Fintech Lawyer in Spain

A fintech lawyer is a legal specialist who combines knowledge of the financial regulatory framework with a deep understanding of digital business and the technology applied to financial services. Their role is to guide startups, scaleups and established companies through a regulatory environment that is constantly changing.

Their work ranges from obtaining regulatory licenses (payment institutions, e-money institutions, VASPs) to designing AML/KYC compliance systems, negotiating contracts with banks, GDPR compliance and advising on business models based on open banking, crypto-assets or alternative lending.

Working with a fintech lawyer from the early stages of your company drastically reduces regulatory risk and speeds up time-to-market, because it avoids delays caused by unforeseen legal problems.

The license you need depends on your business model. The main regulated entities in Spain are the payment institution (PI) and the electronic money institution (EMI), both supervised by the Bank of Spain and regulated by Royal Decree-law 19/2018 on payment services.

For crypto-asset activities, the applicable framework is the MiCA Regulation (in force since 2024) and, in Spain, registration as a virtual asset service provider (VASP) with the Bank of Spain. Lending and crowdfunding projects have their own regime under Regulation (EU) 2020/1503.

Determining which license your fintech company needs is the first step of our advice: a mistake in the regulatory classification can mean months of delay and unnecessary costs.

To obtain a payment institution license from the Bank of Spain, you must file an application that includes the program of operations, the business plan, the organizational structure, the internal control mechanisms, and the risk management and anti-money laundering procedures.

Main requirements:

• Minimum initial capital depending on the payment services to be provided (between €20,000 and €125,000).
• An appropriate governance structure: board of directors, compliance officer and AML/CFT officer.
• An AML/CFT manual and a risk assessment tailored to the payment institution’s activity.
• Evidence of the good repute and experience of the directors and key managers.

The process before the Bank of Spain can take between 3 and 12 months. A fintech lawyer who knows the procedure well can anticipate requests for information and significantly shorten the timeline.

Fintech companies are obliged entities under Law 10/2010 on the prevention of money laundering. This means they must have a complete AML/KYC system: customer identification and verification, risk assessment by customer and transaction, ongoing transaction monitoring, and reporting of suspicious transactions to SEPBLAC.

The fintech environment has specific features that call for tailored solutions: digital onboarding, remote identity verification (eIDAS, video identification), automated risk scoring and real-time alert management. A fintech lawyer specializing in AML designs a system adapted to these specific needs.

A SEPBLAC inspection of a fintech without a robust AML/CFT system can lead to sanctions of up to millions of euros and revocation of its license. Prevention is the only viable strategy.

The PSD2 Directive, transposed in Spain by Royal Decree-law 19/2018, has transformed the financial sector by requiring banks to open their APIs to third-party providers (TPPs) such as fintechs, with the user’s consent. PSD2 compliance involves strong customer authentication (SCA) requirements, technical access interfaces and agreements with sponsor banks.

A fintech lawyer advises on registration as an AISP (account information service provider) or PISP (payment initiation service provider), on negotiating access agreements with financial institutions, and on compliance with the regulatory technical standards (RTS) of the European Banking Authority (EBA).

The PSD3 framework and the accompanying Payment Services Regulation (PSR) will expand these obligations. Working with a fintech lawyer who keeps up with EU regulatory developments is key to staying current.

The MiCA Regulation (Markets in Crypto-Assets) has applied in full in Spain since late 2024. It sets the regulatory framework for issuing crypto-assets and providing crypto-asset services across the European Union, and it affects exchanges, wallets, stablecoin issuers and custody service providers.

In Spain, crypto-asset service providers (CASPs) must obtain authorization from the CNMV or the Bank of Spain, depending on the type of service provided. A fintech lawyer specializing in crypto-assets guides you through token classification, the authorization process, drafting the white paper required by MiCA and designing an AML system adapted to digital assets.

Operating as a CASP without MiCA authorization is equivalent to operating as an unlicensed payment institution: the regulatory consequences are just as serious. Advice before you launch is essential.

The answer: from day one. The most critical legal decisions for a fintech startup are made in the earliest stages. The choice of regulatory model, corporate structure, agreements with co-founders and investors, and data architecture all have consequences that last for years.

A fintech lawyer can help a startup determine whether it needs a license or can operate as an agent of an authorized institution, how to structure its relationship with a sponsor bank, how to prepare documentation for a funding round, and how to scale to other European markets using the EU passport.

Investing in specialist fintech legal advice from the start is always cheaper than fixing regulatory problems later. The costs of non-compliance—sanctions, forced closures, reputational damage—are exponentially higher.