Financial Regulation

A gap identified by the policy auditor does not in itself constitute a breach. It indicates that the text of the policy does not include, or only partially includes, an obligation that the relevant standard does require. The seriousness of the issue depends on whether the obligation stems from a directly applicable regulation or a Level 2 implementing measure, and the supervisor assesses the matter on the basis of the written text.

The fact that a particular area on the map shows a concentration of sanctions means that supervisory activity is intense in that area and that the breaches giving rise to them are recurring within the sector. It does not imply a breach in itself. For a compliance team, it is a priority for review; it helps to organise the work and justify where resources are allocated.

In the simulator, the output lists the obligations associated with the derivative, the reporting to an authorised registry under EMIR, the potential for centralised clearing if thresholds are exceeded, the exchange of collateral in non-cleared OTC contracts and, for energy derivatives, REMIT obligations towards ACER. If the results indicate that thresholds have been exceeded, that the activity is restricted or that a potential investigation is likely, the case requires professional analysis.

How do I know which financial regulations apply to my organisation?

The order in which the legislation is read matters. Level 1 consists of the Union’s Regulations and Directives; the former are directly applicable, whilst the latter are implemented through transposition, in Spain primarily via Law 6/2023 on Securities Markets and Investment Services. Level 2 comprises the RTS, ITS and delegated acts, which specify deadlines, formats and thresholds. Level 3 comprises the Guidelines and Q&As issued by ESMA and the EBA, and the criteria set by the CNMV.

Here’s an example. A payment institution wishing to hold crypto-assets in custody starts with MiCA at Level 1, which restricts this activity to providers authorised by the CNMV as the competent authority. It then moves on to the RTS and ITS, which set out the application process and governance requirements, and concludes with the guidelines and Q&As from ESMA, the EBA and the CNMV. At the same time, it checks compliance with DORA, which applies across almost the entire sector.

If your organisation requires regulatory advice – from licensing to representing you before the regulator – please see our financial regulation section.