CNMV / Bank of Spain
From regulatory strategy to day-to-day operations
“We turn requirements into processes: licenses, policies, evidence and a roadmap you can defend before the supervisor.”
Financial Regulation in Spain
Legal advice on financial regulation for banks, fintechs and regulated entities. We help you comply and operate with confidence: licenses and registrations, corporate governance, internal controls, reporting and responses to requests for information from the CNMV, the Bank of Spain and other supervisors. A practical approach: documentation + evidence and an action plan to reduce the risk of penalties and operational friction.
MiFID II
Market conduct + product governance
“We review suitability, conflicts of interest, inducements, documentation and records to reduce the risk of inspection findings and complaints.”
PSD2 / Fintech
Payments and electronic money, without improvisation
“Authorization, safeguarding, outsourcing and controls: the key is to demonstrate traceability and ongoing compliance.”
Inspections
Requests for information, action plans and defense
“We prepare robust responses: facts, evidence, corrective measures and follow-up to close findings.”
Financial regulation services: what we cover
Applicable regulatory framework
We identify the framework and your obligations: conduct, governance, controls, outsourcing, reporting and risk prevention for your business and operating model.
Authorizations and registrations
We plan and handle authorization applications: documentation, policies, organizational structure and support in your dealings with the supervisor.
Investment firms (ESI) and investment advice
We review organizational and conduct requirements: conflicts of interest, inducements, suitability, product governance and records for inspection.
PSD2: payments and electronic money
Compliance design: safeguarding of funds, outsourcing, security, business continuity and evidence so you can operate steadily and without friction.
Internal control and compliance
Policies, procedures and controls: risk map, roles, internal reporting, training and traceability to demonstrate ongoing compliance.
Inspections and proceedings
Responses to requests for information, action plans, formal submissions and a defense strategy based on facts and documentary evidence.
Key milestones and timelines in financial regulation
In financial regulation, what protects you in a review is not “having a document” but demonstrating governance, evidence, controls and follow-up. We help you organize the cycle: diagnosis, implementation, reporting and continuous improvement.
Diagnosis (gap analysis): mapping of obligations and risks by activity, clients, product and channels.
Design and implementation: policies, procedures, roles, records and controls, backed by evidence.
Testing and traceability: operational testing and review of files, records and decisions.
Reporting: calendar of recurring obligations (reports, notifications and internal follow-up).
Continuous improvement: action plan, owners, deadlines and verification that findings have been closed.
Dealing with supervisors: CNMV, Bank of Spain and SEPBLAC
In financial regulation projects, the key is to anticipate: consistent documentation, evidence and robust responses. We support you with requests for information, inspections and communications, including anti-money laundering matters where applicable. Our approach prioritizes clarity, traceability and corrective action.
Scope of our advice: what will we review?
In financial regulation, we review organization, operations, technology and reporting. The goal is to align rules, processes and evidence so that compliance is sustainable.
1. Corporate governance and policies
We review policies, procedures, roles and committees: conflicts of interest, remuneration, client acceptance, outsourcing and the documentation required for audits and supervision.
2. Operations, technology and controls
We validate end-to-end processes: onboarding, records, controls, outsourcing and evidence. We test scenarios to ensure consistency, security and traceability in real-world execution.
3. Reporting and relations with supervisors
We organize your calendar of obligations, internal reporting and responses to requests for information. The focus: consistent documentation, evidence and closing findings with an action plan.
Initial authorization or ongoing compliance?
In financial regulation, many entities go through two phases: launch (application, policies and “go-live”) and ongoing compliance (controls, reporting, audit and improvement). Understanding this difference avoids roadblocks and reduces the risk of penalties.
| Aspect | Authorization project (go-live) | Ongoing compliance |
|---|---|---|
| When does it apply? | New setup, change of business model, product or structure (application and launch). | Day-to-day operations, periodic reporting and supervisory reviews. |
| Scope | Design of policies, structure, minimum controls, documentation and initial evidence. | Controls in operation, records, traceability, internal audit and improvement plans. |
| Basis | Authorization/registration requirements and the supervisor’s criteria applicable to the case. | Recurring obligations, guidelines and supervisory practices for your activity. |
| Goal | Start operating in compliance, with no gaps in documentation. | Sustain compliance, respond to inspections and reduce operational incidents. |
*The regulatory fit depends on the activity and the competent supervisor. What matters is that rules, processes and evidence are consistent.
How we approach financial regulation
A clear, actionable methodology: diagnosis, plan, implementation and evidence. We prioritize what the supervisor reviews and what avoids operational friction.
01
Regulatory diagnosis
We define the applicable framework based on your activity, product and channels. We identify obligations, risks and critical points for supervision.
02
Gap analysis + roadmap
A comparison between “what you have” and “what is required”: policies, records, controls, roles and evidence. We deliver an action plan with priorities and deadlines.
03
Implementation and evidence
We draft or adjust documentation, turn it into processes and verify traceability. In an inspection, what cannot be shown with evidence “does not exist”.
04
Support before the supervisor
Preparing responses to requests for information, reviewing findings and closing them through a corrective plan. Order and consistency to reduce exposure.
Operational checklist
Evidence that strengthens your financial regulation compliance
In financial regulation, evidence is decisive: approved policies, controls in operation, records and a documented improvement plan. That is how you reduce penalties and operational friction.
Applicable framework defined Approved policies Traceable records Recurring reporting
-
Map of obligations and risks
Define which rules apply to you and which regulated risks your activity involves (product, channel, client and jurisdiction).
-
“Operational” policies and procedures
Not just paper: they must translate into processes, roles, records and controls that can actually be carried out.
-
Records and evidence (auditable)
Keep a traceable record of decisions, reviews, approvals, controls and exceptions. That is what inspectors ask for.
-
Outsourcing and technology under control
Outsourcing, critical providers and security: contracts, KPIs, governance, continuity and evidence of monitoring.
-
Action plan and follow-up
If there are gaps, document the plan: owners, deadlines, evidence of closure and verification.
Common mistakes we avoid in financial regulation
In financial regulation, the risk is not just about “complying” but about proving it with traceability. These failures often trigger requests for information, penalties or operational roadblocks.
⚠️
Policies that are never put into practice
A perfect manual, weak execution. What gets inspected is actual application: roles, controls, records and evidence.
⚠️
Incomplete or inconsistent records
Lack of traceability: decisions, reviews, approvals and exceptions. Without records, compliance is hard to defend.
⚠️
Outsourcing without governance
Critical providers without oversight: contracts, KPIs, security, continuity and monitoring. Often a red flag in reviews.
⚠️
Late response to the supervisor
Requests for information handled “against the clock” without evidence. This is better solved with a plan, owners, deadlines and documentation prepared in advance.
What sound compliance in financial regulation must be able to demonstrate
Beyond the “document”, what matters in supervision is traceability: governance, controls, records, reporting and an improvement plan.
Governance Controls Records Reporting
Governance and organization
- Clear roles (compliance, risk, internal audit, business).
- Approved policies, communicated with evidence of adoption.
- Conflicts of interest and documentation consistent with operations.
- Committees and internal reporting with minutes and follow-up.
Consistency between governance and execution reduces supervisory findings.
Controls and evidence (what supervisors expect to see)
- Controls in operation: what is done, when, by whom and with what record.
- Complete records: decisions, reviews, approvals and exceptions.
- Traceability: from requirement to process and from process to evidence.
- Action plans: cause, impact, correction and verification of closure.
Quality tip
If a “why” cannot be reconstructed with evidence, it usually becomes a finding.
Outsourcing and technology
- Outsourcing under control: contracts, KPIs, audit and continuity.
- Security: access, incidents, changes and evidence of monitoring.
- Critical providers: governance and periodic assessment.
- Availability: the ability to deliver information quickly when requested.
It reduces operational and reputational risk and the risk of penalties.
Risk-based approach
- Controls proportionate to activity, clients and channels.
- Prioritization of critical points and evidence of mitigation.
- Consistency between policies, procedures and day-to-day execution.
What “adds up” in supervision is consistency + traceability.
Important note:
Request a readiness checklist
Organize your compliance as a system: requirement → process → control → record → review → improvement. That is what keeps financial regulation “under control”.
Risks and penalties for non-compliance with financial regulation
Requests for information and inspections due to inadequate policies, controls or records.
Significant fines and mandatory corrective measures, depending on severity and repeat offenses.
Reputational risk: loss of trust among clients, partners, investors and counterparties.
Operational roadblocks: friction in onboarding, with providers and audits, in access to banking and in growth.
Cost of reacting: fixing things against the clock is usually more expensive than implementing and documenting properly in good time.
Need support with financial regulation?
We help you with licenses, ongoing compliance, evidence and responses to requests for information: a practical, traceable approach you can defend before supervisors.
All about financial regulation
What is financial regulation?
Financial regulation is the set of rules and supervisory criteria that govern how banks, fintechs, payment institutions, investment firms (ESI) and other regulated activities must operate. It aims to ensure client protection, stability, transparency and risk control.
In practice, it involves policies, controls, records, reporting and the ability to respond to the CNMV, the Bank of Spain and other bodies.
It is not “paper”: it is a living system that is demonstrated with evidence.
When do I need authorization or registration?
It depends on the actual service and how it is provided. Many activities (payments, electronic money, investment, intermediation, etc.) require prior authorization or registration.
If your model involves raising funds, execution, custody, advice or regulated services, it is advisable to validate it before launch.
Which regulations usually come into play?
The framework depends on the activity: organizational and conduct requirements, corporate governance, internal control, outsourcing, security and reporting, plus risk prevention where applicable.
The key is to align rules + supervisory criteria + actual operations, and to document it with traceability.
What does our advice include?
Regulatory diagnosis, compliance plan, drafting or adjusting policies and procedures, design of controls and records, and support in your dealings with supervisors.
What makes the difference:
- Evidence and traceability (not just a “document”).
- Complete records: decisions, reviews, exceptions.
- An action plan with owners, deadlines and verification of closure.
- Preparation for requests for information and inspections.
Benefits of solid compliance
It reduces the risk of penalties, improves access to banking and facilitates growth (products, partners, investment). It increases the trust of clients and counterparties.
It also reduces operational friction: fewer roadblocks, fewer emergencies and more predictability.
What documentation should I prepare?
To speed things up: organizational chart and roles, current policies and procedures, contracts with critical providers, control records, internal reporting and evidence of reviews and approvals.
If everything is in order, requests for information are answered better and compliance is easier to defend.
What happens if I fail to comply?
Exposure to penalties, corrective measures, inspections and reputational risk. There may also be operational roadblocks (accounts, partners, audits).
Preventing problems with evidence and solid controls is usually far more cost-effective than reacting late.
How much does a financial regulation project cost?
It depends on the activity, scope, volume of processes and how mature your documentation is. The decisive factors are the complexity of the model and the evidence already available.
We give you a tailored quote after a quick assessment of your needs and priorities.
Book a call
Official sources
Key legislation, linked to the official text:
- Law 10/2014 of June 26 on the Regulation, Supervision and Solvency of Credit InstitutionsBOE · consolidated text
- Law 6/2023 of March 17 on Securities Markets and Investment ServicesBOE · consolidated text
- Royal Decree-law 19/2018 of November 23 on Payment Services and Other Urgent Financial MeasuresBOE · consolidated text
Legislation and links reviewed in .
Insurance and financial regulation: all our services and guides in English
0 pages in this area.