Pocket Option and the CNMV: Warnings in 2026

What the CNMV Is

The Comisión Nacional del Mercado de Valores supervises Spanish securities markets and the firms that provide investment services in Spain, authorising them, policing their conduct, and publishing who is on the list.

Authorisation is the word the whole subject turns on, and it is worth unpacking before anything else, because most people treat it as a badge rather than as a relationship.

Spain's market regulator

The supervisor sits inside the European framework rather than beside it. It applies MiFID II as implemented in Spain, cooperates with the other national authorities and with ESMA, and holds its own national product-intervention powers, which is how the European restriction on binary options for retail clients continues to bind here. It supervises markets, issuers and intermediaries, and it can investigate, require changes, and impose sanctions on the firms it has admitted.

It is equally worth being clear about what the supervisor is not, since disappointed expectations here are common. It does not guarantee anyone's returns, it does not approve individual products as suitable for you, and it is not a court of first instance for private disputes. It sets and enforces the conditions under which firms may deal with the public, and it acts on breaches of those conditions. A reader who expects it to recover money from a company it never authorised is expecting the wrong thing from the right institution.

Investor protection

For a private client, the value of authorisation is a list of duties the firm owes you and can be punished for breaching. Appropriateness testing before a complex product is sold. Cost and charge disclosure in a form you can compare. Best execution when an order is handled. Client-money rules and organisational requirements. A defined internal complaints procedure with deadlines, and an escalation route to the supervisor when the answer is unsatisfactory. None of that depends on the firm choosing to be decent, which is precisely the point of it.

The register of authorised entities

The register is the public face of all of that, and it is the single most useful five-minute check available to a Spanish reader. It records the entities authorised to provide investment services in Spain: firms established here, credit institutions, and firms authorised in another member state operating under an EEA passport. That last category matters, because it is how a legitimately authorised European firm serves Spanish clients without a separate Spanish licence.

• An entry names the entity, its authorisation and, where relevant, its home-state authority.
• The correct object of the search is the legal entity, not the trading brand on the advertisement.
• A firm operating under a passport should be traceable both here and in its home register.
• No entry means no authorisation, which is a finding, not an ambiguity.

Authorisation is not a quality rating, it is a set of enforceable duties plus a supervisor with the power to act on them.

The Regulator's Warnings

Alongside the register, the supervisor publishes warnings about entities offering investment services without authorisation. They serve a real purpose, and they are systematically misread as the negative half of a two-sided verdict.

Spanish has a good word for the target of these notices, chiringuito financiero, and the vividness of the phrase does some damage: it makes people expect a warning list to be a roll-call of villains, when it is really a log of what has been reported and processed so far.

Lists of financial "boiler rooms"

The notices identify entities that appear to be providing investment services in Spain without being authorised to do so. Sister authorities across the European Union publish equivalents, ESMA maintains warning material at European level, and supervisors outside the Union run their own lists on their own criteria. A warning is an alert to the public rather than a court finding, and it is published when an authority has grounds and capacity to publish it.

Unregistered brokers

Here is the asymmetry, stated as plainly as we can manage, because everything else on this page depends on it.

• A hit in the authorisation register is strong positive evidence. Someone examined the firm and admitted it, and the entry can be verified independently against a home-state register.
• Absence from a warning list is not evidence of anything. Lists are compiled reactively, from complaints, referrals and monitoring with finite resources. Countless unauthorised entities have never been the subject of a published notice.
• A warning is meaningful in one direction only. Its presence tells you a great deal; its absence tells you nothing at all.
• The two lists are not opposites. They answer different questions, and treating them as a pair produces a false clean bill of health.

There is a structural reason the lag is permanent rather than a resourcing problem that might one day be fixed. Publishing a notice requires identifying an entity, gathering grounds and going through an administrative process, while launching a website, a brand name and a new domain requires an afternoon. Operations that want to stay ahead of a list can generally do so by changing the name on the door, which is why a list of names will always trail the population it describes. The register works the other way round: it is a closed set that only grows when someone is admitted, so nothing can outrun it.

How to check them

Both resources live on the supervisor's own website and neither requires an account or a fee. The practical difficulty is not access but identification: consumer-facing brands, app names and website names frequently differ from the legal entity, so a search on the marketing name can return nothing while the underlying company is perfectly findable, or the reverse. Search the corporate name where you can find one, check any authorisation reference against the home-state register when a firm claims a European passport, and treat a screenshot of an authorisation as worthless unless you have confirmed it at the source.

Run both checks, but weight them honestly: the register can clear a firm, while the warning list can only ever condemn one.

Pocket Option's Situation

What can be verified here is an absence of authorisation. What cannot be verified, and what we therefore refuse to assert either way, is whether any supervisor has published anything naming this brand.

This is the most delicate section on the site, so it is written as a ledger rather than as an argument. Each line is marked for what supports it.

No registration with the CNMV

The first three rows are the honest core. An absence of authorisation is something a reader can confirm independently and is not an accusation about anyone's conduct. Third-party writing about this sector sometimes points to membership of a self-regulatory or dispute-resolution scheme as though it filled the gap. It does not. A private membership scheme has no statutory powers, imposes no MiFID II duties, carries no compensation fund, and confers no European passport. Describing it as a licence is a category error, whoever makes it.

A product restricted in the EU

Layered on top is the product question, which is separate and which is settled. Binary options may not be marketed, distributed or sold to retail clients in the European Union under the ESMA-led product-intervention regime, applied nationally here. So a Spanish reader looking at this instrument is looking at something no authorised firm may offer them, from a venue no European authority has authorised. Those are two independent facts, and the page on the ESMA restriction takes the reasoning apart properly.

The temptation at this point is to compress everything into a legal status, one word long, and publish it. We decline, and the refusal is the useful part. A verdict of that kind would either assert a permission nobody has granted or assert a specific prohibition against a specific company that we have not verified, and both sentences would read as confident precisely because they had stopped tracking the evidence. Keeping the ledger above in separate rows is less satisfying and considerably more accurate, and it lets a reader see which row is actually doing the work in their own decision.

Implications for the user

Notice what none of that establishes. It does not establish that anyone has been defrauded, and this site does not call the operator a scam, just as it will not call it safe. It establishes that the supervisory machinery a Spanish resident would normally rely on is not engaged, and that the operator's own published terms exclude the market this page is written for. Whether that is disqualifying is the reader's judgment. Our page asking whether it is legal in Spain sets out the three separate questions that judgment rests on.

Absence of authorisation is verifiable and worth acting on; absence of a warning is not verifiable as anything and should carry no weight in either direction.

What Protection Is Lost

The cost of dealing outside the authorised perimeter is best described by naming the specific protections that stop applying, because in the abstract it sounds like paperwork.

People underestimate this because the protections are invisible while nothing goes wrong. They become the entire story the moment something does.

A guarantee fund

FOGAIN, the Fondo de Garantía de Inversiones, is the piece most readers have never heard of and the one they would most want in a crisis. It covers clients of authorised Spanish investment firms when the firm becomes insolvent or otherwise cannot return client cash and securities, within the scheme's limits. It is not insurance against losing trades, and no scheme anywhere protects you from a position that moved against you. It protects against the firm failing while holding your money, which is a different risk entirely, and it exists only inside the authorised perimeter. Our page on fund security works through what does and does not follow from that, including why segregation of client money at an unsupervised venue is unverifiable in both directions rather than absent.

Recourse in disputes

Recourse is the practical failure point, and it is worth walking one step at a time. A dispute with an authorised firm begins with a documented internal procedure, escalates to a supervisor who can sanction, and ends, if necessary, in a Spanish court with jurisdiction over a Spanish establishment. Against a company with no presence here, the first step reaches only a support inbox, the second reaches an authority that can warn the public but cannot order anyone to pay you, and the third produces a judgment that still has to be enforced abroad. Complaints in this product category concentrate at the payout stage, which is exactly where that chain is weakest.

Local oversight

And the ordinary consumer routes do not fill the gap. Spanish consumer bodies and mediation schemes are built around entities established in Spain. A card chargeback or a payment-provider dispute is sometimes the only practical lever, and it is time-limited and depends entirely on how the funds left in the first place. There is no substitute for the supervised relationship, which is why the register check comes first rather than last.

FOGAIN and MiFID II conduct duties are not paperwork, they are the difference between a complaint that has somewhere to go and one that does not.

How to Act Prudently

The prudent version of this is a short sequence anyone can run in an afternoon, and it does not require trusting this page or any other. Every step is a public check.

Do this for whatever venue is actually in front of you, not only for the one this article names.

1. Find the legal entity. Read the terms of service and the footer for a company name, a registration number and a registered address. If none is stated clearly, that is itself a finding, and it makes every subsequent check harder for reasons that are not accidental.
2. Search the Spanish authorisation register. Look for the entity, not the brand. Also check the passported-firm category, since a legitimately authorised European firm may serve Spanish clients from another member state.
3. Verify any claimed European authorisation at its home source. A reference number is only worth what the home-state register says about it. Never accept a screenshot or a badge image on the firm's own site.
4. Search the published warnings, and weight the result correctly. A hit is decisive. No hit changes nothing, because a warning list is not a clearance list.
5. Identify the instrument. Establish whether what is on offer is a fixed-payoff contract, and remember that such contracts may not be sold to EU retail clients whoever is offering them.
6. Read the geographic terms. If the provider's own notice excludes residents of your region, take it at face value. It is not an obstacle to be worked around; it is the provider telling you what happens later.

Checking the register

Two habits make that sequence reliable. Search from the supervisor's own website rather than from a link in an advertisement or a review, and note what you found rather than trusting your memory of it a week later. The check costs nothing, it is repeatable, and unlike a review it does not depend on anyone's motives.

Understanding the risk

Then there is the risk that has nothing to do with regulation at all. Fixed-time options are a high-risk product on a horizon short enough that noise dominates, capital can be lost in full and quickly, and most retail accounts in this category lose money. That is true of an impeccably supervised venue as much as an offshore one. Authorisation changes who is watching and what recourse you have. It does not change the shape of the payoff.

Deciding with information

The decision is the reader's, and we will not manufacture the missing pieces for it. We will also not offer any route past a geographic restriction: no VPN, no alternative country of residence, no third-party intermediary. Those routes surface at verification rather than at sign-up, which is the worst possible moment for them to surface, and documents that misstate identity or residence are fraud in their own right. What we would recommend instead is starting from the register rather than from the review, and applying the criteria set out on our page about regulated alternatives to whichever provider is actually under consideration.

Run the register check first and let it lead; a public authorisation record settles more in five minutes than a week of reading opinions will.