How to request the CIRBE report for free and what debts appear

The consultation of the CIRBE (Central de Information on Risks of the Bank of Spain, technically “CIR”) by a financial institution is heavily regulated. It is not a private file like ASNEF, but a public service managed by the Bank of Spain, with reserved information and very limited access. Below I summarize the main requirements and limits.

1. Basic legal framework

The regulatory pillars that cover the consultation of the CIRBE include, among others:

• Specific CIR regulations: the management and administration of the Central de Información de Riesgos corresponds to the Bank of Spain and is structured through its own regulations (among others, Circular 1/2013 regulating the CIR and its subsequent development, cited in the official note from the Bank of Spain about Circular 1/2025).
• Law 44/2002, on Measures for Reform of the Financial System, which recognizes the CIR as a public instrument of risk information and has been amended to, for example, guarantee access to the CIR to certain credit administrators appointed by buyers of doubtful portfolios (doctrinal analysis).
• Law 10/2014, on the organization, supervision, and solvency of credit institutions, whose article 82 emphasizes the reserved nature of the information held by the Bank of Spain, including that obtained in the CIR, and the conditions for its transfer.
• Data protection regulations: Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), which establish the legal basis, the rights of the data subject, and the applicable processing principles.

2. Who can consult the CIRBE and under what circumstances?

Not every entity can “look at the CIRBE.” Access is limited to:

• Reporting entities (credit institutions, financial credit establishments, certain real estate credit intermediaries, etc.), which are obliged to submit risk information of their clients to the CIR and, in return, receive automatic monthly reports on the risk position of their holders, as detailed in the CIR 2025 Report.
• Other entities authorized by law, such as the Official Credit Institute (ICO), which accesses CIR information under agreements supported by article 82 of Law 10/2014 and subject to strict confidentiality clauses (ICO–Bank of Spain agreement).

From the perspective of ordinary banking use, the entity can consult a client's CIRBE:

• When a risk relationship already exists (loans, guarantees, etc.), through the automatic reports it receives monthly.
• When the client requests new financing or an operation involving credit risk (loan, mortgage, credit line, refinancing, etc.), through a specific risk report used to assess their solvency, as the Bank of Spain explains that these reports “support the analysis of the solvency of potential clients.”

3. Legal basis and consent

Unlike a private delinquency file, access to the CIRBE is not based on the client's consent, but on:

• Compliance with a legal obligation and exercise of public powers (art. 6.1.c and e GDPR): entities are obliged to declare risks and the Bank of Spain to manage the CIR for financial stability and supervision purposes.
• Legitimate interest and sectoral regulations in the evaluation of solvency and credit risk, always respecting the principles of minimization, purpose limitation, and proportionality.

Therefore, no additional explicit consent is required each time the bank consults the CIRBE to evaluate a financing operation. It is mandatory, however, to contractually inform about the possibility of such consultations and data processing, in line with the transparency requirements of the GDPR and LOPDGDD.

4. Usage limits and confidentiality duty

The entity may only use CIRBE information to:

• Analyze the client's solvency, manage and control their credit risk.
• Comply with prudential and supervisory obligations (reporting, stress tests, etc.).

The following are prohibited, unless specifically authorized by law:

• The transfer or disclosure to third parties of individualized data from the CIR (Law 10/2014 imposes the reserved nature of this information and requires ensuring that only strictly necessary personnel can access it).
• Use for commercial purposes unrelated to risk evaluation and management (marketing, pure commercial segmentation, etc.).

5. Client rights

The client does not have direct access to the database but can:

• Request their risk report from the CIR free of charge through the Bank of Spain (including telematic channels, which already concentrate the vast majority of requests).
• Exercise rights of access, rectification, deletion, or limitation regarding inaccurate or outdated data, both against the entity that declared them and, if applicable, against the Bank of Spain itself, relying on data protection regulations.

In summary: the financial institution can consult a client's CIRBE without requesting specific consent each time, but only if it is legally authorized, does so to evaluate and manage credit risks linked to a real or potential relationship with that client, respects the reserved nature of the information, and scrupulously complies with the guarantees of the GDPR and LOPDGDD.

The Central de Información de Riesgos (CIR) of the Bank of Spain is supported by a tiered regulatory framework: a basic law (Law 44/2002), a ministerial order that develops it (Order ECO/697/2004), and a set of Bank of Spain circulars, headed by Circular 1/2013 and its numerous subsequent amendments. Additionally, the reform of real estate credit contracts has introduced relevant adjustments in this framework.

1. Basic legal norm: Law 44/2002

The modern legal basis of the CIR is in chapter VI of Law 44/2002, of November 22, on Measures for Reform of the Financial System (text in BOE). According to Circular 1/2013 itself:

• Law 44/2002 configures the CIR as a “public service” of the Bank of Spain, aimed at facilitating the exercise of its supervisory and inspection functions and contributing to the stability of the financial system.
• It establishes the basic criteria of the CIR: what data are declared, for what purposes they are used, the right of access, rectification, and cancellation of data, and the general framework for information protection.
• It authorizes the Minister of Economy or, by delegation, the Bank of Spain, to develop the operating rules of the CIR (types of risks to declare, content, form and periodicity of declarations and reports, etc.).

Law 44/2002 has been subsequently amended in various aspects but remains the reference legal norm for the CIR.

2. Regulatory development: Order ECO/697/2004

In execution of Law 44/2002, the Ministry of Economy issued the Order ECO/697/2004, of March 11, on the Central de Información de Riesgos (text in BOE). According to its preamble:

• It replaces the historical regulation derived from Decree-Law 18/1962 and the Order of February 13, 1963, completely updating the CIR regime.
• It specifies the obligations of reporting entities (monthly periodicity, data to submit, corrections, etc.) and refers to the Bank of Spain circulars for technical details.
• It determines the information about holders and operations that must be communicated, in coordination with article 60 of Law 44/2002.

This Order has been amended, among others, by:

• Order ECC/747/2013, of April 25, which adjusts its articles 3 and 4 (text in BOE).
• Order ETD/699/2020, of July 24, on the regulation of revolving credit, which introduces significant changes in the CIR and in Order ECO/697/2004 itself (text in BOE).

3. Technical norms of the Bank of Spain: Circular 1/2013 and its amendments

The operational detail level is given by the Bank of Spain circulars. The central piece is:

• Circular 1/2013, of May 24, of the Bank of Spain, on the Central de Información de Riesgos, which modifies Circular 4/2004, of December 22, on public and reserved financial information standards and financial statement models (text in BOE).

This circular:

• Repeals the old Circular 3/1995 on the CIR and completely reorganizes the system.
• Details which entities are obliged to declare, what types of risks and operations are included, the granularity of information, declaration thresholds, coding of holders, operations, and guarantees, etc.
• Regulates in detail the reports that the CIR provides to entities and holders.

Since 2013, Circular 1/2013 has undergone intense updating through the following amending circulars, among others:

• Circular 5/2013, of October 30, and its erratum, with changes in CIR rules and annexes (text in BOE).
• Circular 3/2015, of July 29, which adjusts rules and annexes to improve information detail (text in BOE).
• Circular 4/2016, of April 27, and Circular 7/2016, of November 29, with new technical modifications of the CIR (Circular 4/2016, Circular 7/2016).
• Circular 1/2017, of June 30, which incorporates information requirements derived from Regulation (EU) 2016/867 (AnaCredit).
• Circular 1/2020, of January 28, which adapts the CIR to Law 5/2019 on real estate credit contracts and Royal Decree 309/2019, expanding the perimeter of reporting entities and regulating access for lenders and real estate intermediaries (text in BOE).
• Circular 1/2021, of January 28; Circular 2/2018; Circular 2/2023; and Circular 1/2025, which continue adjusting thresholds, annexes, and information fields of the CIR (for example, Circular 2/2023 and Circular 1/2025).

4. Key idea

In summary, the CIR is governed by a three-level framework:

• Legal rank: Law 44/2002 (chapter VI).
• Regulatory rank: Order ECO/697/2004, amended by subsequent norms (especially Order ETD/699/2020).
• Technical regulations of the Bank of Spain: Circular 1/2013 and its numerous amending circulars, which specify daily operation, data to declare, and access to risk information.

The Bank of Spain is exclusively responsible for the management and supervision of the CIRBE (Central de Información de Riesgos of the Bank of Spain). This central is a large database that collects information about the credit risks that financial institutions maintain with their clients. The competencies of the Bank of Spain cover both the technical organization of the system and its use for prudential supervision of the financial sector and protection of debtors.

1. Management and organization of the CIRBE

First, the Bank of Spain has the competence to create, maintain, and update the CIRBE. This includes:

• Defining which operations must be declared (types of credits, minimum amounts, guarantees, etc.).
• Establishing the formats, deadlines, and channels through which entities communicate the information.
• Configuring technical systems for reception, storage, and processing of data.
• Ensuring operational continuity and infrastructure security.

In practice, this means that the Bank of Spain issues the technical instructions followed by banks, credit cooperatives, financial credit establishments, and other obligated entities, as well as updating them when accounting, prudential, or technological standards change.

2. Supervision of compliance by entities

A key competence is the supervision of compliance with declaration obligations by participating entities. The Bank of Spain must verify that:

• Entities submit information on time and with the required periodicity.
• Data are complete (including all operations subject to declaration).
• Declared information is coherent and reasonable from a prudential perspective.

When it detects incidents (omissions, systematic errors, lack of submission, etc.), the Bank of Spain can:

• Require correction of submitted data.
• Demand improvement plans for the entity's internal procedures.
• Include such non-compliance in the supervisory file, potentially leading to sanction proposals under the applicable disciplinary regime.

3. Supervisory and prudential use of information

The CIRBE is an essential tool for banking supervision. The Bank of Spain has the competence to exploit this information to:

• Analyze the aggregate exposure to credit risk of the financial system.
• Identify risk concentrations by sectors, territories, or large clients.
• Cross-check information declared by entities in their financial statements and regulatory reports.
• Detect anomalous behaviors or excessively lax credit granting practices.

All this is integrated into on-site and off-site supervision work, allowing the Bank of Spain to assess entities' solvency, adequacy of provisions, and quality of risk management systems.

4. Regulation of access and debtor rights

Another fundamental competence is regulating who can consult the CIRBE and under what conditions. The Bank of Spain:

• Determines access rules for reporting entities (queries about their clients).
• Establishes procedures for natural and legal persons to obtain their own risk reports.
• Defines retention and anonymization periods for information.
• Adapts CIRBE operation to personal data protection regulations and banking secrecy.

In this area, the Bank of Spain also has public service functions, resolving incidents about incorrect data, rectification requests, and complaints related to risk information.

5. Statistical functions and support for financial policy

Finally, the Bank of Spain uses the CIRBE for statistical and macroprudential analysis purposes. Its competencies include:

• Producing aggregated statistics on financing to households and companies.
• Providing inputs for studies on financial stability and credit cycles.
• Supporting the design and monitoring of regulatory and macroprudential policy measures.

All this is done respecting anonymity in publications and ensuring that individual information is only used for supervisory purposes or as authorized by regulations.

In summary, the competencies of the Bank of Spain in supervising the CIRBE cover system design, monitoring compliance by entities, prudential use of information, protection of debtor rights, and statistical exploitation, making the CIRBE a central instrument for the stability of the Spanish financial system.