Banking Law and External Audit Regulation in Spain

Introduction

External auditing is an important part of banking regulation in Spain because banks manage depositors’ money, operate with substantial financial risks, and can affect the stability of the wider financial system. An independent external audit provides assurance that a bank’s annual accounts have been prepared in accordance with the applicable accounting framework and that material misstatements are identified and properly reported.

Spanish banks are subject to both Spanish legislation and European Union rules. Credit institutions and specialised lending institutions are required to submit their accounts to external audit. In addition, banking entities are subject to prudential supervision by the Banco de España and, where applicable under the Single Supervisory Mechanism, the European Central Bank.

Legal and Regulatory Framework

The principal Spanish statute governing statutory audits is Law 22/2015 of 20 July on Auditing (Ley 22/2015 de Auditoría de Cuentas). It implements important elements of the EU statutory-audit framework and operates together with Regulation (EU) No 537/2014, which establishes additional requirements for statutory audits of public-interest entities. Credit institutions generally fall within the enhanced public-interest audit framework because of their systemic and public significance.

Banking supervision is principally governed by Law 10/2014 on the regulation, supervision and solvency of credit institutions, its implementing Royal Decree 84/2015, and relevant Banco de España circulars. Banco de España expressly identifies external auditing of annual accounts and financial statements as part of the supervisory framework applicable to banks.

Accounting and audit regulation are closely connected. Banco de España Circular 4/2017 establishes public and confidential financial-reporting rules for credit institutions and seeks consistency with EU-adopted International Financial Reporting Standards. External auditors therefore assess financial statements prepared within this specialised banking accounting environment.

Independence of External Auditors

Auditor independence is one of the central principles of Spanish audit regulation. Law 22/2015 establishes a general requirement that auditors remain independent from the audited entity. Where relationships, financial interests or services create unacceptable threats to objectivity, the auditor may be prohibited from undertaking or continuing the audit.

For banks and other public-interest entities, Regulation (EU) No 537/2014 adds stricter requirements concerning independence, prohibited non-audit services, audit-firm selection and rotation, and communications with the audit committee. Spanish law therefore combines general auditor-independence requirements with enhanced safeguards for systemically important entities.

Professional scepticism is equally important. Auditors cannot simply accept management representations. They must critically assess evidence concerning matters such as loan impairment, expected credit losses, asset valuation, provisions, going-concern assumptions and financial disclosures.

Audit Committees and Corporate Governance

Spanish credit institutions and specialised lending institutions are generally required to maintain an audit committee. The committee provides an important link between the board, internal control functions and the external auditor.

Its responsibilities include supervising financial reporting and internal-control effectiveness, participating in the selection and appointment of the external auditor, reviewing the audit plan and monitoring auditor independence. The committee must also consider threats to independence and information concerning additional services and fees received by the external auditor.

This structure helps prevent management from exercising excessive influence over the external audit process.

Communication With Banking Supervisors

External auditors of regulated financial institutions have responsibilities extending beyond the ordinary relationship between an auditor and a commercial company. Spanish audit legislation recognises circumstances in which auditors must communicate significant matters discovered during their work to financial supervisory authorities.

Historically, Spanish legislation specifically strengthened requirements for auditors of entities supervised by Banco de España and other financial regulators to communicate circumstances capable of materially affecting an institution's activities, continuity, stability or solvency, as well as serious problems affecting the audit opinion.

Consequently, external auditing functions as both a financial-reporting safeguard and an important component of prudential supervision.

Auditor Liability and Enforcement

Auditors can incur professional, administrative and, in sufficiently serious circumstances, civil or criminal consequences for misconduct. Liability may arise where an auditor negligently fails to identify material accounting irregularities, breaches independence requirements, performs inadequate audit procedures, or issues an audit opinion without sufficient appropriate evidence.

At the same time, an external audit is not a guarantee that a bank will remain solvent or commercially successful. Spanish Audit Law expressly distinguishes statutory auditing from a guarantee concerning the future viability of the audited entity or the effectiveness with which management conducts its activities.

Important Case Laws

1. Banco Español de Crédito (Banesto) Case

The Banesto litigation followed the intervention of Banco Español de Crédito by the Banco de España in 1993 after serious financial and accounting problems emerged. The proceedings generated extensive judicial consideration of directors, accounting information and responsibilities surrounding the bank's management.

Principle: Reliable financial statements, adequate controls and effective independent verification are essential in banking because inaccurate accounts may conceal risks capable of threatening depositors and financial stability.

2. Bankia IPO Litigation

The restructuring and stock-market flotation of Bankia generated major civil and criminal proceedings concerning the accuracy of financial information made available to investors.

In the civil litigation, Spanish courts recognised the significance of inaccurate or misleading financial information in investor decision-making. The disputes demonstrated that audited financial statements do not automatically prevent liability where the overall financial picture presented to investors is materially defective.

Principle: External auditing strengthens financial credibility, but an audit opinion does not eliminate the responsibility of the bank and its governing bodies for accurate financial reporting.

3. Supreme Court Bankia Investor Cases — 2016

In important judgments delivered in 2016, the Spanish Supreme Court addressed investors who had acquired Bankia shares during its public offering and alleged that the financial information provided did not reflect the institution's true economic position.

The Court permitted contractual remedies where the defective financial information had materially affected investor consent.

Principle: Financial statements and prospectus information concerning a bank can directly influence investment decisions, making accurate accounting and effective audit scrutiny particularly important.

4. Banco Popular Resolution Litigation

The 2017 resolution of Banco Popular Español generated extensive litigation before Spanish and EU courts concerning valuation, disclosure, supervisory action and the consequences of bank resolution.

Although these proceedings are broader than auditor-liability cases, they demonstrate the importance of reliable valuation and financial information when supervisors assess whether a credit institution is failing or likely to fail.

Principle: Audit information forms part of a larger prudential information system and may become particularly important when the financial condition of a bank deteriorates.

5. Deloitte–Bankia Audit Proceedings

Proceedings relating to Deloitte's audit work for Bankia became an important Spanish example of scrutiny of an external auditor following a major banking crisis. Questions concerned the auditing of financial statements surrounding Bankia's restructuring and market flotation.

The litigation illustrates an important distinction between management responsibility and auditor responsibility. Management prepares the financial statements; the auditor independently examines them and expresses an opinion based on sufficient appropriate evidence.

Principle: An auditor is not responsible for managing a bank but can face scrutiny where questions arise concerning independence, professional scepticism or the adequacy of audit procedures.

6. Ernst & Young–Banco Popular Audit Proceedings

The auditing of Banco Popular before its resolution also generated regulatory and legal scrutiny concerning whether financial information appropriately reflected the bank's financial position and risks.

These proceedings demonstrate the importance of properly examining loan portfolios, impairment, provisions and asset valuations in banking audits.

Principle: Banking auditors must give particular attention to areas involving substantial accounting estimates and management judgment because relatively small changes in assumptions can materially affect reported capital and profitability.

7. European Court Litigation Concerning Banco Popular

Proceedings before the General Court and Court of Justice of the European Union arising from Banco Popular's resolution considered the EU bank-resolution framework, institutional decision-making and valuation processes.

Although these cases did not primarily determine ordinary statutory-auditor negligence, they are relevant to understanding external audit regulation because reliable financial and valuation information is fundamental to supervisory and resolution decisions.

Principle: External auditing operates within the wider EU banking architecture involving supervision, financial reporting, valuation and resolution.

Relationship Between External Audit and Banking Supervision

External auditors and banking supervisors perform different functions. The auditor determines whether financial statements satisfy the applicable financial-reporting framework and whether they are materially misstated. Banco de España and the ECB, where applicable, supervise matters such as capital adequacy, liquidity, governance and prudential risk.

Spanish law nevertheless creates interaction between these functions. Law 10/2014 gives Banco de España important supervisory powers over credit institutions, while the audit framework requires external verification of financial information.

Therefore, external auditing should be understood as one layer of Spain's broader banking-control system rather than as a substitute for prudential supervision.

Conclusion

External audit regulation in Spanish banking combines Law 22/2015, Law 10/2014, Royal Decree 84/2015, Banco de España accounting and supervisory rules, and EU legislation including Regulation (EU) No 537/2014.

The framework requires independent auditing of bank financial information, imposes enhanced independence standards for public-interest entities, gives audit committees substantial oversight responsibilities and connects external auditors with financial supervisors where serious problems arise.

The Banesto, Bankia, Banco Popular and related auditor proceedings demonstrate why this framework matters. Banking audits concern much more than technical accounting compliance: reliable audited information supports depositor protection, investor confidence, supervisory decision-making and financial stability. At the same time, Spanish law makes clear that an audit is an independent assurance mechanism—not a guarantee that a bank will never experience financial distress.