We help you identify which fintech license your project really needs: payments, electronic money, investment services, crypto-assets or an unregulated structure. We analyze the regulatory fit, set the roadmap before the Bank of Spain or the CNMV, and leave you with a model you can defend from design through to operation.
Free consultation
We reply within 24 h
Six building blocks to define the right regulatory fit and build a project you can defend before any supervisor.
We analyze whether your fintech needs authorization in payments, electronic money, investment, crypto-assets, banking or another alternative route. The right perimeter is decided before the application, not after.
We identify the competent supervisor, the type of application, the pre-application strategy and the documentation needed, so you do not build on the wrong foundation.
We organize the business plan, program of operations, governance, capital, internal policies and annexes to file a coherent, defensible application.
We review outsourcing, SLAs, security, business continuity and partner contracts so the structure reflects how the fintech actually operates.
We design the compliance block: anti-money laundering, key functions, reporting, customer protection and evidence ready for supervisory review.
We help you move from authorization to actual operation: controls, DORA, incidents, transparency, complaints and documentation that holds up over time.
Payments, electronic money, investment, crypto, banking or operating without a license of your own: each model has its own fit and its own supervisor. Choosing correctly is the first regulatory task for any fintech.
“The right question is not ‘I want a fintech license’ but ‘what regulated activity does my project actually provide?’ That is what decides whether you are talking about payments, an EMI, MiFID, banking or crypto.”
“Choosing the wrong supervisor or regulatory status leads to delays, requests for information and a weak application. The regulatory perimeter is defined before investing more in product and partners.”
“The right license depends on how you acquire customers, which funds or assets you handle, who carries out the operations and what role your critical third parties play in the service chain.”
“A well-structured fintech does not just obtain authorization: it can sustain AML/KYC, governance, customer protection, outsourcing and evidence from day one.”
Getting the regulatory fit wrong is no minor problem: it delays the product, blocks investors, breaks partner agreements and can force you to rebuild the model from scratch.
The biggest mistake: assuming there is a generic “fintech license”. Without analyzing the service actually provided, the project is designed on a wrong premise from the start.
Each activity has its own lane: taking in funds, initiating payments, issuing electronic money, providing investment services or holding crypto-assets in custody are not the same thing. Confusing them is costly.
Product, legal and operations out of sync: when they move forward separately, contradictions appear between documentation, technology, contracts and operations, and the authorization pays for them later.
Choosing the wrong regulatory status forces you to redo contracts, governance, the risk map and your pitch to investors or banking partners.
Providing reserved financial services without prior authorization can lead to the immediate suspension of the activity and substantial penalties.
Banks, funds and investors require regulatory clarity before committing. A well-defined license speeds up funding rounds and commercial deals.
Before building the application, it pays to validate the regulatory fit, identify the competent supervisor and make sure product, operations and contracts point in the same direction.
There is no single fintech license as a legal category. “Fintech” describes a type of business, but authorization depends on the actual regulated activity the company will carry out.
A fintech may need to fit into payments, electronic money, investment, banking, crypto-assets or other regimes, or may not need a license at all if its role is purely technological and it does not carry out any reserved activity.
It depends on the service provided. Some models fit a payment institution (PI), others an electronic money institution (EMI), others investment services under MiFID II, a banking license or frameworks such as MiCA for crypto-assets.
The common mistake is choosing the entity type by comparison with competitors instead of reviewing what the company actually does in the service chain: whether it handles funds, intermediates, executes, holds assets in custody or only provides technology.
It depends on the type of activity. Projects linked to payments, electronic money or certain banking authorizations usually look to the Bank of Spain, while those related to investment services, securities markets or certain market activities may fall within the remit of the CNMV.
Choosing the wrong regulatory lane is no minor mistake: it shapes all the documentation, corporate governance, internal policies and costs of the project.
A fintech can act as a mere technology provider if it does not itself carry out any reserved activity and if its contractual and operational design genuinely reflects that role. Saying “we are software” is not enough if the functional reality is different.
When the company is involved in funds, execution decisions, account access, custody, financial onboarding or controls that form part of the regulated service, the analysis must be done carefully. Many “tech” structures hide a poorly mapped regulated activity.
The supervisor reviews consistency: activity, corporate structure, directors, capital, key functions, technology, outsourcing, risks, internal policies and the real capacity to operate in line with the authorization requested.
It also assesses the maturity of the project: whether legal, product and operations are aligned, whether critical third parties are properly governed and whether the model can sustain ongoing compliance once the license is granted.
Because in many fintechs the real risk lies not only in the idea but in how it is executed. The AML/KYC block, supplier relationships, subcontracting, SLAs and customer protection are central pieces of compliance.
When these matters are left until the end, the application loses strength and future operations become fragile. The supervisor, partner banks and investors want to see an orderly model, not a collection of patches.
There is no single answer, because there is no single fintech license either. Time and cost depend on the type of authorization, the complexity of the model and the starting point of the project.
What usually drives up the cost of these processes is starting without an assessment, redoing the regulatory fit halfway through or finding out late that actual operations do not match the entity type you intended to apply for. In financial regulation, preparing well from the start is almost always cheaper than correcting late.
The most important phase begins: operating as a supervised entity with ongoing compliance. If this phase is not designed in advance, problems appear when you scale, are audited or need to show that reality matches the authorized model.
Choosing the right license does not start with the application: it starts with understanding what the project actually does. That analysis defines the supervisor, the entity type, the documentation and the legal roadmap for the entire fintech.
It is understanding what service the project really provides: whether it handles funds, intermediates, executes, holds assets in custody or only provides technology. That analysis avoids confusing technology with regulation and saves months of delays.
The supervisor does not just read the dossier: it checks whether the app, fund flows, onboarding, partners and promises to customers are consistent with the regulatory status requested. Internal contradictions are the most common cause of requests for information.
Fintechs that design the post-license phase from the outset sustain growth better: live controls, traceable evidence, governed outsourcing and documentation that withstands due diligence, audits and real supervision.
If you want to structure the regulatory fit of your project, take a look at our fintech regulation services or request a direct analysis of how your model fits.
An effective fintech license is not a label: it is a set of consistent decisions (regulatory fit, application, AML/KYC, governance and ongoing compliance) that you demonstrate with traceability before any supervisor.
1) FitBeing a PI, an EMI, a PISP, an investment firm (ESI) or a pure technology provider is not the same thing. That decision shapes the supervisor, the capital, the application and the entire operational roadmap.
2) ApplicationProgram of operations, governance, policies, technology and outsourcing must fit together without contradictions. The supervisor reads the dossier, but also the reality behind it.
3) ComplianceAnti-money laundering, customer protection and third-party control are not add-ons. When they are designed late, the application loses strength and future operations remain fragile.
4) Post-licenseSustaining compliance, controlling third parties, handling complaints, reporting internally and keeping documentation alive is what turns the authorization into a genuinely supervisable entity.
Quick decisionPI or EMI, depending on whether you issue electronic money. Supervisor: Bank of Spain.
Investment firm (ESI), EAF or other MiFID entity types. Supervisor: CNMV. Conduct and reporting requirements.
MiCA framework: CASP authorization. Robust KYC, Travel Rule and specific AML.
A reasoned analysis of the actual activity and the legal status that corresponds to it, before opening the application.
Fit report, description of the actual service and comparison of the available regulatory entity types.
A consistent description of the business, customers, channels, technology and partners that supports supervisory review.
Detailed business description, financial projections, third-party contracts and functional organization chart.
Fit and proper directors, properly evidenced key functions, segregation of responsibilities and internal reporting.
Appointments, CVs, conflicts of interest policy, minutes and annual internal audit plan.
An anti-money laundering system proportionate to risk: onboarding, monitoring, escalation and reporting.
AML/CFT manual, KYC files, alert log and evidence of staff training.
Documented critical third parties: contracts, SLAs, security, continuity and an exit plan for contingencies.
Supplier register, contracts with SLAs, continuity policy and ICT incident reporting.
Spot them before you start the application, so you do not have to rebuild it halfway through.
If you are defining the regulatory fit of your fintech, these terms come up in the entity-type analysis, in the application and in your dealings with the supervisor. Understanding them well keeps you from choosing the wrong lane from the start.
Analysis of what the company actually does in the service chain and which legal status corresponds to it under the applicable rules.
A PI provides payment services; an EMI can also issue electronic money (wallets, prepaid). Different minimum capital and requirements. Supervisor: Bank of Spain.
Investment firms (ESI) and financial advisory firms (EAF) regulated under MiFID II. Supervisor: CNMV. They require conduct policies, suitability and specific reporting.
EU regulation that sets the authorization framework for CASPs (crypto-asset service providers): robust KYC, Travel Rule, safeguarding and specific AML.
PSD2 roles for operating in open banking without handling the funds themselves. A PISP initiates payments and an AISP aggregates bank account information. They require registration with the Bank of Spain.
Applicable since January 2025 to all regulated financial entities in the EU: ICT risk management, continuity, incident reporting and oversight of critical providers.
A system of controls to identify customers, assess risks, monitor transactions and document decisions. Mandatory for any regulated entity.
Heads of compliance, internal audit, risk and AML/CFT, who must be identified, be fit and proper, and have a real capacity to perform their role before the supervisor.
A set of controls, evidence and processes that allow the fintech to operate, grow and pass audits without compliance becoming an operational bottleneck.
Tell us about your project and we will explain which fintech license you really need and how to structure it operationally from the start.
In Spain there is no “fintech license” as a unified legal category. The regulatory framework that applies to a technology company operating in financial services depends exclusively on the actual activity it provides: whether it manages client funds, executes payments, provides investment services, issues electronic money or holds crypto-assets in custody. Each activity has its own rules, its own supervisor and its own capital, governance and compliance requirements.
The Bank of Spain supervises payment institutions (PIs), electronic money institutions (EMIs) and credit institutions authorized in Spain. The applicable legal framework includes Royal Decree-law 19/2018 (PSD2 transposition), Law 21/2011 on electronic money and Law 10/2014 on the regulation, supervision and solvency of credit institutions. Prior authorization is mandatory before providing any of these services.
The National Securities Market Commission (CNMV) supervises investment firms (ESIs) and financial advisory firms (EAFs), which operate under the framework of the MiFID II Directive and its Spanish transposition. Fintechs with an investment component, distribution of financial instruments or wealth advisory services must analyze whether their model falls into this category before operating.
The MiCA Regulation sets the authorization framework for crypto-asset service providers (CASPs) across the European Union. It requires authorization as a CASP, capital requirements, safeguarding of assets, specific AML/KYC policies, compliance with the Travel Rule and regulatory reporting. The CNMV is the competent authority in Spain for the supervision of CASPs.
Since January 2025, the DORA Regulation has applied on a mandatory basis to all regulated financial entities in the EU: PIs, EMIs, investment firms (ESIs), EAFs, CASPs and credit institutions. It requires an ICT risk management framework, a business continuity policy, incident logging and reporting, and oversight of critical technology providers. Any fintech that obtains a license must adapt its model to DORA from day one.
Key legislation, linked to the official text:
Legislation and links reviewed in .