Banking Law and Digital Ecosystem Responsibility in Spain

Introduction

Digital ecosystem responsibility in banking means that a bank remains accountable for the legal, operational, ethical, and consumer effects of the wider digital network through which it provides services. That network includes cloud providers, fintech partners, payment processors, data analytics firms, artificial-intelligence suppliers, cybersecurity vendors, social-media channels, open-banking interfaces, and outsourced customer-support providers.

For Spanish banks, responsibility does not end when a service is outsourced or delivered through a third-party application. The bank must ensure that the ecosystem is secure, lawful, fair, resilient, and transparent. This approach is increasingly important because a digital failure can affect millions of customers at once, interrupt payments, expose personal data, distort credit decisions, or create financial-stability risks.

Spain applies a combination of Spanish banking law and directly applicable European Union rules. The key institutions are the Bank of Spain, the National Securities Market Commission (CNMV), the Spanish Data Protection Agency (AEPD), the European Central Bank (ECB), and European supervisory authorities.

Legal and Regulatory Framework

The Law on the Regulation, Supervision and Solvency of Credit Institutions, together with the Bank of Spain’s supervisory powers, requires banks to maintain sound governance and effective risk management. A bank’s management body remains responsible for major operational decisions, internal control, outsourcing, and compliance. It cannot avoid responsibility by arguing that a technology provider caused the failure.

A major EU measure is Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (DORA), applicable from January 2025. DORA applies to banks, payment institutions, investment firms, insurers, market infrastructures, and certain cryptoasset service providers. It requires them to establish information and communication technology risk-management frameworks, report major ICT incidents, test digital resilience, maintain business continuity, and control third-party technology risk.

DORA is especially important for cloud outsourcing. Spanish banks often depend on external providers for data storage, payments, customer onboarding, fraud detection, and artificial-intelligence tools. The bank must conduct due diligence before outsourcing, maintain written contractual safeguards, monitor service performance, retain audit and access rights, prepare exit strategies, and avoid excessive dependency on one provider.

Data responsibility is governed by the General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 on Personal Data Protection and Digital Rights. A bank must process personal information lawfully, minimise unnecessary collection, protect confidential data, provide clear privacy notices, and respect rights of access, correction, erasure, portability, and objection. These duties extend to customer data shared with fintech partners and open-banking providers.

The Revised Payment Services Directive (PSD2), implemented in Spain through payment-services legislation, supports open banking and allows authorised third-party providers to access account information or initiate payments with customer consent. However, consent must be informed, specific, and secure. Banks remain responsible for secure authentication, fraud prevention, and protection of payment-account data.

Core Responsibilities in the Digital Ecosystem

First, banks must ensure governance accountability. The board should understand the bank’s technology dependence, approve its digital-risk strategy, receive regular incident reports, and ensure that compliance, cybersecurity, data protection, internal audit, and risk functions are adequately independent.

Second, banks must ensure cybersecurity and resilience. DORA requires identification of critical systems, monitoring of vulnerabilities, incident classification, regulatory notification, testing, backup arrangements, and recovery procedures. A cyberattack on a cloud provider or payment interface can become the bank’s problem even where the technical failure originated outside the bank.

Third, banks must act responsibly when using artificial intelligence and automated decisions. AI may assist credit scoring, anti-money-laundering screening, fraud detection, customer service, and investment advice. Yet an algorithm can create discrimination, inaccurate outcomes, opaque refusals of credit, or excessive surveillance. Banks must ensure meaningful human oversight, model validation, data quality, explainability, and a process for customer challenge and review.

Fourth, banks must protect consumer trust and inclusion. Digital transformation should not exclude elderly customers, persons with disabilities, rural users, or people without advanced smartphones. Digital-only systems should be accompanied by accessible assistance, understandable contractual terms, complaint procedures, and secure alternatives for vulnerable users.

Finally, banks must control competition and platform dependency. A small group of major technology firms can influence access to cloud services, app stores, payment data, and AI systems. Excessive dependence can undermine resilience and bargaining power. Responsible governance therefore requires multi-provider assessment, portability planning, and careful management of conflicts of interest.

Case Laws

Google Spain SL v AEPD and Mario Costeja González, Case C-131/12 established the “right to be forgotten.” It confirms that organisations processing personal data must respect data-subject rights, including in digital banking ecosystems.

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, Case C-311/18 (Schrems II) held that international personal-data transfers require effective protection. Spanish banks using non-EU cloud or technology services must assess transfer safeguards carefully.

Wirtschaftsakademie Schleswig-Holstein, Case C-210/16 recognised that an organisation may be a joint controller with a platform provider. It shows that banks can share responsibility when using external digital platforms for customer engagement or analytics.

**Fashion ID GmbH & Co