Fintech
The startup launching its own product
“We have the portfolio engine and the app ready. What we are not sure about is whether we are advice or management, and everything depends on that: type of firm, capital and timelines.”
Robo-Advisor License in Spain: CNMV Requirements for Automated Investing
In Spain there is no such thing as a robo-advisor license: the authorization you need depends on the service your platform provides—investment advice or discretionary management. We help you choose the right type of firm, design the online test and govern the algorithm with evidence.
Launching a robo-advisor? Free regulatory assessment
Walk us through your product flow—from onboarding to the portfolio—and we will tell you which MiFID service it is and which license it requires.
- 50+ entities advised
- Reply within 24 h
- No commitment
- EAF capital
- €75,000
- EAFN capital
- €50,000
- MiFID II suitability assessment
- Art. 25
- Key legislation
- Law 6/2023
Services
The regulatory building blocks of a robo-advisor
Six areas that determine whether your platform operates with the right license, a valid test and a governed algorithm. All of them are examined at authorization and afterwards.
License
Set up an EAF to provide advice
If your engine issues personal recommendations on portfolios or products, you are providing investment advice: the EAF is the natural route. We prepare the application, with the digital component clearly explained to the CNMV.
Learn more →
AdviceCNMV€75,000Application
Management
Automated discretionary management
If the system decides on and executes rebalancing under a client mandate, the service is portfolio management: it requires an authorized type of firm and a robust management agreement. We design the regulatory fit and the full documentation.
Learn more →
MandateRebalancingSGCAgreement
Suitability
Online suitability test
Valid if it is well designed: internal consistency, traceability of answers and periodic updating of the client profile.
Learn more →
Art. 25Traceability
AI
AI in investment advice
If the engine uses artificial intelligence, add the AI Act and ESMA’s position: explainability and the firm’s responsibility.
Learn more →
AI ActESMA
Authorization
EAF authorization
The full service before the CNMV: program of activities, MiFID II policies and fit and proper assessment of directors for your project.
Learn more →
CNMVESI
Resilience
DORA for platforms
Your business is technology: digital operational resilience, the register of ICT providers and mandatory contractual clauses.
Learn more →
DORAICT
Profiles
Who is building (or buying) a robo-advisor
Four typical projects that come through our firm: similar algorithms, very different regulatory fits.
Asset manager
The traditional firm going digital
“We want an automated channel for smaller portfolios without cannibalizing private banking. The question is whether our current license covers the new digital flow.”
B2B
The white-label technology provider
“We sell the software to regulated entities. We need the contract to set out who provides the service and who answers to the supervisor for the algorithm.”
EAF
The adviser automating their proposals
“My EAF advises two hundred clients manually. If I automate profiling and proposals, am I still within my program of activities or do I need to amend it?”
Before you launch
The three mistakes that sink a robo-advisor
Automated investment projects rarely fail because of the algorithm: they fail on the regulatory fit, the test and governance.
Launching as “technology” without a license: if the app suggests specific portfolios to each user, it is providing investment advice. The reserved activity rules do not distinguish between humans and algorithms: operating without authorization is a very serious infringement.
A decorative suitability test: questionnaires that take a minute to complete, accept contradictory answers without reacting and are never updated cannot support valid recommendations: they are the first piece of evidence against you.
An algorithm without an owner: nobody documents the rules that allocate portfolios, the version changes or who monitors the results. Before the CNMV, answering “the system decides” is the same as having no answer.
| Business model | MiFID service | License required |
|---|---|---|
| The platform recommends specific portfolios or products to each user | Investment advice (personal recommendation) | An EAF or another authorized ESI; also an EAFN if the project is limited to Spain. |
| The system invests and rebalances on the client’s behalf under a prior mandate | Discretionary, client-by-client portfolio management | An SGC, SGIIC or AV/SV authorized to manage portfolios; the mandate agreement is the key element. |
| The website offers content, simulators and data without recommending specific instruments | No reserved investment service, as a general rule | No license, but watch the boundary: personalization turns the tool into advice. |
Shall we find the right fit for your robo-advisor?
We go through your product flow screen by screen, determine the MiFID service you provide, handle the right license application and leave your online test and algorithm governance ready to withstand a CNMV review.
Frequently asked questions
Robo-advisors: common questions
Is there a specific robo-advisor license in Spain?
No. Neither Law 6/2023 nor MiFID II creates a category of firm for automated investing: the framework is technology-neutral. What is authorized is not the channel but the investment service you provide through it.
That is why the first question for any project is not “what license do robo-advisors need?” but “what exactly does my platform do with each user?”. The answer—recommend, manage or only inform—determines the type of firm, the capital and the application.
What license do I need if my platform recommends portfolios?
Recommending a specific portfolio or specific products to each user based on their profile is investment advice: a personal recommendation on financial instruments. You need to be an EAF or another ESI authorized for that service.
As a capital benchmark: the EAF requires €75,000 and the EAFN—valid only for operating in Spain, without an EU passport—€50,000 or professional indemnity insurance. We cover the full route in how to set up an EAF.
And what if the system also executes and rebalances automatically?
If the client signs a mandate and the system decides on and implements the investments on their behalf, the service is discretionary, client-by-client portfolio management. That goes beyond what an EAF can do: we are talking about SGCs, SGIICs or securities brokers (agencias de valores) and broker-dealers (sociedades de valores) authorized to manage portfolios.
In addition, in discretionary management third-party inducements are prohibited and must be passed on to the client. The mandate agreement and its limits are the core of the model: we cover it in discretionary portfolio management.
Is a fully online suitability test valid?
Yes. MiFID II Art. 25 does not require paper or face-to-face meetings: it requires assessing knowledge and experience, financial situation and objectives before recommending or managing. A digital test is valid if its design withstands scrutiny:
- Consistency: controls that detect contradictory answers and require them to be resolved.
- Traceability: a record of what the client answered, which profile resulted and what was recommended.
- Updating: periodic review of the profile, not a questionnaire frozen since onboarding.
ESMA’s suitability guidelines, updated in 2023, add sustainability preferences to the assessment. More on the suitability test.
What does “governing the algorithm” mean?
It means the engine has an owner and a paper trail: documented, understandable allocation rules, dated version control, testing before every change, monitoring of results and human oversight with real authority to correct or stop the system.
The firm is responsible for every recommendation or investment decision the engine generates, whether it built the engine in-house or bought it from a third party. If the system uses AI, the analysis is completed with the AI Act and ESMA’s position: we cover this in AI in financial advice.
Can I operate without a license if my website “only provides information”?
As a general rule, educational content, market data and generic simulators are not reserved investment services. The line is crossed when the tool moves from informing to recommending: when the result is presented as suitable for that specific user based on their circumstances.
A “we suggest this portfolio” after a personal questionnaire is already on the other side of the line. We analyze the nuances in can you give investment advice without a license?
How does the B2B or white-label model work?
The technology provider sells the software; the regulated entity provides the service under its own brand and license, and is answerable for it to clients and the supervisor. That boundary must be clear in the contract: who approves changes to the engine, what information the entity receives, what it can audit and how to exit the agreement.
For the entity, the software is an outsourced function that it must effectively control; for the provider, a well-defined contract is the difference between selling technology and unintentionally providing a reserved service. Review the framework in outsourcing of critical functions.
What information and warnings must digital onboarding provide?
The digital channel does not lower information requirements: the nature of the service explained in plain language, ex-ante costs before signing up, visible warnings—not buried in a drop-down menu—and consistency between what the marketing promises and what the contract says.
Screen design is part of compliance: an onboarding flow that boasts about returns and hides costs is a regulatory problem, not just a UX one. Rely on our pages on costs and charges disclosure and financial product advertising.
Operational guide
From algorithm to license: the robo-advisor roadmap
Three stages to go from digital product to authorized entity without having to redo anything along the way.
Classify the service
We walk through the actual user flow and legally classify each step: where there is a personal recommendation, where there is a management mandate and where there is mere information. That picture determines the type of firm and the capital.
Build the digital application
A program of activities that explains the engine, a suitability test with defensible logic, MiFID II policies adapted to the channel and written algorithm governance: what the CNMV will want to understand before granting authorization.
Operate with evidence
Monitoring of results, periodic review of the test and the engine, a log of versions and incidents, and timely reporting: the platform is supervised like any other entity, it just leaves a bigger digital trail.
10-step robo-advisor checklist
- User flow map: document screen by screen what the client sees, answers and receives, from sign-up to investment.
- Service classification: determine whether the flow constitutes advice, discretionary management or mere information. This is the decision that drives everything else.
- Choice of firm type: an EAF or EAFN to advise; an SGC, SGIIC or authorized AV/SV to manage under a mandate. Decide based on the business plan, not just the capital.
- Suitability test design: consistent questions, controls against contradictory answers, full traceability and periodic updating of the profile.
- Allocation rules: document how the profile translates into a portfolio—criteria, thresholds and edge cases—with dated versions.
- Human oversight: appoint people with real authority to review results, halt the engine and correct allocations.
- Onboarding and warnings: plain language, the nature of the service explained, ex-ante costs and visible warnings before signing up.
- Contracts and outsourcing: set out the relationship with technology providers in writing. The service and the responsibility cannot be delegated.
- Operational resilience: apply DORA—register of ICT providers, mandatory contractual clauses and incident management.
- Periodic review: schedule audits of the test, the engine and the results, and update the program of activities as the product evolves.
If your engine recommends, start by setting up an EAF; if it manages under a mandate, review discretionary portfolio management.
Operational glossary
Key robo-advisor concepts
The vocabulary the supervisor will use when reviewing your platform. Your documentation should speak the same language—and every term should have evidence behind it.
Robo-advisorModel
Automated investing
A platform that profiles the client and proposes or manages portfolios using algorithms. It is not a legal category: it is a channel for providing regulated services.
The license depends on the service, not the technology.
Personal recommendationService
The advice trigger
Presenting an instrument as suitable for a specific user based on their circumstances. If your app does this, it is providing investment advice.
Reserved activity: requires an EAF or another ESI.
Management mandateService
The client delegates, the system decides
An agreement under which the client authorizes the firm to invest on their behalf. It turns the service into discretionary portfolio management.
Authorized firm types: SGC, SGIIC, AV/SV.
Suitability testMiFID II
The mandatory prior filter
An assessment of knowledge, financial situation and objectives before recommending or managing. An online test is valid if its design withstands scrutiny.
Basis: MiFID II Art. 25.
TraceabilityEvidence
Being able to reconstruct every decision
A record of what the client answered, which profile resulted and which recommendation the engine generated, with dates and versions.
Without traceability, there is no possible defense.
Test consistencyDesign
Controls against the absurd
Mechanisms that detect contradictions—a very high risk tolerance alongside a declared panic about losing money—and require them to be resolved before profiling.
A test that accepts everything is worthless.
Algorithm governanceControl
Rules with an owner
Documentation of the engine, version control, testing before every change and monitoring of results, with designated people in charge.
The CNMV will ask who controls the system.
Human oversightControl
Someone who can stop the machine
People with the authority and resources to review, correct and suspend the engine’s operation when something goes wrong.
“The system decided” is not a defense.
White labelB2B
Third-party technology
Robo-advisor software that a regulated entity offers under its own brand. The license and the responsibility belong to whoever provides the service.
The provider is subject to the outsourcing regime.
Robo-advisor playbook
What the supervisor will review on your platform
Service classification
Full consistency between what the app actually does and the service declared in the program of activities.
User flow map, product screenshots and a documented legal classification of each feature.
Suitability test
Defensible design: internal consistency, no way to proceed with contradictions, and periodic updating.
Documented questionnaire logic, profile records and testing of the consistency controls.
Allocation engine
Explainable profile-to-portfolio rules, versioned and tested before each deployment.
Algorithm documentation, version log and results of pre-change testing.
Client communication
Onboarding in plain language, visible warnings and cost information before signing up.
Screen templates, versioned legal texts and verified consistency between marketing and contract.
Ongoing operations
Monitoring of results, incident management and periodic review of the system, with designated people in charge.
Dashboards, incident log, review minutes and formal appointments.
Signs that your platform has a regulatory problem
These five situations come up again and again in projects that reach our firm too late. The sooner they are fixed, the cheaper it is.
- The app shows a portfolio “recommended for you” and the project is still presented as “just technology”, without a license.
- The questionnaire lets users sign up even when they state they have no savings and a one-month horizon.
- Nobody can explain why the engine allocated a specific portfolio to a specific client six months ago.
- The software provider can change the algorithm without the entity approving it or even finding out.
- Onboarding boasts about returns and hides costs: the marketing runs ahead of the mandatory information.
Related decisions
Firm types and boundaries around automation
A robo-advisor forces you to choose a type of firm and to watch the boundaries: management versus advice, information versus recommendation, your own license versus an agreement with third parties. These pages complete the analysis before you commit capital.
Firm type
Portfolio management company
The ESI specialized in discretionary management: capital, services and when it is the natural home for a robo-advisor.
See the firm type →
SGCManagement
Firm type
SGIIC
Fund management companies (SGIICs) can also provide discretionary portfolio management: what their license allows and when that route makes sense.
See the alternative →
IICManagement
Boundary
Operating without a license?
What a content website or a simulator can do without authorization, and what triggers the reserved activity rules.
Know the limits →
Reserved activityBoundary
Context
Fintech regulation
The robo-advisor within the Spanish fintech landscape: licenses, the sandbox and the project’s regulatory strategy.
See the map →
FintechLicenses
Clear on your route? Start with setting up your EAF or with discretionary portfolio management. And if the engine uses artificial intelligence, complete the analysis with AI in financial advice and the AI Act.
Contact
Book a call
Tell us how your automated investment platform works and we will explain which type of firm it needs, with what capital and with what controls.
Robo-advisors and automated investing in Spain: license, online test and governance
The term robo-advisor covers very different models: from the app that suggests a portfolio after a questionnaire to the system that invests and rebalances on the client’s behalf without human intervention. Spanish and EU rules regulate the service, not the channel: there is no robo-advisor license. Law 6/2023 and MiFID II are technology-neutral, so the platform needs the same authorization a professional would need to do the same thing manually—and is subject to the same conduct, information and control obligations.
The license follows the service, not the technology
If the platform issues personal recommendations—presenting specific portfolios or products as suitable for each user—it is providing investment advice and must be an EAF or another authorized ESI; the EAFN is an alternative for projects limited to Spain, with €50,000 of capital or professional indemnity insurance, compared with the EAF’s €75,000. If the system operates under a mandate and decides the investments for the client, the service is discretionary portfolio management, reserved to authorized SGCs, SGIICs and AV/SVs. And if the website is limited to content and generic simulators, there is no reserved service, although the boundary with recommendation is closely watched: you cross it as soon as you personalize. Details in advising without a license.
The online suitability test: valid, but it needs proper design
The suitability test under MiFID II Art. 25 can be completed entirely online. What the CNMV examines is the design: consistency (controls that detect contradictory answers and block progress until they are resolved), traceability (being able to reconstruct what the client answered, which profile resulted and what was proposed) and updating (periodic review of the profile, not a form frozen since onboarding). Since ESMA’s guidelines were updated in 2023, the assessment also covers the client’s sustainability preferences. A test that is quick to complete is not the problem; a test that is impossible to defend is.
Algorithm governance and human oversight
The engine that turns profiles into portfolios is the heart of the model and must be governed: documented and explainable rules, dated versions, testing before every change, monitoring of results and designated people with authority to correct or stop the system. Responsibility for every recommendation or investment decision lies with the firm, whether it built the software or contracted it: the technology provider is brought in under the outsourcing of functions regime, with information and audit rights. When the engine uses AI, the analysis is completed with the AI Act and ESMA’s position, which we cover in AI in financial advice.
Digital onboarding, warnings and ongoing compliance
The digital channel multiplies both reach and scrutiny: the nature of the service must be explained in plain language, costs must be shown ex ante and warnings must be visible, not buried in drop-down menus. Consistency between acquisition marketing and the contractual reality is reviewed through the lens of the financial product advertising rules. And after launch, compliance continues: periodic review of the test and the engine, incident management, operational resilience under DORA and updating the program of activities as the product evolves.
Licenses
Model compliance
Official sources
Key legislation, linked to the official text:
- Law 6/2023 of March 17 on Securities Markets and Investment ServicesBOE · consolidated text
Legislation and links reviewed in .