## 1espea2024009-print-pdf ## Source details **Canonical URL:** [1espea2024009-print-pdf](https://www.imf.org/-/media/files/publications/cr/2024/english/1espea2024009-print-pdf.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2024/english/1espea2024009-print-pdf.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2024/english/1espea2024009-print-pdf.pdf.json) --- ### Executive summary — scope and approach - Assessment covered fintech developments in Spain, including digitalization of the banking sector, and the supervisory oversight of fintech activity. - Analysis focused on: - Impact of fintech on regulated firms, mainly banks. - Interaction between new market entrants and existing firms. - Approach towards industry monitoring. - Institutional arrangements for regulation and supervision of fintech, including overall supervisory cooperation. - Authorities in scope: Banco de España (BdE), Comisión Nacional del Mercado de Valores (CNMV), Directorate-General for Insurance and Pension Funds (DGSFP). Engagement with the Sandbox Coordination Commission and General Secretariat of the Treasury and International Financing (SGTFI) focused on sandbox roles. ### Key findings — market structure and activity - Banks are dominant; fintech penetration is significant in payments and nascent in asset management, investments and lending. - Bizum: owned by 23 Spanish banks, established in 2016, now serves over 25 million customers of 38 Spanish banks, representing 98 percent of the domestic banking sector. - Spending on digital products, services and communication has increased across the banking sector; sales and transaction growth correlate with bank size and business scope. - Number of licensed EMIs doubled between 2018 and 2023, from five to 10. - Most fintech activities are regulated at least from a conduct of business perspective; outside payments, fintech activities are not yet material enough to pose threats to financial stability. - Nonbank digital lending: diverse players face funding constraints that limit scaling of balance sheets. - Crypto asset sector: small (rapid growth from a very low base); concentrated (significant share of domestic investors served by two companies); low penetration limited to small investors; speculative investments constitute the largest share of client activity. - With MiCA implementation in December 2024, most crypto-asset-related activities will be regulated. ### Regulatory and supervisory arrangements and tools - Framework follows “same risk, same activity, same regulatory outcome” principle; focus on nature of activity and licensing status rather than technology used. - Spain’s framework combines EU legislation (PSD2, MiCA, DORA, DLT Pilot Regime, Consumer Credit Directive/Mortgage Credit Directive) and national regulation. - Tools used: inter-agency Sandbox, Innovation Hub, ad-hoc horizontal assessments, thematic studies, and a developing database of fintech companies. - Technological risks and digital transition were priorities for BdE in 2023 and included in DGSFP’s strategic supervision plan. ### Inter-agency Sandbox — strengths and challenges - Strengths: - Wide representation of relevant Spanish authorities in a single body. - Comprehensive supervisory review and protocol agreements between promoter and authority/authorities. - Guarantee scheme to secure user and financial sector safety. - Intensive supervisory monitoring during testing phase. - Six cohorts have provided significant learning and enabled communication of supervisory expectations. - Challenges: - High supervisory resource intensity: preparatory and testing phases can have a combined average length of greater than 10 months. - Low rates of acceptance and low post-testing take-to-market of projects. - Several promoters approach the Innovation Hub; some exit the sandbox after significant supervisory resources expended. - Legislative constraints: sandbox law does not give the Coordination Commission administrative flexibility (e.g., semi-annual cohort frequency) or permit authorities to choose among alternative monitoring options. ### Resourcing and institutional capacity - Supervisory authorities require adequate resourcing to meet complex risks and incoming regulatory requirements. - Resource strains observed at BdE and CNMV; CNMV currently lacks full autonomy over recruitment. - FSAP recommends granting full autonomy to CNMV over recruitment and aligning BdE and CNMV resources to current and expected workloads. ### Key recommendations (selected) - Inter-agency Sandbox - 1) Provide for Sandbox Coordination Commission to make changes to sandbox operation and streamline administrative processes. — Agency: Government. Priority: H. Timing: I. - 2) Provide greater flexibility to supervisory authorities to use preferred mix of tools to monitor market developments, convey supervisory expectations, assess the adequacy of the regulatory perimeter, and assess whether supervisory approaches should be adjusted where necessary. — Agency: Government, BdE, CNMV, DGSFP. Priority: H. Timing: NT. - Fintech Monitoring and Oversight - 3) Intensify data collection on nonbank fintechs, including on nonbank digital lending and crypto asset lending, and undertake horizontal assessments and thematic reviews while analyzing the various channels of contagion between the nonbank fintechs and banks. — Agency: MINECO, BdE, CNMV. Priority: M. Timing: NT. - 4) Assess the current and projected workloads over a 3-to-5 year period in the area of fintech monitoring, regulation and supervision and ensure alignment of resources to these. — Agency: BdE. Priority: M. Timing: I. - 5) Estimate current and projected future workload, ensure alignment of resources to these, and grant full autonomy over the recruitment and retention process. — Agency: CNMV. Priority: H. Timing: I. - Digitalization of Banking Sector - 6) Conduct deeper assessment of the impact of digitalization on LSIs’ business models, governance, and risk management strategies. — Agency: BdE. Priority: M. Timing: NT. - Note: Priority codes H, M, L = high, medium, low. Timing codes I, NT, MT = immediate (within one year), near-term (within 2–3 years), medium-term (within 3–5 years). --- ### Fintech landscape and digitalization overview - European Commission ranked Spain seventh out of 27 EU Member States in the Digital Economy and Society Index (DESI) in 2022. - EU Commission data show more than 300 fintech firms operating in Spain covering a range of financial services. - Active nonbank providers include BigTechs; pure technology companies; nonbank PSPs (PIs and EMIs); consulting companies acting as front-end for fintechs; and digital-only banks (typically backed by traditional banking groups and regulated like credit institutions). - Innovation concentrated largely in payments; lending, asset management, and investments still nascent. ### Payments — adoption, trends, and infrastructure - Consumer payment trends: - 80 percent of non-recurring payments were made at the POS in 2022, down by nearly 7 percentage points. - Online purchases rose to 16 percent of the total in 2022. - Cash remains the dominant means of payment at 65 percent of total transactions, but use is declining. - E-wallets or digital wallets account for 30 percent of e-commerce transactions. - Instant payments and SCT Inst: - SEPA Instant Credit Transfers (SCT Inst) in Spain accounted for 54 percent of total transfers in 2023, versus the EU average of 15 percent. - Rapid growth driven by Bizum. - Market structure and licensing: - Number of PIs licensed in Spain increased from 54 in 2018 to 77 in 2023. - Role of new payment solutions: - BNPL usage increased, especially for online purchases; may be offered by merchants in collaboration with third-party lenders (regulated or nonbank). ### Lending — digital entrants and scale - Nonbank digital lending includes crowdfunding, equity crowdfunding, P2P platforms, and intermediation platforms. - Consumer finance crowdfunding platforms extended credit amounting to approximately €2 billion in 2019. - Spanish banking sector size is more than €4.5 trillion. - Despite many fintechs classified in lending, total credit volume by these companies remains low. - BdE taxonomy indicates many lending intermediation service providers do not take credit risk. ### Asset management and investments - Investment management services developing via Big Data and Artificial Intelligence. - Robo-advisors and automated investment management platforms provide algorithm-driven services with little human supervision. - Larger robo-advisors are banking groups; nonbank fintechs partner with banks and are licensed with the CNMV. - Number of nonbank fintechs offering investment analysis and stock tracking services is growing. ### Banks, collaboration with fintechs, and market dynamics - Banks collaborate with fintechs by acquiring products, joining consortia, investing in start-ups, delegating services, and running incubators/accelerators. - Regulated institutions tend to collaborate rather than acquire fintechs due to capital requirements on investments. - In collaborations, fintechs typically provide technology/service know-how; incumbents provide regulatory support and customer access. - Most digital-only banks are owned by large banks; a few independent challenger banks exist. ### Digitalization of the banking sector — adoption and investments - 70 percent of domestic Spanish customers use online banking services, compared with the EU average of 64 percent. - Spanish banks follow an omnichannel approach, maintaining branches while expanding digital channels. - ICT investments and expenses: - By June 2023, annual ICT investments by Spanish banks reached €4 billion, compared to €2.6 billion in 2009. - Spanish banks’ ICT expenses as a share of total administrative expenses were 33 percent, versus the EU average of 31 percent. - Cooperative banks and LSIs: - Anecdotal evidence suggests ICT expenses of some credit cooperatives increased by 60 percent over the past five years. - Proportion of digital clients for several LSIs reached as high as 73 percent of total active clients in June 2023, compared to 58 percent in December 2020. - Differential returns: - SIs have seen significant increases in digital customer bases and digital revenues. - LSIs improved digital access, sometimes with little visible impact on sales and revenues. - Operational resilience and governance: - Banks adapted governance and risk management (e.g., greater technical expert representation at board level) and increased focus on operational resilience, concentration, and third-party risks. - Supervision: - BdE conducted horizontal reviews on digital transformation impacts focused on operational resilience and digitalization strategies. - SSM conducting comprehensive horizontal assessment of digitalization impact on SIs; 6 out of 10 SIs selected for first phase are from Spain. - No comprehensive ad-hoc horizontal assessment for LSIs beyond operational resiliency due to lack of resources. - Recommendation: - BdE should conduct a deeper assessment of the impact of digitalization on LSIs’ business models, governance, and risk management strategies. --- ### Bizum — business model, scale, and oversight - Launched in 2016 by 23 Spanish banks as an information layer enabling P2P instant payments via smartphone by linking phone numbers to bank accounts with no fees to consumers. - Expanded features: donations to NGOs (2018), e-commerce payments (2019), Consumer QR at POS (2022), and Bizum ID (2023). - Technical and regulatory setup: - Built according to the SEPA Instant Credit Transfer (SCT Inst) standard. - Acts as an informational layer leveraging SEPA real-time payments; settlements occur through the National Electronic Clearing System. - Every use case follows PSD2. - Scale and penetration: - In 2023, SCT Inst transfers in Spain accounted for 54 percent of total transfers; Bizum accounted for approximately 90 percent of SCT Inst usage in Spain. - Bizum usage expanded to greater than 90 percent of bank customers in Spain across all age-groups—25 million customers of 38 Spanish banks, representing 98 percent of the domestic banking sector. - The e-commerce/consumer point-of-service has almost 60,000 participating merchants. - Oversight under PISA: - PISA framework entered into force in November 2022 and is based on the CPMI-IOSCO Principles for FMIs. - Bizum is currently classified as an arrangement and is an unlicensed entity owned and governed by banks. - BdE payments oversight department is considering enhancing monitoring of Bizum from an arrangement to a scheme under PISA because Bizum has started offering additional services (primarily for e-commerce payments). - If classified as a scheme, Bizum would be subject to enhanced monitoring. - Ongoing oversight activities under PISA include risk-assessments, evaluation of changes, major incidents reporting, and statistical monitoring. - BigTech/mobile payment partnerships: - BdE data: 22 banks work with Apple Pay; 7 banks work with Google Pay; 12 banks work with Samsung Pay. --- ### Crypto asset ecosystem — market structure, investor profile, and regulation - Market characteristics: - Concentrated service provision and low penetration limited to small investors using crypto assets primarily for speculative purposes. - Market primarily serviced by two crypto-asset service providers (CASPs) (one passporting firm and one domestic exchange firm). - CNMV 2022 survey of 1,500 respondents: - 6.8 percent had invested in crypto currencies. - These investors had an average age of about 40 years. - These investors devoted approximately 5 percent of their investable capital into crypto assets. - Investments were made through social media and technology platforms primarily for speculative purposes. - Crypto exposures, risks, and supervisory arrangements: - Banks’ exposures to crypto assets are immaterial; BdE data show both SIs and LSIs have a conservative approach with limited exposures. - BdE intends to conduct the crypto exposure exercise on a regular basis. - Current market size does not pose significant financial stability concern, but misconduct and market abuse risks remain important. - Monitoring from market conduct and AML perspectives: - CNMV competencies on crypto advertising initially granted by Royal Decree-Law 5/2021 and implemented by CNMV Circular 01/2022. - Law 6/2023 on Securities Markets and Investment Services (LMVSI) designated CNMV competent to control advertising of crypto assets as means of investment. - Prior communication to CNMV (Investors Department) required for massive advertising campaigns aimed at more than 100,000 people, or which are going to have a significant impact on the target public. - Collective investment schemes can be authorized by CNMV to invest in instruments linked to crypto assets; prospectuses must include an express and prominent mention about exposure to cryptocurrencies and associated risks. - BdE manages the register of providers engaged in exchange services between virtual currency and fiat currencies and custodian wallet providers in Spain for AML/CFT purposes (registration does not imply prudential authorization). - MiCA implementation and responsibilities: - MiCA will start to apply in 2024: June 2024 for Titles III and IV; December 2024 for Titles I, II, V, VI, VII. - MiCA provides a framework for licensing and regulating CASP and includes provisions on transparency, disclosure, authorization and supervision of transactions for issuing and trading crypto-assets (including asset-referenced tokens and e-money tokens). - After MiCA becomes applicable: - CNMV assigned competences over crypto assets other than ARTs or EMTs (Title II of MiCA) and over authorization and operating conditions for CASPs (Title V). - BdE responsibilities include issuers of non-significant ARTs (Title 3) and EMTs (Title IV); for domestic EMTs and ARTs BdE will: - Review notifications and white papers received from licensed EMIs and banks intending to issue domestic EMTs. - Approve white papers from licensed banks intending to issue domestic ARTs. - Grant authorization to legal persons intending to issue domestic ARTs. - Dedicate adequate supervisory resources for the supervision of issuers of EMTs and ARTs and significant EMTs and ARTs operating in Spain. - For significant EMTs and ART issuers across the EU, supervisory responsibilities will be shared between the European Banking Authority (EBA) and relevant national competent authorities (NCAs). - Remaining gaps and recommendations: - MiCA will address most challenges and risks, but certain activities are not covered (e.g., DeFi activity and crypto asset lending). - Authorities should evaluate and monitor the extent of DeFi and crypto lending activities; if material, the regulatory perimeter and supervisory approach should be adjusted. - Anecdotal evidence of a growing number of crypto asset lending platforms exists, with some service providers collaborating with licensed EMIs or offering card solutions (example given of a crypto-asset lending platform partnering with Mastercard). - Crypto assets not covered by MiCA include those that qualify as financial instruments under MiFID II and non-fungible tokens (NFTs). - Recommendation: Supervisory authorities should collect information on crypto lending and DeFi activities that are not covered under MiCA. --- ### Nonbank digital lending and regulatory perimeter - Several lending activities may be carried out in Spain without legal reservation for any specific category of institution; regulation is largely unharmonized. - Activities requiring a license include real estate crowdfunding; authorization/registration required to act as a Specialized Lending Institution (SLI), a Mutual Guarantee Company, or a real estate nonbank lender. - Lending activities usually regulated from conduct and AML-CFT perspectives. - New activities outside existing regulatory perimeter include BNPL and P2P lending offered by nonbank lenders: - BNPL ticket sizes are small and retail; activity is on the rise and extended on the basis of less information compared with traditional consumer credit. - BNPL platforms typically perform soft credit checks, often do not report credit history, and provide full coverage of credit risks with merchants paying high fees. - BNPL offered via e-commerce and at POS; Spanish banks also offer BNPL, exposing them to unsecured lending without detailed credit assessment. - Anecdotal evidence of BigTechs partnering with nonbank lending companies and telecommunications providers collaborating with nonbank lenders. - Emergence of many nonbank digital financial intermediation providers that facilitate consumer credit via banks through credit profiling using technology-enabled tools. - Such nonbank digital lenders may not be bound to report to the Central Credit Register (CCR) of BdE. - Data limitations impede thorough analysis; anecdotal evidence suggests nonbank credit volume remains very small compared to bank credit, but limited information exists on business models, funding, scale, client base, and bank collaborations. - Recommendation: - Supervisory authorities should continue to collect information on nonbank digital lending activities, undertake horizontal assessments and thematic reviews to analyze potential sources of interconnectedness between banks and firms involved in non-bank lending. --- ### Regulatory and supervisory approach — legal basis and oversight - Multiple authorities oversee banking and other financial services: - SIs supervised within the SSM (ECB leadership role) with BdE and national authorities participating; ECB has indirect role for LSIs where national authorities are direct supervisors. - BdE supervises: specialized lending entities, PIs, EMIs, and real estate nonbank lenders and credit intermediaries (market conduct perspective). - CNMV supervises securities markets and participants. - DGSFP supervises insurance, reinsurance, and pension plans and funds. - SEPBLAC supervises prevention of money laundering and financing of terrorism. - Spanish authorization regime focuses on provider classification and nature of activity rather than technology used. - Some fintech-related service providers providing ancillary/support services may not fall under direct regulatory oversight or reporting obligations. - Companies offering services similar to licensed institutions (e.g., robo-advisory asset managers) require authorization and are supervised by CNMV. - Authorities do not maintain a specific registry dedicated to fintech entities providing financial services under their oversight. --- ### The inter-agency sandbox — legal basis, governance, operations, and metrics - Legal basis: Law 7/2020 of 13 November (the “Sandbox Law”) established to facilitate digital transformation and create a controlled testing environment with safeguards for users and financial stability. - Governance: Coordinated by SGTFI through a Sandbox Coordination Commission including SGTFI, BdE, CNMV, DGSFP, SEPBLAC, Secretary of State for Digitalization and AEPD. Commission meets approximately quarterly and issues an annual report (two completed, one published). - Admissibility and timing: - Article 5 minimum admissibility requirements: technology-based innovation applicable to financial services; added value; maturity for testing; compliance with AML-CFT and data protection regulations. - Initial admissibility assessment expected to conclude within a maximum of two months. - Protocol determination target duration is three months but can take longer; certain instances took 4.5 to 6 months. - Supervisors’ testing and preparatory phases can have a combined average length of greater than 10 months. - Participation and outcomes: - Eligible participants: any type of company, consortia or natural persons. - Of 109 applications received, 16 projects have completed testing. - Of the 16 completed projects, one has acquired a license and two more are in the application process. - Promoter composition for BdE: over 20 percent from banks and fintech companies, 30 percent consulting firms, and 7 percent PIs. - Operational features: - Promoters do not require a license to test in the sandbox. - Protocols include financial guarantees and signed user agreements where projects involve real users; informed consent of participants is required. - Testing phase: intensive supervisory engagement (weekly follow-up meetings, information reports, potential onsite inspections); supervisory authority can interrupt testing if project goes off track. - At testing end: promoter submits a report; supervisory authority vets promoter report and publishes main conclusions on the authority’s website; supervisory engagement yields market intelligence and may inform regulatory adjustments. - Experience and patterns: - Many tested projects already had a license or did not require authorization under current rules. - Low completion rates partly reflect promoters seeking supervisory expectations or discovering inadequate maturity; completion rates improved after the first cohort. - Application rates declined after the first cohort; CNMV receives between one and three applications per cohort; BdE applications decreased from seven in the second cohort to three in the sixth cohort. - More promoters now prefer the Innovation Hub; imminent entry into force of MiCA likely to be a disincentive for crypto-related projects to use the sandbox. - Costs and suggested changes: - Intensive oversight consumes significant supervisory resources; sandbox operation is costly for stretched BdE and CNMV resources. - Legislation fixes semi-annual cohort frequency and limits supervisory flexibility to divert cases to lower-cost alternatives such as Innovation Hubs. - Suggested legislative and operational considerations: - Allow the Sandbox Coordination Commission to recommend simplifications based on lessons learned. - Streamline accountability and administrative procedures. - Better match pace of entry to pace of exit. - Extend greater flexibility to supervisory authorities to rely on a wider range of tools. - Recommendation: - Authorities (BdE, CNMV and DGSFP) should undertake a cost-benefit analysis of sandbox efficiency, including a comprehensive review of administrative, operational and review procedures at supervisory review, testing and exit phases. --- ### Innovation hubs, fintech engagement, and resourcing metrics - Innovation Hub obligations established by Sandbox law; implemented at BdE, CNMV, and DGSFP. - CNMV Fintech Portal: more than 700 queries since 2020 on topics including crypto assets/blockchain, automated advisory channels, crowdfunding platforms. Portal is a communication channel; opinions are exclusively informative. - BdE innovation channel received approximately 40 queries since inception. - DGSFP introduced a generic e-mail for Sandbox and technological innovation questions; queries focused mainly on Sandbox. - CNMV recently authorized to recruit 76 people but lacks full flexibility and independence in hiring; recruitment rigidities persist. - Recommendation (resourcing and organizational): - CNMV should be granted full autonomy over recruitment, including in key specialist areas. - FSAP recommends CNMV ensure alignment of resources to current and projected future work by gaining full autonomy over recruitment and retention processes. - BdE should assess current and projected workloads over a three to five year period and align resources accordingly. --- *Source: EXECUTIVE SUMMARY and selected sections (1espea2024009-print-pdf).* ### EXECUTIVE SUMMARY __________________________________________________________________________ 5 ### EXECUTIVE SUMMARY ### Scope and approach - Assessment covered fintech developments in Spain, including digitalization of the banking sector, and the supervisory oversight of fintech activity. - The analysis focused on: - Impact of fintech on regulated firms, mainly banks. - Interaction between new market entrants and existing firms. - Approach towards industry monitoring. - Institutional arrangements for regulation and supervision of fintech, including overall supervisory cooperation. - Authorities in scope: Banco de España (BdE), Comisión Nacional del Mercado de Valores (CNMV), Directorate-General for Insurance and Pension Funds (DGSFP). Engagement with the Sandbox Coordination Commission and General Secretariat of the Treasury and International Financing (SGTFI) focused on sandbox roles. ### Key findings — market structure and activity - Banks play a dominant role in Spain’s fintech landscape; fintech penetration is significant in payments and nascent in asset management, investments and lending. - Bizum: owned by 23 Spanish banks, established in 2016, now serves over 25 million customers of 38 Spanish banks, representing 98 percent of the domestic banking sector. - Spending on digital products, services and communication has increased across the banking sector; sales and transaction growth correlate with bank size and business scope. - The number of licensed EMIs doubled between 2018 and 2023, from five to 10. - Most fintech activities are regulated at least from a conduct of business perspective; outside payments, fintech activities are not yet material enough to pose threats to financial stability. - Nonbank digital lending: diverse players face funding constraints that limit scaling of balance sheets. - Crypto asset sector characteristics: - Small (rapid growth from a very low base). - Concentrated (significant share of domestic investors served by two companies). - Low penetration limited to small investors. - Speculative investments constitute the largest share of client activity. - With MiCA implementation in December 2024, most crypto-asset-related activities will be regulated. ### Regulatory and supervisory arrangements and tools - Regulatory framework follows “same risk, same activity, same regulatory outcome” principle; focus on nature of activity and licensing status rather than technology used. - Spain’s framework combines EU legislation (PSD2, MiCA, DORA, DLT Pilot Regime, Consumer Credit Directive/Mortgage Credit Directive) and national regulation. - Authorities use a range of tools: inter-agency Sandbox, Innovation Hub, ad-hoc horizontal assessments, thematic studies, and a developing database of fintech companies. - Technological risks and digital transition were priorities for BdE in 2023 and included in DGSFP’s strategic supervision plan. ### Inter-agency sandbox — strengths and challenges - Strengths: - Wide representation of relevant Spanish authorities in a single body for evaluating fintech innovation. - Comprehensive supervisory review of promoters’ applications and a protocol agreement between promoter and supervisory authority/authorities. - Establishment of a guarantee scheme to secure user and financial sector safety. - Intensive supervisory monitoring during testing phase. - Six cohorts of applicants have provided significant learning and enabled communication of supervisory expectations to promoters and the wider ecosystem. - Challenges: - High supervisory resource intensity: preparatory and testing phases can have a combined average length of greater than 10 months. - Low rates of acceptance and low post-testing take-to-market of projects. - Several promoters approach the Innovation Hub; some promoters exit the sandbox after significant supervisory resources have been expended. - Legislative constraints: sandbox law does not give the Coordination Commission administrative flexibility (e.g., semi-annual cohort frequency) or permit authorities to choose among alternative monitoring options. ### Resourcing and institutional capacity - Supervisory authorities require adequate resourcing to meet complex risks and incoming regulatory requirements. - Resource strains observed at BdE and CNMV; CNMV currently lacks full autonomy over recruitment. - FSAP recommends granting full autonomy to CNMV over recruitment and aligning BdE and CNMV resources to current and expected workloads. ### Key recommendations (Table 1) - Inter-agency Sandbox 1) Provide for Sandbox Coordination Commission to make changes to sandbox operation and streamline administrative processes. — Agency: Government. Priority: H. Timing: I. 2) Provide greater flexibility to supervisory authorities to use preferred mix of tools to monitor market developments, convey supervisory expectations, assess the adequacy of the regulatory perimeter, and assess whether supervisory approaches should be adjusted where necessary. — Agency: Government, BdE, CNMV, DGSFP. Priority: H. Timing: NT. - Fintech Monitoring and Oversight 3) Intensify data collection on nonbank fintechs, including on nonbank digital lending and crypto asset lending, and undertake horizontal assessments and thematic reviews while analyzing the various channels of contagion between the nonbank fintechs and banks. — Agency: MINECO, BdE, CNMV. Priority: M. Timing: NT. 4) Assess the current and projected workloads over a 3-to-5 year period in the area of fintech monitoring, regulation and supervision and ensure alignment of resources to these. — Agency: BdE. Priority: M. Timing: I. 5) Estimate current and projected future workload, ensure alignment of resources to these, and grant full autonomy over the recruitment and retention process. — Agency: CNMV. Priority: H. Timing: I. - Digitalization of Banking Sector 6) Conduct deeper assessment of the impact of digitalization on LSIs’ business models, governance, and risk management strategies. — Agency: BdE. Priority: M. Timing: NT. - Note: Priority codes H, M, L = high, medium, low. Timing codes I, NT, MT = immediate (within one year), near-term (within 2–3 years), medium-term (within 3–5 years). *Source: EXECUTIVE SUMMARY (1espea2024009-print-pdf).* ### 10. Digital delivery and product innovation touches most financial services in Spain today. ### 10. Digital delivery and product innovation touches most financial services in Spain today. ### Fintech landscape and digitalization overview - The European Commission ranked Spain seventh out of 27 EU Member States in their Digital Economy and Society Index (DESI) in 2022. - Data collected by the EU Commission show that more than 300 fintech firms are operating in Spain covering a range of financial services. - Outside of banks, active providers include BigTechs; pure technology companies; nonbank Payment Service Providers (PSPs), such as Payment Institutions (PIs) and EMIs; consulting companies acting as front-end for fintechs; and digital-only banks (typically backed by traditional banking groups and regulated like credit institutions). - Technology-driven innovation is concentrated largely in payments, with lending, asset management, and investments still nascent. ### Payments: adoption, trends, and infrastructure - Consumer payment trends: - 80 percent of non-recurring payments were made at the POS in 2022, down by nearly 7 percentage points. - Online purchases rose to 16 percent of the total in 2022. - Cash remains the dominant means of payment at 65 percent of total transactions, but use is declining. - E-wallets or digital wallets account for 30 percent of e-commerce transactions. - Instant payments and SCT Inst: - The SEPA Instant Credit Transfers facility (SCT Inst) in Spain accounted for 54 percent of total transfers in 2023, versus the EU average of 15 percent. - The rapid growth of instant payments in Spain is being driven by the bank consortium-led arrangement Bizum. - Market structure and licensing: - The number of firms licensed and regulated as PIs or EMIs has increased in the last five years. - The number of PIs licensed in Spain has increased from 54 in 2018 to 77 in 2023. - Role of new payment solutions: - BNPL (Buy Now Pay Later) usage has increased, especially for online purchases, and may be offered by merchants in collaboration with third-party lenders (regulated or nonbank). ### Lending: digital entrants and scale - Nonbank digital lending players include crowdfunding, equity crowdfunding, P2P platforms, and intermediation platforms offering product comparison, credit rating, and customer credit profiling. - Consumer finance crowdfunding platforms extended credit amounting to approximately €2 billion in 2019. - By contrast, the Spanish banking sector size is more than €4.5 trillion. - Despite a large share of fintechs classified in the lending category, total volume of credit granted by these companies remains low. - The BdE taxonomy and studies indicate lending intermediation service providers are numerous but often do not take credit risk. ### Asset management and investments: robo-advisors and automated services - Investment management services are developing, driven by Big Data analytics and Artificial Intelligence. - Robo-advisors and automated investment management platforms provide algorithm-driven financial planning and investment services with little to no human supervision. - Larger robo-advisory service providers are banking groups; nonbank fintechs partner with banks and are licensed with the CNMV. - The number of nonbank fintech firms offering investment analysis and stock tracking services is growing. ### Banks, collaboration with fintechs, and market dynamics - Banks remain dominant and collaborate with fintechs by acquiring products, joining consortia, investing in start-ups, delegating services, and running incubators/accelerators. - Regulated institutions tend to collaborate rather than acquire fintechs due to capital requirements on such investments. - In collaborations, fintechs typically provide technology/service know-how; incumbents provide regulatory support and access to customer databases. - Most digital-only banks are owned by large banks; a few independent challenger banks exist. ### Digitalization of the banking sector: adoption and investments - 70 percent of domestic Spanish customers use online banking services, compared with the EU average of 64 percent. - Spanish banks follow an omnichannel approach, maintaining branches while expanding digital channels for delivery. - ICT investments and expenses: - By June 2023, annual ICT investments by Spanish banks reached €4 billion, compared to €2.6 billion in 2009. - Spanish banks’ ICT expenses as a share of total administrative expenses were 33 percent, versus the EU average of 31 percent. - Cooperative banks and LSIs: - Anecdotal evidence suggests ICT expenses of some credit cooperatives increased by 60 percent over the past five years. - The proportion of digital clients for several LSIs reached as high as 73 percent of total active clients in June 2023, compared to 58 percent in December 2020. - Differential returns: - SIs have seen significant increases in digital customer bases and digital revenues. - LSIs have improved digital access but, in some cases, with little visible impact on sales and revenues. - Operational resilience and governance: - Banks have adapted governance and risk management (e.g., greater technical expert representation at board level) and increased focus on operational resilience, concentration, and third-party risks. ### Supervision, reviews, and regulatory focus - The BdE has conducted horizontal reviews on digital transformation impacts focused on operational resilience and digitalization strategies. - The SSM is conducting a comprehensive horizontal assessment of the impact of digitalization on SIs’ business models, governance, and risk management; 6 out of 10 SIs selected for the first phase are from Spain. - No comprehensive ad-hoc horizontal assessment of digitalization’s impact on LSIs (beyond operational resiliency) has been undertaken due to lack of resources. Recommendation - The BdE should conduct a deeper assessment of the impact of digitalization on the business models, governance, and risk management strategies of LSIs, drawing on lessons from previous BdE analyses and the ongoing SSM review. ### Bizum: business model and scale (summary) - Launched in 2016 by 23 Spanish banks as an information layer to enable P2P instant payments via smartphone by linking phone numbers to bank accounts with no fees to consumers. - Expanded features: donations to NGOs (2018), e-commerce payments (2019), Consumer QR at POS (2022), and Bizum ID (2023). - Technical and regulatory setup: - Built according to the SEPA Instant Credit Transfer (SCT Inst) standard. - Acts as an informational layer leveraging the SEPA real-time payment standard; settlements occur through the National Electronic Clearing System. - Every use case follows PSD2. - Scale and penetration: - In 2023, SCT Inst transfers in Spain accounted for 54 percent of total transfers; Bizum accounted for approximately 90 percent of SCT Inst usage in Spain. - Bizum usage has expanded to greater than 90 percent of bank customers in Spain across all age-groups—25 million customers of 38 Spanish banks, representing 98 percent of the domestic banking sector. - The e-commerce/consumer point-of-service has almost 60,000 participating merchants. *Source: 1espea2024009-print-pdf - 10. Digital delivery and product innovation touches most financial services in Spain today.* ### 25. Bizum is overseen by BdE’s payment systems oversight department as an arrangement ### 25. Bizum is overseen by BdE’s payment systems oversight department as an arrangement for electronic payment instruments, with monitoring conducted under the PISA framework. ### PISA framework and Bizum classification - The Eurosystem oversight framework for electronic payment instruments, schemes and arrangements (PISA framework) entered into force in November 2022 and is based on the CPMI-IOSCO Principles for FMIs. - PISA assesses the security and efficiency of electronic payments and applies to governing bodies of payment schemes and arrangements. - Under PISA, the governance body (licensed or non-licensed) may outsource functions or rely on third parties but remains ultimately responsible for ensuring adherence to the framework. - Bizum is currently classified as an arrangement and is an unlicensed entity owned and governed by banks. - The BdE payments oversight department is considering enhancing monitoring of Bizum from an arrangement to a scheme under PISA because Bizum has started offering additional services (primarily for e-commerce payments). - If classified as a scheme, Bizum would be subject to enhanced monitoring. - Ongoing oversight activities under PISA include risk-assessments, evaluation of changes, major incidents reporting, and statistical monitoring. ### BigTech and mobile payment partnerships - Spanish banks rely extensively on BigTech to offer mobile payment services to fully incorporate banks’ financial cards into these services. - BdE data indicates: - 22 banks work with Apple Pay - 7 banks work with Google Pay - 12 banks work with Samsung Pay ### C. Crypto Asset Ecosystem — market structure and investor profile - The crypto sector in Spain is characterized by concentrated service provision and low penetration limited to small investors using crypto assets primarily for speculative purposes. - The market is primarily serviced by two crypto-asset service providers (CASPs) (one passporting firm and one domestic exchange firm). - CNMV 2022 survey of 1,500 respondents: - 6.8 percent had invested in crypto currencies - These investors had an average age of about 40 years - These investors devoted approximately 5 percent of their investable capital into crypto assets - Investments were made through social media and technology platforms primarily for speculative purposes ### Crypto exposures, risks, and current supervisory arrangements - Banks’ exposures to crypto assets are immaterial; BdE data collection found both SIs and LSIs have a conservative approach to crypto assets with limited exposures overall. - BdE intends to conduct the crypto exposure exercise on a regular basis. - Current size of the crypto assets market does not pose a significant financial stability concern, but misconduct and market abuse risks remain important. - Crypto asset activity is monitored by authorities from market conduct and AML perspectives: - CNMV competencies on crypto advertising were initially granted by Royal Decree-Law 5/2021 and implemented by CNMV Circular 01/2022. - Law 6/2023 on Securities Markets and Investment Services (LMVSI) designated CNMV as competent authority to control advertising of crypto assets as means of investment. - Prior communication to CNMV (Investors Department) for approval is required for massive advertising campaigns aimed at more than 100,000 people, or which are going to have a significant impact on the target public. - Collective investment schemes can be authorized by CNMV to invest in instruments linked to crypto assets; prospectuses for authorized CIS must include an express and prominent mention about exposure to cryptocurrencies and associated risks. - BdE manages the register of providers engaged in exchange services between virtual currency and fiat currencies and custodian wallet providers in Spain for AML/CFT purposes (registration does not imply prudential authorization). ### MiCA implementation and supervisory responsibilities - The EU MiCA Regulation will introduce uniform EU market rules for crypto assets and will start to apply in 2024: - June 2024 for Titles III and IV - December 2024 for Titles I, II, V, VI, VII - MiCA provides a framework for licensing and regulating CASP and includes provisions on transparency, disclosure, authorization and supervision of transactions for issuing and trading crypto-assets (including asset-referenced tokens and e-money tokens). - After MiCA becomes applicable, CNMV has been assigned competences over crypto assets other than ARTs or EMTs (Title II of MiCA) and over authorization and operating conditions for CASPs (Title V). - BdE responsibilities include issuers of non-significant ARTs (Title 3) and EMTs (Title IV), and for domestic EMTs and ARTs BdE will: - Review notifications and white papers received from licensed EMIs and banks intending to issue domestic EMTs - Approve white papers from licensed banks intending to issue domestic ARTs - Grant authorization to legal persons intending to issue domestic ARTs - Dedicate adequate supervisory resources for the supervision of issuers of EMTs and ARTs and significant EMTs and ARTs operating in Spain - For significant EMTs and ART issuers across the EU, supervisory responsibilities will be shared between the European Banking Authority (EBA) and relevant national competent authorities (NCAs). ### Remaining gaps, emerging activities, and recommendations for crypto - MiCA will address most challenges and risks, but certain activities are not covered (e.g., DeFi activity and crypto asset lending). - Authorities should evaluate and monitor the extent of DeFi and crypto lending activities; if material, the regulatory perimeter and supervisory approach should be adjusted. - Anecdotal evidence of a growing number of crypto asset lending platforms exists, with some service providers collaborating with licensed EMIs to facilitate crypto asset credit intermediation or offering card solutions (for example, a crypto-asset lending platform partnering with Mastercard facilitates crypto-asset backed payments). - Crypto assets not covered by MiCA include those that qualify as financial instruments under MiFID II and non-fungible tokens (NFTs). Recommendation: - Supervisory authorities should collect information on crypto lending and DeFi activities that are not covered under MiCA. ### C. Nonbank Digital Lending and Financial Intermediation — regulatory perimeter and developments - Several lending activities may be carried out by individuals and companies in Spain without legal reservation for any specific category of institution; regulation is largely unharmonized. - Activities requiring a license include real estate crowdfunding; authorization/registration is required to act as a Specialized Lending Institution (SLI), a Mutual Guarantee Company, or a real estate nonbank lender. - Lending activities are usually regulated from conduct and AML-CFT perspectives. - New activities falling outside existing regulatory perimeter include BNPL and peer-to-peer lending offered by nonbank lenders: - BNPL ticket sizes are small and are retail, but activity is on the rise and extended on the basis of less information compared with traditional consumer credit. - BNPL platforms typically perform soft credit checks, often do not report credit history, and provide full coverage of credit risks with merchants paying high fees. - BNPL is offered via e-commerce platforms and at POS; Spanish banks also offer BNPL solutions, exposing them to unsecured lending without detailed credit assessment. - Anecdotal evidence of BigTechs partnering with nonbank lending companies and telecommunications providers collaborating with nonbank lenders to offer BNPL and other lending solutions. - Emergence of many nonbank digital financial intermediation providers that facilitate consumer credit via banks through credit profiling using technology-enabled tools and qualitative/quantitative parameters. - Such nonbank digital lenders may not be bound to report to the Central Credit Register (CCR) of BdE. - Data limitations impede thorough analysis of risks in some unregulated segments; anecdotal evidence suggests nonbank credit volume remains very small compared to bank credit, but limited information exists on business models, source funding, scale, client base, and collaborations with banks. Recommendation: - Supervisory authorities should continue to collect information on nonbank digital lending activities, undertake horizontal assessments and thematic reviews to analyze potential sources of interconnectedness between banks and firms involved in non-bank lending. ### Regulatory and Supervisory Approach — legal basis and fintech oversight - Multiple authorities oversee conduct of banking and other financial services in Spain: - SIs are supervised within the SSM (ECB leadership role) with BdE and other national authorities participating; ECB has an indirect role for LSIs where national authorities are direct supervisors. - BdE supervises: specialized lending entities, PIs (payment institutions), EMIs (electronic money institutions), and real estate nonbank lenders and credit intermediaries (market conduct perspective). - CNMV is Spain’s market regulatory authority supervising securities markets and market participants. - DGSFP supervises insurance, reinsurance, and pension plans and funds. - SEPBLAC supervises prevention of money laundering and financing of terrorism, including financial sanctions and countermeasures. - Spanish authorization regime focuses on the provider’s classification and the nature of the activity rather than technology used. - Some fintech-related service providers providing ancillary or support services to regulated institutions may not fall under direct regulatory oversight or reporting obligations. - Companies offering services similar to licensed institutions (e.g., robo-advisory asset managers) require authorization and are supervised by CNMV. - Authorities do not maintain a specific registry dedicated to fintech entities providing financial services under their oversight. *Source: IMF staff report excerpt.* ### 41. The authorities’ objectives are to harness the benefits of fintech while managing ### The authorities’ objectives are to harness the benefits of fintech while managing additional risks it may generate ### Objectives and risks of fintech innovation - Authorities aim to keep up to date with European regulatory developments and possible improvements in national legislation. - Risks of interest include: - robustness of the business models of fintech services providing firms; - threats to cyber security; - operational interconnectedness and concentration of key service provision, e.g., CSP; - impact on incumbents’ business models and on consumers. ### Supervisory tools, monitoring, and data limitations - Tools and activities used by financial sector authorities: - operating a sandbox and an Innovation Hub; - ad-hoc horizontal assessments and thematic studies on emerging fintech issues; - facilitating development of a database of fintech companies in Spain; - participation in and organization of fintech events by BdE, CNMV, and DGSFP. - Data and information limitations impeding risk assessment: - scarcity and unreliability of information due to fragmentation and diversity of fintech service provision; - certain activities not regulated or only subject to licensing/registration without prudential supervision and oversight; - some firms operate cross-border using passporting arrangements without specific reporting to host authorities; - limited information on nonbank digital lending activities. - BdE fintech mapping studies and counts: - BdE studies in 2017, 2019 and 2021 identified 130, 224 and 677 fintech companies in Spain respectively; the mapping is based on business model and service provided irrespective of supervisory oversight. ### The inter-agency sandbox: legal basis, objectives, and governance - Legal basis and objective: - Law 7/2020 of 13 November (the “Sandbox Law”) established to facilitate digital transformation of the financial system and create a controlled testing environment for new products and services, ensuring safeguards for users and financial stability. - Sandbox objective: provide requisite assurances and oversight by supervisory authorities, in a safe testing environment, of novel financial solutions that leverage technology. - Governance structure: - Coordinated by the General Secretariat of the Treasury and International Financing (SGTFI) through a Sandbox Coordination Commission. - Commission membership includes SGTFI, three financial supervisory authorities (BdE, CNMV, DGSFP), SEPBLAC, the Secretary of State for Digitalization and Artificial Intelligence (Ministry for Digital Transformation and of Civil Service), and Spain’s Data Protection Authority (AEPD). - Commission meets on an approximately quarterly frequency and issues an annual report (two completed thus far, with one published). - Out of three SGTFI representatives, one serves as President and another as Secretary of the Coordination Commission. ### Admissibility, allocation, and procedural timings - Eligible participants: - Any type of company, consortia or natural persons can participate. - Projects typically fall across three types: (i) supervised entities, (ii) fintech start-ups, (iii) IT solutions providers and consultants. - Article 5 minimum admissibility requirements: - offer a technology-based innovation applicable to financial services; - have added value; - have maturity of preparation to render them ready for testing; - ensure compliance with AML- CFT and data protection regulations. - Procedural timings and responsibilities: - Initial assessment of admissibility by SGTFI and BdE, CNMV, DGSFP expected to conclude within a maximum of two months. - Projects assigned to one or more supervisory authorities based on services to be tested. - Exemptions may be granted on a case-by-case basis by respective financial sector authorities within their competencies. ### Protocol determination, testing oversight, and exit - Protocol determination and safeguards: - Supervisory authorities review key parameters and agree protocols with promoters to erect safeguards and testing plans. - Promoters do not require a license or specific authorization to test in the sandbox. - Promoter composition for BdE: over 20 percent from banks and fintech companies, 30 percent consulting firms, and 7 percent PIs. - Protocol determination stage target duration is three months but can, on average, take more time; certain instances took 4.5 to 6 months. - Protocols include financial guarantees and signed user agreements where projects involve real users; informed consent of participants is required. - Testing phase oversight: - Intensive supervisory engagement, e.g., weekly follow-up meetings, requirement for information reports, potential onsite inspections. - Supervisory authority empowered to interrupt testing if project goes off track. - At testing end, promoter submits a report; supervisory authority vets promoter report and publishes its main conclusions on the authority’s website. - Supervisory engagement yields market intelligence and may inform adjustments to the regulatory perimeter or supervisory approach. ### Experience from six cohorts: outcomes and patterns - Time and completion metrics: - Supervisors’ testing and preparatory phases can have a combined average length of greater than 10 months. - Of 109 applications received, 16 projects have completed the testing process. - Post-testing licensing outcomes: - Of the 16 completed projects, one has acquired a license and two more are in the application process. - Observed patterns and explanations: - Many tested projects either already had a license or did not require authorization under current rules (e.g., digital ledger technology, crypto asset service provision categories, IT solutions sold or outsourced to regulated entities). - Low completion rates partly reflect promoters seeking supervisory expectations or discovering inadequate maturity; completion rates have improved after the first cohort but cohort-specific rates were not available. - Application rates declined after the first cohort; CNMV receives between one and three applications per cohort; BdE applications decreased from seven in the second cohort to three in the sixth cohort. - More promoters now prefer the Innovation Hub; imminent entry into force of MiCA likely to be a disincentive for crypto-related projects to use the sandbox. - Benefits for successful completions: - Projects completing the testing phase are better placed to meet licensing and regulatory requirements and to promote solutions and access financing because supervisory testing results are published and SGTFI publishes an annual report. ### Strengths, operational costs, and suggested operational changes - Strengths of the sandbox: - Comprehensive supervisory review of applications, protocol determination securing user and financial sector safety, and intensive supervisory oversight during testing. - Significant supervisory learning and effective communication of supervisory expectations; transparency of reporting extends benefits to the broader ecosystem. - Costs and constraints: - Intensive oversight requires significant supervisory resources; with stretched resources at BdE and CNMV, the sandbox is not an economical tool. - Legislation fixes semi-annual cohort frequency and limits supervisory flexibility to divert suitable cases to lower-cost alternatives such as Innovation Hubs. - Sandbox Coordination Commission cannot modify operational arrangements. - Solutions tested to date may not be fully representative of market financial innovation (e.g., CNMV solutions limited to asset tokenization, crypto-currency and DLT-FMI in relation to the EU DLT Pilot Regime). - Suggested legislative and operational considerations: - Consider legislative changes to allow the Sandbox Coordination Commission to recommend simplifications based on lessons learned, streamline accountability and administrative procedures, and better match pace of entry to pace of exit. - Extend greater flexibility to supervisory authorities to rely on a wider range of tools to monitor market developments, convey supervisory expectations, and assess adequacy of the regulatory perimeter. ### Recommendation - The authorities (BdE, CNMV and DGSFP) should undertake a cost-benefit analysis of the efficiency of the sandbox process, including, but not limited to, a comprehensive review of the administrative, operational and review procedures specifically being followed at the supervisory review and testing phase and outcomes achieved at exit phase. *Source: IMF country report content provided.* ### 53. Consideration should be given to provide for the Coordination Commission to make changes ### Consideration should be given to provide for the Coordination Commission to make changes to the sandbox operation, and to streamline administrative processes ### Sandbox governance and operations - The DLT Pilot Regime is part of the Digital Finance Package introduced by the European Commission in 2020 and aims at developing the trading and settlement for DLT financial instruments. - The DLT Pilot requires ESMA to assess whether the RTS developed under MiFIR relative to certain pre- and post-trade transparency and data reporting requirements need to be amended to be effectively applied also to securities issued, traded, and recorded on DLT. - The Coordination Commission is required to publish an annual report on the digital transformation of the financial system (Art. 25 of Law 7/2020). - A cohort has to initiate every 6 months (Art 6 (3) of Law 7/2020), though in practice there were instances of multiple cohorts running consecutively due to varying period of testing. - Consideration should be given to provide for the Coordination Commission to make changes to the sandbox operation, and to streamline administrative processes (e.g., adjust, where necessary, the frequency of cohorts and redirect, where seen beneficial, individual applications to other tools where these are available and more/equally suitable). ### Innovation hubs, Fintech portals, and engagement statistics - The Sandbox law established the obligation of running an Innovation Hub, currently in place at BdE, CNMV, and DGSFP. - The CNMV created a Fintech Portal to provide support on regulatory aspects of securities markets affecting projects. - Since its initiation in 2020, the Fintech Portal of the CNMV has received more than 700 queries on topics including crypto assets/blockchain, automated advisory channels, crowdfunding platforms. - The Fintech Portal is purely a communication channel; opinions expressed by the CNMV within the Fintech Portal are exclusively informative. - Every query received through the Fintech Portal at CNMV follows a process including separate documentation and potential invitation to test the solution or product in the sandbox. CNMV’s Annual Report includes statistics and a general overview of the queries. - CNMV has dedicated staff to respond to these queries, but resources are shared with the Sandbox and other fintech initiatives of the sectoral authority. - BdE’s innovation channel has received approximately 40 queries since inception. - DGSFP has introduced a specific generic e-mail address for questions regarding the Sandbox and technological innovation; questions received focused mainly on the Sandbox. ### Internal organization and resourcing for fintech supervision - BdE established an internal Financial Innovation Group with representatives from innovation, banking supervision, payments, conduct, regulation, financial stability, legal, information systems, and General Secretariat; the group meets in different compositions and helps coordinate sandbox and innovation channel functioning. - CNMV’s fintech department responsible for the sandbox and the Fintech Portal collaborates internally across departments and is principally engaged in the implementation of MiCA. - Within DGSFP, the Conduct Market Department processes sandbox applications and ad-hoc queries, with IT and other departments involved depending on project subject matter. - Current resourcing: - Supervisory resources are stretched at the BdE, and less-than-adequate at the CNMV. - The CNMV’s lack of flexibility and independence in hiring staff—due to government approvals needed on a case-by-case basis—hampers recruitment, retention, and succession planning in specialist areas. - The CNMV does not expect license applications from larger CASPs (likely licensed outside Spain) but expects relatively smaller CASPs domiciled in Spain to apply for a license. CNMV is responsible for supervision of all CASPs or other crypto-asset related service providers offering services in Spain. - The BdE will be responsible for licensing and supervising some ARTs and EMT issuers. - Resources will be needed to jointly monitor and supervise significant EMT and ART issuers operating in Spain with EBA. - BdE staff is aware of the cost associated with sandbox operation. ### Recommendations (resourcing and organizational) - The CNMV should be provided full autonomy over its recruitment of staff, including in key specialist areas. While CNMV has recently been authorized to recruit 76 people, significant rigidities in the recruitment process remain. - The FSAP recommends that the CNMV ensure alignment of resources to current and projected future work by gaining full autonomy over its recruitment and retention processes. - The BdE should assess current and projected workloads over a three to five years period and align resources and enhance capacity accordingly. ### Supervisory and international cooperation - BdE participates in BIS, Asociación de Supervisores Bancarios de las Américas (ASBA), Centro de Estudios Monetarios Latinoamericanos (CEMLA), various FSB working groups on fintech, BIS Innovation Network Working Group of Green Finance, CEMLA Fintech Data Gaps Working group, Basel Committee FTG, workstream on Non-Financial Risks (WNFR) of the Supervisory Cooperation Group (SCG), and some FinCoNet working groups (e.g., BNPL). - CNMV participates in various committees of ESMA and IOSCO. - DGSFP maintains collaboration with the Association of Latin American insurance supervisors (ASSAL), which conducted a survey on Insurtech in 2023. - BdE and CNMV are members of the European Forum for Innovation Facilitators (EFIF); EFIF enables exchange of experiences from engagement with firms through innovation facilitators (regulatory sandboxes and innovation hubs), imparts technological expertise, and fosters consensus on regulatory treatment of innovative products, services and business models. - BdE participates in the Joint Team on Digitalization and Fintech focusing on impact, risk, and supervision of new technologies by banks. - There are consistent and significant cooperation and coordination mechanisms with other European authorities in relation to fintech based on existing agreements and regulation governing Spain’s participation in European supervision and banking sector institutional arrangements (SSM). ### Regulatory oversight and digitalization indicators (high-level) - CNMV Fintech Portal queries: more than 700 since 2020. - BdE innovation channel queries: approximately 40 since inception. - CNMV recently authorized to recruit 76 people. - Cohort initiation requirement: every 6 months (Art 6 (3) of Law 7/2020). - BdE to assess workloads over a three to five years period. *Italic: Source — 1espea2024009-print-pdf - 53. Consideration should be given to provide for the Coordination Commission to make changes to the sandbox operation, and to streamline administrative processes (excerpt).* --- _Source: https://www.imf.org/-/media/files/publications/cr/2024/english/1espea2024009-print-pdf.pdf_