Data reporting services providers (APA, ARM, CTP)

When an investment firm executes a transaction, the market does not find out on its own. Someone has to publish the details of that transaction so that other participants know the price at which it was matched; someone has to report it to the supervisory authority so that it can monitor market abuse; and someone has to consolidate everything the different trading venues publish so that there is a single picture of the European market. Those three functions are what data reporting services providers perform.

The regime was created by MiFID II and MiFIR and responds to a very specific problem: fragmentation. When the same financial instrument trades on a regulated market, on several multilateral trading facilities, on organized trading facilities and through systematic internalizers, price information is no longer in one place. The EU legislator chose to professionalize the function: instead of each entity publishing as best it can, authorized and supervised entities were created whose business is precisely that publication and that reporting.

In Spanish law the regime is set out in Title VI of Law 6/2023 on Securities Markets and Investment Services, Articles 182–186, implemented by Title VII of Royal Decree 813/2023, Articles 146–157. Article 1(3) of the royal decree expressly states that it implements the regime applicable to these providers under Title VI of the law, and Article 2(6) confirms that this title applies to them. But, as we will see, the most decisive part of the regime is not in Spanish law but in Regulation (EU) No 600/2014 and its delegated regulations, because since the 2019 reform the power to authorize and supervise has largely shifted to the European Securities and Markets Authority.

It helps to understand what a data reporting services provider is not. It is not a trading venue: it does not match orders or bring buyers and sellers together. It is not an investment firm merely by being a provider, although many entities authorized as providers are also investment firms through a separate route. And it is not a mere technology vendor: the authorization attaches to the regulated function, not to the software that supports it. If your project consists of selling a tool so that a third party can publish, you probably do not need this authorization; if it consists of publishing yourself on behalf of others, you do.

Three types of operator can provide these services. First, investment firms already authorized to provide investment services that want to add the publication or reporting function: this is the most common case, because the entity already has its data infrastructure and compliance organization in place. Second, operators of trading venues (regulated markets, multilateral trading facilities and organized trading facilities), which are in the best possible position to publish, because the data originates in their own order book. And third, specialized providers whose business is precisely this, with no trading activity of their own.

The practical consequence of that openness is that the regulatory analysis rarely ends with the data provider authorization. If you are going to be both an investment firm and a provider, you have two perimeters to coordinate: that of the securities broker (agencia de valores) or broker-dealer (sociedad de valores), and that of the provider. If you are going to operate an OTF and also be an APA, as happens in the Spanish register, you will have to separate functions and manage conflicts of interest between what you trade and what you publish. That design is the part of the project that consumes the most legal work, and it should be done before writing a single line of the program of operations.

Until 2021, the authorization and supervision of data reporting services providers lay with the national competent authority of each Member State: in Spain, the CNMV. The review of the European System of Financial Supervision changed the starting point. As the preamble to Law 6/2023 itself acknowledges, the authorization and supervision of certain data reporting services providers (other than ARMs and APAs) was transferred to the European Securities and Markets Authority as a result of Directive (EU) 2019/2177.

The resulting rule has two levels and should be stated precisely, because oversimplifying it is the source of almost every mistake:

• The consolidated tape provider (CTP) falls within ESMA’s remit. It is the genuinely pan-European type: it consolidates data from across the internal market, so it would make no sense for a national authority to supervise it.
• APAs and ARMs are, in principle, also supervised by ESMA, unless the derogation criteria set by a delegated regulation are met. If they are, they continue to be authorized and supervised by the national competent authority.

That derogation is not a theoretical oddity. The very title of Delegated Regulation (EU) 2022/466 says so: it is adopted “by specifying the criteria for derogation from the principle that approved publication arrangements and approved reporting mechanisms are supervised by the European Securities and Markets Authority.” In other words, the regulation starts from the premise that EU supervision is the rule and national supervision a narrowly defined exception. For a mid-sized provider with business concentrated in Spain, that exception is exactly where it wants to be, because it means dealing with the CNMV rather than ESMA, and a different fee regime.

The delegated regulation does not just set entry thresholds: it establishes a periodic review mechanism. Derogation status is reassessed annually starting from the year after full authorization, using data from the previous calendar year as the reference. And the change of supervisor is neither immediate nor automatic at the first breach: it happens when the provider fails to meet the criteria for two consecutive years, with effect from June 1.

That design has an obvious strategic implication for any growth project. If the business plan envisages taking on clients in a fourth Member State, or exceeding a half-percentage-point share, you are not planning only a commercial expansion: you are planning a change of supervisory authority, with everything that entails in terms of who you deal with, language of proceedings, fees and timeline. The practical recommendation is simple: monitor the three criteria as one more business indicator, as often as you check revenue, and not as an annual formality. The warning that you are about to cross the threshold should come months in advance, not when you have already failed the second year.

It also pays to have data collection organized. The criteria are measured against the market total (the number of transactions or the volume reported by all APAs, or by all ARMs), figures that the individual provider does not control. Providing that information to the competent authorities when they request it is part of the ordinary obligations, and your information system should be ready to produce it without an ad hoc project each time.

Two useful conclusions can be drawn from the register before deciding anything. The first is that the Spanish data provider market is very small: two active entities and one that deregistered in December 2022. It is not a saturated sector, but nor is it one where demand easily absorbs a new entrant: the natural clients of the service are the investment firms themselves, which already have a provider.

The second is the pattern revealed by the registered entities. The two active ones are, respectively, a company in the market operator’s group and a broker-dealer that is also the operator of an organized trading facility. In other words, the model that has worked in Spain is not the independent provider coming in from outside, but the entity already embedded in the market infrastructure that adds the publication function on data it already handles. If your project does not start from that position, the business plan has to explain very convincingly where the clients will come from.