Lending without a license in Spain: reserved activities

Spanish financial law does not prohibit an activity in general terms and then authorize exceptions. It does something different and stricter: it lists who may carry it out and then expressly prohibits anyone else from doing so. This technique is called a reserved activity (reserva de actividad), and it is repeated, with the same structure, in the three areas that matter here: payment services, the issuance of electronic money and lending activity.

In practice, the right question is never “is this prohibited?”. The question is “am I on the list?”. And if you are not, it does not matter how reasonable your model is, how small the volume or how well-intentioned the project: you are outside the permitted perimeter.

It is also worth distinguishing three situations that are constantly confused and have very different consequences:

• Non-reserved activity. What you do simply does not fit any of the legal definitions. You need nothing, but it is advisable to have this documented.
• Reserved activity with a legal exclusion. It fits the definition, but the law itself excludes it from its scope. You have to prove the exclusion applies, and it is usually narrower than it looks.
• Reserved activity with an exemption regime. It is inside, but there is a lighter regime — usually volume-based — that avoids the full license. It almost always requires prior registration: the exemption does not apply on its own.

That third point is the one that sinks the most projects. Being exempt does not mean doing nothing; it means going through a different, lighter procedure. Anyone who operates believing they are exempt without having registered is in exactly the same position as someone operating without a license.

Article 5 of Royal Decree-law 19/2018 sets the list. Only four categories of providers may provide payment services on a professional basis: credit institutions, including Spanish branches of foreign credit institutions; electronic money institutions, insofar as the services provided by the branches are linked to the issuance of electronic money; payment institutions regulated in Title I and the entities under the regimes of Articles 14 and 15; and the Sociedad Estatal de Correos y Telégrafos (the Spanish state postal company), for the services it is empowered to provide under its specific rules.

Added to those four, when they are not acting in their capacity as public authorities, are the European Central Bank, the Bank of Spain and the other national central banks, and the central government (Administración General del Estado), the Autonomous Communities and local authorities.

And then comes paragraph 3, which allows no nuanced reading: “Any natural or legal person that is not a payment service provider and is not explicitly excluded from the scope of this royal decree-law is prohibited from providing any of the payment services listed in Article 1.”

Two nuances are often overlooked. First, the reference to entities under Articles 14 and 15 means the list includes exempt entities, which are legitimate providers even without a full license — as long as they are registered. Second, holding a license for some payment services does not make you an authorized provider of others. The authorization specifies which services it covers, and providing a different one puts you back up against the same prohibition. If that is your case, the way forward is extending your license.

The critical boundary here is not the list of issuers but the definition of electronic money that the prohibition refers to. Many prepaid balance products, platform wallets and internal marketplace accounts sit on that boundary without anyone ever having analyzed it. The deciding question is not whether you call it a wallet, but whether there is stored monetary value that represents a claim on the issuer and is accepted by third parties other than the issuer.

It is also worth cross-checking this analysis against the electronic money institution license: the same operation can fall outside the electronic money perimeter and inside the payment services perimeter, or the other way around. They are two separate reservations, with two separate lists, and you have to answer both.

Taking repayable funds from the public is reserved to credit institutions, and Article 3(3) of Law 10/2014 puts it in the broadest terms: “Any natural or legal person not authorized or registered as a credit institution is prohibited from carrying out the activities legally reserved to credit institutions and from using the names proper to them or any others that may lead to confusion with them.”

Granting credit, by contrast, has not traditionally been reserved with the same intensity. Financial credit establishments, regulated in Article 6 of Law 5/2015, are companies that, without being credit institutions, may engage professionally in granting loans and credit, factoring, financial leasing, granting guarantees and sureties and reverse mortgages, among other activities. Their structural limit is that they may not take repayable funds from the public, although they may issue securities under securities market rules or securitize assets.

For years, the result has been a wide space of lenders that grant credit without being supervised entities, subject to transparency and consumer protection rules but not to a prudential authorization regime. That space is precisely what the consumer credit reform is set to close. And that is why this page is relevant today to many more businesses than a year ago.

This second reservation is breached surprisingly often, and almost always in the same place: marketing materials. Calling a product that is not a bank “your digital bank”, or calling what is a technical wallet “your account”, is not poetic license. The prohibition in Article 3(3) of Law 10/2014 expressly covers names “that may lead to confusion”, and that standard is measured by how the recipient perceives it, not by what the issuer intended.

The financial credit establishment also has a reverse, little-known twist: the name is not only reserved, its use is mandatory. An authorized EFC must include “EFC” in its corporate name. It is not a branding choice.

First route: stay outside the definition. It is the cleanest and the most underused, because it requires a good understanding of the legal definition before designing the product. Changing who holds the funds, who holds the customer relationship or when the transfer of value takes place can take an entire operation outside the perimeter. It is a product architecture decision, not a drafting trick: if the actual flow of funds does not change, neither does the legal classification.

Second route: rely on a legal exclusion. The payment services and electronic money rules contain lists of operations excluded from their scope. They are narrower than they look, and applying them usually requires proving factual elements — the scope of the network, the purpose of the instrument, the nature of the commercial agent — so it is advisable to document them before relying on them, not after a request for information.

Third route: the volume-based exemption regime. It is the most overlooked and is often the right answer for projects that are just starting. Article 5 of Royal Decree-law 19/2018 itself includes among legitimate providers the entities under Articles 14 and 15, which are lighter regimes. And there is a relevant timing point: according to the Bank of Spain’s Information Guide, the procedure for Article 14 exempt entities is decided within twenty days and, unlike full authorization, if there is no decision in time the application is deemed approved.

But the usual warning applies: being exempt is not the same as doing nothing. The exemption requires prior registration and works on thresholds that must be monitored continuously, because exceeding them takes you out of the regime. If your project may fit here, the starting point is the small (low-volume) payment institution.

Directive (EU) 2023/2225 — known as CCD2 — had to be transposed by November 20, 2025, and its provisions apply from November 20, 2026. Spain is running late: the draft bill (anteproyecto) on consumer credit agreements was put out for public consultation on January 8, 2026 and has not yet been approved.

What matters for this page is that the draft bill creates two new ways into the supervised perimeter, both before the Bank of Spain:

• The authorized high-cost lender, regulated in Chapter II of its Title I. Authorization is granted by the Bank of Spain, and the planned minimum share capital is €300,000, fully paid up, with a capital company incorporated by simultaneous formation, registered office and effective management in Spain, and a corporate purpose limited by its bylaws.
• The limited-scope financial credit establishment (EFCAL), which the draft bill introduces by amending Law 5/2015: capital companies that are not credit institutions, with a limited activity and supervised by the Bank of Spain.

In parallel, the reform also covers intermediaries: it amends Law 2/2009 to organize the regional registers and a state register for ancillary intermediaries. In addition, the draft implementing royal decree provides for a register of ancillary lenders, managed by the Directorate-General for Consumer Affairs, for suppliers of goods or services that are not microenterprises and grant interest-free credit with limited charges.

The takeaway for any operator is straightforward: if you currently grant consumer credit, finance point-of-sale purchases or act as an intermediary in credit agreements without being supervised, your situation may change on November 20, 2026. The draft bill also contains transitional provisions on the continuity of existing operators and on registration deadlines; their details are worth following closely, because they determine how much real leeway there is. You can see the full picture on our pages on CCD2, the high-cost lender and the EFCAL.