CNMV 2026: new AI and crypto assets department, what changes for supervised entities

Key data

Financial entities supervised by the CNMV and crypto asset operators have, as of July 3, 2026, a new institutional contact: the Department of Technology and Digital Innovation, created specifically to assume competencies in artificial intelligence and emerging technologies. The Resolution of June 25, 2026 of the CNMV Council modifies the Internal Rules Regulation of the supervisor to align its structure with the European regulations MiCA, DORA and DLT, and with its digitalization roadmap towards 2030.

This change is not cosmetic: it means that the CNMV will have specific organizational capacity to supervise MiCA compliance by crypto asset service providers (CASP), and DORA by obligated financial entities. If your company operates in any of these areas, the regulator already has the structure to monitor you.

What does this regulation establish?

The resolution introduces five specific structural changes in the internal functioning of the CNMV:

All these changes respond to the CNMV's strategic digitalization roadmap towards 2030, which makes technological supervision a central axis of the regulator for the coming years.

Economic and operational impact

The direct impact of this resolution is not economic in terms of new fees or fines, but operational and strategic: the CNMV strengthens its supervisory capacity in three areas that until now lacked their own department.

• Crypto assets (MiCA): Crypto asset service providers (CASP) that operate or want to operate in Spain will now have a specific CNMV department as their contact. This accelerates authorization procedures and, at the same time, intensifies ongoing supervision.
• Digital resilience (DORA): Financial entities obligated by DORA—banks, asset managers, insurers, investment platforms—will see how the CNMV gains technical muscle to review their digital operational resilience plans. The new department will be able to demand and evaluate these plans with greater technical depth.
• Artificial intelligence: The new department assumes competencies over AI. This anticipates that the CNMV will begin to supervise the use of AI models in investment decision-making, in automated portfolio management and in risk detection.
• Data governance: The renamed Department of Analysis, Financial Stability and Data assumes strategic data governance, which can translate into new reporting or data quality requirements for supervised entities.

Who does it affect?

• Crypto asset service providers (CASP) that operate under the MiCA Regulation in Spain or that are in the process of authorization before the CNMV.
• Financial entities subject to DORA: banks, fund managers, investment services companies (ISC), participatory financing platforms and insurers with activity in securities markets.
• Entities that use distributed ledger technology (DLT) for issuance or trading of financial instruments.
• Companies that use AI in investment or portfolio management processes, which will come under the radar of the new department.
• CNMV staff, whose authorization regime for securities operations is updated, now including the possibility of contracting portfolio management.

Practical example

A Spanish fintech operating as a crypto asset service provider and processing its authorization under MiCA before the CNMV will find, as of July 3, 2026, that its file is managed by the new Department of Technology and Digital Innovation, rather than by a generalist unit.

This has two immediate practical consequences: on one hand, the technicians reviewing its application will have a more specialized profile in blockchain technology and crypto assets; on the other, the questions and information requests it receives will be more detailed and technical. The company must ensure that its technical documentation—system architecture, cybersecurity controls, asset custody policies—is up to the level of more specialized scrutiny.

Similarly, a fund manager subject to DORA that until now had not received specific requirements about its digital resilience plan can anticipate that the new department will begin to include this aspect in its supervisory reviews.

What should companies do now?

1. Identify if you are subject to MiCA, DORA or the DLT Regulation. If your company operates with crypto assets, manages critical digital infrastructures or uses distributed ledger technology, you are already within the perimeter of the CNMV's new department.
2. Review the status of your digital resilience plan (DORA). With the new department operational, the CNMV has the technical capacity to demand and audit these plans. If you don't have it updated, now is the time to do so.
3. Update the technical documentation of your MiCA application. If you are in the process of authorization as a CASP, anticipate more technical and detailed questions from the new specialized department.
4. Map the use of AI in your investment or management processes. The new department assumes competencies over AI. Document what models you use, for what decisions and with what controls, before they ask you.
5. Monitor CNMV communications. With the strengthening of the Communications Directorate and the presidency's direct supervision of communications policy, it is foreseeable that the regulator will issue more guides, criteria and technical communications in these areas. Subscribe to their alerts.

Official source

Consult complete regulation at official source

Notice: This article is purely informational in nature and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-14432