Registration with the CNMV does not end the project: it starts it. From that day on, your EAF is accountable for periodic reporting, audit, FOGAIN, fees and team training, and for keeping its MiFID II and AML/CFT policies alive. We put your calendar and your evidence in order.
Is your EAF up to date on everything? Free compliance review
Tell us when you were authorized and what you have up to date: we send you back a map of gaps and priorities, with no commitment.
Six areas account for almost all the recurring work of an authorized EAF. In each one, we can act as your external team or as reinforcement for your own.
Suitability, conflicts of interest, inducements, ex ante and ex post cost disclosure: we check that each policy works in real operations and leaves the paper trail the CNMV expects to find when it asks.
Your EAF is an obliged entity: an up-to-date manual, due diligence applied, an active control body and recorded training. We keep the system proportionate to risk and ready for any review.
Current membership, annual contributions paid and accurate information to clients on what is covered and what is not.
Every relevant change in the business (services, clients, resources) must be reflected and filed before it is carried out.
Anyone who provides information or advice needs accredited knowledge and competence, with certifications and recorded ongoing training.
If you are still in the authorization phase, start with the complete guide to the application and come back here on the day you are registered.
Four typical moments in the life of an authorized EAF. If you recognize yourself in any of them, this is exactly the work we do.
“We celebrated the registration and a week later we asked ourselves: what do we have to send to the CNMV, when, and who prepares it? Nobody hands you the compliance calendar along with the authorization.”
“We advise well, but there are only three of us. The returns to submit, the policy reviews and the accredited training eat up our time: we need someone external to put it on a system.”
“We started with fund portfolios and now we also advise on other products for a different type of client. The program of activities still describes the company we were three years ago, and that is a problem.”
“They asked us to prove our team’s training and our policy reviews. Everything had been done... but almost nothing was documented as evidence. We learned the lesson the hard way.”
Problems at supervised EAFs rarely come from bad faith: they come from routines that keep getting postponed. These three patterns explain most of the scares.
Complying “in bursts”: concentrating the effort when a request for information arrives and neglecting the rest of the year turns the logic of the system upside down. Supervision rewards consistency: timely returns, dated reviews and assigned owners.
Policies without evidence: having a suitability, conflicts or AML manual proves nothing if there are no records of how it is applied. Before the supervisor, what is not documented is, for practical purposes, what was not done.
A frozen program of activities: launching services, products or segments that the program does not cover leaves the firm operating outside its own authorized framework, with consequences that can escalate depending on the case.
| Frequency | Typical obligations | Operational key |
|---|---|---|
| Periodic | IFR/IFD prudential reporting and information returns to the CNMV; continuous monitoring of suitability, conflicts and inducements in every recommendation. | An internal calendar with owners and deadlines earlier than the official ones: the margin absorbs the unexpected. |
| Annual | Statutory audit, FOGAIN contributions, supervisory fees, ex post costs and charges information, staff training and policy review. | Group them in an annual compliance plan approved by the management body, with evidence filed by financial year. |
| Event-driven | Amendment of the program of activities, changes of directors or senior managers (fit and proper), changes in qualifying holdings, significant incidents. | Golden rule: file first, implement later. The change notified late is the one that demands the most explanations. |
We build your EAF’s annual compliance plan (reporting, audit, FOGAIN, training, MiFID II and AML/CFT reviews), run it with you month by month and leave every obligation backed by its evidence. You advise; we keep the license in good standing.
Two main blocks. The first is prudential reporting under the IFR/IFD regime: information on own funds and the requirements that apply according to the firm’s class (EAFs are usually Class 3, with a simplified regime). The second is the periodic activity and financial information that the rules require from supervised entities, in the formats and deadlines set in each case.
Our recommendation: keep an internal submission calendar with an owner, a target date and an archive of acknowledgments of receipt. The details of the prudential framework are in IFR/IFD.
Yes: the statutory audit is part of the package of obligations of authorized entities, and its result matters both to the Commercial Registry and to the supervisor. It is advisable to choose an auditor familiar with regulated entities and to plan the work with time to spare, because the audited accounts feed other parts of compliance (reporting, own funds, fees).
A practical tip: use the audit to also review the consistency between the accounts and the prudential requirements, and document that review.
EAFs, and EAFNs too, must be members of FOGAIN since Law 6/2023 and pay its annual contributions, calculated under the criteria of the fund’s rules and, as a general rule, based on the firm’s activity. On top of that come the CNMV’s supervisory fees, accrued under the terms of the rules that govern them.
We cannot give you a universal figure because it depends on each firm and financial year; what you should do is budget for both items every year and keep the payment receipts as evidence.
Whenever the actual business no longer matches the one described: new services or instruments, another type of client, significant changes in organization or resources, new delivery channels. The update is filed with the CNMV before the change is implemented, not after.
A governance habit that works: in every committee that approves something new, ask “does this fit within our program?”. If the answer is no or maybe, go through the program of activities before launching.
People who provide information or advice on financial instruments must demonstrate knowledge and competence in line with the ESMA guidelines; in Spain, the CNMV publishes the list of qualifications and certificates it considers verified. On top of that comes ongoing training, which must be delivered and recorded.
The usual mistake is not a lack of qualifications but a lack of records: certificates not filed, training hours not recorded, new staff advising before completing their accreditation. We cover this in MiFID II staff certifications.
Policies are not approved once: they are maintained. In an EAF’s day-to-day practice, this means, among other things, periodically reviewing the policy and the suitability tests (the ESMA guidelines, updated in 2023, incorporate sustainability preferences), the conflicts of interest register, the inducements regime and cost disclosure, which requires ex ante communication and an annual ex post aggregate per client.
Each review must be dated, with conclusions and, where appropriate, with the new version of the document approved by whoever is responsible.
MiFID II Art. 16(7) requires firms to record communications that may result in transactions, even if they are not ultimately executed, and to keep them for 5 years, extendable to 7 at the request of the authority. For an EAF, this covers the channels through which it deals with clients in the course of its service.
The operational key is twofold: define which channels are allowed (and block the rest) and periodically check that recording and archiving work. We go into more detail in recording of MiFID communications.
As a financial institution, an EAF is an obliged entity under anti-money laundering legislation: a manual tailored to its real risk, customer due diligence, detection and reporting of suspicious transactions, an operational internal control body, staff training and independent reviews of the system on the terms of the applicable rules.
The standard is not having paperwork but being able to prove that the system works: complete KYC files, minutes of the control body and recorded training. The whole topic is covered in anti-money laundering and AML manual.
A small EAF does not need a department: it needs a system. Three building blocks and a ten-step annual cycle that fit into any organization.
All the year’s submissions, payments, reviews and renewals in a single calendar, with a named owner and an internal date earlier than the official one. If it is not in the calendar, it does not exist.
Every obligation met generates its proof: acknowledgment of submission, payment receipt, review minutes, training certificate. Filed by year and by area, ready to answer any request for information within hours.
A short list of events that require action (a change of service, role or partner, a serious incident) linked to whoever handles the filings. That way, business changes never get ahead of their notifications.
We can run this cycle with you as outsourced compliance: see our MiFID II compliance and anti-money laundering services, or the full package in financial compliance.
The 10 steps to set up your financial advisory firm (EAF) with the CNMV, with the evidence you must be able to show at each one. To keep at hand throughout the project.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
Nine concepts that shape your EAF’s relationship with the CNMV, FOGAIN and your own clients once you have the license.
Information on own funds and applicable requirements that the investment firm submits to the CNMV according to its prudential class. EAFs are usually Class 3.
External review of the firm’s financial statements, linked in practice to own funds, fees and reporting.
Annual contributions to the Investment Guarantee Fund, membership of which has been mandatory for EAFs and EAFNs since Law 6/2023.
Levies accrued for the CNMV’s supervisory activity, under the terms of the rules that govern them.
Filing with the CNMV when the EAF changes its services, clients, organization or resources compared with what was authorized.
Standard set by the ESMA guidelines for staff who provide information or advice; the CNMV publishes the list of verified qualifications.
Aggregated annual information on costs and charges, with an itemized breakdown on request and the cumulative effect on return.
Recording of communications that may result in transactions (MiFID II Art. 16(7)), kept for 5 years, extendable to 7.
The EAF is responsible for its anti-money laundering system: due diligence, suspicious transaction reporting, control body and training.
Complete and timely submissions, consistent with each other and with the accounts, with no gaps caused by changes in staff or systems.
Submission calendar carried out, acknowledgments filed and reconciliation between returns and accounts.
Own funds above the requirement at all times, with internal monitoring and the ability to anticipate pressure points.
Documented periodic calculations, audited accounts and minutes in which the management body reviews them.
Complete and up-to-date suitability tests, costs disclosed ex ante and ex post, conflicts identified and managed in every recommendation.
Traceable client files, suitability and conflicts records, and samples of cost communications.
Everyone who provides information or advice accredited from day one, with ongoing training planned and delivered.
A qualifications matrix per person, valid certificates and a record of training hours per financial year.
A risk-proportionate system that genuinely operates: customers identified, alerts handled, control body active.
Complete KYC files, minutes of the internal control body and documented independent reviews.
None of these signs is a crisis on its own; together, they sketch the profile of the EAF that comes off badly in a review.
Ongoing compliance is also the best preparation for supervision: an EAF that keeps its obligations up to date gets through requests for information and inspections without drama. These pages show you the other side of the board.
How a supervisory action unfolds, what documentation is requested and how to prepare in good time.
Minor, serious and very serious infringements and their consequences: fines, public reprimand, revocation and disqualification.
Internal control functions proportionate to the size of the firm: what the supervisor requires from a small structure.
What you can delegate (and what you cannot), under which contracts, and what responsibility you retain when you outsource compliance or systems.
And if the root of it all is that you do not have the license yet, start with how to set up an EAF or with EAF authorization; the other vehicles are covered in investment firm authorization, and the move up from the national vehicle in converting an EAFN into an EAF.
Tell us how you currently handle your EAF’s compliance and we will point out the areas worth strengthening.
Obtaining CNMV authorization turns a financial advisory firm (EAF) into a supervised entity, and supervision is a permanent state. Law 6/2023, Royal Decree 813/2023, the MiFID II framework and the IFR/IFD prudential regime make up a set of duties that is not exhausted by complying: you must be able to prove compliance with dated evidence when the supervisor asks. This page organizes those duties into three rhythms (periodic, annual and event-driven obligations) and points out, for each area, which proof is worth keeping on file.
The first area is reporting: the EAF submits to the CNMV the IFR/IFD prudential reporting (own funds and requirements according to its class, usually Class 3 for small and non-interconnected firms) together with the periodic activity information that the rules require. In parallel, the firm must maintain its permanent own funds at all times, generally linked to fixed overheads, which calls for documented internal monitoring and not just a once-a-year snapshot. The statutory audit closes the loop by connecting accounts, solvency and reporting. The full framework is in IFR/IFD and regulatory capital.
Since Law 6/2023, EAFs, and EAFNs too, are mandatory members of FOGAIN, which protects investors up to €100,000 in the statutory cases where assets are not returned; membership entails annual contributions set under the fund’s rules. On top of that come the CNMV’s supervisory fees. None of these items is discretionary: they make up the fixed cost of keeping the license and must be budgeted every financial year, with receipts filed as evidence of compliance.
Day-to-day operations concentrate the conduct obligations: a suitability test before each recommendation (with the sustainability preferences incorporated by the ESMA guidelines updated in 2023), management of conflicts of interest, an inducements regime in line with MiFID II Art. 24, and ex ante and annual ex post cost disclosure. Staff who provide information or advice must demonstrate knowledge and competence with qualifications and certificates verified by the CNMV and receive recorded ongoing training, as we explain in MiFID II certifications. And communications that may result in transactions are recorded and kept for 5 years, extendable to 7 (MiFID II Art. 16(7)).
As an obliged entity, the EAF maintains an anti-money laundering system proportionate to its risk: due diligence, suspicious transaction reporting, an active internal control body and staff training, with independent reviews on the terms of the applicable rules. That leaves the “event-driven” area: the amendment of the program of activities when the business changes, the fit and proper assessment when directors or senior managers are replaced, and the notifications linked to qualifying holdings. The discipline that prevents almost every problem fits in one sentence: changes are filed before they are implemented, not after.
Key legislation, linked to the official text:
Legislation and links reviewed in .