Field note · Investing
Spain screens certain foreign investments before they are allowed to complete. Most buyers are not caught. The ones who are tend to find out late, and by then the authorisation sits between them and a completion date they have already promised.
The regime lives in article 7 bis of Act 19/2003 on capital movements and foreign economic transactions, and its detail is in Royal Decree 571/2023 on foreign investment. It is not a formality. An acquisition that needed authorisation and did not get it has no legal effect and cannot be registered, and the buyer cannot exercise the economic or voting rights attached to the shares until the position is regularised. Fines are available on top of that.
What follows is the decision tree we run at the start of a deal. It takes twenty minutes. Run at the end of a deal, the same question takes six months.
Step one — are you a foreign investor for these purposes?
Broader than most people expect. The regime reaches:
- Residents outside the European Union and the European Free Trade Association.
- Residents inside the EU or EFTA whose ultimate beneficial owner sits outside it. A Luxembourg or Dutch holding company owned from outside Europe does not solve this.
- Investors directly or indirectly controlled by a foreign government, including sovereign wealth funds and state-owned enterprises.
- Investors with a record of activity affecting security or public order in another Member State, or against whom there is a serious risk of criminal or illegal activity affecting the sectors listed below.
There is also a separate transitional regime that catches EU and EFTA investors. It applies where the investment gives a stake of 10% or more in a Spanish listed company, or in an unlisted company where the investment exceeds 500 million euros, and the target operates in one of the protected sectors. It has been extended four times. As things stand it runs until 31 December 2026, under Royal Decree-Law 1/2025 of 28 January. If you are reading this after that date, check whether it was extended again before relying on the answer.
Step two — does the investment reach the threshold?
Authorisation is triggered where the operation results in a stake of 10% or more of the share capital, or in acquiring control of the company, whether wholly or in part. Control is assessed by substance, not only by percentage: shareholders’ agreements, board appointment rights and veto rights count.
Step three — is the target in a covered sector?
The list in article 7 bis is long and drawn widely. Among others:
- Critical infrastructure — energy, transport, water, health, communications, media, data processing and storage, aerospace, defence, electoral and financial infrastructure, and sensitive land and property.
- Critical and dual-use technologies — artificial intelligence, robotics, semiconductors, cybersecurity, aerospace, defence, energy storage, quantum and nuclear technology, nanotechnology and biotechnology.
- Supply of essential inputs, energy, raw materials and food security among them.
- Access to sensitive information, particularly personal data, or the ability to control such information.
- The media.
If the target operates in none of these, the sectoral regime generally does not apply. That is a real answer, and it is the answer for most transactions.
Step four — is there an exemption?
Two matter in practice, both in article 17 of Royal Decree 571/2023.
Size. Investments are exempt where the turnover of the target company did not exceed five million euros in the last closed financial year — but not where the target operates in technologies of interest to Spain.
Energy. Energy is carved out separately and on its own terms: an investment in the energy sector is exempt regardless of amount only where the target does not carry out regulated activities, the investment does not create a dominant position, the installed capacity share stays below 5%, and any retail supply is to fewer than 20,000 customers. The practical consequence catches people out: a small renewables target can still need authorisation.
If authorisation is needed
The application goes to the Directorate-General for International Trade and Investment. Under article 14.8, that Directorate-General decides investments up to five million euros and the Council of Ministers decides above that figure. Article 14.9 sets a maximum period of three months.
Budget more than three months. The clock only starts when the file is complete, and requests for further information stop it. A Council of Ministers decision also has to find its way onto an agenda.
Two consequences for the transaction itself:
- Put it in the contract. The authorisation should be a condition precedent to completion, with a long-stop date that reflects a Council of Ministers timetable rather than an optimistic one, and a clear allocation of who bears the risk if it is refused or conditioned.
- Check it before you spend money on due diligence, not after. This is the cheapest question in the deal and the most expensive one to answer late.
What is coming
The European framework is being rebuilt. Regulation (EU) 2026/1386, published in the Official Journal on 26 June 2026, replaces the 2019 screening regulation and applies from 17 January 2028. It makes a national screening mechanism compulsory in every Member State, sets minimum common sectors that all Member States must screen, and — the change that matters most for structuring — expressly extends screening to investments made through EU-established subsidiaries of non-EU investors.
Spain already screens more widely than the current European minimum, so the direction of travel is not a surprise here. But anyone structuring a European holding chain on the assumption that an EU entity is a clean entry point should stop doing that now rather than in 2028.
This is general information on Spanish and European law as at 31 August 2026, not advice on your transaction, and the position changes. If you are looking at a Spanish target, submit your project and you will have an answer within two working days on whether the regime applies to it.