CNMV warning as an unauthorised firm: how to get off the list

The case, in five lines

What is brought

A challenge to the CNMV's warning (an optional request for reconsideration, the recurso de reposición, or a judicial review appeal) or, if the warning was justified and circumstances have changed, an application for its withdrawal or correction and an appeal against any refusal; in the alternative, an action against the CNMV's conduct as unlawful de facto action, the vía de hecho (articles 25.2 and 30 LJCA, the Contentious-Administrative Jurisdiction Act). In parallel, defence against the cease-and-desist order (article 129.4 of Ley 6/2023, the Securities Markets and Investment Services Act) and regularisation.

Before which court

The CNMV (Comisión Nacional del Mercado de Valores, Spain's securities regulator) publishes the warning, issues the cease-and-desist order and decides on withdrawal and on reconsideration; its decisions are administratively final (article 23 of Ley 6/2023). Judicial review lies with the Sala de lo Contencioso-administrativo (the Contentious-Administrative Chamber) of the Audiencia Nacional (the National High Court), as court of sole instance (fourth additional provision, paragraph 2, of the LJCA), with a cassation appeal to the Tribunal Supremo (the Supreme Court). No pre-action requirement applies: article 5 of Organic Law 1/2025 governs civil proceedings only.

Deadline

Reconsideration: one month, and the CNMV has another month to decide (article 124 LPAC, the Administrative Procedure Act). Judicial review: two months from the day after notification of the act or of the express decision on reconsideration (article 46.1 and 4 LJCA); a strict time bar, with August excluded (article 128.2 LJCA). Without notification, count them from the day you learned of the warning. If reconsideration is deemed refused through silence, the Tribunal Constitucional (the Constitutional Court) holds that the appeal is not subject to a time bar: it remains open for as long as the CNMV has not decided expressly. Unlawful de facto action: ten days after the ten days the CNMV has to act on your formal demand, or twenty without one (article 46.3 LJCA). Periodic penalty payments if the activity continues thirty days after the cease-and-desist order (article 9.1 of Royal Decree 813/2023). The infringement is time-barred five years after it ends (article 311 of Ley 6/2023).

Who can bring it

Standing lies with the company and the individuals named in the warning, and with anyone harmed without being the target, such as a company whose brand is used by a clone; the challenge is brought against the CNMV. Anyone providing investment services on a professional or habitual basis, or soliciting clients for them, needs authorisation or must be a registered agent (articles 129 and 130 of Ley 6/2023), as does anyone providing crypto-asset services (article 59 MiCA).

Financial risk

With the warning published: blocked advertising (article 246.3 of Ley 6/2023) and accounts under review or closed. If you keep operating: periodic penalty payments of up to 500,000 euros per order and a very serious infringement fined at no less than 600,000 euros, up to five times the revenue earned or 10% of turnover, and disqualification of directors. Regularisation costs money: in crypto-assets, own funds of 50,000 to 150,000 euros or a quarter of fixed overheads, if higher. The losing party usually pays the costs (article 139 LJCA).

What the warning is, and why it is not 'for information only'

Ley 6/2023 (the Securities Markets and Investment Services Act) reserves investment services, their marketing and client acquisition to firms authorised by and registered with the CNMV or the Banco de España, Spain's central bank (article 129.1). Anyone carrying on those reserved activities without authorisation is ordered by the CNMV to cease immediately (article 129.4), and Royal Decree 813/2023 adds that the CNMV 'may also issue public warnings regarding the existence of this non-compliant conduct' (article 9.2). From that, and from its power to 'publish notices' (article 234.3.o), comes the so-called chiringuitos list (Spanish slang for boiler rooms).

The CNMV presents it as investor information: it warns about those who 'may' be providing services without authorisation. But the law gives it legal effect: search engines, social networks and media outlets must check, before running ads for investment services, that the advertiser is authorised and is not among the entities warned against by the CNMV or by foreign supervisors (article 246.3 of Ley 6/2023). That is why advertising is the first thing to go and, almost at the same time, your banking relationship.

It helps to separate three things that tend to arrive together: the warning, which is not a penalty and needs no prior hearing (Royal Decree 813/2023 provides one for the order); the cease-and-desist order, which opens the door to periodic penalty payments; and sanctioning proceedings, a separate procedure with its own defence. Check which section you appear in, too: if it is the one for warnings from foreign supervisors, another authority made the decision and the main battle is in that authority's country.

What triggers it: where the regulatory perimeter lies

Article 125 of Ley 6/2023 lists the investment services: reception and transmission of orders, including bringing investors together so that they trade with each other; execution of orders; dealing on own account; portfolio management; placing and underwriting; investment advice; and operating trading facilities. They require authorisation if provided on a professional or habitual basis in relation to financial instruments, foreign exchange included (article 129.1), and habitual activity is proved by the advertising, the clients and how you are paid.

Trading signals are the most contested case. The law excludes from investment advice generic, non-personalised recommendations and those disseminated exclusively to the public (article 125.1.g). A channel posting the same ideas to everyone, without regard to each member's circumstances, has a case for falling outside the perimeter. It loses that case if it personalises or if a system executes trades in the subscriber's account: depending on who decides and who executes, that may already be investment advice, portfolio management or reception and transmission of orders.

The most common trap is client acquisition. Only authorised firms may market investment services and solicit clients on a professional basis, directly or through agents registered with the CNMV before starting (articles 129.1 and 130.3). An affiliate paid per client referred to a broker, without being its registered agent, is soliciting clients even if the broker is authorised. In crypto-assets an equivalent authorisation requirement applies (article 59 MiCA), and a third-country firm loses the reverse solicitation exemption if it solicits clients or advertises in the Union (article 61).

If you do nothing: cease-and-desist order, penalty payments and sanctions

The warning is usually followed by a cease-and-desist order, which the CNMV issues after giving you a hearing (article 9.2 of Royal Decree 813/2023): that is the best opportunity to head it off with evidence. If the activity continues thirty days after the order is notified, periodic penalty payments of up to 500,000 euros are imposed, repeated with each new order (article 129.4 of Ley 6/2023 and article 9.1 of the Royal Decree). They are not the penalty: they are a means of forcing you to stop, and can be combined with it.

Carrying on reserved activities without authorisation is always a very serious infringement (article 289.1.b and 2.a). The fine can reach the highest of several amounts, such as five times the revenue earned from the reserved activity, 10% of turnover or 5,000,000 euros, and it can never be lower than 600,000 euros (article 312.1 and 14). The directors responsible risk up to 400,000 euros and disqualification for up to ten years (article 327), and the penalty is made public (articles 334 and 335).

If the activity went on for months, the infringement is only time-barred five years after it ended (article 311). The 600,000 euro floor is set by Ley 6/2023, in force since 7 April 2023: earlier conduct is governed by the rules then in force, unless the new law is more favourable (article 26 of Law 40/2015, the Public Sector Legal Regime Act), but if the activity carried on, the CNMV is likely to apply the new law. In crypto-assets it may order immediate cessation without prior warning and, as a last resort, restrict access to the website or have the domain deleted (article 94.1.h and aa MiCA), with the penalties in articles 307 and 323 of Ley 6/2023.

Getting off the list: four situations, four strategies

If the warning is a mistake, because it confuses you with a cloned domain or because your activity is not reserved, you ask for it to be corrected or withdrawn and, at the same time, you challenge it. Against a clone, the evidence is technical: who registered the domain, where it is hosted, which accounts it collects payments into and who owns the trade mark. Against the legal characterisation, it is how the business really works: who decides, who executes, where the money goes and how you are paid.

If you operate under the cover of an authorised firm, that cover must appear where the CNMV looks for it: in its register of agents or, if the firm is from another Member State, in its home supervisor's notification to the CNMV (articles 145 and 147 of Ley 6/2023). In crypto-assets, the passport is activated by notification to the home supervisor (article 65 MiCA). If that step is missing, it is completed before requesting withdrawal; if it is on record, the warning is a factual error.

If the activity was reserved, the way out is to stop and regularise: take down the offer and the ads, onboard no new clients, organise the exit of existing ones and choose between becoming an agent of an authorised firm or applying for your own licence, which for an investment firm the CNMV decides within six months, with deemed refusal if it does not (article 131). Stopping does not erase the warning or the risk of a penalty, but it allows you to request withdrawal and counts as a mitigating factor (article 329.1.h and j). Check the corporate object too: if it breaches the law, the registration is void (article 129.5).

The challenge: what you attack, when and before which court

There are two routes, and choosing the wrong one costs you the deadline. If the warning was wrong from the outset, you challenge the warning itself: it affects your rights, and CNMV decisions are administratively final (article 23 of Ley 6/2023). You may seek reconsideration from the CNMV within one month or bring a judicial review appeal within two (article 46.1 LJCA, the Contentious-Administrative Jurisdiction Act) before the Sala de lo Contencioso-administrativo (the Contentious-Administrative Chamber) of the Audiencia Nacional (the National High Court), under the fourth additional provision, paragraph 2, of the LJCA. If it was justified but you have since stopped or regularised, you apply for withdrawal and challenge any refusal.

Calculating the deadline is the delicate part: the warning is published and often not notified. It can be argued that time therefore does not run, but do not rely on it: count the one month and the two months from the day you learned of it. If you seek reconsideration, the two months run from notification of its decision (article 46.4 LJCA); if it is deemed refused a month later, the Tribunal Constitucional (the Constitutional Court) holds that no time bar applies: you may appeal for as long as the CNMV has not decided expressly. August does not count for the court appeal, but it does for reconsideration. As unlawful de facto action, the time limit is counted in days: ten after the ten days the CNMV has to act on your formal demand, or twenty without one (articles 30 and 46.3 LJCA).

No prior negotiation is required: the pre-action requirement in article 5 of Organic Law 1/2025 applies in civil proceedings, not against a supervisor. It does apply to civil claims, such as an action against whoever is impersonating your brand, before the commercial section of the Tribunal de Instancia (the first-instance court), or a client's claim for the money invested, except when seeking interim measures before filing (article 5.3). Before the Audiencia Nacional you may seek interim suspension, but the court weighs investors' interests (article 130 LJCA): without an obvious error, it is hard to obtain.

Evidence: what the Audiencia Nacional actually looks at

In the appeal, the CNMV sends the full administrative file to the court and you will see what it relied on: screenshots, ads, investor complaints, warnings from other supervisors. The courts defer to the supervisor's technical judgement, but facts are not a matter of discretion: if you were not managing other people's money or soliciting clients, the warning has no basis, however cautiously it was worded. The case is won by contesting the facts with expert evidence.

What decides the case is evidence that reconstructs the business as it actually operated: an IT expert report on who decides, who executes and whether your system has access to clients' accounts and credentials; a forensic accounting report that follows the money, because if it never passed through your accounts the portfolio management and custody allegations fall away; and the agreements with the broker and their invoices, because a commission per client or per volume proves solicitation better than any witness.

Your own marketing is often the CNMV's best evidence: 'we manage your money' or 'guaranteed returns' carry more weight than the disclaimer saying you do not give advice. Do not delete anything: take the offer down, but keep a complete, certified copy of the website, the ads and the channels as they were. And weigh every word you send to the CNMV or post on social media: it will go into the file, including any sanctioning file.

Banks, clients and reputation: containing the damage in the meantime

The bank does not need a penalty to close your account: Spain's anti-money laundering law prohibits it from maintaining the relationship if it cannot apply customer due diligence and exempts it from liability if it terminates on that ground, save for unjust enrichment (article 7.3 of Law 10/2010). A CNMV warning triggers exactly that review: get ahead of it with a file on the activity, the source of the incoming payments and your strategy. If the account has already been closed, that is a separate, civil battle, with its own deadlines.

With clients, a mass message to reassure them that also promises new opportunities can be read as continued solicitation. The prudent course is to announce that the offer has been withdrawn and to organise the exit of positions and balances through the same channels through which they came in, never via personal or third-party accounts. If client money is missing, there is also a criminal dimension: the CNMV may refer the matter for prosecution and require assets to be frozen (article 234.3.e and n of Ley 6/2023).

Withdrawal does not wipe the trail clean by itself: the warning is reproduced on alert portals, forums and search engines, and in crypto-assets ESMA (the European Securities and Markets Authority) publishes a register of non-compliant entities, which it updates when circumstances change (article 110 MiCA). Once withdrawal is obtained, each of them is asked to update its records. An individual named in the warning can ask search engines to delist outdated results (article 17 GDPR); the company cannot, because the Regulation only protects natural persons.

How we run the case, step by step

1. 1

   We record the date and wording of the warning

   We certify the entry, its date and its section, and calculate the one month for reconsideration, the two months for the appeal and, where relevant, the days for a de facto action claim.

2. 2

   We cut your exposure without destroying evidence

   We take down the ads and stop onboarding, keep a certified copy of the website and channels and prepare a client communication that does not look like solicitation.

3. 3

   We assess your activity against the perimeter

   We review each service (signals, copy trading, affiliate marketing, custody, crypto-assets) against articles 125 and 129 of Ley 6/2023 and article 59 MiCA, and choose the route.

4. 4

   We file our submission with the CNMV

   A request for reconsideration or an application for withdrawal, with expert reports, agreements and register entries; if a hearing notice arrives ahead of a cease-and-desist order, we answer it in full.

5. 5

   We protect your banking and operations

   We send your bank and payment providers a file on the activity and the incoming payments, and set the exit in motion: registered agent, passport or authorisation.

6. 6

   We appeal and clean up the trail

   If the CNMV maintains the warning, we appeal to the Audiencia Nacional, seeking interim suspension where the error is clear; afterwards, we ask portals and search engines to update their records.

The law that applies

• Arts. 125, 129 y 130 de la Ley 6/2023. They reserve investment services and client acquisition to authorised firms and their registered agents; anyone carrying on those activities without authorisation is ordered to cease, backed by periodic penalty payments of up to 500,000 euros. BOE-A-2023-7053
• Art. 246 de la Ley 6/2023. Search engines, social networks and media outlets must check, before running ads for investment services, that the advertiser is authorised and is not among the entities warned against. BOE-A-2023-7053
• Arts. 289, 311, 312 y 327 de la Ley 6/2023. Carrying on reserved activities without authorisation is a very serious infringement: at least 600,000 euros, up to five times the revenue earned or 10% of turnover, and up to 400,000 for directors; it is time-barred five years after the activity ends. BOE-A-2023-7053
• Art. 23 de la Ley 6/2023. CNMV decisions are administratively final and may be challenged before the contentious-administrative courts. BOE-A-2023-7053
• Arts. 59, 61, 94 y 110 del Reglamento (UE) 2023/1114 (MiCA). Only authorised or eligible providers may provide crypto-asset services; soliciting clients in the Union rules out reverse solicitation; immediate cessation may be ordered without prior warning, and ESMA publishes a register of non-compliant entities. 32023R1114
• Arts. 25, 30 y 46 y disposición adicional cuarta de la Ley 29/1998 (LJCA). An appeal lies against administratively final decisions and against unlawful de facto action; appeals against the CNMV go to the Audiencia Nacional as court of sole instance, within two months; against de facto action, within ten or twenty days. BOE-A-1998-16718
• Art. 5 de la LO 1/2025. In civil proceedings, a claim requires a prior attempt at a negotiated solution, save for exceptions such as interim measures before filing; it does not apply to an appeal against the CNMV. BOE-A-2025-76
• Art. 7 de la Ley 10/2010. Banks may not maintain business relationships if they cannot apply customer due diligence, and terminating them on that ground creates no liability, save for unjust enrichment. BOE-A-2010-6737

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions