Investment Firm License in Spain (CNMV ESI Authorization)
We guide you through the investment firm license process in Spain before the CNMV (Spanish Securities Market Commission): defining your business model, preparing the application file and the programme of operations, internal control, MiFID policies, AML/CFT, outsourcing and operational evidence. The goal is an investment firm (ESI) that is defensible and aligned with how you actually operate.
Free consultation
We reply within 24h
What does a well-prepared ESI authorization include?
It is not just about submitting documents. The key is that the application file, the organization and day-to-day operations fit together, so they can withstand the CNMV's review and support the launch of the business without having to redo everything later.
Diagnosis and regulatory perimeter
We define which investment services you will provide, your client type, channels, critical functions and the applicable regime before building the application file.
Application and programme of operations
We organize the descriptive reports, organization chart, resources, services, procedures and evidence so the application is consistent and defensible before the CNMV.
Governing bodies, key functions and internal control
We turn responsibilities, internal reporting, oversight and records into practice, so the structure is operational rather than merely formal.
Conduct of business and investor protection policies
Conflicts of interest, suitability or appropriateness, inducements, client information, complaints, record-keeping and best execution where applicable.
AML/CFT and third-party relationships
We integrate AML/CFT, governance of critical service providers, contractual clauses, monitoring and control traceability to reduce supervisory friction.
Launch and information requests
Support with remedying deficiencies, training, adjustments and evidence review, so you reach authorization and operate with a sustainable model.
How we handle an investment firm license in Spain
The structure is simple: the right regulatory fit, a consistent application file, solid answers to information requests and real readiness to operate from day one.
Diagnosis and roadmap
We review your model, services, organization, outsourcing, controls and gaps to decide what needs to be built and in what order.
CNMV application file
We draft and organize the programme of operations, policies, procedures, functions, resources and evidence so that everything is internally consistent.
Information requests and remediation
We answer the CNMV's observations with technical and legal precision, avoiding contradictions between annexes, the organization chart and actual operations.
Implementation and go-live
We get records, training, reporting and controls ready, so the authorization is not just a paperwork milestone but a working operating model.
Entities and projects we work with
.png)
Investment firms, brokers and broker-dealers
Corporate structure, board of directors, key functions, application file and control model to provide investment services with CNMV authorization.
.png)
Investment fintechs
Digital advice, intermediation or portfolio management models that need a proper MiFID fit, operational evidence and technology governance.
.png)
EAFs, family offices and financial advice
Registration, suitability, conflicts of interest and transparency policies, and adapting the model when the activity calls for a regulated structure or a move up to ESI status.
What happens if the application file or your operations are poorly designed
The problem is not just that it takes longer. A poor regulatory fit or weak documentation leads to repeated information requests, delays, friction with third parties and greater supervisory exposure.
Information requests due to inconsistencies
Reports, annexes, functions and policies that do not fit together trigger requests to remedy deficiencies and drag out the process for no good reason.
“Paper-only” internal control
Without records, reporting and clear owners, the model is fragile and very hard to defend during supervision or operational incidents.
Reputational and commercial risk
Without authorization, or with open regulatory questions, you run into roadblocks with partners, banks, service providers, investors and institutional clients.
A weak business launch
Launching without processes, training and evidence forces you to rewrite procedures on the fly and increases the risk of non-compliance from the outset.
Need to obtain your CNMV authorization as an investment firm with legal certainty?
We prepare the application file, the programme of operations, MiFID policies, internal control, the AML/CFT component and the evidence you need, so your model reaches the CNMV better prepared.
Request a quote →Services related to ESI authorization
Other securities market and CNMV services that complement your investment firm authorization.
CNMV authorization
Pre-notification, application file, remediation and responses to information requests for regulatory applications before the CNMV.
→ EAFFinancial advisory firm (EAF) registration
Regulatory fit, application file and compliance for financial advisory models supervised by the CNMV.
→ MiFID IIMiFID II compliance advice
Suitability, conflicts of interest, inducements, best execution, reporting and evidence for defensible ongoing compliance.
→ CertificationsCNMV MiFID II certifications
Qualification requirements for staff who advise on or provide information about financial instruments.
→ InvestmentFunding rounds
Investment documentation, term sheets, shareholders' agreements and structures for primary market transactions.
→ Due diligenceFinancial assessment of projects
Legal and financial analysis and review of regulatory risks for investment transactions and growth decisions.
→ESI authorization in Spain: frequently asked questions
What is an investment firm (ESI) and when do I need authorization?
An investment firm (ESI, empresa de servicios de inversión) is an entity that provides services such as investment advice, reception and transmission of orders, execution, portfolio management, placing or underwriting on a professional basis. If your activity falls within that perimeter, you need prior authorization from the CNMV before you start operating.
What does the ESI authorization application file include?
It includes the business model, programme of operations, human and technical resources, organization chart, key functions, policies and procedures, governance, internal control and evidence.
- Services and target clients.
- Outsourcing and critical service providers.
- MiFID policies and records.
- Organization and responsibilities.
Which policies are critical for an investment firm?
It depends on the scope, but the essentials are usually the policies on conflicts of interest, client classification, suitability or appropriateness, inducements, complaints, record-keeping, best execution where applicable, outsourcing, security and business continuity.
How important is internal control?
Extremely important. Internal control is what turns the application file into a model that can actually be supervised: who approves, what is reviewed, what is recorded and how it is reported to the board of directors.
Are an EAF and an ESI the same thing?
No. An EAF (financial advisory firm) focuses on financial advice. An ESI (investment firm) can cover a wider range of investment services, with more demanding organizational and operational requirements.
What usually triggers the most CNMV information requests?
Inconsistencies between documents, lack of evidence, key functions that are not properly put into practice, generic policies disconnected from actual operations, and outsourcing without real governance or monitoring.
How long does it take to get an investment firm license in Spain?
It depends on the type of entity, the complexity of the model and the quality of the application file. What usually causes the most delay is the “back and forth” over avoidable requests to remedy deficiencies.
How do you help with the process?
We work from the initial regulatory fit through to launch: diagnosis, application file, policies, internal control, AML/CFT, responses to information requests and operational readiness for go-live.