CNMV sanction proceedings opened against you: how to defend yourself

The case, in five lines

What is brought

Defence in CNMV sanction proceedings: written submissions and evidence against the notice opening proceedings and the proposed decision. Against the penalty, an optional recurso de reposición (a request for reconsideration addressed to the CNMV itself) or a judicial review claim (recurso contencioso-administrativo) with an application for interim suspension. If the penalty was imposed under Law 35/2003 on collective investment schemes (LIIC), an administrative appeal to the Minister for the Economy comes first (article 94.1 LIIC).

Before which court

The CNMV investigates and imposes the penalty (article 270 of Ley 6/2023, the Securities Markets and Investment Services Act), with a mandatory report from the Banco de España (the Spanish central bank) where it penalises a Spanish credit institution for a serious or very serious infringement. Its decision is administratively final (article 23) and is challenged before the Sala de lo Contencioso-administrativo (Contentious-Administrative Chamber) of the Audiencia Nacional (the National High Court) under the fourth additional provision of the LJCA (the Judicial Review Act), without the prior negotiation that article 5 of Organic Law 1/2025 reserves for civil cases.

Deadline

One year from the decision opening proceedings to decide and notify, extendable by a reasoned decision (article 270.2 of Ley 6/2023); once it expires, the proceedings lapse (article 25.1.b LPAC, the Administrative Procedure Act). Infringements become time-barred after five, four or two years (very serious, serious or minor) from their commission or from the end of a continuing activity (article 311). Against the penalty, one month for reconsideration or a strict two-month time bar for judicial review, from the day after notification (article 46 LJCA).

Who can bring it

Each respondent mounts a defence: the firm and, in their own right, the directors and senior managers charged with the infringement (article 327 of Ley 6/2023), as well as anyone who carries on a reserved activity without authorisation (article 289). If the company wants to pay and a director wants to contest his or her own fault, each needs a separate defence. Whoever is penalised may appeal.

Financial risk

For very serious infringements, a fine of up to the highest of: five times the gross profit, 5% of own funds or of the funds used, 10% of turnover or 5,000,000 euros, plus withdrawal of authorisation and disqualification (article 312). For serious ones, up to three times the profit, 2% or 300,000 euros (article 313). For directors, up to 400,000 or 250,000 euros and, for very serious infringements, removal from office (article 327). The penalty is published, and losing the appeal usually means an adverse costs order (article 139 LJCA).

Before proceedings open: the inspection is already the case file

Almost no CNMV case begins with the notice opening proceedings. Months of supervision come first: information requests, on-site visits, summonses to give evidence and inspection records. Facts established by CNMV staff have evidential value, without prejudice to any evidence you put forward to the contrary (article 238 of Ley 6/2023). Every reply to an information request is therefore already a defence document: whatever is handed over in a hurry, incomplete or poorly explained resurfaces later as a proven fact in the proposed decision.

Non-cooperation is not neutral either: failing to send what is requested on time or failing to appear when summoned to give evidence is a minor infringement (article 310.a), although for an investment firm failing to send what is requested, sending it late or sending inaccurate data can be a serious or very serious one (article 291.1.g). There is a limit for individuals: the Court of Justice of the European Union recognises that, when they face penalties of a criminal nature such as those for market abuse, they have the right not to give answers that would incriminate them, but not a right to refuse to appear.

That evidential value covers established facts, not assessments: 'the controls were insufficient' is the inspection team's opinion, and it is contested with technical evidence. At this stage it pays to centralise all replies, keep a copy and an index of what was handed over, and correct any wrong data in writing, immediately. Remedying the breach on your own initiative and cooperating by providing relevant information count, by law, when the penalty is set (article 329.1.h and j).

The notice opening proceedings: what it must say and what to do with it

The CNMV opens and investigates the case and imposes the penalty (article 270 of Ley 6/2023) under Laws 39/2015 and 40/2015 and, among other special rules, those of Royal Decree 2119/1993 (article 269). The notice opening proceedings must identify each alleged offender, the facts, their possible classification and penalty, the investigating officer (instructor) and how to seek his or her recusal, the body that will decide, the option of admitting liability and the time allowed for submissions (article 64.2 LPAC). If classification is left to a pliego de cargos, a statement of objections (article 64.3), you have twenty days to answer it (article 7 of Royal Decree 2119/1993).

The first trap lies in article 64.2(f): if you make no submissions and the notice contains a precise finding on liability, it may be treated as the proposed decision, and a stage of the defence is lost. Submissions contest the facts, their classification, attribution and each person's fault, limitation and proportionality, and propose evidence, explaining what it is meant to prove, because the instructor may only reject it, with reasons, if it is manifestly improper or unnecessary.

Two requests belong in the first filing. A full copy of the file, with the documents on which each charge rests. And a reasoned objection to publicity: the CNMV may publish the notice opening proceedings, naming the respondent, after ruling on what is confidential and weighing, with reasons, the public interest against the harm (article 336). That harm (banks, counterparties, clients, a funding round) is proven with documents, and confidential treatment of sensitive material is requested before the decision is taken.

One year to decide: lapse of proceedings and the pitfalls of the clock

The CNMV has one year to decide and notify, extendable under articles 23 and 32 of Law 39/2015 (article 270.2 of Ley 6/2023), counted from the date the decision opening proceedings is adopted, not from its notification (article 2 of Royal Decree 2119/1993). If the decision is notified later, the proceedings lapse and the file is closed (article 25.1.b LPAC). Notification is what counts, not signature: a decision signed in time but notified late arrives in proceedings that have already lapsed.

Two extensions must be watched. The Tribunal Supremo (the Supreme Court) has held that article 32 serves to extend the time limits for individual steps, not the maximum period, and that extending the latter is exceptional, although it is permitted, with proper reasons, where the case is objectively very complex. And requesting a mandatory report allows the clock to be suspended for up to three months if the request and its receipt are notified (article 22.1.d LPAC); where it is the Banco de España report needed to penalise a credit institution, the suspension also covers its directors charged in the case.

What nobody tells you: in a case that reached the Tribunal Supremo, the CNMV justified the extension partly on the extensions of time the respondents had requested to file submissions. Every extension requested as a matter of routine becomes an argument to justify the delay. And lapse is not acquittal: lapsed proceedings do not interrupt limitation, but if the infringement is still live the CNMV may open new proceedings and carry over what was done (article 95.3 LPAC). Lapse and limitation are always calculated together.

Limitation and classification: where years and millions are won

Very serious infringements become time-barred after five years, serious ones after four and minor ones after two, counted from their commission or, for a continuing activity, from when it ends (article 311 of Ley 6/2023). Opening proceedings with the knowledge of the person concerned interrupts limitation, and time starts running again if the file is left idle for three months for reasons not attributable to that person. A later, more favourable rule, including one on limitation, applies retroactively (article 26.2 LRJSP, the Public Sector Legal Regime Act).

Classification decides almost everything. Many types of conduct are very serious if the breach is not merely occasional or isolated, and serious otherwise (for example, articles 289.2, 290.2 and 293.2); a one-off breach of the conduct of business rules with a single client is minor (article 310.b). Reclassification as serious lowers the ceiling on the fine from 5,000,000 euros or 10% of turnover to 300,000 euros or 2%, shortens the limitation period and rules out removal of directors; a minor infringement is not even published in the BOE, the Official State Gazette (article 335). That is why the sample is contested: how many clients the failure really affected.

Tipicidad, the requirement that infringements be precisely defined by statute, is the other main battleground. Only conduct that a statute defines as an infringement can be penalised, and analogy is not allowed (article 27 LRJSP); many infringements cross-refer to EU regulations, and the article cited must match exactly. Departing from the CNMV's technical guides is not in itself an infringement: the law provides that the CNMV may ask for an explanation (article 22.3), and the infringement has to lie in the rules themselves. On MiCA, article 307 of Ley 6/2023 cites the Regulation using the article numbering of its draft, and in sanction proceedings that is a tipicidad issue.

Fault, directors and how large the fine can be

No fault, no penalty: only those acting with intent or negligence are liable (article 28.1 LRJSP). For the firm, diligence is proven by the compliance system it actually operated: policies, controls that actually worked, reports and board minutes showing that the risk was known and managed. Additional penalties only reach directors and senior managers responsible for the infringement (article 327), according to their degree of responsibility (article 329.2): a dissenting vote, a justified absence or an unheeded warning counts as individual evidence.

The notice opening proceedings will offer you an early exit: if the proposed penalty is purely financial, admitting liability and paying before the decision each give a reduction of at least 20%, and the two can be combined, in exchange for waiving any administrative appeal (article 85 LPAC). But the penalty is still imposed and published, counts as a prior penalty for five years (article 329.1.l) and weighs in future fit and proper assessments. And the company's admission affects directors who contest their own fault: the Tribunal Supremo accepts that all of them may be charged in a single set of proceedings.

The fine has no floor, save for exceptions such as the minimum of 600,000 euros for carrying on a reserved activity (article 312.14), but it does have ceilings and mandatory criteria: the nature of the infringement, responsibility, financial strength, duration of the risk, losses to third parties, gains, systemic effects, remediation, compensation, cooperation and final penalties over the previous five years (article 329.1 and article 29.3 LRJSP). The decision must explain why it sets that figure, and setting the amount is not a matter of discretion: the courts review it against those criteria.

The decision: publication, appeal and interim suspension

The CNMV publishes any penalty on its website once notified, and it may delay publication, anonymise it or not publish at all if publication would be disproportionate or cause disproportionate harm (article 334), which is requested with evidence of the harm. Serious and very serious penalties are also published in the BOE once administratively final (article 335). The Tribunal Constitucional (the Constitutional Court) has held that such publication is not an additional penalty: attacking it as double punishment fails, and the battle worth fighting is over article 334.

A penalty under Ley 6/2023 is administratively final (article 23). You may seek reconsideration within one month (article 124 LPAC), and while that remains possible or pending the penalty is not enforceable (article 90.3 LPAC); or appeal to the Audiencia Nacional, through a procurador (court agent), within two months from the day after notification (article 46 LJCA). If it was imposed under Law 35/2003 on collective investment schemes, an appeal to the Minister for the Economy comes first (article 94.1 LIIC). No prior negotiation is needed, although a client's civil claim before the civil section of the Tribunal de Instancia, the first-instance court, will require it (article 5 of Organic Law 1/2025).

Once enforceable, the penalty may be suspended if you tell the CNMV that you will go to court, but that suspension falls away if, when filing the claim, you do not apply for interim relief in the same document (article 90.3 LPAC). For a fine, the court usually requires security (article 133 LJCA); against disqualification, irreparable harm carries more weight. The Audiencia Nacional reviews the file you built: new evidence is admitted, but it comes too late to prevent publication. A further appeal to the Tribunal Supremo requires objective cassational interest.

How we run the case, step by step

1. 1

   We fix the dates on day one

   From the notice opening proceedings, we calculate the deadline for submissions, the date on which the proceedings lapse after one year and the limitation date of each fact according to its classification. Those three dates drive the defence.

2. 2

   We request the file and push back on publicity

   We ask for a full copy of the supervisory file, confidential treatment of sensitive material and, with evidence of the harm, that the notice opening proceedings not be published (article 336 of Ley 6/2023).

3. 3

   We separate defences and decide on admitting liability

   We assess whether the company and each manager should follow the same strategy, and what admitting liability and paying at a discount (article 85 LPAC) means compared with contesting classification, fault or limitation.

4. 4

   We file submissions and propose the evidence that decides the case

   We contest the facts, classification, tipicidad (statutory definition of the infringement), fault and proportionality, and propose a statistical expert report on the sample and documentary evidence of compliance, explaining what each piece of evidence is for.

5. 5

   We answer the proposed decision and watch the clock

   We respond to the proposed decision, check every extension and suspension of the time limit, insist on the fifteen days under article 90.2 LPAC if the classification is made more serious and request the article 334 measures.

6. 6

   We appeal in time and seek interim suspension

   We choose between reconsideration and an appeal to the Audiencia Nacional depending on whether it pays to keep the penalty unenforced, and apply for interim relief in the same document that starts the claim.

The law that applies

• Arts. 23, 269 y 270 de la Ley 6/2023. The CNMV opens, investigates and penalises under Laws 39/2015 and 40/2015 and Royal Decree 2119/1993, with a Banco de España report if it penalises a credit institution; it has one year, extendable, to decide and notify, and its decisions are administratively final. BOE-A-2023-7053
• Art. 311 de la Ley 6/2023. Very serious infringements are time-barred after five years, serious ones after four and minor ones after two, from their commission or the end of a continuing activity; opening proceedings with the person's knowledge interrupts the period, which restarts after three idle months. BOE-A-2023-7053
• Arts. 312, 313 y 327 de la Ley 6/2023. For very serious infringements, a fine of up to the highest of five times the profit, 5% of own funds, 10% of turnover or 5,000,000 euros; for serious ones, up to 300,000 euros or 2%; for responsible directors, up to 400,000 or 250,000 euros. BOE-A-2023-7053
• Arts. 238 y 329 de la Ley 6/2023. Facts established by CNMV staff have evidential value unless rebutted; the penalty is graded by nature, responsibility, financial strength, harm, gains, remediation, compensation, cooperation and final penalties over five years. BOE-A-2023-7053
• Arts. 334, 335 y 336 de la Ley 6/2023. Penalties are published on the CNMV website once notified, unless delayed, anonymised or withheld as disproportionate; serious and very serious ones in the BOE once final, and notices opening proceedings may be published after a reasoned balancing exercise. BOE-A-2023-7053
• Arts. 64, 85 y 90 de la Ley 39/2015 (LPAC). The opening notice may stand as the proposed decision if no submissions are made; admitting liability and paying give cumulative reductions of at least 20% if the penalty is purely financial; suspension of an enforceable penalty falls away if interim relief is not sought on appeal. BOE-A-2015-10565
• Arts. 26 a 29 de la Ley 40/2015 (LRJSP). Retroactivity of the more favourable penalty rule, statutory definition of infringements with no analogy, liability only for intent or negligence, and proportionality under mandatory grading criteria. BOE-A-2015-10566
• Art. 46 de la Ley 29/1998 (LJCA). A judicial review claim must be brought within two months from the day after notification of the administratively final act or, if reconsideration was sought, from its express or deemed decision. BOE-A-1998-16718

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions