We design and strengthen the risk management framework of your investment firm (ESI) supervised by the CNMV: risk map, risk unit and risk committee, compliance function, internal audit, IFR/IFD prudential framework and supervisory reporting. A coherent, proportionate and defensible model.
Free consultation
We reply within 24 h
Six building blocks that make up a coherent, proportionate risk management framework that any investment firm can defend before the CNMV.
We identify and classify your firm’s relevant risks—credit, market, liquidity, operational, concentration, technology and compliance—and translate them into a risk profile aligned with the RtC/RtM/RtF approach of the prudential framework.
We design the independent risk management function, the risk committee and their reporting to the management body under Royal Decree 813/2023 and Law 6/2023 (LMVSI), with a scope proportionate to the size of the firm.
We set up the compliance function required by MiFID II: conduct control, suitability, conflicts of interest, product governance and reporting to the supervisor.
We define the third line of defense: an annual internal audit plan, independent review of controls and follow-up of recommendations and findings.
We analyze K-factor own funds requirements, initial capital and your investment firm’s classification under Regulation (EU) 2019/2033 (IFR) and Directive (EU) 2019/2034 (IFD).
We integrate technology risk into the investment firm’s framework: ICT risk management, business continuity, incident reporting and oversight of critical providers under DORA.
Broker-dealers, securities brokers, portfolio management companies or financial advisory firms: each type has its own risk profile, capital and internal organization requirements before the CNMV.
“Because it can deal on its own account and underwrite issues, a broker-dealer concentrates market and counterparty risk: it needs the highest initial capital and a robust risk framework.”
“A securities broker acts on behalf of clients. The risk focus shifts to operational risk, the safekeeping of client funds and instruments, and compliance risk.”
“A portfolio management company manages on a discretionary basis: controls focus on suitability, conflicts of interest, best execution and reputational risk.”
“A financial advisory firm has a low risk profile, but it must still have a risk and compliance framework proportionate to its activity before the CNMV.”
A weak or merely formal risk framework leads to CNMV requests for information, additional capital requirements, penalties and reputational damage that constrain the firm’s activity.
The most common mistake: treating the risk function as a document rather than a living function. When the risk committee keeps no evidence, minutes or follow-up, the model does not survive a supervisory review.
The CNMV assesses internal organization, not just paperwork: if the risk map, governance, compliance function and internal audit do not fit together, the supervisory review process detects the gaps.
The prudential framework is proportionate but demanding: under IFR/IFD, own funds are calculated using K-factors, and the CNMV can impose additional capital requirements if the risk assessment proves insufficient.
If the CNMV considers that risks are not sufficiently covered, it can require additional own funds above the IFR requirement.
Deficiencies in internal organization and risk management are classified as infringements in the LMVSI and can lead to penalties and liability for directors.
A control incident or a public reprimand erodes relationships with clients, counterparties and custodians, and hurts the business.
Before an inspection or an authorization, it is worth reviewing the risk map, internal governance, control functions and own funds calculation to make sure the model withstands supervisory review.
It is the set of policies, functions and procedures that an investment firm puts in place to identify, measure, monitor and mitigate the risks arising from its activity. It includes the risk management function, the risk committee, the compliance function and internal audit.
It is not a paperwork exercise: the CNMV looks for a real, proportionate internal organization able to sustain the activity, with controls that are actually performed and evidenced.
The main framework is Law 6/2023 of March 17 on Securities Markets and Investment Services (LMVSI) and its implementing regulation, Royal Decree 813/2023 of November 8, which repealed Royal Decree 217/2008.
On top of that come MiFID II (Directive 2014/65/EU) and Delegated Regulation (EU) 2017/565, plus the IFR/IFD prudential framework: Regulation (EU) 2019/2033 and Directive (EU) 2019/2034.
The LMVSI regulates risk management and the risk committee and, as a new feature compared with the previous regime, extends this requirement to small and non-interconnected investment firms (ESIPNI) as well, leaving the details to proportionate implementing regulations.
In practice, the scope and formality of the committee are scaled to the size, nature and complexity of the firm. We analyze which setup fits your investment firm.
It is the specific prudential regime for investment firms, made up of Regulation (EU) 2019/2033 (IFR) and Directive (EU) 2019/2034 (IFD), the latter transposed into Spanish law by the LMVSI and Royal Decree 813/2023.
It replaces the general application of the banking framework (CRR/CRD) with a model proportionate to risk and size, based on K-factors.
It is the benchmark internal control model:
The CNMV expects these lines to be clearly separated and to have independence and resources.
The risk management function identifies and measures risks and ensures they are kept under control; the compliance function monitors adherence to conduct rules (MiFID II) and conflicts of interest; internal audit independently reviews that both work.
They are separate functions and, to the extent proportionality allows, independent from each other and from the business.
It reviews the consistency and adequacy of the internal organization: risk map and risk appetite, corporate governance, fitness and propriety of directors and key function holders, conflicts of interest and remuneration policies, the control system and evidence that it works.
As part of the supervisory review, it can request information, require corrective measures and impose additional own funds requirements.
As a general rule: credit and counterparty, market, liquidity, operational, concentration, technology (ICT), compliance and reputational risk.
The IFR framework also groups risk into three main blocks—risk to client (RtC), risk to market (RtM) and risk to firm (RtF)—which drive the K-factor own funds calculation.
A small and non-interconnected investment firm: an investment firm that, given its size and activity, meets the thresholds that exempt it from the most burdensome requirements of the prudential framework (for example, average revenue from investment services below €30 million, among other criteria). It is subject to a simplified, proportionate regime.
They are the parameters the IFR uses to calculate investment firms’ own funds requirements based on the risk they generate. They fall into three groups: risk to client (RtC), risk to market (RtM) and risk to firm (RtF), and measure variables such as assets under management, client orders handled or client money held.
The largest and most interconnected investment firms (with consolidated assets above certain thresholds) may become subject to the banking framework and, where applicable, be required to apply for authorization as a credit institution. The CNMV can also require certain firms to apply CRR requirements because of their systemic relevance.
The DORA Regulation, applicable since January 2025, requires investment firms to have a technology risk management framework: ICT governance, business continuity, incident recording and reporting, resilience testing and oversight of critical providers. It is one more piece of the risk framework, not a separate silo.
It depends on the type of firm. As a guide under the IFD / Royal Decree 813/2023 framework: €750,000 for broker-dealers that deal on own account or underwrite issues; €150,000 for securities brokers; and €75,000 for portfolio management companies and financial advisory firms. The exact amount must be confirmed based on the authorized services.
The Investment Guarantee Fund (FOGAIN) covers clients of investment firms if the firm becomes insolvent, within the legal limits. Membership and contributions depend on the type of investment firm; certain EAFs and EAFNs have a specific regime under the LMVSI.
Not all investment firms have the same risk profile or the same requirements. Initial capital and the scope of the control framework depend on the services the firm provides.
The control effort depends on two blocks: the risk profile arising from the authorized services and the applicable prudential framework (investment firm class under IFR/IFD).
Before implementing anything, we complete the assessment of the risk profile and the investment firm class. That way the framework is proportionate: neither oversized nor insufficient for the CNMV.
| Investment firm type | Broker-dealer (sociedad de valores) | Securities broker (agencia de valores) | Portfolio manager | EAFN |
|---|---|---|---|---|
| Initial capital (indicative) | €750,000 | €150,000 (€75,000 without custody) | €75,000 | €75,000 |
| Deals on own account | Yes | No | No | No |
| Holds client funds and instruments | Yes | Possible | No | No |
| Predominant risk | Market and counterparty | Operational and custody | Conflicts and suitability | Compliance (low) |
| Risk committee and risk function | Yes | Yes | Yes | Proportionate |
| Supervisor | CNMV | CNMV | CNMV | CNMV |
Indicative figures for comparison purposes. The exact initial capital, prudential class and scope of the risk framework depend on the specific investment services the firm provides and must be confirmed case by case under the LMVSI, Royal Decree 813/2023 and IFR/IFD.
An effective risk framework is not a manual: it is a system that shows consistency between governance, control functions, capital and evidence. The key is to build something proportionate that withstands the CNMV’s supervisory review.
The supervisor analyzes whether the internal organization supports the activity: fit and proper directors, key functions with real independence, consistent policies and evidence that controls are actually performed.
The risk map, the risk appetite and the committee’s reporting to the management body should be designed before capital. Without them, the own funds calculation has no foundation.
Compliance, internal audit, confidential regulatory reporting and DORA must be sustained over time, not just to obtain authorization or pass a one-off inspection.
If you want to structure or review your investment firm’s risk framework, see our securities market regulation services or our corporate compliance practice.
An effective risk framework is not a dossier: it is a set of consistent decisions (risk map, governance and control functions, own funds and reporting) demonstrated through traceability. Here is a panel showing how it works in practice.
1) Risk mapThe goal is not to fill in a template: it is to identify the firm’s real risks and set a risk appetite that shapes decisions and capital.
2) GovernanceThe risk function, the risk committee and its reporting to the management body must fit with compliance and internal audit, without overlaps or gaps.
3) CapitalThe K-factor calculation and the initial capital must be consistent with the risk profile. A weak calculation leads to CNMV requests for information.
4) Ongoing controlCompliance, internal audit, DORA, reporting and follow-up turn the framework into a real function: reviews, corrections and live evidence from day one.
Quick decisionLarge, interconnected investment firm: may become subject to the banking framework (CRR/CRD) or need a credit institution license.
Standard investment firm: K-factor own funds, risk committee and full internal organization.
Small and non-interconnected investment firm: simplified, proportionate regime, while still controlling its risks.
Identification of relevant risks and limits consistent with the business model and the investment firm class.
Risk appetite statement, risk map and policies by risk category.
An independent function that measures, monitors and reports risks to the management body.
Appointment of the head of risk, risk reports and periodic reporting to the board.
A body with proportionate composition and meeting frequency that advises on risk strategy.
Committee terms of reference, minutes, agendas and follow-up of decisions.
Monitoring of MiFID II conduct, conflicts of interest and product governance.
Compliance manual, annual report, conflicts register and evidence of controls.
Independent review of the effectiveness of risk management and compliance.
Annual audit plan, review reports and follow-up of recommendations.
K-factor calculation, initial capital and sufficient coverage of the risk profile.
Own funds calculation report, confidential regulatory returns and capital assessment.
Spot them before an authorization or an inspection to avoid requests for information and corrective measures.
If you are structuring the risk framework of an investment firm, these terms come up in internal policies, reports and dealings with the CNMV.
A firm authorized by the CNMV to provide investment services: broker-dealers, securities brokers, portfolio management companies and financial advisory firms.
An independent function that identifies, measures and monitors the firm’s risks and reports to the management body. It may rely on a risk management unit.
A body that advises the board on risk strategy and risk appetite. The LMVSI requires it on a proportionate basis, including for ESIPNIs.
Regulation (EU) 2019/2033 (IFR) and Directive (EU) 2019/2034 (IFD): a prudential regime proportionate to the investment firm’s risk and size, distinct from the banking framework.
IFR parameters for calculating own funds according to risk: risk to client (RtC), risk to market (RtM) and risk to the firm itself (RtF).
Control model: business (1st), risk management and compliance (2nd) and internal audit (3rd). They must be separate and independent.
An investment firm that meets the thresholds exempting it from the most burdensome prudential requirements. It is subject to a simplified, proportionate regime.
EU regulation applicable since January 2025 that requires ICT risk management, business continuity, incident reporting and oversight of critical providers.
Periodic information that investment firms send to the CNMV on solvency, activity and risks, under the CNMV’s circulars. The basis of ongoing supervision.
Download our guide with the full framework: internal organization, control functions, risk committee, IFR/IFD framework and preparation for supervisory review.
Tell us about your investment firm and we will explain how to structure or strengthen its risk control framework before the CNMV.
In Spain, risk control and risk management at investment firms are built on Law 6/2023 of March 17 on Securities Markets and Investment Services (LMVSI) and its implementing regulation, Royal Decree 813/2023 of November 8, which repealed Royal Decree 217/2008 and completed the transposition of Directive (EU) 2019/2034 (IFD). Supervision lies with the CNMV, which assesses the internal organization, the fitness and propriety of directors and key function holders, and the adequacy of the risk management framework.
Royal Decree 813/2023 sets out the internal organization measures—risk management, the risk management unit, conflicts of interest and records—and, for large and interconnected firms, internal governance and the treatment of risks through a risk committee. The LMVSI regulates risk management and extends the risk committee obligation to small and non-interconnected investment firms as well, with implementing rules proportionate to the size and profile of the firm.
The prudential regime for investment firms is governed by Regulation (EU) 2019/2033 (IFR) and Directive (EU) 2019/2034 (IFD), which replace the general application of the banking framework with a risk-proportionate model. Own funds requirements are calculated using K-factors, grouped into risk to client (RtC), risk to market (RtM) and risk to firm (RtF). The most systemically relevant investment firms may become subject to the banking framework or need authorization as a credit institution.
On top of the organizational rules sit the MiFID II conduct rules (Directive 2014/65/EU) and Delegated Regulation (EU) 2017/565: suitability, conflicts of interest and product governance. The control model rests on three lines of defense—business, risk and compliance functions, and internal audit—which the CNMV expects to be separate, independent and properly resourced.
As part of the supervisory review, the CNMV can request information, require corrective measures and impose additional own funds requirements when it considers that risks are not sufficiently covered. A consistent, well-evidenced risk framework reduces the risk of requests for information and sanction proceedings.
Key legislation, linked to the official text:
Legislation and links reviewed in .