It is the document the CNMV checks everything else against: services, instruments, client type, organization, resources and outsourcing. We draft it to match how you actually operate and ready for future amendments.
Preparing or amending a programme of operations?
Tell us which services you want to provide and we will tell you how to reflect them without triggering unnecessary requirements.
It is not just another form: it is the backbone of the application. This is how it fits into each type of authorization we handle.
We draft the programme of operations as the core of any investment firm application: we define services and activities, instruments and client type so that the rest of the documentation fits without contradictions.
In an EAF, the programme decides almost everything: whether the advice will be independent or not, which instruments the product range covers and which human resources justify the model. We design it together with the business plan.
The complete application for your Financial Advisory Firm (EAF), with the programme of operations as its centerpiece.
The more reserved services, the more demanding the programme: in a broker-dealer (SV), each activity adds organization, capital and controls.
Delegated functions are declared in the programme and require effective control: we help you structure them properly.
The programme is not filed away: when the business changes, the amendment is filed with the CNMV before you operate differently.
Four real situations in which this document decides the fate of the application or of the already authorized firm.
“My business plan was crystal clear, but when we turned it into the programme of operations we found that my app did things that pointed to a different license type. Better to see it now than in a request for information.”
“We want to add the placing of issues to our business. That can’t be improvised: it is an amendment to the programme that has to be filed with the CNMV, with new resources and controls.”
“In the annual review we saw that our actual operations no longer matched the approved programme. Regularizing it in time meant we did not face an inspection with that gap still open.”
“When we set up the portfolio management company, we were asked to describe our technical and human resources in far more detail than we expected. The programme was what saved us the most requests for information.”
Almost all CNMV requests for information on this document follow the same patterns. Spotting them before filing saves entire rounds of corrections.
Internal inconsistency: the financial plan projects revenue from a service that the programme does not include, or the organizational chart assigns functions to people the resources section does not mention. The CNMV cross-checks all the documents against each other.
Overreaching programme: requesting services “just in case” raises the license type needed and the capital and controls required. Every declared activity must come with real resources to provide it.
Operating outside the programme: launching a service or instrument that is not included without first filing the amendment leaves the firm carrying on an activity without coverage, with supervisory and disciplinary consequences.
| Programme block | What it must reflect | Typical mistake |
|---|---|---|
| Services, instruments and clients | The exact investment and ancillary services, the instruments they will cover and the client type (retail, professional, eligible counterparty), aligned with the business plan. | Declaring services that will not be provided “to leave room”: they trigger capital, organization and requirements with no revenue to justify them. |
| Organization and resources | A real organizational chart, control functions with named holders, and technical and human resources proportionate to the declared activity. | Describing a staff structure that does not exist, or assigning compliance, risk and audit to people without demonstrable time commitment or expertise. |
| Delegation and outsourcing | Which functions are outsourced, to which provider, and how the firm retains control of and responsibility for what is delegated. | Outsourcing critical functions without contracts, without monitoring and without internal capacity to supervise: responsibility is never delegated. |
We draft it based on how you actually operate: we define services and instruments, size resources and organization, structure outsourcing and leave the document ready for the CNMV to check the rest of the application against it without finding cracks.
It is the document in the authorization application that describes what the firm will do and with what resources: investment and ancillary services, financial instruments, client type, internal organization, technical and human resources, and planned delegation or outsourcing.
Under Law 6/2023 and Royal Decree 813/2023, it works as the firm’s official map: it defines the scope within which the firm is authorized to operate.
Because that is literally how it reviews applications. The supervisor cross-checks the programme against the financial plan (does the projected revenue come from the declared services?), the fit and proper assessment of directors and senior managers (do they know the business the firm says it will carry on?), the MiFID II policies (do they cover the services and instruments in the programme?) and the resources described.
Any contradiction between documents leads to a request for information. That is why it makes sense to draft the programme first and build the rest of the application from it, not the other way around.
The essential blocks are:
Indirectly, yes: the services you declare determine the license type, and the license type carries the initial capital set by the IFR/IFD prudential regime. As a guide: an EAF or a portfolio management company starts at €75,000, a securities broker (agencia de valores) at €150,000 and a broker-dealer (sociedad de valores) at €750,000.
Hence the real cost of an overreaching programme: each service added “just in case” can raise the license type required and, with it, capital, structure and ongoing obligations. We also explain this in how to set up an EAF.
You are operating outside the scope of your authorization. Depending on the service, this can range from an organizational breach to providing a reserved investment service without coverage, which the law treats as a very serious infringement.
The operating rule is simple: before launching a new service, instrument or channel, check whether it fits within the approved programme; if it does not, the amendment is filed with the CNMV before you start, not after.
Amendments are filed with the CNMV itself, with documentation proportionate to the change: adjusting a distribution channel is not the same as adding a new investment service, which may require reviewing resources, policies and even prudential requirements.
As a general rule, it makes sense to treat each significant business change as a mini-application: describe the change, size the resources it needs and show that the controls cover it. It is part of the ongoing compliance we review in EAF obligations.
By declaring it and demonstrating control. The programme must identify which functions are outsourced (for example, systems, administration or part of the control functions), to which providers and with what supervision mechanisms.
The firm always retains responsibility for what is delegated, and the CNMV expects to see adequate contracts, documented monitoring and real internal capacity to supervise the provider. We have a dedicated page on outsourcing of critical functions.
You can, but it is the shortest route to a round of requests for information: templates describe generic firms, and the CNMV quickly spots when the text does not match the financial plan, the team or the technology of the specific project.
Our approach is the opposite: we start from your business model, define only the services that are strictly necessary and draft the programme so that every statement is verifiable with evidence. If you are at the design stage, start with investment firm authorization or setting up an EAF.
Order matters: first the model, then the scope of services, then resources and controls. This is the sequence we follow in every application.
We translate your plan into regulatory language: which investment and ancillary services you really need, on which instruments and for which clients. This is where the license type is decided and, with it, capital and structure.
We size the organizational chart, control functions and technical and human resources in proportion to the activity, and we structure outsourcing with its supervision mechanisms.
We check that the financial plan, policies, fit and proper assessment and technology tell the same story as the programme, and we set up the internal process for handling future amendments.
If the programme is part of a full application, see our investment firm authorization and EAF authorization services.
The 10 steps to set up your Financial Advisory Firm (EAF) before the CNMV, with the evidence you must be able to show at each one. Keep it at hand throughout the project.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These are the concepts you will work with when drafting the programme and answering CNMV requests for information about it.
It describes services, instruments, clients, organization, resources and outsourcing. It defines the investment firm’s authorized scope.
Advice, portfolio management, reception and transmission of orders, execution, placing... Each one requires express authorization.
Activities such as advice to undertakings or preparing reports, which accompany the main services in the programme.
Retail, professional or eligible counterparty: the classification determines the protections, tests and documentation for each service.
Compliance, risk management and internal audit, with identified holders and proportionate to the size of the firm.
The team, systems and tools used to provide the declared services. They must exist at launch, not in the future plan.
Delegating functions to providers is possible if it is declared, properly contracted and supervised. Responsibility is not transferred.
Programme, financial plan, policies, fit and proper assessment and technology must tell the same story. Every contradiction is a request for information.
Adding significant services, instruments or channels requires filing the amendment with the CNMV before operating differently.
A defined and justified scope: each declared service with specific instruments and a business reason behind it.
Financial plan (revenue lines), business model description and the chosen license type with its initial capital.
Clarity on who is served (retail, professional, eligible counterparty) and through which channels clients are acquired and served.
Client classification policies, onboarding procedures and planned marketing materials.
Proportionate governance and structure, with control functions assigned to holders with a real time commitment.
Organizational chart, fit and proper assessment of directors and senior managers, and description of key positions.
A team and systems sufficient for the declared activity from the first day of operations.
Headcount by function, qualifications of advisory staff and inventory of tools and technology providers.
Outsourced functions identified, with specific providers and demonstrable internal control over what is delegated.
Outsourcing contracts, monitoring procedures and assessment of critical providers.
If any of these sound familiar, fix them before filing: each of these cracks usually turns into a request for information.
The content of the programme depends on earlier decisions (which license type, which officers, which prudential regime) and shapes the firm’s later life. These pages help you make those decisions with sound judgment before you write a single line of the programme of operations.
The complete guide to a Financial Advisory Firm (EAF) application: license type, capital, policies and timelines.
How the authorization procedure works, which documents it involves and where the months are lost.
Directors and senior managers must know how to do what the programme says the firm will do. This is how it is demonstrated.
The services in the programme determine your prudential class and your own funds. Understand the link before you declare them.
If your project is an EAF, start with EAF authorization; if it points to more services, see the securities broker (agencia de valores), the broker-dealer (sociedad de valores) or the portfolio management company.
Tell us which investment services you want to provide and we will design with you a programme of operations that the CNMV can check without finding gaps.
In every authorization application for an investment firm (broker-dealer, securities broker, portfolio management company or EAF), one document organizes all the others: the programme of operations. Governed by Law 6/2023 and Royal Decree 813/2023, it describes which services the firm will provide, on which instruments, for which clients and with what organization and resources. It is not a descriptive formality: it defines the scope within which the firm is authorized to operate, and the CNMV uses it as the benchmark when reviewing the rest of the application.
The document is organized in blocks: the investment and ancillary services to be provided; the financial instruments each service will cover; the client type the firm targets (retail, professional or eligible counterparty) and its acquisition channels; the internal organization, including control functions; the available technical and human resources; and the planned delegation and outsourcing, with their supervision mechanisms. The combination of declared services also determines the license type required and, with it, the initial capital under the IFR/IFD prudential regime: €75,000 for EAFs and portfolio management companies, €150,000 for securities brokers and €750,000 for broker-dealers.
The CNMV’s review is, in essence, a cross-checking exercise. The financial plan must generate revenue only from the services the programme declares; the fit and proper assessment of senior officers must show experience in those same activities; the MiFID II policies must cover exactly the services and instruments described; and the technical and human resources must be proportionate to the projected business. Every contradiction between documents turns into a request for information to fix it, and rounds of requests are where applications lose months. That is why the right method is to draft the programme first and then build the rest of the application from it.
The most expensive mistake is the overreaching programme: declaring services that will not be provided “to leave room” raises the license type, capital and controls required with no revenue to justify them. The opposite mistake also comes at a cost: falling short means filing for an extension a few months later. The practical rule is to declare the scope that the business plan needs over a reasonable horizon, with real resources to support it. We explain how this works for each license type in how to set up an EAF and in investment firm authorization by the CNMV.
The approved programme is not a dead file: when the firm wants to add significant services, instruments or channels, the amendment is filed with the CNMV before it changes how it operates. Operating outside the programme leaves the firm without coverage for that activity, with consequences that can amount to a very serious infringement if a reserved service is involved. A well-run investment firm periodically reviews whether its actual operations still match the approved programme, as part of the ongoing compliance we describe in EAF obligations and in investment firm risk management.
Key legislation, linked to the official text:
Legislation and links reviewed in .