming requests, answers and versions of what is handed over. Avoids contradictions between departments.
Business, control functions (compliance and risk) and internal audit: the organizational model the supervisor expects to see working.
How the management body actually works, fitness and propriety of senior managers, and control functions with sufficient resources.
Minutes that reflect real debate, up-to-date fit and proper assessments, and a dedicated budget and reporting for compliance and risk.
Suitability and appropriateness, ex ante and ex post cost disclosure, and conflicts of interest and inducements managed in line with MiFID II.
Complete client files, regular internal sampling, and conflicts and inducements registers with documented decisions.
A complete archive of orders and of communications that may result in transactions, retrievable without delay.
A tested recording system, 5-year retention (extendable to 7 on request) and documented retrieval tests.
Own funds and liquidity in line with IFR/IFD, and confidential returns consistent with actual activity, submitted on time.
Regular reconciliations between accounting, prudential reporting and the program of activities, with independent review.
Balanced marketing communications, consistent with the license and with the client’s contractual documentation.
An internal advertising register, prior compliance sign-off and dated screenshots of the website, campaigns and social media.
If you recognize yourself in any of them, you have work to do before a review arrives on its own.
Every CNMV review is easier to understand in context: the supervisor’s annual priorities, the client complaints that feed its analysis and the specific regimes (market abuse, ongoing obligations) that draw its focus.
The annual plan anticipates where the supervisor will put its resources. Reading it carefully is the cheapest way to prepare.
Repeated complaints are raw material for supervision: patterns that end up in thematic requests for information.
Inside information and market manipulation give rise to particularly sensitive reviews for listed companies and investment firms.
Ongoing compliance after registration is exactly what supervision tests: reporting, policies and training.
If your firm is not yet authorized, start on the right foot: a solid application for CNMV investment firm authorization (or to set up an EAF) is the best vaccine against future reviews. And if the open front is anti-money laundering, see our page on SEPBLAC inspection.
Tell us where the CNMV review of your firm stands and we will organize the response with you: dealings with the supervisor, evidence and timetable.
The CNMV supervises investment firms, fund managers, listed companies and other securities market participants with two tools: off-site supervision (analysis of reporting and requests for information) and the on-site inspection at the firm’s offices. The current framework rests on Law 6/2023 of March 17, which gives the supervisor broad powers of verification and investigation, and is completed by MiFID II and the IFR/IFD prudential regime, which define a large part of the obligations reviewed.
Most of the relationship with the CNMV happens without visits: confidential and prudential returns, notifications, public information and requests for information when something catches its attention. The supervisor cross-checks sources systematically: if your website promises a service that your program of activities does not cover, or your reporting does not match your accounts, the question will come. That is why the first rule of supervision-ready compliance is consistency: reporting, manuals, contracts and marketing communications must tell the same story. The second is to answer requests for information on time, with legal review and without improvising: every answer becomes part of the file.
The in-person review usually combines interviews with directors and key staff, access to systems and sampling of client files: suitability tests, cost disclosures, the conflicts register, orders and recordings of communications (kept for 5 years under MiFID II Art. 16(7), extendable to up to 7 on request). The inspection team compares what the policies say with what people do; the gap between manual and practice is the most frequent finding. A prepared firm manages the visit with a single point of contact, a daily log of what has been handed over and precise answers: acknowledging that a figure will be checked later is always better than speculating in front of the inspector.
Effective preparation comes before any announcement: an evidence repository organized by obligation, versioned policies that reflect how the firm actually operates and regular mock inspections that measure retrieval times and train people for interviews. Our investment firm internal control and risk management work and our internal audits run as mock inspections aim for exactly that: no surprises on the day of the visit, either for the supervisor or for you. The natural complement is to keep an eye on the CNMV’s annual priorities, which anticipate the topics it will review.
The review usually closes with a findings letter setting out weaknesses and observations, which may require a remediation plan with measures and dates. It should be handled with the same rigor as a lawsuit: technical submissions where there are grounds, acceptance with a credible plan where there are not, and documented follow-up of every commitment. If the facts are serious, the review may lead to sanctioning proceedings under the Law 6/2023 regime (we cover this in CNMV sanctions), and what happened during supervision will weigh in those proceedings: one more reason to take care over every submission from day one.
Key legislation, linked to the official text:
Legislation and links reviewed in .