Banking Law and Experimental Financial Regulation in Spain

1. Introduction

Experimental financial regulation in Spain refers primarily to the legal framework that allows new technology-based financial products, services, business models and supervisory technologies to be tested in a controlled environment before they are deployed on the wider financial market.

The central instrument is Spain's Law 7/2020, of 13 November, on the digital transformation of the financial system (Ley 7/2020, para la transformación digital del sistema financiero). It created Spain's financial regulatory sandbox (espacio controlado de pruebas).

The Spanish model attempts to balance two potentially conflicting objectives:

financial innovation + financial stability and consumer protection

It therefore does not simply give fintech companies regulatory exemptions. Instead, it creates a controlled environment in which the innovation can be tested under supervisory conditions.

As of September 2026, Spain's twelfth sandbox cohort is open for applications from 1 September to 13 October 2026.

2. Meaning of Experimental Financial Regulation

Traditional financial regulation normally operates through:

Law → licence → supervision → enforcement

Experimental regulation introduces another stage:

Innovation → controlled testing → regulatory observation → evidence → possible authorisation/regulatory adaptation

The purpose is to allow regulators to observe how a new technology works before deciding how it should be regulated on a larger scale.

Examples include:

• artificial intelligence in credit assessment;
• blockchain-based payments;
• tokenisation;
• digital identity;
• automated investment advice;
• RegTech;
• SupTech;
• fraud-detection systems;
• open-banking technologies;
• digital lending;
• insurance technology;
• distributed-ledger settlement;
• innovative compliance systems.

Law 7/2020 defines technological financial innovation broadly enough to cover new business models, applications, processes and products affecting financial markets, financial services or public functions in the financial sphere.

3. Legal Foundation: Law 7/2020

The principal statute is:

Ley 7/2020, de 13 de noviembre, para la transformación digital del sistema financiero.

Its central objective is to enable technological innovation while maintaining:

1. financial stability;
2. market integrity;
3. consumer protection;
4. personal-data protection;
5. prevention of money laundering;
6. prevention of terrorist financing;
7. appropriate supervision.

The Banco de España expressly describes the sandbox as a safe environment for testing technology-based financial innovations while mitigating or minimising risks to the financial system and participants.

4. The Spanish Regulatory Sandbox

The Spanish sandbox is not simply a "free zone" from financial regulation.

It is a:

controlled, supervised and legally structured testing environment.

Law 7/2020 is built around three major ideas:

A. Controlled environment

Testing takes place within defined limits.

B. Supervisory instrument

Financial authorities observe the innovation.

C. Law + protocol model

The general statutory framework is supplemented by a specific testing protocol agreed between the promoter and the relevant supervisor.

5. Who Can Participate?

The sandbox is not limited to licensed banks.

The framework allows natural or legal persons, individually or collectively, to submit qualifying projects. The current government information expressly states that any person or entity presenting a project satisfying the statutory requirements may participate.

Therefore, potential participants include:

• banks;
• fintech companies;
• technology companies;
• start-ups;
• financial-market infrastructure providers;
• insurance innovators;
• academic/technology collaborations;
• companies developing regulatory technology.

6. Eligibility Requirements

Under Article 5 of Law 7/2020, the project must satisfy several substantive conditions.

Requirement 1 — Technological innovation

The project must involve a technology-based innovation applicable to the financial system.

For example:

An AI system that evaluates SME creditworthiness.

would potentially qualify.

A completely ordinary banking product with no meaningful technological innovation would not normally satisfy this criterion.

Requirement 2 — Sufficient maturity

The project must be sufficiently developed to be tested.

This is important.

The sandbox is not intended to finance basic scientific research.

The technology should be sufficiently developed to allow an actual controlled test.

Requirement 3 — Added value

The project must have potential value in at least one of the following areas:

• improving regulatory compliance;
• benefiting financial-service users;
• improving efficiency of financial entities or markets;
• improving financial regulation or supervision.

These criteria are expressly identified by Banco de España.

7. The Four Main Regulatory Benefits

Experimental regulation can produce four different forms of public benefit.

1. Compliance innovation

Example:

AI automatically checks thousands of transactions for AML red flags.

2. Consumer benefit

Example:

An application makes financial products easier for consumers to compare.

3. Market efficiency

Example:

Blockchain reduces settlement time.

4. Better supervision

Example:

A RegTech platform allows Banco de España or another supervisor to detect systemic risk earlier.

Thus, the sandbox is not designed only for the benefit of the private company.

It is also a regulatory-learning mechanism.

8. Application Process

Broadly, the process can be understood as:

Project preparation

↓

Application to the Treasury

↓

Preliminary assessment

↓

Allocation to competent supervisor

↓

Testing protocol

↓

Controlled testing

↓

Supervisory monitoring

↓

Conclusions

↓

Possible authorisation or regulatory adaptation

Banco de España currently provides an electronic procedure for submitting documentation where a project has received a favourable preliminary evaluation.

9. The Testing Protocol

The protocol is one of the most important elements of Spanish experimental regulation.

Before testing begins, the promoter and relevant supervisory authority establish the conditions governing the experiment.

The protocol can determine:

• scope of testing;
• number of participants;
• duration;
• technological parameters;
• risk controls;
• reporting requirements;
• consumer-protection measures;
• data-protection requirements;
• procedures for incidents;
• termination conditions.

Therefore, the sandbox is experiment-specific regulation rather than a generic exemption.

10. Consumer Protection

If real consumers participate, the regulatory framework imposes additional safeguards.

Participants must receive appropriate information and informed consent mechanisms, and the testing framework must include appropriate guarantees and indemnification mechanisms.

This reflects a central principle:

Innovation cannot be used as a justification for exposing consumers to uncontrolled financial risk.

11. No Automatic Financial Licence

This is one of the most important examination points.

Sandbox participation ≠ financial authorisation.

Participation does not itself authorise a company to conduct a regulated financial activity professionally.

Banco de España expressly states that admission to the sandbox does not grant authorisation to begin a reserved activity or to provide financial services habitually on a professional basis.

For example:

A fintech may successfully test a payment innovation.

That does not automatically mean that it can subsequently operate as a payment institution without obtaining the required authorisation.

12. Regulatory Authorities

Experimental financial regulation involves multiple Spanish authorities depending on the nature of the project.

Banco de España

Relevant primarily for banking and payment-related activities.

CNMV

Relevant for securities and investment-market activities.

DGSFP

Relevant to insurance and pension-sector innovation.

Secretaría General del Tesoro y Financiación Internacional

Important in the administration of the sandbox framework.

AEPD

Relevant where personal-data processing is involved.

SEPBLAC

Relevant to AML/CTF matters.

Banco de España confirms that sandbox activity can involve cooperation with CNMV, DGSFP, AEPD, SEPBLAC and other competent authorities.

13. Banking Law and AI

AI presents one of the most important applications of experimental financial regulation.

A Spanish bank might want to test:

AI-based credit scoring

The system could evaluate:

• income;
• repayment history;
• transaction patterns;
• business performance;
• fraud indicators.

But this creates legal risks.

Risks

• discriminatory outcomes;
• incorrect decisions;
• opaque algorithms;
• privacy violations;
• cybersecurity;
• excessive automation;
• inability to explain rejection of credit.

Therefore, the sandbox could allow the regulator to observe:

accuracy + fairness + explainability + consumer impact + compliance

before large-scale deployment.

14. Banking Law and Blockchain

Blockchain can be tested for:

• payments;
• settlement;
• tokenised securities;
• digital identity;
• transaction monitoring;
• trade finance.

The legal challenge is that traditional banking law assumes relatively clear intermediaries.

Blockchain can introduce:

decentralised networks + automated transactions + smart contracts.

This raises questions concerning:

• legal responsibility;
• custody;
• ownership;
• settlement finality;
• cybersecurity;
• AML;
• consumer protection.

The sandbox provides a mechanism for testing these questions under controlled conditions.

15. Banking Law and Digital Lending

A fintech might create an automated lending platform where:

Customer application → AI assessment → automated approval → digital contract → electronic disbursement

The legal issues include:

• identity verification;
• responsible lending;
• transparency;
• interest calculation;
• consumer protection;
• data processing;
• automated decision-making;
• fraud;
• AML.

Experimental regulation can help regulators determine whether the system produces better outcomes than traditional lending.

16. Banking Law and RegTech

RegTech means technology used to improve regulatory compliance.

For example:

A bank develops an AI system that automatically monitors 20 million transactions and identifies suspicious patterns.

Instead of manually reviewing every transaction, compliance officers investigate the transactions flagged by the system.

The sandbox can help test:

• false-positive rates;
• AML effectiveness;
• explainability;
• data security;
• auditability;
• regulatory reporting.

This is especially important because financial institutions cannot simply outsource legal responsibility to an algorithm.

17. Banking Law and SupTech

SupTech is technology used by regulators themselves.

For example:

Banco de España could theoretically use machine-learning tools to identify:

• unusual bank behaviour;
• liquidity stress;
• emerging systemic risks;
• suspicious patterns;
• concentration risks.

The Spanish innovation framework is explicitly concerned with technologies that can improve the exercise of financial supervisory functions.

18. Data Protection

Experimental financial regulation must operate alongside data-protection law.

A fintech testing an AI credit model may process:

• financial information;
• identification data;
• transaction histories;
• behavioural information.

Therefore, GDPR and Spanish data-protection rules remain important.

The sandbox itself does not eliminate data-protection obligations.

The Banco de España expressly identifies personal-data protection as one of the sensitive policy objectives that must remain protected during sandbox testing.

19. AML and Experimental Finance

Another major limitation is anti-money-laundering regulation.

Innovative financial technology cannot create an AML-free environment.

A blockchain-based payment system, for example, must address:

• customer identification;
• beneficial ownership;
• suspicious transactions;
• transaction monitoring;
• sanctions;
• terrorist financing.

The Spanish sandbox specifically preserves the objective of preventing money laundering and terrorist financing.

20. Cybersecurity

Experimental finance also creates cybersecurity problems.

A digital banking platform could be attacked through:

• malware;
• ransomware;
• API attacks;
• credential theft;
• smart-contract vulnerabilities;
• denial-of-service attacks.

Consequently, testing protocols should include:

• access controls;
• incident reporting;
• penetration testing;
• backup systems;
• business continuity;
• recovery procedures.

21. Experimental Regulation and DORA

The European Union's Digital Operational Resilience Act (DORA) is highly relevant to the modern Spanish framework.

It addresses ICT risk and operational resilience in the financial sector.

Therefore, experimental regulation cannot be understood as an isolated Spanish concept.

The Spanish sandbox operates within a broader EU financial-regulatory environment.

This produces an important principle:

Spanish experimentation is nationally administered but increasingly influenced by EU-level financial regulation.

22. Experimental Regulation and MiCA

Crypto-asset innovation also demonstrates the limits of national experimentation.

Where EU legislation such as MiCA applies, a Spanish fintech cannot rely upon sandbox participation to disregard mandatory EU requirements.

The sandbox may help authorities understand the technology and its regulatory implications, but it does not eliminate applicable substantive law once the activity moves into ordinary commercial operation.

23. Important Spanish Case Law

There is an important methodological point:

Spanish courts have not yet produced a large body of judgments specifically interpreting Law 7/2020's financial sandbox.

Therefore, for an academic answer, it is better to distinguish:

1. direct sandbox jurisprudence, which remains limited; and
2. analogical banking/financial jurisprudence, which establishes principles applicable to experimental finance.

The following cases are particularly useful.

Case 1 — STS 1916/2013, 9 May 2013

Cláusulas suelo

The Supreme Court established important principles concerning transparency in banking contracts.

The Court held that merely making a contractual clause grammatically understandable is insufficient where the consumer cannot understand its real economic consequences.

Importance for experimental finance

An innovative financial product may be technically sophisticated.

But:

technical complexity cannot replace meaningful consumer disclosure.

For AI lending, automated investment products or algorithmic financial services, consumers should understand the important economic consequences of the product.

Case 2 — STS 234/2017, 6 April 2017

Swap and informed consent

The Supreme Court considered a banking swap and the bank's obligation to provide clear and comprehensible information concerning the product's specific risks.

Principle

Financial institutions dealing with complex products have enhanced information responsibilities.

Experimental-finance application

Suppose a sandbox project tests a complex algorithmic derivative.

The bank cannot simply say:

"The customer accepted the terms."

The institution must be able to demonstrate meaningful risk communication.

Case 3 — STS 3944/2019, 16 December 2019

Financial advice and complex products

The Supreme Court addressed claims involving investment products and legal information/advisory obligations.

The case illustrates that failure to provide legally required information can create civil liability.

Application

An experimental financial product may be innovative, but innovation does not eliminate:

• information duties;
• suitability obligations where applicable;
• advisory responsibilities;
• civil liability.

Case 4 — STS 3558/2020, 26 October 2020

Transparency in mortgage contracts

The Supreme Court examined whether contractual terms passed incorporation and transparency controls. It distinguished between mere grammatical comprehensibility and the broader legal analysis required for consumer protection.

Application

This is relevant to digital contracts.

A fintech cannot assume:

"The customer clicked 'I agree', therefore the contract is valid."

Digital contracting still requires compliance with applicable transparency rules.

Case 5 — STS 418/2023, 28 March 2023

Multicurrency mortgage and additional guarantees

The Supreme Court examined a clause allowing the bank to demand additional security when currency movements increased the outstanding euro-equivalent amount.

The Court found problems where the consumer had not received adequate pre-contractual information about the clause and where the contractual advantage was disproportionate.

Experimental-finance application

An innovative financial contract may contain automatic:

• margin calls;
• collateral requirements;
• algorithmic adjustments;
• risk triggers.

These mechanisms must be transparent and legally proportionate.

Case 6 — STS 816/2023 and later commission jurisprudence

Spanish Supreme Court jurisprudence concerning mortgage opening commissions emphasises that validity cannot always be determined abstractly; the circumstances of the individual contract and the proportionality of the charge matter. More recent decisions continue to apply this case-by-case approach.

Application

This is relevant to fintech pricing.

A digital lender cannot assume that a technologically automated fee is automatically lawful.

The legal assessment can consider:

• amount;
• service provided;
• proportionality;
• disclosure;
• applicable banking rules.

Case 7 — STS 3072/2025, 1 July 2025

The Supreme Court considered a multicurrency mortgage and concluded in that case that the bank's simulations adequately communicated the risks of exchange-rate movements and their consequences.

Importance for experimental regulation

This case demonstrates the positive side of risk disclosure:

When complex financial risks are properly explained, the product can survive transparency scrutiny.

This is especially relevant to experimental products involving sophisticated algorithms or market risks.

Case 8 — STS 4955/2025, 12 November 2025

The Supreme Court considered a consumer claim involving a loan and an opening commission of 2.17%.

The Court applied proportionality principles and upheld the finding that the commission was abusive in the circumstances.

Experimental-finance application

Digitalisation does not prevent courts from examining:

• proportionality;
• unfairness;
• economic burden;
• consumer impact.

A fintech cannot argue that an algorithmically generated fee is lawful simply because it is technologically innovative.

Case 9 — STS 5185/2025, 12 November 2025

Banco Popular resolution

The Supreme Court addressed claims concerning Banco Popular shares following the bank's EU resolution.

It applied the consequences of the EU bank-resolution framework and the CJEU's interpretation concerning post-resolution shareholder claims.

Importance

This case demonstrates that innovative or sophisticated financial activity remains subject to:

• EU banking law;
• resolution rules;
• systemic-risk regulation;
• limits on private contractual remedies.

This is particularly important for fintechs that eventually become systemically important.

24. Legal Lessons from the Cases

The cases collectively establish several principles.

Principle 1 — Innovation does not eliminate transparency

A new technology does not reduce consumer rights.

Principle 2 — Complexity increases the importance of information

The more complex the product, the greater the importance of explaining risks.

Principle 3 — Digital consent is not automatically informed consent

Clicking a button does not necessarily prove that the consumer understood the economic consequences.

Principle 4 — Automated pricing remains subject to legal scrutiny

Algorithms cannot be used to disguise disproportionate charges.

Principle 5 — EU law remains supreme within its field

Spanish experimentation must operate consistently with applicable EU financial regulation.

25. Experimental Regulation vs Regulatory Exemption

This distinction is extremely important.

Spain's sandbox follows the first model.

Law 7/2020 specifically provides that sandbox admission does not itself authorise ordinary professional provision of reserved financial services.

26. Exit from the Sandbox

An experiment should ultimately produce one of several outcomes:

Outcome A — Successful innovation

The promoter proceeds toward obtaining the necessary licence/authorisation.

Outcome B — Modification

The technology is changed and tested again.

Outcome C — Termination

The experiment is stopped because the risks are unacceptable.

Outcome D — Regulatory learning

The authority identifies regulatory barriers or areas where legislation may need improvement.

Banco de España expressly describes the sandbox as including an eventual route toward regulated activity and the identification of regulatory barriers in the conclusions stage.

27. Why the Sandbox Is Important for Banking Law

Traditional banking regulation often develops after financial innovation.

For example:

Technology appears → consumers adopt it → risks emerge → regulator responds → legislation changes.

Experimental regulation tries to reverse this sequence:

Technology appears → controlled experiment → regulator observes risks → evidence develops → appropriate regulation.

This is why the sandbox can be considered a form of evidence-based financial regulation.

28. Advantages

1. Encourages fintech innovation

Companies can communicate with regulators during development.

2. Improves regulatory knowledge

Supervisors understand emerging technology.

3. Reduces uncertainty

Companies obtain greater clarity regarding regulatory expectations.

4. Protects consumers

Testing is conducted under safeguards.

5. Detects systemic risks

Potential problems can be discovered before large-scale deployment.

6. Encourages competition

Smaller fintech companies can experiment without immediately confronting the full complexity of market deployment.

29. Disadvantages and Criticisms

Experimental regulation also has weaknesses.

Regulatory arbitrage

Companies may try to use experimentation to avoid ordinary regulation.

Selection bias

A small controlled test may not reveal risks that arise at millions of users.

Limited consumer representation

A small experiment may not accurately represent vulnerable consumers.

Supervisory-resource burden

Authorities need technically skilled personnel.

Uncertainty after testing

Successful sandbox participation does not guarantee commercial authorisation.

Rapid technological change

By the time a test finishes, the technology may already have changed.

30. Hypothetical Example

Imagine a Spanish fintech called:

IberiaAI Finance S.L.

It develops an AI system that predicts SME default risk.

Stage 1

The company develops the model.

Stage 2

It applies for sandbox participation.

Stage 3

The authority evaluates:

• technological innovation;
• maturity;
• consumer benefit;
• financial-system impact.

Stage 4

A testing protocol is established.

Stage 5

The company tests the model on 500 consenting SMEs.

Stage 6

The supervisor examines:

• prediction accuracy;
• discrimination;
• explainability;
• data protection;
• consumer outcomes.

Stage 7

The experiment ends.

Stage 8

The regulator identifies:

• strengths;
• weaknesses;
• necessary safeguards;
• regulatory obstacles.

Stage 9

If the business is a regulated lending/payment activity, the company obtains the necessary authorisation before ordinary professional operation.

This illustrates the fundamental Spanish model:

test first under supervision, then move toward ordinary regulated activity.

31. Relationship with Banking Supervision

Experimental financial regulation does not replace prudential supervision.

Banks remain subject to conventional requirements concerning:

• capital;
• liquidity;
• governance;
• risk management;
• internal controls;
• AML;
• consumer protection;
• operational resilience.

The sandbox is therefore best viewed as an innovation layer within the broader financial-regulatory system, rather than an alternative banking system.

32. Current Spanish Position

Spain has moved beyond the theoretical stage.

The Banco de España has studied the practical effects of the sandbox on projects it supervised and published an Occasional Paper in 2024 examining:

• how the Spanish sandbox operates;
• its different phases;
• eligibility criteria;
• experiences of promoters;
• project evolution;
• possible improvements.

The paper describes the sandbox as an instrument intended simultaneously to promote innovation and protect financial stability, market integrity and financial-service users.

Furthermore, the twelfth cohort is currently open in 2026, demonstrating that the sandbox is now an established continuing regulatory mechanism rather than a one-off experiment.

33. Conclusion

Spanish experimental financial regulation represents a major change in the philosophy of banking regulation.

The traditional approach was:

"Comply with the rules before entering the market."

The experimental approach adds:

"Where appropriate, test the innovation in a controlled environment so that regulators can learn how the rules should operate."

The central legal instrument is Law 7/2020, which created Spain's financial regulatory sandbox. It requires technological innovation, sufficient maturity, potential added value and controlled testing. Participation does not itself constitute a banking or financial-services licence.

The case law does not yet provide a large body of decisions directly interpreting the sandbox. Nevertheless, Spanish Supreme Court jurisprudence on financial transparency, complex products, informed consent, proportionality, consumer protection and EU banking law provides important principles for experimental finance. Cases such as STS 1916/2013, STS 234/2017, STS 3944/2019, STS 3558/2020, STS 418/2023, STS 816/2023, STS 3072/2025 and STS 4955/2025 demonstrate that technological innovation cannot displace fundamental banking-law principles.

In short:

Spanish experimental financial regulation seeks to create a middle ground between unrestricted financial innovation and rigid ex-ante regulation: innovation is permitted, but only within a controlled, supervised and consumer-protective legal framework.