Closed beta·The first secondary CAE marketplace in Spain, currently in development·Request an invitation
CAE Market security: integrity, traceability and compliance
5 layers of control protecting buyers, sellers and the regulator. The Secondary CAE Market is a newly created regulated market: technical trust is the primary adoption factor, ahead of price and interface.
The architecture described below corresponds to the version audited on 19 April 2026: internal regulatory compliance audit at 99.3% across 156 control points (10 domains, 151 compliant, 1 justified partial, 0 non-compliant, 4 not applicable).
Overview: five security layers
Each layer addresses a specific threat in the lifecycle of a CAE on a secondary market: improper access, order book manipulation, contract repudiation, double selling and registry tampering. The five layers run sequentially for each order and can be audited independently by the competent regulators.
Layer 1
Controlled access
KYC, MITECO accreditation, 150% penalty clause
Layer 2
Order book
Deterministic matching, anti wash trading detector
Layer 3
eIDAS signature
EU Regulation 910/2014 Art. 25, SHA-256 audit trail
Layer 4
SEPA flow
CAE frozen in transit, no custodial escrow
Layer 5
Immutable audit
Append-only triggers, SHA-256 signed external CSV
Controlled access and KYC
No operator can post or cross orders without first having passed the Know Your Customer (KYC) procedure applied by CertificAhorro. The control combines automated verifications against public databases and manual review by HM Capital SARL's compliance team.
Mandatory items of the KYC file:
- For Sujetos Delegados: verification of the MITECO accreditation (Art. 9 of Real Decreto 36/2023) cross-checked against the public SD registry published by the Ministry for the Ecological Transition.
- For Sujetos Obligados: verification of obligated-party status pursuant to Art. 70 of Ley 18/2014 (accredited retailers and distributors).
- Official identity document of the legal representative with proven powers of representation.
- CIF and company name cross-checked against public databases (commercial registry, MITECO directory).
- Sworn statement regarding the intermediation chain. Art. 6 of Real Decreto 36/2023, in its interpretation applicable since 15 December 2024, limits the chain to a single intermediary between the action's executor and the Sujeto Obligado. The statement is reinforced by a penalty clause of 150% of the amount in the event of proven falsehood.
The validation period is 2 to 5 business days. The review is manual and not subcontracted. Accreditation is renewed annually and suspended immediately if any of the supporting documents ceases to be valid (MITECO certificate expiry, loss of regulatory role, unreported change of representative).
Order book integrity
The order book applies a deterministic matching algorithm with price-time priority (FIFO within the same price level). The rules are published in the Market Terms and Conditions: at equal price, the order posted first prevails; a price improvement displaces the later order. There are no hidden prioritizations, rebates or market makers subsidized by the platform.
Anti-manipulation detection (wash trading detection):
The platform integrates a statistical module dedicated to detecting patterns that could distort the published price index. The detectors cover three families of signals: same-day round-trip cross trades, price anomalies relative to the volume-weighted average market price, and self-crossing between accounts controlled by related parties. Listings flagged by the module are frozen automatically pending review by the compliance team, without waiting for an external complaint.
As a security principle, the exact parameters of the algorithm and the decision thresholds are not published: their disclosure would help a malicious operator calibrate them to stay below the radar. The CNMC and MITECO have a reserved channel to access the full specification under documented request, in accordance with the procedure described at /mercado-cae/contacto-regulatorio.
Separation of commercial data between direct competitors: during the posting phase, the counterparty's identity remains anonymized. It is only revealed after matching and strictly to the extent necessary to generate the sale contract and the invoices.
eIDAS electronic signature of contracts
All sale contracts are generated automatically with the regulatory data required by Art. 17.2 of Orden TED/815/2023: identification of the parties, unique CAE identifier, volume in MWh, agreed price, issue date and particular conditions. The document includes the 150% penalty clause on the seller's sworn statements as well as the mandatory tax mentions.
The signature is executed by means of a simple electronic signature (SES) compliant with Art. 25 of EU Regulation 910/2014 (eIDAS), integrated via DocuSeal. The Regulation states literally that an electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form
(Art. 25.1). Each signature generates a complete audit trail: document SHA-256 hash, timestamp, IP address, user-agent, and the sequence of opening, reading and signing events.
The signed document is stored on Cloudinary in an authenticated-type folder, that is, with access restricted by signed token. Access from the platform goes through an authenticated proxy that verifies RBAC: only the parties to the contract, the administrator team and the Compliance Officer can download the document. The download is recorded in MktDocAccess, subject to the same immutability guarantees as Layer 5.
See the dedicated page /firma-electronica for an exhaustive breakdown of the eIDAS flow applied across the entire CertificAhorro platform.
SEPA fund flow and MITECO freeze
Payment is made by direct SEPA transfer between buyer and seller, with the bank details exchanged through the signed contract. In the current version of the platform there is no custodial escrow: CertificAhorro neither receives nor holds the funds of the main transaction. It only invoices its platform commissions in accordance with the tax regime described below.
How the transaction is protected without custodial escrow:
- Automatic freezing of the CAE in transit: after matching, the platform locks the CAE in the order book. The transferring Sujeto Delegado cannot re-list it or cross it with a second counterparty while the transfer is pending. This operational control replaces the function performed by a custodial escrow in other financial markets.
- MITECO transfer as a point of no return: the request to change ownership before the National Registry is only initiated after the eIDAS signature of the contract. Until then, legal ownership of the CAE remains with the selling SD.
- Cross-border invoicing HM Capital SARL -> Spanish client: two automatic invoices are issued in XML Facturae 3.2.2 format compliant with Ley 18/2022 (Crea y Crece). The MKT-S invoice is addressed to the seller, the MKT-B invoice to the buyer. Both are issued under reverse charge pursuant to Art. 84.Uno.2 of Ley 37/1992 and Art. 196 of Directive 2006/112/CE: no French VAT, express reverse-charge mention and self-assessment by the Spanish client in modelo 303.
- Dispute procedure: if, after the effective transfer of the CAE, one of the parties fails to pay, the aggrieved party opens a formal dispute from the transaction panel. Opening the procedure freezes settlement, triggers escalation to the administrator team and, in the event of persistent default, enables the suspension of any new operations by the defaulting operator.
Immutable traceability (tamper-evidence)
The administrative audit log (AdminAuditLog) records every sensitive action carried out on the platform: an administrator's intervention, the freezing of a listing on authority request, the publication of a new version of the Terms and Conditions, access to a contractual document. The log is protected by append-only PostgreSQL triggers installed at the database level.
The BEFORE UPDATE and BEFORE DELETE triggers installed on the AdminAuditLog, LegalAcceptance and MktDocAccess tables raise the Postgres error ERRCODE 42501 (insufficient_privilege) outside the dedicated audit_admin role, which is not provisioned in the application runtime (NOLOGIN). The web application can at no point modify or delete an audit entry: writing is done in append mode, and any UPDATE or DELETE attempt aborts the transaction.
Market transactions (MktTransaction) are frozen in COMPLETED or CANCELLED state: only the fields tied to dispute management (dispute*, relatedParties*) and the updatedAt field can evolve once the operation is closed. The remaining financial and contractual fields are immutable.
Daily external copy signed with SHA-256:
The admin-audit-daily-export cron (GitHub Actions, running at 02:13 UTC) exports in CSV format all AdminAuditLog entries from the previous day, computes the file's SHA-256 hash and sends it as an attachment to the billing@certificahorro.es mailbox. Workspace archiving (the Google server's SMTP timestamp) creates an external tamper-evident copy: any subsequent divergence between the database and the archived CSV is detected by recomputing the SHA-256. The cron works as a heartbeat: the email is sent even on days with no activity, which allows an interruption of the log to be detected.
Document retention: ten years pursuant to Art. L102 B of the French Tax Procedures Code applicable to HM Capital SARL, aligned with the retention period for accounting records applicable to the market's cross-border invoices. There is no automatic purge.
Regulatory upgrade path: should the CNMC require a qualified cryptographic proof in the future, the AdminAuditLog structure already includes the sequence, prevHash and rowHash fields needed for a hash chain anchored to a Time Stamping Authority (TSA) compliant with RFC 3161, with provision for activation on FreeTSA and, in qualified mode, FNMT-RCM Ceres. Activation is not deployed by default as it is deemed disproportionate for a non-financial CAE operator: the compensating controls described (append-only triggers + daily external copy + restricted DB credentials with semi-annual rotation and 7-day PITR backups on Railway) are considered sufficient in the current regulatory context of the CAE market.
Regulatory compliance audit
The security architecture described has been evaluated as part of the internal v2.0 audit, dated 19 April 2026. The audit covers 156 control points spread across 10 domains (corporate structure, GDPR and LOPDGDD, RD 36/2023, Orden TED/815/2023, secondary market, electronic signature, document system, cross-border taxation, retention and tamper-evidence). The result in strict coverage is 99.3%: 151 compliant points, 1 justified partial point, 0 non-compliant points and 4 points not applicable to the current scope.
The only point evaluated as partial, named F6.10 (cryptographic tamper-evidence), corresponds to the absence of a hash chain with qualified TSA anchoring activated by default. The documentary justification and the associated compensating controls are precisely those described in Layer 5. The full detail of the audit, its methodology and the domain reports are published at /normativa#auditoria.
Contact for auditors and authorities
CertificAhorro maintains a single regulatory point of contact aimed at MITECO, CNMC, AEPD, courts and the State's security forces and bodies. The page /mercado-cae/contacto-regulatorio describes the listing-freeze procedure, the response times (execution of urgent precautionary measures in under 24 business hours, ordinary requests in under 10 business days), the identified competent authorities and the legal basis applicable to each type of request.
Institutional supervision of the market: MITECO (Real Decreto 36/2023 and Orden TED/815/2023 on the CAE System and its National Registry), CNMC (Ley 3/2013 on energy markets and competition defense) and AEPD (EU Regulation 2016/679 and Ley Orgánica 3/2018 on personal data processing).
An architecture designed to be audited
The controls described apply to all Secondary CAE Market transactions since the opening of the closed beta. The compliance team responds to authority requests in under 24 business hours.
Last updated: