Banking Law and Electronic Records in Spain

Introduction

Electronic records are central to modern banking in Spain. Account-opening documents, payment orders, loan agreements, customer communications, identity checks, transaction logs and regulatory reports are increasingly created and retained digitally. Spanish law generally recognises an electronic record as legally valid and admissible. A banking document cannot be rejected merely because it exists electronically.

However, legal validity does not automatically prove authenticity or accuracy. Where a customer disputes a digital record, the bank may need to establish who created it, whether it was altered, when it was sent, whether it was accessible and whether the customer actually consented to the transaction.

Legal and Regulatory Framework

Regulation (EU) No. 910/2014, known as the eIDAS Regulation, governs electronic identification, signatures, seals, timestamps and trust services. It has been substantially amended by Regulation (EU) 2024/1183, which created the European Digital Identity Framework. A qualified electronic signature has the same legal effect as a handwritten signature throughout the European Union.

Law 6/2020 on Certain Aspects of Electronic Trust Services supplements eIDAS in Spain. It regulates trust-service providers, electronic certificates and supervisory responsibilities. An ordinary or advanced electronic signature is not automatically invalid simply because it is not qualified, although a qualified signature receives the strongest presumption of authenticity.

Law 34/2002 on Information Society Services and Electronic Commerce recognises electronic contracts and requires service providers to make contractual terms available before acceptance. After an electronic agreement is completed, the institution should confirm receipt and preserve the version accepted by the customer.

The Civil Procedure Act, Law 1/2000, permits electronic documents, sound recordings, images and data files to be submitted as evidence. If authenticity is challenged, the court may consider electronic signatures, timestamps, technical reports, metadata and expert evidence.

Electronic banking records must also comply with:

The Commercial Code’s accounting and document-retention obligations.

Law 10/2010 on preventing money laundering and terrorist financing.

Royal Decree-Law 19/2018 on payment services.

Regulation (EU) 2016/679, or GDPR.

Organic Law 3/2018 on data protection and digital rights.

Law 5/2019 on Real Estate Credit Contracts.

Regulation (EU) 2022/2554 on digital operational resilience.

Validity and Evidential Value

A reliable banking record should establish integrity, authenticity, availability and traceability. Integrity means that the information remains complete and unaltered. Authenticity concerns whether the record genuinely came from the identified person or system. Availability requires the document to remain accessible throughout the applicable retention period. Traceability means that relevant actions can be reconstructed through logs and timestamps.

Banks should preserve the complete evidential chain rather than retaining only a screenshot or final PDF. Relevant evidence may include the contractual version, authentication logs, OTP confirmation, electronic certificate, timestamp, IP information, device identifier and confirmation message.

Scanned signatures have weaker evidential value than qualified electronic signatures because they can be copied easily. Likewise, possession of the customer’s password or phone does not conclusively prove that the customer personally authorised a payment. Banks must consider phishing, malware, identity theft and SIM-swapping risks.

Retention, Privacy and Customer Rights

Money-laundering legislation generally requires banks to preserve customer-identification and transaction documentation for ten years. Certain accounting records must ordinarily be retained for six years under the Commercial Code. Other records may require different periods because of limitation rules, regulatory requirements or pending litigation.

Retention must comply with the GDPR storage-limitation principle. Information should not be kept indefinitely without a legitimate purpose. Banks must establish retention schedules, restrict employee access, encrypt sensitive information and securely delete records when the applicable period expires.

Customers may request access to their personal data and, where information is inaccurate, seek rectification. The right to erasure is not absolute. A bank may retain records where this is required by anti-money-laundering, accounting, supervisory or litigation obligations.

For payment disputes, the bank must usually prove that a disputed transaction was authenticated, accurately recorded and not affected by a technical failure. Authentication alone does not necessarily prove fraud or gross negligence by the customer.

Enforcement and Remedies

Electronic-record obligations are supervised by several institutions. The Bank of Spain oversees banking conduct and payment-service compliance. The Spanish Data Protection Agency may investigate unlawful processing, excessive retention or inadequate security. The SEPBLAC framework applies to anti-money-laundering records, while courts determine evidential admissibility and contractual consequences.

A customer may challenge an electronic record as forged, incomplete, altered or improperly attributed. Available remedies can include correction of the account, repayment of an unauthorised transaction, contractual nullity, damages, regulatory complaints or exclusion of unreliable evidence.

Banks may face GDPR administrative penalties, consumer-law sanctions and civil liability. Manipulation or unauthorised access to electronic records may also result in criminal liability.

Relevant Case Laws

Content Services Ltd v Bundesarbeitskammer, Case C-49/11: The Court of Justice held that merely placing contractual information on a website did not necessarily provide it on a durable medium. The customer must be able to store and reproduce the information unchanged.

BAWAG PSK Bank für Arbeit und Wirtschaft v Verein für Konsumenteninformation, Case C-375/15: Information placed in an electronic banking mailbox may qualify as being provided on a durable medium only where the customer can store it unchanged and is actively informed that it is available.

Bundesverband der Verbraucherzentralen v Deutsche Bank, Case C-583/18: The Court addressed the accessibility and presentation of payment-service information, reinforcing the need for clear and comprehensible contractual records.

Profi Credit Polska, Case C-176/17: The Court emphasised that national procedures must allow effective judicial examination of contractual documents and unfair terms, even where a lender relies on formal documentary evidence.

Spanish Supreme Court Judgment 300/2015: The Court warned that digital communications can be manipulated and that authenticity must be carefully verified when electronic messages are disputed.

Spanish Supreme Court Judgment 116/2017: The Court accepted digitally obtained communications while stressing the importance of contextual assessment, corroborating evidence and reliable attribution.

Spanish Constitutional Court Judgment 114/1984: The Court developed fundamental principles concerning unlawfully obtained communications and evidential use, influencing later treatment of privacy-sensitive electronic material.

Barbulescu v Romania (2017): The European Court of Human Rights held that monitoring electronic communications requires adequate notice, necessity and proportionality. The principles are relevant to employee communications and internal banking investigations.

Conclusion

Spanish law fully recognises electronic banking records, but their legal strength depends on reliable creation, authentication, preservation and presentation. Banks must combine eIDAS-compliant trust services, secure retention, data-protection controls and complete audit trails. Proper electronic-record governance protects customers, enables effective supervision and allows digital evidence to withstand judicial scrutiny.