Crowdfunding License in Spain: CNMV Authorization for Crowdlending Platforms

Crowdlending (lending-based crowdfunding, or peer-to-peer lending) is a financing model in which a digital platform connects project owners who need funding with investors who lend money in exchange for an agreed return. The CNMV is the competent authority in Spain to authorize and supervise the crowdfunding service providers (CSPs) that run crowdlending platforms.

Since November 2021, the applicable framework has been Regulation (EU) 2020/1503 (the European Crowdfunding Service Providers Regulation, or ECSP), which harmonizes the rules for lending-based and investment-based crowdfunding platforms across the European Union.

If you want to run a crowdlending platform in Spain, you need CNMV authorization as a CSP, which is, in practice, your crowdlending license in Spain. Without it, the activity is unlawful.

The ECSP Regulation (Regulation (EU) 2020/1503) is the EU law that governs crowdfunding platforms, including crowdlending. It sets a harmonized framework with common requirements for all Member States: authorization, prudential requirements, corporate governance, investor protection and the EU passport.

For crowdlending platforms, the ECSP Regulation requires authorization as a CSP, compliance with capital requirements, management of conflicts of interest, business continuity plans, a key investment information sheet (KIIS) for investors and entry knowledge tests.

The ECSP Regulation has replaced the previous national rules (in Spain, the former national regime for crowdfunding platforms, or PFP, under Law 5/2015 on the promotion of business financing). All platforms must now operate under the EU regime.

The application for authorization as a CSP is filed with the CNMV following the procedure set out in the ECSP Regulation and ESMA's regulatory technical standards (RTS).

Main requirements:

• Detailed business plan: operating model, target segments, financial projections and risk analysis.
• Prudential requirements: own funds, professional indemnity insurance or a combination of both, equal to the higher of €25,000 or one quarter of the previous year's fixed overheads.
• Corporate governance: organizational structure, fit and proper management (suitability and good repute), key functions.
• Policies on risk management, conflicts of interest, business continuity and outsourcing.

The CNMV has three months from receipt of a complete application to decide. Careful preparation of the application file cuts timelines and reduces information requests.

Crowdlending platforms are obliged entities for anti-money laundering purposes and must comply with Law 10/2010 and its implementing regulation (Royal Decree 304/2014). This means a full AML/CFT framework that applies both to investors and to project owners seeking funding.

Key obligations:

• Full KYC on investors and project owners: identification, verification, beneficial ownership and source of funds.
• Risk assessment and customer classification by risk level (high, medium, low).
• Monitoring of fund flows: consistency between the amounts invested or received and the declared profile.
• Screening against sanctions lists and PEPs (politically exposed persons), with ongoing due diligence.

SEPBLAC can inspect crowdlending platforms at any time. Your evidence of compliance must be up to date and readily available.

The ECSP Regulation imposes strict investor protection obligations that crowdlending platforms must meet: transparency, assessment of investor knowledge and exposure limits.

Protection measures:

• KIIS (Key Investment Information Sheet): a key information document for each project, covering risks, expected return and loan terms.
• Entry knowledge test: an assessment of the investor's knowledge and experience before they are allowed to invest.
• Reflection period: non-sophisticated investors have a 4-day reflection period during which they can revoke their offer.
• Investment limits: mechanisms to warn non-sophisticated investors when an investment exceeds risk thresholds.

Breaching investor protection obligations is among the most serious infringements and can lead to the withdrawal of the authorization.

One of the advantages of the ECSP Regulation is that crowdlending platforms authorized in one Member State can operate across the EU through a passporting regime (notification to the host-country authorities).

To passport, you notify the CNMV of your intention to operate in other countries, stating the services you will provide and the languages you will use to communicate with investors and project owners. The CNMV then forwards the notification to the host-country authority.

The EU passport lets you scale the business without obtaining an authorization in each country, but you must meet the ECSP requirements in every host jurisdiction.

The cost depends on the complexity of the business model, the volume of documentation to prepare, the applicable prudential requirements and the platform's existing level of compliance.

Costs fall into two blocks: initial authorization (preparing the application, regulatory documentation, business plan, policies and procedures) and ongoing compliance (periodic reporting to the CNMV, AML/CFT framework, audits, policy updates and training).

The cost of not obtaining authorization (operating unlawfully, CNMV sanctions, criminal liability, loss of investors) is far higher than the cost of complying with the rules.