The draft of the Consolidated Text of the Securities Market Law, pursuant to Royal Decree 14/2018 passed in September, has been published recently. This transposes into Spain's body of law the provisions of EU Directive 2014/65/ (MiFID II) and its Delegated EU Directive 2017/593, which had been awaiting adaptation.

The Bill contains several provisions regulating the system for authorizing and supervising service companies and investment activities and those granting new supervisory powers to the National Securities Market Commission (CNMV); it also makes significant additions to the rules of conduct that these companies must follow to guarantee investor protection. Even though many of them were covered in the previous EU Directive 2004/39 (MiFID I), these requirements represent reinforced duties of customer reporting and of monitoring transactions that trigger conflicts of interest.

Some of the most important features are highlighted below:

General organization, conduct and information duties

The regulation lays down general minimum requirements for internal organization and operating, and some general duties that companies must adhere to in the best interests of their clients and other stakeholders, having the duty of acting honestly, impartially and professionally.

Specifically, companies are obliged to adopt such measures as might be necessary to prevent, detect and manage potential conflicts of interest between their clients and the company or group itself.

It stipulates that they must keep their clients informed at all times in an appropriate, impartial, clear and trustworthy manner, and identify, where applicable, information that is of an advertising nature. They should also provide clients with a report on the service provided, in a durable format. This report should cover the regular reporting that has been carried out, explaining the type and complexity of the financial instruments in question and the nature of the service, and noting the cost of the transactions and services performed against the client's account.

Furthermore, companies must ensure at all times that they have all the information on their clients that they need and must assess the suitability and need of the investment services or portfolio management they offer, so that they are commensurate with clients' risk tolerance and capacity to withstand losses.

The board of directors

Consistent with the regulatory developments of the last few years, the Bill reinforces the relevance of the board of directors, conferring on it the duty of defining, approving and supervising the following matters:

• The company's organization, the knowledge, skills and experience required of its staff, its resources and procedures, and the provisions applicable depending on the nature, scale and complexity of its activities
• Its strategy for the services, activities, products and transactions it offers, matched to its risk tolerance, as well as clients' profiles and needs
• The remunerations policy of the people providing services to clients, and their inclination to incentivize responsible business conduct, fair treatment of clients and avoidance of conflicts of interest

This body will also be in charge of regularly monitoring and assessing the institution's corporate governance system and the appropriateness and application of its strategic goals.

Likewise, it will be responsible for the risks taken on by the institution and should spend enough time on considering issues relating to these, as well as on regularly approving and reviewing the strategies and policies around assuming, managing, supervising and reducing risks. The regulation requires companies to set up a risk committee, unless they are exempted under the regulations from this obligation.

Vetting the board of directors

Turning to the profile of the board of directors and its members, the regulation stipulates that the board should collectively have enough knowledge, skills and experience to understand the institution's activity and its key risks, as well as to ensure that decisions are taken independently and freely.

The members of this body and of Senior Management should also individually meet the following vetting requirements*: i) being known to be trustworthy, honest and of integrity; ii) possessing enough knowledge, skill and experience; iii) acting with independent criteria and iv) being in a position to exercise good governance over the institution.

Companies will have to make sure that their board members and senior management comply at all times with the vetting requirements specified above, to which end it is important that internal units and procedures are in place to carry out selections, re-elections and succession planning.

The CNMV will also review the suitability of those occupying these positions. To this end, the Bill has added new requirements (honesty and professional integrity, skills, independent criteria and good governance) to those listed in the earlier law, such that non-compliance with any of these could result in the CNMV taking measures to remedy the shortcomings noted. These measures could be: i) revoking the company's license, on an exceptional basis, or ii) requiring the person to be temporarily suspended or permanently dismissed, or else for the deficiencies to be rectified.

A new feature is that these requirements must also be satisfied by the consolidated groups of which the companies form part, the members of the board and the senior management of the parent companies, when these are holding companies or mixed-activity holding financial companies; they must also be satisfied by those in charge of internal control functions, financial directors and other key positions in the companies who have been chosen for the daily running of the business.

The Bill also includes a reference to diversity in the make-up of the organ of governance, stipulating that selection procedures must tend towards diversity of experience and knowledge, encourage the selection of women, achieve a balanced presence on the governing body and, in general, avoid unconscious bias that leads to any form of discrimination.

Appointments and remuneration committee in significant institutions

The bill requires institutions that are classified as significant to set up a nominations committee made up of non-executive members of the board. The CNMV will decide the maximum number of posts which board members and senior managers can occupy at the same time in these institutions.

The CNMV can also decide whether a significant company should have a dedicated remuneration committee, a joint nominations & remunerations committee, or whether it is exempted from this obligation.

The category of "significant" will be defined in the regulation, bearing in mind: i) the minimum amount of all the asset items, ii) total minimum annual turnover and iii) the average minimum number of employees over the course of the financial period.

Remuneration policy and managing conflicts of interest

The Bill specifies that the remuneration policy should be commensurate with the nature, scale and complexity of the company's business, and in any case consistent with promoting solid and effective risk management, and with managing possible conflicts of interest in its service provision to clients.

An additional requirement for licensing, revocation of license and penalization

In conformity with corporate governance regulations, a further requirement has been added to those already needed to obtain an operating license. Such criteria will be taken into account when revocation of a license is being considered:

• When the CNMV is not informed of the identity of shareholders or significant partners in the institution, and the value of their stakes, or if they are not considered fit and proper for the role.
• When the CNMV finds that the members of the board of directors do not meet the criteria of trustworthiness, knowledge, skills, experience or time availability to discharge their duties, or when there are objective and demonstrable reasons to believe that this body or the individuals managing the companies may represent a threat to the entity's effective, appropriate and prudent management or to the market's integrity.
• When there are serious conflicts of interest between the posts, responsibilities or functions of the board of directors or the person at the head of the company.

Furthermore, repeated and serious failure to respect corporate governance duties, to select and assess members of the Board, senior management and advisors, or to perform duties in the areas of remuneration or organizational requirements will be considered a very serious breach.

Reporting to the CNMV

Finally, there are new duties of reporting to the supervisory body. As well as the mandatory reporting of new board appointments before they take up their positions, the CNMV must now be informed when there are changes to the posts in charge of internal control, new financial directors and any other position that is key to the daily running of the business, both in subsidiary companies and in their parent institutions**, when the latter are:

• significant entities reporting as consolidated groups
• significant institutions that form part of a group, when the consolidated investment services company is not a significant entity
• significant entities that are not part of a group