Banking Law and External Audit Independence in Spain

Introduction

External audit independence is an essential part of Spanish banking regulation because banks manage deposits, credit, investments, and other financial interests whose reliability depends heavily on trustworthy financial statements. An external auditor must therefore examine a bank’s accounts objectively and without financial, managerial, commercial, employment, or personal relationships capable of compromising professional judgment.

Spain regulates auditor independence principally through Law 22/2015 of 20 July on Auditing (Ley de Auditoría de Cuentas) and its implementing Royal Decree 2/2021. For banks and other entities qualifying as public-interest entities, these national rules operate together with Regulation (EU) No 537/2014 and the EU statutory-audit framework. Spanish law expressly requires auditors to abstain from an audit when their independence is compromised.

Legal and Regulatory Framework

1. Law 22/2015 on Auditing

Article 14 establishes the fundamental independence principle. Auditors and audit firms must remain independent from the audited entity and must not participate in its management or decision-making. Persons capable of influencing the audit must likewise avoid relationships that create, or could reasonably be perceived as creating, conflicts of interest. The Instituto de Contabilidad y Auditoría de Cuentas (ICAC) supervises compliance with these independence requirements.

Spanish law adopts a mixed system. First, auditors must identify threats to independence and establish appropriate safeguards. Second, legislation specifies particular incompatibilities where independence is considered insufficient and the audit cannot properly be undertaken.

Typical threats include:

Self-interest threats, such as important financial interests in the bank.

Self-review threats, where the auditor would effectively audit work previously performed by the auditor or its network.

Familiarity threats arising from excessively close or prolonged relationships.

Advocacy threats, where an auditor promotes the client's position.

Intimidation threats, where pressure from management could interfere with professional judgment.

The auditor must assess and document relevant threats and safeguards. Where safeguards cannot reduce a serious threat sufficiently, the auditor must abstain from performing the audit.

2. Special Position of Banks

Banks are especially important because credit institutions fall within Spain's mandatory external-audit framework. The Banco de España explains that Spanish credit institutions and specialised lending institutions must submit their accounts to external audit and must have an audit committee under the applicable statutory framework.

Bank auditors may also have regulatory communication responsibilities. Under Article 38 of Law 22/2015, auditors of public-interest entities supervised by bodies such as the Banco de España, CNMV, or insurance supervisors must communicate specified significant information discovered during their audit to the competent supervisory authority.

Independence Requirements for Bank Auditors

A bank's auditor should be independent both in fact and in appearance. Spanish legislation therefore addresses financial relationships, business relationships, employment connections, family relationships, participation in management, incompatible services, audit fees, and prolonged audit engagements.

The auditor's wider professional network is also relevant. Independence cannot necessarily be preserved merely by placing a prohibited activity in another entity belonging to the same audit network. Spanish legislation specifically considers network relationships when determining whether incompatibility exists.

For public-interest entities, EU rules impose additional safeguards, including restrictions on specified non-audit services, limits relating to fees, requirements concerning audit committees, and external rotation or maximum engagement periods. These provisions seek particularly to reduce self-review and familiarity risks.

Audit Committees

Audit committees constitute another important independence safeguard in Spanish banking governance. Their role includes supervising financial reporting and the external audit relationship and helping protect the auditor from inappropriate managerial influence.

For public-interest entities, the regulatory framework strengthens audit committees' involvement in auditor selection and oversight of auditor independence. This creates an institutional separation between the external auditor and executives whose financial reporting is being examined.

Case Laws and Judicial Principles

Because highly specific Spanish reported judgments dealing solely with bank external-auditor independence are comparatively limited, the subject is best understood through Spanish and EU cases concerning auditor independence, auditor liability, professional diligence, conflicts of interest, and the reliability of audited financial information.

1. CJEU, Commission v Italy, Case C-255/01

The Court of Justice considered national rules affecting statutory auditors and emphasised the importance of an effective regulatory framework surrounding statutory auditing. The case illustrates the broader EU principle that statutory audit cannot be treated merely as an ordinary commercial service. Professional qualification, independence, and regulatory supervision serve significant public interests.

Principle: Member States may maintain substantial professional safeguards around statutory auditors because reliable and independent auditing protects investors, creditors, and markets.

2. CJEU, Commission v Austria, Case C-270/02

This case arose in the context of statutory auditing and national professional requirements. It forms part of the EU jurisprudential background governing the balance between freedom to provide professional services and legitimate safeguards surrounding auditors.

Principle: EU market freedoms do not eliminate justified professional requirements designed to preserve the reliability and integrity of statutory audit.

3. CJEU, Commission v Spain, Case C-140/03

This proceeding concerned Spain's rules affecting auditors and EU-law requirements governing professional activity.

For banking audit independence, its significance lies in demonstrating that Spanish regulation of auditors operates within the broader EU legal order. Domestic restrictions must therefore pursue legitimate objectives and comply with EU requirements while maintaining adequate protection for audit quality.

Principle: Spanish statutory-audit regulation must be interpreted consistently with EU rules governing professional services and the public-interest function of auditing.

4. CJEU, Commission v Spain, Case C-157/09

The Court examined Spanish rules concerning statutory auditors and audit firms in the context of EU law.

The decision is relevant to the institutional independence of the auditing profession because restrictions governing audit firms must be assessed against both internal-market requirements and the legitimate objective of ensuring reliable statutory auditing.

Principle: Auditor regulation must balance professional independence and public-interest protection against disproportionate restrictions on establishment and professional activity.

5. CJEU, Ernst & Young P/S v Konkurrencerådet, Case C-633/16

Although principally a competition-law case concerning implementation of a concentration, it involved Ernst & Young and demonstrates how structural relationships involving major professional-services firms are analysed according to their actual legal and economic effects.

Its indirect relevance to banking audit independence is that independence analysis should focus on substantive relationships and influence rather than merely contractual labels.

Principle: Regulatory analysis looks at the real effect of professional and corporate relationships, an approach consistent with modern auditor-independence regulation.

6. CJEU, Banco Español de Crédito SA v Calderón Camino, Case C-618/10

This was not an auditor-independence dispute, but it is important to the wider Spanish banking-law environment. The Court strengthened judicial protection concerning unfair terms in consumer banking contracts.

For auditors, the case illustrates the broader regulatory expectation that banking operations are subject to intensive scrutiny because weaknesses in governance, documentation, provisions, liabilities, or compliance may affect financial reporting.

Principle: Banks operate within a heightened regulatory and consumer-protection environment, making reliable independent scrutiny of their financial position particularly important.

7. CJEU, Bankia SA and Others, Case C-910/19

The litigation concerned investor claims connected with securities and financial disclosure involving Bankia. It is relevant to external audit because investor decisions in financial institutions may depend heavily upon published financial statements and related disclosures.

Principle: Reliable financial disclosure is central to investor protection. Independent external auditing therefore functions as an important component of the wider system designed to ensure trustworthy market information.

Practical Application to Spanish Banks

Suppose an audit firm audits a Spanish bank but simultaneously provides extensive consultancy affecting figures that will later appear in the bank's financial statements. A significant self-review threat may arise. The auditor must determine whether the service is prohibited and whether independence can lawfully be maintained.

Similarly, an auditor holding a significant financial interest in the audited bank would face an obvious self-interest problem. Close employment, commercial, or family connections may likewise trigger incompatibility rules.

Long relationships between the same auditor and a public-interest bank may create familiarity threats. This explains the importance of rotation requirements.

An auditor must also remain independent from management. Management prepares the financial statements; the auditor independently examines them. An auditor who effectively makes management decisions and later audits their financial consequences undermines this separation.

Regulatory Consequences

Violation of independence requirements can produce serious consequences under Spanish auditing law. Depending on the circumstances, these can include regulatory investigation, professional sanctions, invalidity or unreliability concerns surrounding the audit engagement, civil liability, and reputational consequences.

ICAC plays the central role in supervising statutory auditors' compliance with independence obligations. Banking supervision adds another dimension because auditors of relevant public-interest entities have communication duties toward national supervisory authorities.

Importance for Banking Stability

External audit independence is not simply a technical accounting requirement. Banks operate with substantial leverage and public confidence. Incorrect valuation of loans, inadequate impairment recognition, hidden losses, misleading capital information, or inaccurate financial reporting can affect depositors, investors, counterparties, and financial stability.

Independent auditing provides an additional control against such risks. The Spanish framework therefore combines general independence duties, statutory incompatibilities, threat-and-safeguard assessments, restrictions on non-audit services, audit committees, fee rules, rotation requirements, ICAC supervision, and communication with banking regulators.

Conclusion

External audit independence in Spanish banking law is governed by a combination of Law 22/2015, Royal Decree 2/2021, EU statutory-audit legislation, public-interest-entity requirements, and banking supervisory rules. The central principle is straightforward: an auditor must be objectively independent and must also avoid relationships that reasonably create an appearance of compromised independence.

Spanish law consequently requires identification of independence threats, appropriate safeguards, documentation, avoidance of management participation, compliance with incompatibility rules, and withdrawal from an engagement when independence cannot adequately be protected. Public-interest entities such as banks face additional controls involving non-audit services, fees, audit committees, and rotation.

The case law demonstrates the wider judicial principles behind this framework: statutory auditing performs a public-interest function; professional independence can justify significant regulatory safeguards; Spanish audit regulation must comply with EU law; and trustworthy financial disclosure is fundamental to investor and banking-market protection. Together, these principles make external auditor independence an essential component of sound banking governance in Spain.