Banking Law and Digital Regulation Frameworks in Spain

Introduction

Spain’s digital banking framework is mainly shaped by European Union law. Spanish banks, payment institutions, electronic-money institutions, fintech firms and crypto-asset providers must comply with overlapping rules on licensing, payments, customer protection, cybersecurity, data use, financial crime and operational resilience.

There is no single “Digital Banking Act” in Spain. Instead, the framework combines EU regulations that apply directly with Spanish laws enforced principally by the Banco de España, the National Securities Market Commission (CNMV), the data-protection authority and anti-money-laundering authorities. The result is a system intended to permit innovation while preserving financial stability, consumer trust and market integrity.

Legal and Regulatory Framework

1. Banking authorisation and digital business models

Credit institutions in Spain require authorisation and prudential supervision under EU banking law and Spanish banking legislation. A digital-only bank does not receive a lighter regulatory regime merely because it operates through an application rather than branches. It must meet capital, governance, risk-management, outsourcing and consumer-protection requirements.

The Banco de España supervises banks, payment institutions and electronic-money institutions within its competence. The European Central Bank directly supervises significant Spanish banks through the Single Supervisory Mechanism. Digital outsourcing, cloud infrastructure and automated decision-making therefore remain board-level governance issues rather than merely technical matters.

Spain has also promoted innovation through Law 7/2020, which created a controlled financial sandbox. It enables supervised testing of innovative financial projects without giving participants a permanent exemption from licensing, AML, consumer or data-protection duties.

2. Payment services and open banking

Royal Decree-Law 19/2018 implements the second Payment Services Directive, PSD2. It regulates payment institutions, payment initiation services, account-information services, electronic payments and strong customer authentication.

Open banking permits a customer to authorise a regulated third-party provider to access account information or initiate payments through secure interfaces. The customer’s consent is central, but banks must not use technical barriers to frustrate lawful access by authorised providers.

Digital payment providers must provide clear pre-contractual information, safeguard customer funds, use strong authentication and maintain effective procedures for complaints and unauthorised transactions. If a payment is unauthorised, the provider may have a duty to refund promptly unless it proves fraud or gross negligence by the customer.

3. Crypto-assets, tokenisation and digital money

The Markets in Crypto-Assets Regulation, MiCA, is directly applicable in Spain. It regulates crypto-asset service providers, issuers of asset-referenced tokens and issuers of electronic-money tokens. The CNMV has a central role in supervising much of the crypto-asset market, while the Banco de España has responsibilities relevant to certain electronic-money-token issuers and prudential matters.

MiCA requires authorisation, governance, white-paper disclosures, custody safeguards, conflict-of-interest controls and complaint procedures. A bank offering crypto custody, tokenised deposits or trading access must consider whether its activity falls under MiCA, conventional banking law, securities law, payment-services rules or more than one regime.

A digital euro, if introduced through EU legislation, would also affect Spanish banks as distribution intermediaries. Banks would need to manage identity verification, privacy, payment access, fraud prevention and operational continuity.

4. Data protection, digital identity and automated decisions

The GDPR and Spain’s Organic Law 3/2018 govern the processing of personal data. This is especially important in remote onboarding, biometric authentication, credit scoring, fraud detection, digital identity wallets and customer analytics.

Banks must have a lawful basis for processing, collect only necessary information and keep data secure. They must explain significant automated decisions and provide safeguards where automated processing affects a customer materially, such as a refusal of credit, closure of an account or fraud-related payment block.

Electronic identification and trust services are governed at EU level by eIDAS and in Spain by Law 6/2020. Qualified electronic signatures generally have the legal effect of handwritten signatures. Digital identity tools can facilitate account opening and contract execution, but they do not remove AML customer-due-diligence requirements.

5. AML, fraud and sanctions compliance

Law 10/2010 requires banks and regulated financial firms to identify customers and beneficial owners, assess risk, monitor transactions and report suspicious activity. Digital onboarding must be reliable enough to prevent impersonation, forged documents and misuse of synthetic identities.

Technology can improve monitoring, but automated systems must be explainable, properly tested and subject to human escalation. Banks must also screen customers and transactions for sanctions risk, particularly in cross-border transfers, crypto-asset activity and trade finance.

6. Operational resilience and outsourcing

The Digital Operational Resilience Act, DORA, applies to financial entities operating in Spain. It requires them to manage ICT risk, test resilience, report major incidents and control critical third-party technology providers.

A bank cannot transfer regulatory responsibility to a cloud provider, software developer or fintech partner. Its board must understand critical dependencies, maintain business-continuity plans and ensure that contracts permit audits, access to information and orderly exit arrangements.

Rights and Remedies

Digital banking customers are entitled to transparent terms, secure authentication, accurate information, effective complaint procedures and protection against unauthorised payments. They may challenge unlawful data processing, automated decisions, unfair contract terms and excessive digital-credit costs.

A customer may complain first to the financial institution, then use the relevant supervisory or dispute-resolution route. Depending on the issue, this may involve the Banco de España, CNMV, Spanish Data Protection Agency, consumer authorities or the courts.

Case Laws

1. STC 292/2000, Spanish Constitutional Court – recognised personal-data protection as an autonomous fundamental right. It supports customer control over financial and digital identity data.
2. STS 149/2020, Spanish Supreme Court – held that a revolving-credit interest rate may be usurious where it is markedly higher than normal market rates. The principle applies equally to credit offered through digital platforms.
3. CJEU, Case C-287/19, DenizBank – clarified the concept of a payment instrument under PSD2. It is relevant to contactless cards, mobile wallets and app-based payment tools.
4. CJEU, Case C-311/18, Schrems II – required strong safeguards for transfers of EU personal data outside the European Economic Area. Spanish banks using foreign cloud services must assess those transfers carefully.
5. CJEU, Case C-634/21, SCHUFA – restricted significant decisions based solely on automated scoring. Banks must ensure meaningful safeguards when algorithmic credit or fraud systems affect customers.
6. CJEU, Joined Cases C-26/22 and C-64/22, SCHUFA – confirmed that credit-data retention must comply with necessity, proportionality and data-protection rules.
7. CJEU, Case C-175/20, Valsts ieņēmumu dienests – confirmed that AML-related data demands must remain proportionate and consistent with data-protection principles.

Conclusion

Spain’s digital banking framework permits innovation, but only within a tightly regulated environment. Payment innovation is governed by PSD2-based law; crypto-assets by MiCA; electronic identity by eIDAS; data use by GDPR; and technology resilience by DORA. Banks must combine these rules rather than treating them as separate compliance areas.

The key principle is accountability. A Spanish bank may digitise onboarding, payments, lending, identity verification and asset services, but it remains responsible for customer protection, financial-crime controls, data security, fair automated decisions and operational resilience.