Banking Law and Expenditure Governance in Spain

1. Introduction

Expenditure governance in Spanish banking law refers to the legal and institutional framework through which a bank controls, authorizes, records, monitors, and discloses its expenditure so that corporate funds are used lawfully, prudently, transparently, and consistently with the bank’s risk profile and long-term interests.

Spain does not have one statute called an “Expenditure Governance Act.” Instead, expenditure governance is constructed from several areas of law, principally:

• Law 10/2014 on the Organisation, Supervision and Solvency of Credit Institutions (LOSSEC);
• Royal Decree 84/2015, implementing Law 10/2014;
• the Spanish Companies Act (Ley de Sociedades de Capital—LSC);
• Capital Requirements Regulation (CRR) and EU banking rules;
• accounting and financial-reporting requirements;
• remuneration and corporate-governance rules;
• Banco de España supervision;
• CNMV disclosure and market-conduct requirements; and
• criminal, civil and administrative liability rules.

Law 10/2014 is particularly important because it requires credit institutions to have clear organisational structures, effective risk-management procedures, internal controls, proper administrative/accounting procedures and remuneration policies compatible with sound risk management.

2. Meaning of Expenditure Governance

Expenditure governance concerns much more than simply preventing employees from spending money.

It covers questions such as:

1. Who may approve expenditure?
2. What limits apply to directors and executives?
3. How are related-party expenses controlled?
4. How are executive remuneration and benefits approved?
5. How are corporate cards monitored?
6. How must expenditure be recorded in accounting records?
7. How does the bank prevent conflicts of interest?
8. How does the board monitor expenditure-related risks?
9. What happens when expenditure contributes to financial or prudential risk?
10. What disclosure must be made to shareholders, investors and regulators?

Therefore, expenditure governance is closely connected with corporate governance, internal control, risk governance and directors' duties.

3. Principal Legal Framework

A. Law 10/2014

Law 10/2014 is the central Spanish banking statute for governance and prudential supervision.

Article 29 requires credit institutions to maintain a sound corporate-governance system including:

• clearly defined responsibilities;
• effective risk identification and management;
• internal controls;
• proper administrative and accounting procedures;
• remuneration policies compatible with effective risk management.

The board must also establish a governance system ensuring sound and prudent management and must periodically evaluate its effectiveness and correct deficiencies.

This is extremely important for expenditure governance.

Example

Suppose a bank's board allows executives to spend millions of euros through loosely controlled corporate cards.

Even if individual payments appear small, the bank may have a governance problem because:

• authorization controls are inadequate;
• accounting controls are weak;
• conflicts of interest may exist;
• directors may not be properly supervising management;
• expenditure may not be consistent with prudent management.

4. Board Responsibility

The Spanish framework places significant responsibility on the board of directors.

Article 29 requires the board to establish and supervise the corporate-governance framework.

Article 37 goes further by making the board responsible for the risks assumed by the credit institution and requiring effective information channels concerning risk-management policies and significant risks.

Consequently, expenditure governance cannot simply be delegated to the accounting department.

Board responsibilities may include:

5. Internal Control and Accounting

An important element of expenditure governance is the requirement for correct administrative and accounting procedures.

This means that a bank should be able to establish an audit trail:

Request → Authorization → Payment → Accounting entry → Supporting documentation → Review → Audit

A bank should normally be able to identify:

• who authorized an expense;
• who incurred it;
• its business purpose;
• supporting invoices/documents;
• the account against which it was charged;
• whether it complied with internal policy;
• whether it created a conflict of interest.

Failure of such controls can become a banking-governance issue rather than merely an accounting error.

6. Expenditure and Executive Remuneration

Executive remuneration is one of the most important areas of expenditure governance.

Under Law 10/2014, remuneration policies for personnel whose activities materially affect the institution's risk profile must be designed consistently with sound risk management.

The legislation requires, among other things, that:

• remuneration should not encourage excessive risk-taking;
• remuneration should be consistent with the bank's long-term interests;
• control-function personnel should remain independent;
• variable remuneration should reflect sustainable, risk-adjusted performance;
• the board must supervise the remuneration policy;
• the policy must undergo internal independent evaluation.

Thus, executive remuneration is legally treated as a governance and risk issue, not simply as an ordinary business expense.

7. Variable Remuneration and Expenditure Governance

Spanish banking law is particularly concerned with variable remuneration.

The basic idea is:

A manager should not receive large rewards for generating short-term profits if those profits are subsequently revealed to have been produced by excessive risk.

Accordingly, variable remuneration should take account of:

• individual performance;
• financial performance;
• non-financial performance;
• business-unit performance;
• overall bank performance;
• long-term results;
• risk outcomes.

Law 10/2014 requires variable remuneration to be connected to sustainable and risk-adjusted performance, with mechanisms designed around longer-term results.

This is an important form of expenditure governance through remuneration governance.

8. Remuneration Committee

Royal Decree 84/2015 provides for a remuneration committee.

The committee prepares decisions relating to remuneration, including decisions having implications for:

• risk;
• risk management;
• executive compensation;
• board remuneration;
• contractual conditions.

The committee must also consider the long-term interests of shareholders, investors, other stakeholders and the public interest.

Therefore:

Remuneration Committee → Board → Shareholders/appropriate corporate body → Supervisory oversight

creates a governance chain for significant expenditure on executives.

9. Corporate Cards and Expense Accounts

Corporate cards are a particularly useful illustration of expenditure governance.

A legitimate corporate card may be used for:

• travel;
• accommodation;
• client meetings;
• business meals;
• representation;
• business-related transportation.

But governance requires:

• defined expenditure limits;
• authorized users;
• transaction monitoring;
• supporting documentation;
• accounting classification;
• periodic review;
• internal audit;
• consequences for misuse.

The absence of these controls can turn an apparently ordinary expense system into a serious corporate-governance failure.

10. Case Law: Caja Madrid / “Black Cards”

STS 438/2018, 3 October 2018 — Caja Madrid/Bankia Black Cards

This is one of the most important Spanish cases for expenditure governance.

The Spanish Supreme Court upheld the criminal convictions of numerous former directors and executives of Caja Madrid and Bankia in the “tarjetas black” case.

The cards operated outside the ordinary corporate expense system. Users were not required to justify expenditure, and the amounts were not properly reflected as agreed remuneration or ordinary allowances.

The Supreme Court confirmed Rodrigo Rato's conviction for continuing misappropriation and convictions of other former directors and executives.

The court found that the system permitted individuals to treat institutional money as though it were their own.

Legal significance

The case establishes an important principle:

A formal corporate authorization does not automatically make expenditure lawful.

If the underlying expenditure:

• lacks legitimate corporate purpose;
• falls outside the person's authority;
• bypasses required remuneration rules;
• lacks proper accounting transparency; or
• damages the institution's assets,

the individuals responsible may face serious civil or criminal consequences.

The court also confirmed substantial civil liability for amounts spent through the cards.

11. Caja Madrid: Governance Failure

The case demonstrates several expenditure-governance failures:

1. Lack of transparency

Expenses were not transparently incorporated into remuneration arrangements.

2. Lack of justification

Users were not required to justify their expenditure.

3. Weak accounting controls

The expenses were processed through mechanisms that did not properly identify their personal character.

4. Conflict of interest

The persons benefiting from the system were themselves part of the institution's governing structure.

5. Board failure

The governance structure failed to prevent the continuation and expansion of the system.

6. Personal liability

Those who knowingly benefited could face criminal liability.

Thus, STS 438/2018 is perhaps the clearest Spanish judicial illustration of why expenditure governance is a banking-law issue.

12. Case Law: Banco Popular Remuneration

STS 801/2026, 27 May 2026

The Spanish Supreme Court recently dealt with remuneration of a former Banco Popular executive and the operation of malus/clawback mechanisms.

The dispute concerned recovery of remuneration, including variable remuneration, following the executive's departure and the deterioration of the bank's circumstances.

Importance

The judgment demonstrates that executive remuneration is not necessarily an unconditional payment.

Where a properly established remuneration arrangement contains:

• risk-related conditions;
• performance conditions;
• malus provisions; or
• clawback provisions,

the bank may have legal mechanisms for recovering amounts when the relevant conditions are triggered.

This reinforces the principle that expenditure governance extends beyond authorizing payment to controlling whether the payment remains justified after subsequent risk outcomes become known.

13. Case Law: Banco Popular Executive Remuneration

STS 802/2026, 27 May 2026

Another Supreme Court judgment concerned a former Banco Popular executive and the interpretation of contractual malus/clawback provisions.

The executive had received fixed and variable remuneration together with other benefits. The litigation concerned whether variable remuneration could be recovered under the contractual and regulatory framework.

Principle

The case demonstrates the interaction between:

Employment/contract law + company law + banking remuneration regulation + risk governance.

For expenditure governance, the lesson is that a bank must carefully draft remuneration contracts so that variable compensation reflects:

• risk;
• sustainable performance;
• long-term results;
• regulatory requirements.

14. Case Law: Banco Popular — €1 Million Remuneration Disclosure Penalty

STS 516/2023, 25 April 2023

The Supreme Court considered a €1 million CNMV penalty concerning Banco Popular's annual remuneration reports.

The reports for 2013–2015 were found to have omitted or inadequately presented information concerning executive remuneration, including long-term savings arrangements and payments connected with termination of executive contracts.

The important point is that the infringement concerned internal organisational and prudential requirements, rather than simply an ordinary market transaction.

The Supreme Court upheld the regulatory consequences and accepted the succession of responsibility to Banco Santander following the absorption of Banco Popular.

Expenditure-governance significance

A bank's expenditure governance must therefore include disclosure governance.

It is insufficient for expenditure to be internally authorized.

The bank must also ensure that legally required remuneration and governance information is:

• complete;
• accurate;
• transparent;
• properly disclosed.

15. Case Law: Bankia and Information Governance

STS 896/2023, 6 June 2023

The Supreme Court considered issues concerning investment in Bankia and the information available to investors.

The court emphasized the relevance of directors' duties to obtain adequate information concerning the company's financial position and the importance of proper diligence by persons connected with the board.

Relevance to expenditure governance

This supports a broader governance principle:

Directors cannot properly govern expenditure and risk without adequate information.

A board therefore needs reliable information regarding:

• expenses;
• liabilities;
• remuneration;
• financial performance;
• risk exposures;
• accounting treatment.

16. Bankia Preferentes Case

Supreme Court, 10 July 2019 — Bankia

The Supreme Court also held Bankia responsible in litigation concerning inaccurate information provided in the exchange of preferred securities and subordinated debt for shares.

The court reiterated that Bankia's economic and financial information concerning its 2011 accounts was seriously inaccurate.

Governance lesson

Although this is not a pure expenditure case, it demonstrates why financial-information governance is central to banking governance.

If accounting information is inaccurate, the board, investors and regulators may make decisions on an incorrect financial foundation.

Thus:

Financial reporting → Board decisions → Expenditure/risk decisions → Investor confidence

are interconnected.

17. Administrative Liability After Bank Mergers

The Banco Popular/Santander litigation also illustrates an important principle.

In STS 516/2023, the Supreme Court accepted that administrative sanctioning responsibility may pass to the successor entity following a merger or absorption where there is sufficient economic identity, continuity and succession.

This is significant for expenditure governance because a merger does not necessarily eliminate historical regulatory exposure.

Example

If Bank A commits a governance-related regulatory violation and is subsequently absorbed by Bank B, Bank B may inherit the financial consequences of the regulatory violation.

Therefore, due diligence in banking mergers must include governance and expenditure controls, not merely assets and liabilities.

18. Role of Banco de España

Banco de España has an important supervisory role.

Under Law 10/2014, Banco de España supervises:

• compliance systems;
• risk systems;
• corporate governance;
• remuneration policies;
• management responsibility;
• suitability requirements.

The legislation expressly gives Banco de España responsibility for supervising corporate-governance systems and remuneration policies.

Therefore, expenditure governance can be examined by the supervisor where it affects:

• risk management;
• internal controls;
• remuneration;
• solvency;
• liquidity;
• governance;
• compliance.

19. Proportionality

Spanish banking governance does not require identical controls for every bank.

Law 10/2014 uses a proportionality principle.

Governance mechanisms should correspond to:

• size of the institution;
• internal organisation;
• nature of activities;
• scale of operations;
• complexity of risks.

For example:

A small bank may have:

• one centralized expense-approval system;

while a large international bank may require:

• multiple authorization levels;
• procurement committees;
• independent compliance;
• internal audit;
• automated transaction monitoring;
• board committees;
• group-level controls.

20. Related-Party and Conflict-of-Interest Expenditure

Expenditure governance becomes particularly sensitive where the recipient is:

• a director;
• senior executive;
• shareholder;
• connected company;
• family member of a director;
• related entity.

Spanish corporate governance therefore emphasizes conflict-of-interest prevention.

Law 10/2014 expressly requires the board's governance system to include an appropriate allocation of responsibilities and prevention of conflicts of interest.

Example

If a bank purchases consultancy services from a company controlled by a director, proper governance should involve:

1. identification of the relationship;
2. conflict disclosure;
3. independent review;
4. approval under applicable rules;
5. arm's-length pricing;
6. documentation;
7. accounting;
8. regulatory disclosure where required.

21. Expenditure Governance and Internal Audit

A strong Spanish banking expenditure system should operate through several lines of defence.

First line — Business management

Responsible for:

• legitimate business purpose;
• budget;
• initial authorization;
• documentation.

Second line — Risk and compliance

Responsible for:

• policy compliance;
• conflicts;
• risk assessment;
• regulatory requirements.

Third line — Internal audit

Responsible for:

• independent testing;
• identifying weaknesses;
• reviewing controls;
• reporting deficiencies to appropriate governance bodies.

The board then oversees the overall system.

22. Expenditure Governance and Risk Management

Banking expenditure can create direct or indirect risk.

Examples

Excessive executive remuneration → conduct and financial risk

Weak procurement controls → fraud risk

Uncontrolled corporate cards → operational risk

Poor IT expenditure governance → cyber/operational risk

Excessive expansion expenditure → capital and liquidity risk

Improper related-party payments → conflict and reputational risk

Inaccurate expense reporting → accounting and regulatory risk

Thus, expenditure governance should be integrated into the bank's enterprise risk-management framework.

23. Regulatory Consequences of Poor Expenditure Governance

Depending on the conduct, consequences may include:

Administrative liability

Regulatory fines or supervisory measures.

Civil liability

Compensation for damage caused to the bank or other parties.

Corporate liability

Removal or consequences for directors and executives.

Clawback

Recovery of variable remuneration or other payments.

Criminal liability

Potential offences such as misappropriation, fraud or corporate-management offences where the statutory elements are satisfied.

Reputational consequences

Loss of confidence from depositors, investors and counterparties.

Prudential consequences

Weak governance can contribute to supervisory intervention where it affects risk management, solvency or liquidity.

24. Six Major Cases at a Glance

25. Key Legal Principles

From Spanish legislation and case law, the following principles emerge:

Principle 1 — Corporate money is not personal money

Directors and executives cannot use bank resources for personal purposes merely because they have access to them.

The Caja Madrid black-card litigation is the strongest illustration.

Principle 2 — Authorization must have legal and corporate substance

A nominal board or executive authorization does not automatically validate expenditure that violates the person's authority or corporate rules.

Principle 3 — Expenditure must be traceable

Banks need adequate accounting and administrative controls.

Principle 4 — Remuneration is a risk-management issue

Executive remuneration must not encourage excessive risk-taking.

Principle 5 — Variable remuneration should reflect long-term performance

Short-term profit cannot be the sole basis for rewarding risk-taking executives.

Principle 6 — Transparency is mandatory

Incorrect or incomplete remuneration reporting may generate regulatory sanctions, as illustrated by the Banco Popular litigation.

Principle 7 — Boards cannot avoid responsibility through delegation

The board retains important supervisory responsibilities concerning governance and risk.

Principle 8 — Regulatory exposure can survive corporate restructuring

The Banco Popular/Santander case demonstrates the importance of successor liability following corporate absorption.

26. Model Expenditure-Governance Framework for a Spanish Bank

A legally robust Spanish bank should ideally have:

Board of Directors
↓
Audit/Risk/Remuneration Committees
↓
Executive Management
↓
Delegated expenditure authorities
↓
Procurement & payment controls
↓
Accounting & documentation
↓
Compliance/Risk review
↓
Internal Audit
↓
Banco de España/CNMV supervision

For executive remuneration:

Performance → Risk adjustment → Remuneration Committee → Board → Shareholder approval where required → Payment → Deferral → Malus/Clawback if applicable

27. Critical Evaluation

The Spanish approach treats expenditure governance as part of a broader concept of prudential corporate governance.

This is important because banking institutions are different from ordinary companies. A bank's expenditure decisions can affect:

• capital;
• liquidity;
• risk-taking;
• depositor confidence;
• investors;
• financial stability.

The Spanish experience demonstrates that weak expenditure governance can contribute to much larger institutional failures.

The Caja Madrid black-card case is the clearest example: an apparently limited expense system became a major governance and criminal-liability matter because it lacked transparency, legitimate controls and proper accountability.

Likewise, the Banco Popular remuneration cases show that expenditure governance continues after payment: remuneration may have to be disclosed accurately and, in appropriate circumstances, variable remuneration may be subject to malus or clawback mechanisms.

Conclusion

Banking expenditure governance in Spain is a multidimensional legal obligation rather than a simple accounting function. It is built around the principles of prudence, transparency, authorization, accountability, internal control, risk adjustment and accurate disclosure.

The core legal framework—particularly Law 10/2014 and Royal Decree 84/2015—requires Spanish credit institutions to maintain sound governance, risk-management and internal-control structures.

The case law reinforces this framework:

• STS 438/2018 demonstrates criminal and civil consequences for misuse of institutional funds;
• STS 516/2023 demonstrates the importance of accurate remuneration disclosures and the continuing regulatory consequences of governance failures;
• STS 801/2026 and STS 802/2026 demonstrate the growing importance of malus/clawback and risk-sensitive executive remuneration;
• Bankia jurisprudence demonstrates the importance of reliable financial information and directors' diligence.

In short, Spanish banking law expects expenditure to be not merely authorized, but demonstrably legitimate, documented, risk-sensitive, transparent and subject to effective governance and supervisory control.