Adding a service, amending your articles of association or moving your registered office does not always require authorization: sometimes a notification within fifteen days is enough. And there is a detail almost nobody knows: here silence is positive, the exact opposite of the initial authorization.
Extending your license? Free assessment
Tell us what you want to add and we will tell you whether it needs authorization or just a notification.
The first question is not how to process it, but whether anything needs to be processed at all. Getting the answer wrong is costly either way.
We determine whether what you want to do requires prior authorization, a simple notification within fifteen days or a prior consultation with the supervisor. Your entire timeline depends on that classification.
Application, supporting report from the management body and evidence that the organization can support the new activities. All consistent with the original program of activities.
Adding a service means redrafting the document that sets the perimeter of your license, and making sure the rest of the file stays consistent with it.
Certificate of the resolution, supporting report, draft of the new articles of association identifying the amendments, and subsequent entry in the special register.
Whether an operational function is important or not changes the regime: one month’s prior notice with a possible objection, or notification after the fact.
A new service does not travel on its own: the passport covers what the authorization covers. We coordinate the extension with the notification to host Member States.
An authorization is not a master key: it is a list.
When the supervisor grants a license, it does not authorize the entity to operate in its sector: it authorizes it to provide the specific services listed in its program of activities. Anything not on that list is outside the perimeter, even if it is adjacent, technically trivial or requested by the client. That is why there is a specific extension procedure.
The most common starting mistake is to treat it as a minor administrative formality. It is not, and the law says so clearly in the regime for financial credit establishments: Article 16 of Royal Decree 309/2020 provides that an EFC that intends to extend its activities “shall apply for a new authorization”, even though it is processed through the procedure for amending the articles of association. It is not an addendum to the license you already hold: it is a new authorization over a new perimeter.
The second mistake is the opposite: applying for authorization for things that do not need it. The law sets out a closed list of amendments that are dealt with by a simple notification after the fact, and running them through the authorization route needlessly uses up three months. Telling the two regimes apart correctly is the part of the work that saves the most time.
And the third, and most expensive, is doing nothing: continuing to provide a new service on the assumption that the license “already covers it”. That assumption falls squarely within the reserved activity rules, with consequences that go well beyond a request to remedy your file.
In an initial authorization, silence leaves you out. In an extension, it lets you in.
| Procedure | Provision | Deadline | Administrative silence |
|---|---|---|---|
| Initial authorization of a payment institution | Royal Decree 736/2019 Art. 1(2) | 3 months | Deemed rejected |
| Initial authorization of an EMI | Law 21/2011 Art. 4 | 3 months | Deemed rejected |
| Initial authorization of an EFC | Royal Decree 309/2020 Art. 7(2) | 3 months (max. 12) | Deemed rejected |
| Initial authorization of a bank | Royal Decree 84/2015 Art. 3(2) | 6 months (max. 12) | Deemed rejected |
| Extension of payment services | Royal Decree 736/2019 Art. 6(4) | 3 months | Deemed approved |
| Amendment of articles (PI) | Royal Decree 736/2019 Art. 6(1) | 3 months | Deemed approved |
| Amendment of articles (EMI) | Royal Decree 778/2012 Art. 6(1) | 3 months | Deemed approved |
| Amendment of articles (bank) | Royal Decree 84/2015 Art. 10(1) | 2 months | Deemed approved |
The amendment regulations use the wording “after which it may be deemed approved”. The initial authorization regulations say “shall be deemed rejected by administrative silence” or “may be deemed rejected”.
This reversal is deliberate, and it makes sense: in an initial authorization the supervisor decides whether a new entity enters the system, and there silence cannot work in the applicant’s favor. In an amendment, by contrast, the entity is already inside, already supervised and already known to the supervisor; what is assessed is a change in the scope of something that already exists, and the law accepts that the expiry of the deadline has a positive effect.
For whoever manages the project, this completely changes the procedural strategy. In an initial authorization, the goal is to prevent the deadline from expiring without a decision, because expiry means losing. In an extension, the expiry of the deadline is a legal position you can use. It is therefore worth proving precisely the day on which the file became complete, because that is when the three months (or two, if you are a bank) start to run.
One important nuance: the deadline for banks is two months, not three. Article 10(1) of Royal Decree 84/2015 expressly sets it for amendments to the articles of association, compared with three months for payment institutions and electronic money institutions. It is one of those differences that never appear in any summary and that catch out anyone who carries experience over from one type of entity to another.
The route is not the same, even if the outcome looks similar.
| Entity type | Provision | What the law says |
|---|---|---|
| Payment institution | Royal Decree 736/2019 Art. 6(4) | “The Bank of Spain shall be responsible, subject to a prior report from the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offenses, for authorizing the extension of the payment services for which it is authorized.” It follows the procedure in Article 1, within three months, with positive silence. |
| Electronic money institution | Royal Decree 778/2012 Art. 7 | “Where an electronic money institution intends to extend the activities for which it is authorized, the same procedure as for amending the articles of association shall be followed.” It may be refused if the institution does not meet the solvency requirements or lacks an organization suited to the new activities. |
| Financial credit establishment | Royal Decree 309/2020 Art. 16 | “A financial credit establishment that intends to extend its activities shall apply for a new authorization, which shall be subject to the procedure provided for amending the articles of association in Article 15(1).” Conversion into a hybrid entity follows its own route under Article 21. |
| Bank | Royal Decree 84/2015 Art. 10 and Law 10/2014 Art. 4(2)(c) | Amendments to the articles of association are authorized within two months, with positive silence. The law also allows regulations to determine which amendments can be replaced by a mandatory notification. |
For all four types of entity, the extension is processed through the procedure for amending the articles of association, even though in substance it is a new authorization over a different perimeter.
The express wording of the electronic money regime deserves attention because it anticipates how any extension is assessed: the supervisor may refuse it if the entity does not meet the solvency requirements or if it lacks administrative and accounting organization and internal control procedures suited to the new activities. In other words, the extension is not assessed in the abstract: it is assessed against your actual organization at the time you apply.
This has a sequencing consequence worth planning for. If the new service requires a profile you have not hired, a control you have not set up or a level of own funds you do not reach, the extension application will arrive before the capability. The application should be filed when the organization already supports what is being requested, not when the business plan says it will.
General rule: prior authorization. With four closed exceptions.
As a general rule, amending the articles of association of a supervised entity is subject to prior authorization. For payment institutions and electronic money institutions, it is granted by the Bank of Spain after a report from SEPBLAC (except for share capital reductions, which are expressly excluded from the report), within three months and with positive silence. For banks, the deadline drops to two months.
The documentation required by law is short and very specific. Article 6(1) of Royal Decree 736/2019 lists it: a certificate of the act in which the amendment was resolved, a report from the management body justifying the proposal and a draft of the new articles of association identifying the amendments made. The same three items are repeated word for word in the electronic money and banking regimes.
That last requirement is breached all the time. “Identifying the amendments made” does not mean providing the new articles: it means providing them marking what has changed. Filing a clean text forces the supervisor to compare two documents line by line, and that friction turns into a request for information that uses up an entire round of exchanges.
Once the authorization has been obtained and, where applicable, after the transaction has been entered in the Commercial Registry, the relevant aspects of the amendment to the articles of association or of the extension of activities are entered in the supervisor’s special register. The process does not end with the decision: it ends with registration.
Four closed cases dealt with by a notification within fifteen days.
| Case | What it requires | Basis |
|---|---|---|
| Change of registered office within Spain | Notification to the supervisor only | Royal Decree 736/2019 Art. 6(2)(a) · Royal Decree 84/2015 Art. 10(2)(a) |
| Share capital increase | Notification only | Royal Decree 736/2019 Art. 6(2)(b) · Royal Decree 84/2015 Art. 10(2)(b) |
| Incorporating mandatory or prohibitive legal provisions verbatim, or complying with judicial or administrative decisions | Notification only | Royal Decree 736/2019 Art. 6(2)(c) · Royal Decree 84/2015 Art. 10(2)(c) |
| Minor amendments, after prior consultation with the supervisor | Notification only, if the supervisor has replied that authorization is unnecessary | Royal Decree 736/2019 Art. 6(2)(d) · Royal Decree 84/2015 Art. 10(2)(d) |
The notification deadline is fifteen days from the adoption of the resolution for payment institutions, and fifteen business days for electronic money institutions and banks.
The fourth exception is the most useful and the least used. It allows any amendment to be downgraded to a mere notification, provided that the supervisor, in reply to a prior consultation made for that purpose, has considered the authorization procedure unnecessary “because of its minor relevance”. It is an escape route designed precisely for technical changes that alter nothing of substance, and that nevertheless end up on the three-month track simply because nobody asked.
The counterpart is in the next paragraph: if what is notified goes beyond the exemption regime, the supervisor will warn the parties concerned within thirty days so that they can revise the amendments or follow the authorization procedure. In other words, there is a power of reclassification. Notifying something that needed authorization does not make it notifiable: it only delays the moment it is discovered, and forces you to start the correct procedure with a month lost.
The classification decides the regime, and the law defines the test.
Outsourcing has its own regime and its own scale. Article 15 of Royal Decree 736/2019 defines an important operational function using a purpose-based test: a function is important “if an anomaly or deficiency in its performance may substantially affect the entity’s ability to comply on an ongoing basis with the conditions arising from its authorization”, or its other obligations, “or affect the financial results, the soundness or the continuity of its payment services, and the confidentiality of the information it handles”.
Everything else hinges on that classification:
The law also adds two substantive limits worth bearing in mind when negotiating the contract with the provider: outsourcing may not result in “a complete emptying of the content of the entity’s general activity”, nor impair supervisory powers. And the term outsourcing covers both the initial delegation and any subsequent sub-delegations the provider may make: the whole chain falls within the perimeter, not just the first link. If you are reviewing this area, it is worth cross-checking it with the outsourcing of critical functions.
Two consequences, and nobody sees the second one coming.
The first consequence is the obvious one: you are providing a reserved service without the required license. Article 5(3) of Royal Decree-law 19/2018 is categorical: “Any natural or legal person that is not a payment service provider and is not expressly excluded from the scope of this royal decree-law is prohibited from providing any of the payment services listed in Article 1”. Holding a license for some services does not make you an authorized provider of others.
The second is less obvious and affects international growth. The perimeter of your authorization is also the perimeter of your EU passport: the authorization “shall allow the provision of payment services covered by the authorization” throughout the Union. And when you apply to open a branch, the discrepancy becomes a separate ground for refusal. It is written in two different regulations in the same words: the supervisor may refuse “where the program of activities provides for the provision of payment services for which the institution is not authorized” (Article 10(3) of Royal Decree 736/2019) and, for credit institutions, “where the program of activities submitted provides for activities for which the institution is not authorized” (Article 14(1) of Royal Decree 84/2015).
The strategic takeaway is simple: if your two-year plan includes a new service and expansion into another Member State, the extension comes first. Notifying a passport with a program that goes beyond your authorization does not just fail: it puts you on the supervisor’s radar for a reason you could have avoided.
Half the value of this work lies in deciding correctly which route each change takes. The other half lies in not breaking the consistency of the original file.
“Three different regimes with different deadlines. Putting something that only needed a notification on the long track costs three months; doing it the other way round costs a reclassification.”
“The extension is assessed against your actual organization, not against your plan. If the control is not in place, the application arrives too early.”
“Extending means redrafting the program of activities and keeping the rest of the file consistent with it. That is where contradictions appear.”
“Here silence is positive. The day the file became complete stops being an administrative detail and becomes a legal position.”
Five failures, and none of them has anything to do with the substance of the business.
Misclassifying the change. Processing as an authorization something that only needed a notification costs three months. Notifying something that required authorization triggers the supervisor’s warning within thirty days and forces you to restart the procedure from the beginning.
Applying before you are ready. The extension is refused if the entity does not meet the solvency requirements or lacks an organization suited to the new activities. What is assessed is what you have, not what you plan to have.
Filing clean articles of association. The law requires a draft of the new articles “identifying the amendments made”. An unmarked text triggers a request for information.
Not updating the program of activities. The program sets the perimeter. If the service is extended and the document is not redrafted, the file becomes internally contradictory.
And forgetting the passport. A new service does not travel to host Member States on its own: the change must be notified, at least one month in advance.
| Action | Regime | Deadline | Administrative silence |
|---|---|---|---|
| Extending payment services | Prior authorization | 3 months | Deemed approved |
| Amending articles (PI and EMI) | Prior authorization | 3 months | Deemed approved |
| Amending articles (bank) | Prior authorization | 2 months | Deemed approved |
| Change of registered office within Spain | Notification only | 15 days from the resolution | — |
| Capital increase | Notification only | 15 days from the resolution | — |
| Reclassification by the supervisor | Warning | 30 days | — |
| Important outsourcing | Prior notification | 1 month’s prior notice | Objection within 1 month |
| Non-important outsourcing | Subsequent notification | 1 month from taking effect | — |
| Change to passport details | Prior notification | 1 month in advance | — |
It is a focused analysis and it decides your project’s entire timeline. We do it free of charge.
Ten steps, starting with the one that decides all the others.
Prior authorization, mere notification within fifteen days or a prior consultation on minor relevance. Three regimes with very different consequences.
Solvency and an organization suited to the new activities. What is assessed is what you have, not what you plan.
It is the document that sets the perimeter. If it is not updated, the file contradicts itself.
Step seven looks bureaucratic, but it is not: because silence is positive here, the date on which the file became complete determines when you can rely on it.
Five decisions to make before you file anything.
RouteAuthorization, notification and prior consultation coexist in the same article. Choosing correctly is half the work.
SolvencyThe extension can be refused for lack of solvency or for an organization not suited to the new activities. The plan is not what is assessed.
PerimeterExtending the service without updating the document that sets the perimeter leaves the file contradicting itself.
SilenceThe reversal compared with the initial authorization changes the procedural strategy.
NEGATIVE silence. The goal is to get a decision within the deadline.
POSITIVE silence: “may be deemed approved”. The expiry of the deadline is a position you can use.
The clock starts when the file is complete. Proving that day is no longer a detail.
PassportThe change must be notified to the host Member States at least one month in advance.
Documented analysis of whether authorization, notification or prior consultation applies.
Legal classification memo and, where applicable, the consultation submitted to the supervisor.
Resolution validly adopted by the competent body.
Certificate of the act in which the resolution was adopted.
Report from the management body explaining the proposal.
Signed supporting report.
Draft of the new articles of association identifying the amendments made.
Comparison document with the changes highlighted.
Sufficient own funds for the extended perimeter.
Financial statements and calculation of requirements.
Administrative, accounting and control resources suited to the new activities.
Updated organization chart, contracts and job descriptions.
Updated document consistent with the rest of the file.
New version of the program, checked against the business plan.
Completing the registration process after the decision.
Registration in the Commercial Registry and in the special register.
Treating the extension as paperwork and discovering, after filing, that the organization cannot support the new service. The assessment is not a formality: the supervisor compares what you request with the resources you have at that moment, and refusal on the grounds of an unsuitable organization is expressly provided for.
Terms that appear in the regulations and decide the route.
Application for authorization to provide services not included in the original authorization. For EFCs, the law calls it a “new authorization”.
In amendments and extensions, once the deadline passes without a decision, the application “may be deemed approved”. The opposite of the initial authorization.
Four closed cases that only need to be notified: registered office within Spain, capital increase, mandatory provisions and minor relevance.
Allows an amendment to be downgraded to a mere notification if the supervisor replies that authorization is unnecessary.
If what was notified goes beyond the exemption regime, the supervisor issues a warning so that it is brought back into the authorization procedure.
A function whose deficiency may substantially affect the ability to meet the conditions of the authorization or the continuity of the service.
After the decision and, where applicable, registration in the Commercial Registry, the relevant aspects of the amendment or extension are registered.
An EFC that becomes a hybrid payment institution or hybrid electronic money institution follows its own route, separate from an ordinary extension.
The set of services covered by the license. It also determines the scope of the EU passport.
COMPLIANCE CONTROL CENTER · AMENDMENTS
Cross what you want to do with your type of entity. The cell shows the applicable route and deadline.
Green: notification only. Red: prior authorization.
Entities that already hold a license and want to grow without stepping outside the perimeter.
The most common case: an institution authorized for certain payment services wants to add payment initiation, account aggregation or the issuing of payment instruments.
Extension through the procedure for amending the articles of association, with possible refusal for lack of solvency or an organization not suited to the new activities.
The law expressly calls the extension a “new authorization”. And conversion into a hybrid entity has its own route.
A two-month deadline for amending the articles of association, compared with three for the others. The same four exceptions subject to notification.
All of them can be avoided with a half-day analysis.
Four closed cases are dealt with by a notification within fifteen days. Processing them as authorizations gives away three months for nothing in return.
If what is notified goes beyond the exemption regime, the supervisor issues a warning within thirty days and the procedure has to be restarted from the beginning, with the time already lost.
The Article 6(2)(d) route allows an amendment to be downgraded to a mere notification if the supervisor considers it minor. It is the most underused tool in the regime.
The law requires a draft “identifying the amendments made”. Providing a clean text forces the supervisor to compare and triggers a request for information.
The extension is refused if the organization is not suited to the new activities. The right order is to build first and apply afterwards.
The passport covers what the authorization covers. A program that includes unauthorized services is a separate ground for refusal when opening a branch.
Regulatory text published in the BOE. We link the source so you can check it.
Article 6 (amendment of the articles of association and extension of activities), Article 15 (outsourcing) and Article 10 (activity outside the Union and grounds for refusal).
BOEArticle 6 (amendment of the articles of association) and Article 7 (extension of activities, with the grounds for refusal based on solvency and organization).
BOEArticle 15 (amendment of the articles of association), Article 16 (extension of activities as a new authorization) and Article 21 (conversion into a hybrid entity).
BOEArticle 10 (amendment of banks’ articles of association, with a two-month deadline) and Article 14(1) (grounds for refusal when opening a branch in another Member State).
BOEArticle 4(2)(c): power to authorize amendments to the articles of association and to determine by regulation which ones can be replaced by a mandatory notification.
BOEArticle 5: categories of payment service providers and the prohibition on providing payment services for anyone who is neither a provider nor excluded from its scope.
Initial publication. Amendment and extension regime transcribed from the regulations published in the BOE for the four types of entity, contrasting the effect of silence with that in the initial authorization.
Planned review: impact of the new consumer credit agreements law on the regime for financial credit establishments.
Tell us which license you hold and what you want to add or change. With that, we can tell you on a first reading whether it needs authorization, notification or a prior consultation.
The authorization allows you to provide the specific services listed in the program of activities. That delimitation has two consequences that run through the entity’s whole life: any new service requires extending the license, and the EU passport only covers what the authorization covers. That is why the extension is not a mere formality: Article 16 of Royal Decree 309/2020 calls it, for EFCs, a “new authorization”.
The regime distinguishes three routes with very different deadlines. Prior authorization is the general rule for amending the articles of association and for extending activities. Mere notification covers four closed cases (change of registered office within Spain, capital increase, verbatim incorporation of mandatory provisions and minor amendments) with a deadline of fifteen days from the resolution. And the prior consultation under Article 6(2)(d) allows an amendment to be downgraded to a simple notification if the supervisor considers authorization unnecessary. Choosing the wrong route costs three months in one direction or a reclassification within thirty days in the other.
It is the point that surprises people most often and the one with the greatest consequences. In the initial authorization, silence is negative for all four types of entity. In amendments and extensions it is positive: the regulations use the wording “after which it may be deemed approved”. The logic is clear (the entity is already inside the system and already supervised), but the practical consequence is that the date on which the file became complete stops being an administrative detail and becomes a legal position. And the banking deadline is two months, not three.
Not the ambition of the project, but present capability. The electronic money regime spells it out: the extension may be refused if the entity does not meet the solvency requirements or lacks administrative and accounting organization and internal control procedures suited to the new activities. Hence the right order for any extension project: first build the capability, then apply. And the program of activities, the document that sets the perimeter, must always be redrafted.
A new service does not travel on its own. The perimeter of the authorization is the perimeter of the EU passport, and any change to the notified details requires at least one month’s prior notice to the host Member States. What is more, a discrepancy between the program and the authorization is a separate ground for refusal when opening a branch, in almost identical terms in two different regulations. If the plan includes both a new service and European expansion, the extension comes first. And if the service is already being provided without an extension, you are in reserved activity territory.
Key legislation, linked to the official text:
Legislation and links reviewed in .