FINANCIAL INFRASTRUCTURE INTEROPERABILITY STANDARDS UNDER SPANISH AND EUROPEAN UNION LAW

1. INTRODUCTION

Financial infrastructure interoperability refers to the ability of different financial institutions, payment service providers, banking networks, clearing systems and settlement platforms to exchange financial information and process transactions through compatible technical, operational and legal standards.

In Spain, interoperability is an important regulatory requirement for ensuring efficient payment processing, financial inclusion, competition, consumer protection and cross-border financial integration. It enables customers of different banks to transfer money, access payment services and participate in digital financial markets without unnecessary technical barriers.

The European Union has developed a harmonised regulatory framework to promote interoperability between national financial infrastructures while maintaining security, transparency and financial stability.

2. LEGAL AND REGULATORY FRAMEWORK

A. PAYMENT SERVICES DIRECTIVE (PSD2)

Directive (EU) 2015/2366 establishes common rules for payment services throughout the European Economic Area.

Its objectives include:

Promoting competition among payment service providers.

Facilitating secure electronic payments.

Establishing common consumer-protection requirements.

Supporting access to payment-account information.

Encouraging interoperability between payment systems.

Spain implemented PSD2 principally through Royal Decree-Law 19/2018 on Payment Services and Other Urgent Financial Measures.

B. SEPA REGULATION

Regulation (EU) No. 260/2012 establishes technical and business requirements for credit transfers and direct debits in euros.

It promotes standardisation of payment instruments across participating European countries and reduces technical fragmentation between national payment systems.

C. INSTANT PAYMENTS REGULATION

Regulation (EU) 2024/886 amends the SEPA framework to establish requirements for instant credit transfers in euros.

It strengthens accessibility, payment execution speed and interoperability across payment service providers.

D. DIGITAL OPERATIONAL RESILIENCE ACT (DORA)

Regulation (EU) 2022/2554 establishes digital operational resilience requirements for financial entities.

It addresses ICT risk management, incident reporting, operational continuity and third-party technology risks affecting interconnected financial infrastructure.

E. DATA PROTECTION FRAMEWORK

The General Data Protection Regulation (EU) 2016/679 regulates personal-data exchange between financial institutions and payment service providers. Interoperability must therefore operate consistently with data minimisation, security, lawful processing and purpose limitation.

3. MAJOR INTEROPERABILITY STANDARDS

A. TECHNICAL INTEROPERABILITY

Financial institutions must use compatible technical arrangements to exchange payment instructions and transaction information. International standards such as ISO 20022 support structured financial messaging.

B. OPERATIONAL INTEROPERABILITY

Different payment networks should be capable of processing transactions through compatible procedures, operational schedules and settlement arrangements.

C. LEGAL INTEROPERABILITY

Cross-border financial transactions require consistent legal rules concerning payment execution, liability, authentication, refunds and consumer protection.

D. DATA INTEROPERABILITY

Financial institutions must maintain secure and consistent data-exchange procedures. Data-sharing arrangements must comply with applicable privacy and confidentiality obligations.

E. INSTANT PAYMENT INTEROPERABILITY

Instant payment infrastructure must support the rapid processing of euro transfers across participating payment service providers, subject to applicable regulatory requirements.

4. REGULATORY CONCERNS AND COMPLIANCE CHALLENGES

A. FRAGMENTATION OF PAYMENT SYSTEMS

Different technical standards may prevent financial institutions from exchanging information efficiently, increasing transaction costs and reducing competition.

B. CYBERSECURITY RISKS

Interconnected systems may increase exposure to cyberattacks, unauthorised access and operational disruptions. DORA requires financial entities to maintain appropriate ICT risk-management arrangements.

C. COMPETITION AND MARKET ACCESS

Large financial institutions may control essential infrastructure or impose technical conditions that disadvantage smaller payment service providers.

D. CONSUMER PROTECTION

Interoperability failures may result in delayed payments, duplicate transactions, failed transfers and uncertainty concerning liability.

E. DATA PROTECTION

Financial interoperability must not become unrestricted financial-data sharing. Institutions must establish appropriate legal grounds and security safeguards for processing personal information.

5. IMPORTANT CASE LAWS

1. Verein für Konsumenteninformation v Amazon EU Sàrl (Case C-191/15, CJEU, 2016).

The Court examined contractual jurisdiction and consumer-protection rules in cross-border electronic commerce. Its reasoning is relevant by analogy to the importance of predictable legal conditions for cross-border digital financial services.

2. Asociación Profesional Elite Taxi v Uber Systems Spain SL (Case C-434/15, CJEU, 2017).

The Court considered the legal classification of a digitally coordinated service and the regulatory consequences of platform-based economic activity. This is analogous authority for understanding how digital financial platforms interact with established regulatory frameworks.

3. Google LLC v Commission (Case C-48/22 P, CJEU, 2024).

The Court considered competition-law issues relating to digital markets and platform conduct. Its broader competition principles are relevant by analogy when assessing restrictive access conditions in financial infrastructure markets.

4. MasterCard Inc. and Others v Commission (Case C-382/12 P, CJEU, 2014).

The Court considered the competition-law assessment of multilateral interchange fees within payment-card systems. This is particularly relevant to financial infrastructure because it demonstrates how payment-system arrangements can be examined under EU competition law.

5. Cartes Bancaires v Commission (Case C-67/13 P, CJEU, 2014).

The Court clarified the distinction between restrictions of competition by object and restrictions by effect. Its principles are directly relevant to examining restrictive agreements and access arrangements within payment networks.

6. MEO – Serviços de Comunicações e Multimédia SA v Autoridade da Concorrência (Case C-525/16, CJEU, 2018).

The Court examined discriminatory pricing and the assessment of competitive disadvantage under Article 102 TFEU. Its reasoning is relevant by analogy to financial infrastructure operators imposing different access conditions on competing providers.

6. REGULATORY RESPONSIBILITIES OF FINANCIAL INSTITUTIONS

Spanish financial institutions and payment service providers should:

Adopt applicable SEPA and ISO 20022 messaging standards.

Maintain secure and compatible payment-processing systems.

Comply with PSD2 and Spanish payment-services legislation.

Implement appropriate authentication and fraud-prevention mechanisms.

Maintain operational continuity and ICT resilience under DORA.

Establish transparent contractual arrangements with infrastructure providers.

Prevent unjustified discriminatory access restrictions.

Ensure GDPR-compliant financial-data exchange.

Maintain procedures for resolving failed and delayed transactions.

Cooperate with relevant supervisory authorities.

7. ENFORCEMENT AND REGULATORY SUPERVISION IN SPAIN

The Banco de España supervises relevant payment-service providers and performs statutory functions concerning payment systems. The European Central Bank exercises Eurosystem oversight responsibilities concerning relevant payment systems and infrastructures.

The European Commission and national competition authorities enforce applicable EU competition rules. The Spanish National Commission on Markets and Competition (CNMC) may investigate competition-related infringements.

The Spanish Data Protection Agency (AEPD) supervises compliance with applicable personal-data protection requirements.

Depending on the infringement, enforcement may involve administrative sanctions, corrective measures, contractual remedies and judicial proceedings.

8. CONCLUSION

Financial infrastructure interoperability standards are fundamental to the development of an integrated European financial market. Spain's regulatory framework combines PSD2, SEPA legislation, instant-payment requirements, DORA and GDPR to promote secure, efficient and competitive financial services.

The principal regulatory challenge is balancing technical integration with cybersecurity, consumer protection, fair competition and data privacy. Consistent technical standards, non-discriminatory infrastructure access, transparent payment arrangements and effective regulatory supervision are essential to achieving a secure and interoperable financial ecosystem.