Approaches and developments
Spain’s startup scene has been in constant revolution for the past few years. According to the latest fintech report by El Referente, the number of Spanish fintechs increased to over 400 operative startups in 2020. Traditionally, the fintech companies that have been predominant in the Spanish ecosystem are those in the payments and e-payments and loans sectors, 30% of the total number of fintech companies. However, while growth is seen in almost all fintech sectors, the incorporation of digital payments has decreased despite being one of the sectors with the most fintech companies. Currently, the most popular fintechs are neobanks, wealth management fintechs, insurtechs and biotechs.
In early 2021, Spain’s government published its entrepreneurial strategy (“Spain Entrepreneurial Nation Strategy”) to make Spain a more entrepreneurial country by 2030 and strengthen the role of entrepreneurs in Spain and revitalise the economy after the COVID-19 pandemic, which includes a new “startup law” to bring more favourable conditions to companies that are in the first stages of operations. In this sense, this new law will offer tax incentives and reduce the administrative burdens of these young entities. One of the first stumbling blocks is the recognition of what a startup is – there must be a consensus on the definition of this concept among parties for the new startup law to have a future.
But Spain is not only pushing towards being a more entrepreneurial country, it is also reacting to the fact that in the year 2020, even though Spain has shown a lot of progress, it still occupies position number 13 in the European ranking of digitally integrated startups. In fact, the Digital Economy and Society Index (“DESI”) published a report last year stating that Spanish startups still have a long road ahead in order to exploit the full potential of e-commerce, since the country is below the European average in the use of cloud services and in the penetration of big data analytics. In this sense, Spain still has low participation of technologically integrated companies within the productive tissue of the country, which represents an obstacle to long-term growth and internationalisation, and, therefore, to the increase in the productivity of the economy as a whole.
So, these conditions have led legislators to push towards fintech development in Spain. On the one hand, companies are undergoing digital transformations forced by the current COVID-19 pandemic, investing heavily in new technologies which provide cost-efficient solutions. On the other hand, the effort legislators are putting into the development of a better-adapted regulatory framework for this new reality is significant. In this context, it is especially relevant that the Senate Commission for economic affairs and digital transformation unanimously passed on November 4, 2020 the Law for the Digital Transformation of the Financial Sector. This Law will undoubtedly make Spain an international reference point
for legislative innovation within the fintech sector. A big concern for Spanish authorities, as to the use of this new technology, is regarding the possible gateway fintech may present for possible money laundering and the financing of terrorism. But, mainly, the Law for the Digital Transformation of the Financial Sector has two objectives:
(a) to guarantee suitable tools for the financial authorities to continue with their current roles within the new digital era; and
(b) tofacilitatetheinnovationprocesstopromotemoreequitabledevelopmentbyallowing access to the best financing for different productive sectors and by attracting talent to a highly competitive international technological environment.
Nonetheless, the main highlight of this Law is the establishment of a “sandbox” or test space. This sandbox consists of controlled safe spaces that allow experimentation for new business proposals. It is designed as the ideal environment to identify the best projects for the betterment of financial service provisions through digital innovation. Supervision protocols, proportionality criteria and the principle of equality will govern sandbox proposals. Additionally, the Law also reinforces the necessary instruments aimed to guarantee the objectives set by the current financial policies. But here is where the most interesting aspect of this Law comes into place: pilot projects and proposed tests that are allowed into the sandbox will not be subject to the current applicable legislation for financial services: they will only have to comply with the new Law’s regulations and protocols. There is no doubt that digital transformation represents a new paradigm for the financial sector. In accordance with the Resolution of May 14, 2021, the Secretariat General of the Treasury and International Finance published a list of projects submitted to the controlled testing space (sandbox) that have received a favourable evaluation. Only 18 out of 67 projects have been admitted into the sandbox.
Finally, it is worth noting that the European Union (“EU”) is the driving force encouraging EU Member States to adapt to the new developments. Also, the EU has started a Digital Finance Package to try to harmonise the legal requirements so that fintech companies can operate in any Member State.
For instance, on October 24, 2020, the European Parliament and the Counsel published for the first time a Proposal for a Regulation on Markets in Crypto-Assets (“MiCA”), which will amend Directive (EU) 2019/1937 and will have the aim of harmonising a set of rules for providers of crypto-assets services and issuers of crypto-assets all across Europe.
Fintech offering in Spain
New fintech regulations in the coming years will also open the doors for more financial activities through existing online platforms. Today, Spain is among the most energetic fintech environments in all of Europe, which translates to one of the most active in the world. However, there are still many obstacles ahead that need to be surmounted in order to secure this position and ensure the sector’s continued development. Among the main obstacles we have today for the fintech sector’s growth is that investors’ interest in Spanish fintech firms is relatively lower than in other countries. Also, most Spanish fintechs are oriented towards B2B, obtain revenues via fees/commissions and are at a seed stage, according to a report from the Bank of Spain. Moreover, most of these firms were founded by entrepreneurs and are in large cities such as Madrid and Barcelona. Madrid and Barcelona are the two main hubs, but Valencia is also increasing its popularity among entrepreneurs.
Fintechs are currently present in the following sectors, among others:
The second Payment Services Directive (“PSD2”) was fully transposed in Spain in 2019. PSD2: (i) regulates Payment Initiation Servicers Providers (“PISP”) and Account Information Services Providers (“AISP”), recognising for the first time the right for these companies to have access to information from banks; (ii) simplifies the process to obtain authorisation for small entities and for entities which conduct business within Spanish territory; and (iii) increases the obligations regarding payments security and strengthens the online identification requirements for clients.
It is a common practice for companies to incorporate entities that can provide financial advice (“EAFIs”) as a first step to analyse the Spanish market and search for clients. EAFIs are a type of company which are licensed only to provide investment advice. Therefore, to incorporate an EAFI is easier than to incorporate other companies such as companies and securities agencies (“Sociedad de Valores and Agencia de Valores”), portfolio management companies (“Sociedad Gestora de Carteras”), and asset management companies (“Sociedad Gestora de Instituciones de Inversion Colectiva”).
Social trading platforms
The Spanish Securities Market Commission (“CNMV”) stipulates that this type of company must offer their services to investors under a discretionary portfolio management contract (article 140 d) of the Securities Market Law’s consolidated text). In addition, before signing the contract, the company must be ensured of the investor’s suitability and comply with all the rules of conduct according to the Securities Market Law.
Therefore, for a fintech company to perform “social trading” services, it would need to be incorporated as one of the following: a companies and securities agency (“Sociedad de Valores and Agencia de Valores”); a portfolio management company (“Sociedad Gestora de Carteras”); or an asset management company (“Sociedad Gestora de Instituciones de Inversion Colectiva”). Among these types of entities, the portfolio management company is the simplest and the one that needs fewer requirements to be met for its incorporation.
Law 5/2015, of April 27, on the Promotion of Business Financing (“LFFE”) regulates financial crowdfunding platforms involved in the intermediation of financing through loans, bonds or equity participations. These platforms are under the authorisation, supervision, inspection and sanction of the CNMV, with the participation of the Bank of Spain, in case of lending-based crowdfunding. Moreover, the LFFE restricts the range of services that these platforms may provide. In particular, they are not allowed to offer investment advice or process payments (unless they apply for a licence as hybrid payment institutions).
The current position of the CNMV and the Bank of Spain is that a specific regulation of cryptocurrency and initial coin offerings (“ICOs”) is necessary. Nonetheless, such regulation can only be made at EU level and after consultation with certain third countries, such as the U.S., which play a major role in the world’s financial markets. Since there is no specific regulation on cryptocurrencies in Spain, they cannot be treated as legal tender, which is exclusively reserved for the Euro as the national currency. The CNMV also points out that there have been no issuances of cryptocurrency or ICOs which have been approved or verified by any regulatory authority, such as the Bank of Spain or the CNMV. In Spanish law, cryptocurrency cannot be considered either as a financial instrument (promissory note, derivative, etc.) or a currency (domestic or foreign), but, when traded individually, in the case of public offerings or chattels or commodities, they could be assimilated to securities.
To the extent that they can be considered securities, ICOs may fall within the prospectus filing requirements of the Spanish stock market law (“LMV”), as the definition of financial instruments and negotiable securities is very wide (article 2 of LMV), and the Spanish government can add new types of securities by its own fiat without an amendment of the law being necessary, provided this has been agreed under EU regulations.
Regarding the registration of virtual currency procedures with the Bank of Spain for anti- money laundering reasons, please see the section titled “Key regulations and regulatory approaches” below.
Loan services, loan broking, factoring
As for fintech companies that provide loan services, Spanish law, in general, does not impose any formal or material requirements in order to grant loans. To put it simply, loans are governed by the general commercial law. An exception to this is in the case of consumer loans: the agreement has to be drawn up on paper and the denomination of financial credit establishments (“Establecimientos Financieros de Credito”), specialised in the granting of credits and loans in a specific field such as consumer credit, mortgage credit, credit cards, guarantees, leasing (leasing with purchase option), or factoring (assignment of a credit portfolio), is used.
As for fintech companies that provide brokerage, fine trading and ancillary services, so long as they are not conducted with funds collected from the general public (i.e. banking activity), there would be no need for the fintech to obtain a banking licence.
Online banking services and neobanks/Spanish banking licences and challenger banks
Regarding PSD2, traditional banks are under pressure to become more dynamic, especially since the latest generation of fintech is adapting a lot faster to the international competition. In Spain, there is no specific regulatory framework governing online banking or neobanks, which are those fintechs that offer a 100% mobile banking experience by partnering with a traditional bank to manage operations; such bank is really the one in charge of issues such as regulatory compliance, Know Your Customer (“KYC”) policies and all the processes, controls and restrictions to which the fintech is subject. Unlike neobanks, challenger banks are those which intend to get a banking licence. Online banking services that aim to take deposits from the public, which are used for on-lending, must be provided only by entities that have a licence. Banks within Spain need an authorisation from the Bank of Spain and an authorisation from the European Central Bank (“ECB”). With respect to the Bank of Spain authorisation, fintech entities will have to meet certain requirements, more or less strict, depending on the type of licence that the new company wants to acquire. In general terms, the main requirements to obtain a licence are the same as those required by the ECB: the solvency of the fintech company; the experience of its shareholders and members of the management committee must be at the required level; a good administrative and accounting organisation; and adequate internal control procedures.
In Spain, the types of licences available are as follows:
Licence for credit institutions (i.e. banks, savings banks and credit unions). Credit instiutions are the only entities that can collect reimbursable funds from customers; that is, receive a user’s balance with the commitment to return it under the agreed conditions (offer deposits or bank accounts), among many other products. The credit institution licence is the most complete and complicated licence to obtain.
Licence for other entities. To perform other types of financial activities, such as lending money by means of loans and credits, it is not necessary to have a credit institution licence. There are other non-bank credit companies that can perform certain financial roles without becoming a bank. Each one has a special licence according to its function. The main ones are:
i) Financial credit establishments (“Establecimientos Financieros de Credito”) specialised in the granting of credits and loans in a specific field; for example, consumers. An example of a Spanish company is Cofidis.
ii) Payment entities (“Entidades de Pago”) that intend to provide payment services. They allow the opening of an account, entering and withdrawing of money and balance movements. One example is American Express Spain.
iii) Electronic money entities (“Entidades de dinero electrónico”) are companies dedicated to the issuance of electronic money. They are able to issue, distribute and reimburse customers’ money, as well as offer linked means of payment. Examples include PayPal and some neobanks such as B-Next.
iv) Mutual guarantee societies (“Sociedad de Garantía Recríproca”) are non-profit entities specialised in offering guarantees to facilitate access to financing for small and medium-sized companies. They are usually linked to a specific sector and their activity is supported by their public protective partners (regional or local administrations), savings banks, etc.
v) Appraisal entities are dedicated to real estate appraisals and certify the value of these for different purposes, such as the granting of financing with a mortgage guarantee.
Finally, fintech entities that have obtained a licence in another EU country can operate through the passporting regime or free provision of services. This means that supervision will be exercised in the country in which the fintech company obtained the licence and, to a lesser extent and for specific aspects, in Spain. Fortunately, the requirements to be met by fintech companies to proceed with the freedom to provide services as a credit institution on Spanish territory are quite simple. But, to establish a branch or, where appropriate, a representative office, additional requirements have to be met.
Regulatory and insurance technology
Developing and selling insurance products in Spain falls under Spanish regulation. Currently, the most important legal text regarding this matter is Law 20/2015, which transposes Directive 2009/138/EC (“Solvency II”). In addition, this Law has been developed by detailed enabling legislation provided by the Royal Decree 1060/2015. A new complementary law, Royal Decree Law 3/2020, has come into force for the regulation of the insurance distribution, transposing Directive 2016/97. This piece of legislation regulates the distribution of insurance products within Spain through brokers, agents, underwriters, and banks. On the other hand, Law 20/2015 governs certain aspects related to the insurance market and subjects this activity to an administrative authorisation. Consequently, in order to provide coverage, the insurance company must satisfy the following requirements:
i) Keep a solvency capital requirement and eligible basic own funds to cover the absolute floor of the minimum capital requirements (approximately €5,500,000).
ii) Keep eligible basic own funds to cover at all times the minimum capital requirements and the solvency capital requirement.
iii) Requirements related to honourability, qualifications and professional experience.
iv) Requirements related to corporate governance and internal control systems.
In addition to all of the above, all insurtechs performing in the insurance sector, although not directly as an insurance company but rolling an intermediary profile (e.g. mediators, insurance brokers, insurance agents, etc.), must meet specific requirements in their special area provided in Royal Decree Law 3/2020. The Association of Fintech and Insurtech (“AEFI”), which promotes fintech initiatives, has published a white paper on insurtech regulation in Spain to boost legislative initiatives. However, the licensing authority for all insurance business is the Directorate General for Insurance and Pension Funds (“DGSFP”) operating under the jurisdiction of the Spanish Ministry of Economy.
As for regtech companies, there are currently no special legal licences applicable to such companies. Regtech companies provide technological support for developing and implementing compliance policies and procedures; hence, this technology does not perform direct investment services. However, the CNMV has stated these companies should cooperate with public agencies to afford a better supervision of the market.
The regulator in charge of supervision of fintech businesses is the CNMV, together with the Bank of Spain (supervisory authority of the banking system), and the DGSFP, depending on the type of entity intending to provide services in Spain and the exact nature of those services. The Executive Service of the Commission for the Prevention of Money Laundering and Monetary Infringements (“SEPBLAC”) is another supervisory body.
Although not a regulatory body, the AEFI promotes the development of fintech and insurtech companies in Spain and has played a key role in the approval of the sandbox in Spain.
Key regulations and regulatory approaches
There are business models, such as crowdfunding platforms (equity crowdfunding and crowdlending), which have their own regulatory regime that is established in the LFFE. However, the vast majority of fintechs are not regulated by a specific law. The legal provisions are intended for traditional banking activities and most fintech activities, since they are not restricted, are allowed. However, it is also true that fintech companies cover a myriad of activities, some of which would trigger licensing requirements. Contrary to popular belief, not all activity performed by a fintech company falls outside the regulatory spectrum that characterises the traditional financial system. Conventional bodies, such as the National Stock Market Commission, the Bank of Spain and the DGSFP, oversee these new technologies, using existing legislation not adjusted to technological innovation.
In this respect, the CNMV has created a forum (https://www.cnmv.es/portal/Fintech/ Innovacion.aspx?lang=en) to assist fintechs where regulation is not clear. This forum helps promoters of businesses to ascertain whether their activities fall under the securities market rules and creates an informal space for exchanging information with promoters on their initiatives, which are strictly confidential.
Whether a fintech company falls within the scope of this regulatory regime will depend on the exact nature of its business and the type of activities being carried out. As for regulation of financial instruments, such securities may fall under the definition of financial instruments and negotiable securities, which is very wide (article 2 of LMV). To carry out any of these activities in relation to financial instruments on a professional basis in Spain, the relevant fintech must obtain a licence or an authorisation or operate via the EU passport regime or under the free provision of services regime. In addition to this approval, registration is a requirement to operate in Spain. Marketing of investment services or offering of financial instruments on a professional basis as well as prior or preliminary activities also require an authorisation.
Separately, the provision of loans does not trigger licensing requirements, even though it is a typical activity of credit entities. However, while the activity of extending credit is not a reserved activity, it is usually connected to other regulated activities that trigger licensing requirements.
Regarding payment services, it is prohibited for entities or natural persons who are not payment service providers (apart from certain exceptions derived from PSD2) to provide payment services in Spain on a professional basis.
As for exchange platforms of cryptocurrencies, the CNMV currently considers that exchange platforms of cryptocurrency are subject to at least the rules of custody/registration, conflicts of interest management and transparency (of inducements), and anti-money laundering provisions. The CNMV recommends that platforms apply voluntarily the principles of the securities market regulation to ensure their business operates in compliance with the relevant regulations.
On a separate note, on April 28, 2021, the Spanish National Gazette published Royal Decree 7/2021, of April 27, for the transposition of the EU Directives on the areas of competition, prevention of money laundering (“AMLD5”), credit institutions, telecommunications, tax measures, prevention and remediation of environmental damage, posting of workers in the provision of transactional services and consumer protection.
This Royal Decree will modify Law 10/2010, of April 28, for the Prevention of Money Laundering and Financing of Terrorism (“AML/CFT”) in the following ways:
Definitions: incorporated within article 1 of Law 10/2010:
a) Virtual Currency: means “any digital representation of value not issued by a central bank
or public authority, which is not necessarily associated to an established legal tender and does not possess the legal status of currency or money, but is accepted as medium of exchange and can be transferred, stored or electronically negotiated”.
b) Virtual Currency Exchange for Fiat Currency: means “the purchase and sale of virtual currency by delivery or receipt of euros or any other foreign legal tender or electronic money accepted as a means of payment in the issuing country”.
c) Services for the Custody of Electronic Wallets: means “those individuals or entities that provide services pertaining to the safeguard or custody of private cryptographic keys on behalf of their customers, for the holding, storage and transfer of virtual currency”.
New Regulated Entities
New Regulated Entities were included within article 2 of Law 10/2010. Among these entities, the “providers of services regarding the exchange between virtual and fiat currency, and the custody of virtual wallets” can be found in section z) of article 2 (hereinafter, “Virtual Currency Service Providers”).
Virtual Currency Service Providers will now have to comply with the following provisions:
1) Regardless of their nationality, if the services pointed out in definitions “b)” and “c)” mentioned above are offered or provided in Spanish territory, these individuals or entities will have to be registered within the Registry of the Spanish Central Bank (“SCB”) created for these purposes.
2) Likewise, the following must also register within the SCB Registry:
a) Regardless of their nationality, those individuals or entities that provide the aforementioned services, when the address, administration or management of these activities reside in Spain, regardless of the location of the service recipients.
b) The entities located in Spain that provide these services, regardless of the location of the service recipients.
3) The registration within the SCB Registry will be conditioned to the existence of:
a) Adequate AML procedures, provided by Law 10/2010 (identification of clients, communications to SEPBLAC, internal control measures, etc.).
b) Compliance with the requirements of commercial and professional honourability, according to the terms established in article 30 of Royal Decree 84/2015, of February 13, for the development of Law 10/2014, of June 26, on the regulation, supervision and solvency of credit institutions. In summary, these requirements consist of displaying personal, business and professional conduct that do not cast doubt on the ability to perform a sound and prudent management of the entity.
c) The SCB will have authority to supervise compliance with the abovementioned requirements.
It is important to highlight that if Virtual Currency Service Providers do not comply with the required registration requirement mentioned above, such conduct could be considered a very serious infringement of Spanish law, and the entity or individual will be subject to sanctions imposed by the SCB. The infringement will be considered “serious” and not “very serious” only if the provided services were occasional or isolated.
The SCB has a period of six months before the Registry for Virtual Currency Service Providers starts functioning, counting from the date of entry into force of Royal Decree 7/2021.
If the services mentioned in definitions “b)” and “c)” are provided to residents in Spain, then the Virtual Currency Service Provider will have a period of nine months, counting from the date of entry into force of Royal Decree 7/2021, to register.
Royal Decree 7/2001 entered into force on April 29, 2021, therefore the deadline dates for the abovementioned are as follows:
a) Six months for the registry to start functioning: October 29, 2021.
b) Nine months for Virtual Currency Service Providers to register: January 29, 2022.
In relation to this new Royal Decree, it is interesting to highlight that, for the first time, an official definition of virtual assets is offered by the Spanish legislation. Previously, consideration given to these assets in Spain was limited to the jurisprudential scope of the Supreme Court’s Decision 326/2019 of June 20, 2019, through which the criminal chamber defined them as “intangible assets of exchange…”, that, in no way, have the legal consideration of fiat money. Through this new Royal Decree, the legislator solidifies the Supreme Court’s insight, strengthening its approach and consolidating a definition for virtual assets as a source of Spanish law.
In general terms, it is important to note that fintech companies established in Spain are subject to data protection regulations. In the EU context, Directive 95/46/EC (“General Data Protection Regulation”) has been directly applicable to all Member States, including Spain, since 25 May 2018. In Spain, local data protection laws were passed in December 2018 (“Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales”).
Finally, on July 10, 2021, the Spanish National Gazette published the Law 11/2021 on preventive measures to combat tax avoidance – a long-awaited transposition of the EU
Council Directive 2016/1164 laying down rules against tax avoidance practices that directly affect the functioning of the internal market. This new law has added certain modifications to the Additional Provision number 13 of the Spanish Personal Income Tax Law (“Ley de Impuesto Sobre la Renta”), referring to new declaratory obligations for Cryptocurrency Service Providers operating in Spain as well as individuals or entities holding cryptocurrency abroad.
There are no legal restrictions as there is no specific regulation for fintech companies. Whether a fintech company falls within the scope of the regulatory regime will depend on the exact nature of its business and the type of activities being carried out. Therefore, applicable regulation (and restrictions), for each fintech company should be assessed carefully on a case-by-case basis. One general barrier that fintech companies face is that they cannot access market infrastructures and this constitutes a disadvantage with respect to banks and big companies that have close relationships with Spanish regulators and the government, which aids their digitalisation process.
Within the EU, there is no particularity in cross-border provision of financial products and services as Spanish and foreign fintechs must comply with the general cross-border rules established in each area of the law which transposed the relevant EU Directives (MiFID II, CRD IV, PSD2, etc). For instance, if activities are regulated, Spanish and foreign entities need to obtain suitable passports or licences, depending on each case. There is no other way for foreign fintechs to operate in Spain than the one provided in the relevant EU Directives, but if a fintech company obtains authorisation within an EU Member State, it can benefit from passporting options or from the freedom of service provision regime.
Published in GLI – Fintech 2021, 3rd Ed