Banking Law and Ultimate Research Themes in Banking Governance — Spain

Detailed Explanation with Case Laws

1. Introduction

Banking governance in Spain is a multi-layered legal system. A Spanish bank is governed not only by Spanish banking legislation but also by:

• European Union banking law;
• ECB supervisory rules;
• Single Supervisory Mechanism (SSM);
• European Banking Authority (EBA) standards;
• Bank of Spain requirements;
• Spanish corporate-governance law;
• AML/CFT legislation;
• resolution and recovery rules;
• consumer and payment-services regulation;
• data, cybersecurity and operational-resilience rules.

The most important statutory foundations include:

• Law 10/2014 of 26 June on the regulation, supervision and solvency of credit institutions;
• Royal Decree 84/2015, implementing Law 10/2014;
• Law 11/2015 on the recovery and resolution of credit institutions and investment firms;
• Law 10/2010 on prevention of money laundering and terrorist financing;
• Companies Law (Royal Legislative Decree 1/2010);
• EU Capital Requirements Regulation (CRR);
• Capital Requirements Directive (CRD);
• Bank Recovery and Resolution Directive (BRRD);
• Single Supervisory Mechanism Regulation;
• MiFID II, PSD2, DORA and other sectoral EU legislation.

2. Ultimate Research Theme 1 — Board Responsibility in Spanish Banks

The first major research theme is:

How far should directors of Spanish banks be legally responsible for failures in risk management?

Bank directors have responsibilities that extend beyond ordinary commercial management because banks manage:

• depositors' money;
• payment systems;
• credit risk;
• liquidity;
• systemic risk;
• regulatory capital.

Research questions include:

• When does poor governance become a regulatory violation?
• Can directors be liable for inadequate risk controls?
• How should board responsibility be allocated?
• What is the relationship between collective board responsibility and individual director liability?

3. Theme 2 — Fit-and-Proper Requirements for Bank Directors

Spanish and EU banking law places significant importance on the suitability of persons managing credit institutions.

The assessment commonly considers:

• reputation;
• knowledge;
• experience;
• independence;
• conflicts of interest;
• time commitment;
• collective suitability of the management body.

This creates an important research topic:

Should the suitability test be treated as a continuing governance obligation rather than a one-time appointment test?

This is particularly important following banking scandals and failures.

4. Theme 3 — Board Diversity and Collective Competence

Bank governance cannot be assessed only by looking at individual directors.

The board as a whole should possess sufficient expertise concerning:

• finance;
• accounting;
• risk;
• technology;
• cybersecurity;
• AML;
• consumer protection;
• sustainability;
• banking regulation.

A major research question is:

Can a technically qualified board nevertheless be legally inadequate if it lacks collective expertise in emerging banking risks?

5. Theme 4 — Risk Appetite Governance

A bank's board should establish an appropriate risk appetite framework.

It should address:

• credit risk;
• market risk;
• liquidity risk;
• operational risk;
• concentration risk;
• cyber risk;
• reputational risk;
• climate and transition risk.

The critical governance question is:

Who is legally responsible when actual risk-taking substantially exceeds the board-approved risk appetite?

This connects board law with prudential regulation.

6. Theme 5 — Three Lines of Defence

A major research theme is the relationship between:

First line

Business and operational management.

Second line

Risk and compliance.

Third line

Internal audit.

The research question is:

What happens when the three lines of defence become operationally dependent upon the same management structure?

This is especially important in large Spanish banks.

7. Theme 6 — Internal Control and Banking Governance

Internal controls are central to banking governance.

Research can examine:

• authorization controls;
• segregation of duties;
• financial reporting;
• reconciliation;
• treasury controls;
• fraud prevention;
• regulatory reporting;
• internal audit.

The central question is:

When does inadequate internal control become a breach of directors' legal duties?

8. Theme 7 — Banking Governance and Risk Culture

A bank can possess extensive written policies but still have weak governance.

This produces the important concept of risk culture.

Research questions include:

• Can risk culture be legally measured?
• Can regulators sanction cultural deficiencies?
• What evidence demonstrates poor risk culture?
• Should remuneration be linked to long-term risk outcomes?

9. Theme 8 — Executive Remuneration

Bank remuneration is a major governance issue.

Research can examine whether bonuses encourage:

• excessive lending;
• short-term profits;
• excessive trading;
• regulatory arbitrage;
• excessive risk-taking.

EU banking rules impose restrictions and governance requirements concerning variable remuneration for relevant institutions and staff.

The key research question is:

Can remuneration structures create regulatory liability even where individual transactions are technically lawful?

10. Theme 9 — Related-Party Transactions

A bank's directors may have interests in companies that transact with the bank.

This creates risks involving:

• conflicts of interest;
• preferential lending;
• connected exposures;
• undisclosed relationships;
• self-dealing.

Spanish corporate law and prudential banking rules provide important controls.

A major research theme is:

How should Spanish law balance legitimate group transactions against the danger of insider influence?

11. Theme 10 — Bank Ownership and Controlling Shareholders

Bank governance is also influenced by ownership concentration.

Research questions include:

• What rights should controlling shareholders have?
• When does shareholder influence become excessive?
• How should minority shareholders be protected?
• How should regulators assess acquisitions of qualifying holdings?

This is particularly important in banking because ownership can affect management independence.

12. Theme 11 — ECB and Bank of Spain Supervisory Governance

Spanish banking governance operates through a dual institutional environment.

European level

The ECB exercises direct prudential supervision over significant institutions within the SSM.

Spanish level

The Banco de España has important supervisory responsibilities, particularly within the European supervisory framework.

This produces a major research topic:

Where should legal responsibility lie when national and European supervisory authorities share responsibility?

13. Theme 12 — Judicial Review of Banking Supervisory Decisions

A highly valuable research topic concerns the judicial review of decisions involving:

• licensing;
• sanctions;
• fit-and-proper assessments;
• supervisory measures;
• capital requirements;
• governance requirements;
• resolution.

Research questions include:

• How deferential should courts be to financial regulators?
• How should technical supervisory assessments be reviewed?
• What procedural rights do banks and directors have?

14. Theme 13 — Banking Governance and Administrative Due Process

Banking regulators exercise significant public powers.

Therefore, governance research should examine:

• notice;
• hearing rights;
• reasons for decisions;
• proportionality;
• evidence;
• confidentiality;
• judicial review.

This becomes particularly important where regulatory action can remove or restrict a director's ability to participate in banking management.

15. Theme 14 — AML Governance

AML governance is one of the strongest research areas in Spain.

Under Law 10/2010, regulated institutions must maintain systems concerning:

• customer due diligence;
• beneficial ownership;
• suspicious transaction monitoring;
• internal controls;
• compliance functions;
• record keeping;
• reporting.

The board-level question is:

Can senior management be responsible for systemic AML failures even where individual employees failed to identify specific transactions?

16. Theme 15 — Beneficial Ownership Governance

Modern banking governance increasingly requires banks to understand who ultimately controls customers.

Research areas include:

• complex corporate structures;
• trusts;
• foundations;
• nominees;
• family offices;
• private investment vehicles;
• cross-border ownership.

This is particularly relevant to Spanish private banking.

17. Theme 16 — Banking Governance and Fraud Prevention

Fraud governance involves:

• maker-checker controls;
• payment authorization;
• beneficiary verification;
• cybersecurity;
• internal audit;
• whistleblowing;
• transaction monitoring.

A major research question is:

When does a bank's failure to maintain reasonable anti-fraud controls create civil or regulatory liability?

18. Theme 17 — Cybersecurity Governance

Cybersecurity is now a board-level banking issue.

The EU Digital Operational Resilience Act (DORA) significantly strengthens governance concerning:

• ICT risk;
• incident management;
• resilience testing;
• third-party ICT providers;
• board responsibility.

Research question:

Should a bank's board be legally accountable for systemic cyber-resilience weaknesses even where no cyberattack has yet caused a loss?

19. Theme 18 — Critical ICT Third-Party Providers

Banks increasingly depend on:

• cloud providers;
• payment processors;
• software providers;
• cybersecurity vendors;
• data centres.

DORA makes ICT third-party risk a significant regulatory issue.

The research theme is:

How far should bank boards remain responsible for risks outsourced to technology providers?

20. Theme 19 — Banking Governance and Artificial Intelligence

AI creates new governance questions concerning:

• automated credit decisions;
• fraud detection;
• algorithmic risk assessment;
• customer profiling;
• automated trading;
• AI-supported compliance.

Research questions include:

• Who approves high-risk AI systems?
• Who is responsible for algorithmic errors?
• What level of explainability is required?
• How should model risk be governed?

21. Theme 20 — Algorithmic Lending Governance

A particularly strong research topic is:

Transparency and accountability in automated credit decisions.

Issues include:

• discrimination;
• explainability;
• data quality;
• model validation;
• human oversight;
• adverse decisions.

The EU AI regulatory framework increasingly intersects with banking regulation.

22. Theme 21 — Climate Risk Governance

Climate risk is becoming part of prudential governance.

Boards increasingly need to consider:

• physical risk;
• transition risk;
• stranded assets;
• climate-related credit risk;
• disclosure;
• stress testing.

The major research question is:

Can failure to integrate climate risk become a prudential governance failure?

23. Theme 22 — Greenwashing and Banking Governance

Banks increasingly market:

• green loans;
• sustainability-linked loans;
• ESG investment products;
• transition finance.

Governance questions include:

• Who verifies sustainability claims?
• Who approves ESG disclosures?
• What happens if sustainability targets are misleading?
• Can directors be responsible for misleading sustainability information?

24. Theme 23 — Banking Governance and Consumer Protection

Banks must balance profitability against customer protection.

Research areas include:

• mortgage transparency;
• unfair contractual terms;
• payment fraud;
• consumer credit;
• banking fees;
• vulnerable customers;
• financial inclusion.

25. Theme 24 — Mortgage Governance and Consumer Litigation

Spanish mortgage litigation has produced substantial jurisprudence concerning:

• transparency;
• unfair terms;
• interest-rate clauses;
• expenses;
• foreign-currency mortgages;
• consumer information.

This makes mortgage governance one of the most developed areas of Spanish banking litigation.

26. Theme 25 — Case Law: Aziz v Caixa d'Estalvis de Catalunya

CJEU, Case C-415/11, Aziz

This is one of the most important European banking-consumer cases relevant to Spain.

Core issue

The case concerned Spanish mortgage enforcement and potentially unfair contractual terms.

Principle

EU consumer-protection law can require national procedural systems to provide effective protection against unfair contractual terms.

Governance relevance

Banks must ensure that consumer contracts are not merely formally valid but comply with substantive EU consumer-protection requirements.

27. Theme 26 — Case Law: Banco Español de Crédito v Calderón Camino

CJEU, Case C-618/10

This case concerned unfair terms in consumer contracts.

Principle

National courts must take effective account of EU unfair-terms protection.

Governance significance

Bank governance must incorporate consumer-law compliance into product design and contractual processes.

28. Theme 27 — Case Law: Gutiérrez Naranjo

CJEU, Joined Cases C-154/15, C-307/15 and C-308/15

This important Spanish banking litigation concerned mortgage interest-rate clauses.

Principle

The Court addressed the consequences of unfair contractual terms and the effectiveness of EU consumer protection.

Governance significance

The case demonstrates that large-scale contractual practices can become a governance and litigation-risk issue affecting an entire banking institution.

29. Theme 28 — Foreign-Currency Mortgage Governance

Another important Spanish banking research area is foreign-currency lending.

The key issues include:

• exchange-rate risk;
• transparency;
• consumer understanding;
• pre-contractual information;
• suitability of the product.

Case law

Andriciuc and Others v Banca Românească SA, CJEU Case C-186/16, is a major comparative EU authority concerning foreign-currency mortgage transparency.

Its reasoning is relevant to Spanish courts applying EU consumer-protection principles.

30. Theme 29 — Case Law: Ledra Advertising v Commission and ECB

CJEU, Joined Cases C-8/15 P to C-10/15 P

The litigation arose in the context of the Cyprus financial crisis.

Importance

It demonstrates that EU institutional and banking crisis-management measures can raise questions involving:

• fundamental rights;
• property;
• institutional responsibility;
• financial stability.

Spanish relevance

The principles are useful when researching the legal limits of crisis-management measures affecting bank stakeholders.

31. Theme 30 — Banking Resolution Governance

Under Law 11/2015 and the EU BRRD framework, banks must be capable of orderly resolution.

Research themes include:

• recovery plans;
• resolution plans;
• bail-in;
• minimum requirements for own funds and eligible liabilities;
• management responsibility;
• depositor protection;
• resolution authority powers.

The key question is:

How should corporate governance change when a bank approaches failure?

32. Theme 31 — Bail-In and Shareholder Rights

Resolution can result in losses for:

• shareholders;
• subordinated creditors;
• other eligible creditors.

Research questions include:

• When can investors challenge resolution?
• How is proportionality assessed?
• What procedural safeguards apply?
• How should “no creditor worse off” principles operate?

33. Theme 32 — Banking Governance and Capital Adequacy

Board governance is directly connected with capital.

Research topics include:

• CET1 requirements;
• capital buffers;
• Pillar 1;
• Pillar 2;
• leverage ratio;
• internal capital adequacy;
• stress testing.

The governance question is:

Who is responsible when a bank technically meets minimum capital requirements but maintains an inadequate risk profile?

34. Theme 33 — Liquidity Governance

Liquidity governance examines:

• LCR;
• NSFR;
• liquidity buffers;
• contingency funding plans;
• deposit concentration;
• wholesale funding.

The collapse of banks internationally has demonstrated that a bank can fail from liquidity stress even when its balance sheet appears solvent.

35. Theme 34 — Banking Governance and Stress Testing

Stress testing can examine:

• recession;
• interest-rate shocks;
• property-price collapse;
• deposit outflows;
• market volatility;
• cyber incidents;
• climate scenarios.

Research question:

Should a board be legally accountable for ignoring stress-test results?

36. Theme 35 — Governance of Systemically Important Banks

Large Spanish banking groups can create systemic risk.

Research themes include:

• systemic-risk buffers;
• recovery planning;
• resolution;
• group governance;
• ring-fencing;
• cross-border supervision.

The larger the institution, the greater the potential public consequences of governance failure.

37. Theme 36 — Banking Group Governance

Spanish banks frequently operate through corporate groups.

Research should examine:

• parent/subsidiary relationships;
• consolidated supervision;
• intra-group transactions;
• related-party exposures;
• group risk;
• cross-border subsidiaries.

A key question is:

Who is responsible when a subsidiary's risk threatens the entire banking group?

38. Theme 37 — Cross-Border Banking Governance

Spanish banks can operate across:

• EU Member States;
• Latin America;
• other international markets.

This creates questions concerning:

• home-host supervision;
• consolidated supervision;
• regulatory cooperation;
• AML;
• sanctions;
• resolution.

39. Theme 38 — Banking Governance and Data Protection

Banks hold enormous amounts of personal data.

Governance must address:

• GDPR;
• customer profiling;
• automated decisions;
• fraud databases;
• credit scoring;
• data retention;
• cybersecurity.

Research question:

How should a bank balance fraud prevention against customers' data-protection rights?

40. Theme 39 — Open Banking Governance

PSD2 and subsequent EU payment regulation create governance issues involving:

• account-information services;
• payment-initiation services;
• strong customer authentication;
• third-party providers;
• API security.

A major research theme is:

Who bears responsibility when an open-banking ecosystem creates a fraudulent transaction?

41. Theme 40 — Banking Governance and Digital Identity

Digital identity is increasingly important for:

• remote onboarding;
• customer authentication;
• account opening;
• electronic signatures;
• payment authorization.

The governance question is:

How should banks allocate responsibility when digital identity systems are compromised?

42. Theme 41 — Banking Governance and Outsourcing

Banks outsource:

• IT;
• cloud computing;
• call centres;
• payment processing;
• compliance functions;
• data processing.

The critical legal principle is:

Outsourcing a function does not necessarily mean outsourcing regulatory responsibility.

The bank generally remains responsible for ensuring appropriate oversight.

43. Theme 42 — Banking Governance and Whistleblowing

Whistleblower systems can reveal:

• fraud;
• AML failures;
• manipulation of financial information;
• management misconduct;
• consumer abuse.

Research questions include:

• How should whistleblowers be protected?
• What must a bank investigate?
• When should information reach regulators?
• Can retaliation itself create liability?

44. Theme 43 — Banking Governance and Accounting Manipulation

Banks may face risks involving:

• loan classification;
• provisioning;
• asset valuation;
• impairment;
• capital calculations;
• revenue recognition.

The board, audit committee and external auditor may each have different responsibilities.

45. Theme 44 — Audit Committee Governance

A strong audit committee should oversee:

• financial reporting;
• internal controls;
• internal audit;
• external audit;
• risk reporting.

Research question:

Can an audit committee be liable where serious financial-control failures continued for years without effective intervention?

46. Theme 45 — Banking Governance and External Auditors

Research can examine the relationship between:

• banks;
• auditors;
• regulators;
• investors;
• depositors.

A particularly important issue is whether auditors should have enhanced responsibilities where they identify evidence of serious governance failures.

47. Theme 46 — Banking Governance and Market Abuse

Listed banking groups must comply with EU market-abuse rules.

Governance issues include:

• inside information;
• insider dealing;
• market manipulation;
• disclosure;
• director transactions.

48. Theme 47 — Banking Governance and Disclosure

Banks must provide accurate information concerning:

• capital;
• risk;
• remuneration;
• governance;
• financial results;
• sustainability;
• exposures.

False or incomplete disclosure can generate:

• regulatory;
• civil;
• corporate;
• potentially criminal consequences.

49. Theme 48 — Banking Governance and Financial Stability

The ultimate governance objective is not merely:

“Make the bank profitable.”

It is:

Maintain a safe, resilient and properly governed institution capable of meeting its obligations and protecting financial stability.

This explains why banking governance is subject to substantially greater regulatory intervention than ordinary corporate governance.

50. Priority Research Themes for Spain

For an advanced banking-law research programme, the following topics are particularly strong:

51. Six Especially Strong Case-Law Authorities

For a Spain-focused academic or professional research paper, these cases are particularly useful:

1. Aziz v Caixa d'Estalvis de Catalunya

CJEU, C-415/11
Mortgage enforcement and effective consumer protection.

2. Banco Español de Crédito v Calderón Camino

CJEU, C-618/10
Unfair terms and judicial protection of consumers.

3. Gutiérrez Naranjo and Others

CJEU, Joined Cases C-154/15, C-307/15 and C-308/15
Consequences of unfair mortgage contractual terms.

4. Andriciuc and Others v Banca Românească

CJEU, C-186/16
Foreign-currency mortgage transparency and consumer understanding.

5. Ledra Advertising and Others v Commission and ECB

CJEU, Joined Cases C-8/15 P to C-10/15 P
Financial-crisis measures, institutional responsibility and fundamental rights.

6. Jyske Bank Gibraltar Ltd v Administración del Estado

CJEU, C-212/11
Cross-border banking and AML-related regulatory obligations.

These cases should be read alongside Spanish Supreme Court and Audiencia Provincial decisions for the particular subject under investigation.

52. Ultimate Governance Model

A modern Spanish bank's governance framework can be represented as:

Board of Directors
↓
Risk Appetite + Strategy
↓
Risk Committee / Audit Committee / Compliance
↓
Capital + Liquidity + AML + Consumer + Cyber Controls
↓
Business Operations
↓
Internal Monitoring
↓
Internal Audit
↓
Banco de España / ECB Supervision
↓
Judicial + Resolution Oversight

The important legal principle is that these layers are interconnected. A failure in one area—such as AML, cybersecurity or liquidity—can become a broader governance failure if the board and senior management fail to identify and address it.

53. Final Legal Conclusions

The most important conclusions for Spanish banking-governance research are:

1. Spanish banking governance is simultaneously national and European.
2. Law 10/2014 provides a central Spanish prudential framework, while CRR/CRD and the SSM create the wider EU supervisory structure.
3. Bank directors face significantly greater governance expectations than ordinary corporate directors because banks create systemic and depositor risks.
4. Risk management, capital, liquidity, AML, cybersecurity and consumer protection are all governance subjects—not merely operational matters.
5. ECB and Banco de España supervision creates important questions concerning administrative discretion and judicial review.
6. The board's responsibility increasingly extends to technology, AI, climate risk and outsourced ICT services.
7. Consumer-banking jurisprudence from the CJEU has substantially influenced Spanish banking governance, particularly through Aziz, Banco Español de Crédito and Gutiérrez Naranjo.
8. Resolution law has fundamentally changed the relationship between bank governance, shareholders and creditors.
9. AML and beneficial-ownership obligations make transparency of banking ownership structures a central governance issue.
10. The most advanced research question is no longer simply “Did the bank comply with a rule?” but rather “Did the bank's governance system reasonably identify, control, escalate and remediate the risk?”

Jurisdiction: Spain
Core research fields: Banking governance + ECB/SSM supervision + prudential regulation + AML/CFT + consumer banking + resolution + cybersecurity/DORA + AI + climate risk + corporate governance.