Banking Law and Financial Messaging Standards Compliance in Spain

Introduction

Financial messaging standards are the technical and legal rules that enable banks, payment institutions, central banks and financial-market infrastructures to exchange payment and settlement information accurately and securely. In Spain, compliance has become increasingly important because Spanish institutions operate within the integrated payment infrastructure of the euro area.

Financial messaging covers payment instructions, account identifiers, transaction references, settlement information, confirmation messages and regulatory data. Standards such as ISO 20022 provide structured formats that allow financial institutions and infrastructures to exchange this information consistently.

Spain does not have one single statute called a “Financial Messaging Standards Law.” Instead, compliance results from a combination of Spanish banking and payment legislation, Banco de España technical requirements, EU payment law and Eurosystem infrastructure rules. TARGET-Banco de España, T2 and TIPS are particularly important parts of this framework. TARGET replaced TARGET2 on 20 March 2023 and provides services including liquidity management, real-time gross settlement and instant-payment settlement.

Legal and Regulatory Framework

The Spanish framework begins with Law 13/1994 on the Autonomy of the Banco de España and Law 41/1999 on payment and securities-settlement systems. These laws form part of the legal foundation for payment-system supervision and settlement infrastructure in Spain.

For payment services, Royal Decree-Law 19/2018 of 23 November implemented important elements of the EU Payment Services Directive framework in Spain. It is complemented by Royal Decree 736/2019, which regulates payment services and payment institutions.

Banco de España also identifies EU technical rules on strong customer authentication and common secure open standards of communication as part of Spain's applicable payment-services framework.

Consequently, messaging compliance cannot be separated from payment authorization, authentication, security and operational-resilience obligations.

ISO 20022 and Banking Messages

ISO 20022 provides a common methodology and structured vocabulary for financial messages. Instead of different institutions using incompatible descriptions of payment information, standardized messages allow data to be processed consistently by banks and financial infrastructures.

For Spanish banks, standardized messaging is particularly significant when interacting with Eurosystem infrastructures.

T2 is the Eurosystem's real-time gross settlement service. Participants can send and receive cash transfers that are settled in central-bank money. It handles, among other things, monetary-policy-related payments and interbank and commercial transactions.

Banco de España publishes detailed technical applications governing TARGET-Banco de España, including technical specifications for processing cash-transfer orders, liquidity flows and settlement orders. As of September 2026, Technical Application 5/2025 remains part of the applicable framework, while Technical Applications 3/2026, 5/2026 and 6/2026 are scheduled to enter into force on 14 November 2026.

Thus, messaging compliance is dynamic. Banks must monitor technical releases rather than treating compliance as a one-time exercise.

Instant Payments and TIPS

Messaging standards are equally important for instant payments.

TARGET Instant Payment Settlement (TIPS) allows instant-payment orders to be settled in central-bank money 24 hours a day, every day of the year. Banco de España's documentation includes detailed functional specifications, user requirements, handbooks, connectivity requirements and certification testing.

Instant payments leave little time for manual intervention. Consequently, message quality becomes particularly important. Incorrect account information, invalid formatting, duplicate instructions or incomplete transaction information can interfere with automated processing.

Banks therefore require validation systems capable of detecting errors before financial messages enter settlement infrastructure.

Secure Communication and Authentication

Financial messaging compliance involves more than formatting.

A message can technically follow the required syntax while still creating regulatory problems if the communication channel is insecure or authentication controls are inadequate.

EU rules applicable in Spain include regulatory technical standards concerning strong customer authentication and common and secure open standards of communication.

Banks must therefore consider:

authentication of payment instructions;

integrity of transmitted information;

confidentiality of customer information;

prevention of unauthorized alteration;

traceability of transactions;

operational continuity;

fraud detection; and

appropriate retention of transaction records.

These requirements connect financial messaging standards with broader banking-law duties concerning cybersecurity, payment authorization and customer protection.

Regulatory Reporting

Standardization is also important when information is sent to regulators rather than between banks.

Banco de España Circular 2/2022 establishes rules concerning payment statistics submitted by payment-service providers and payment-system operators. Banco de España's Technical Application 8/2023 further develops requirements for sending payment statistics.

Similarly, payment institutions have financial-reporting obligations under Banco de España Circular 5/2020, which establishes public and confidential financial statements and reporting models for payment institutions and electronic-money institutions.

Accurate standardized information therefore supports both payment processing and regulatory supervision.

Compliance Responsibilities of Spanish Banks

A Spanish bank should approach financial messaging compliance at several levels.

First, the institution must identify which messaging specifications apply to each infrastructure and transaction type.

Second, systems should validate mandatory message fields before transmission. Account identifiers, currencies, amounts, dates, references and other required data must be compatible with the relevant technical specification.

Third, the bank needs effective change-management procedures. When TARGET or another infrastructure changes technical specifications, internal payment systems must be updated and tested.

Fourth, banks should maintain cybersecurity and authentication controls around messaging systems.

Finally, audit trails should make it possible to reconstruct payment instructions and determine when messages were created, transmitted, modified, rejected or settled.

Relevant Case Laws

There is no substantial body of Spanish case law devoted specifically to the technical syntax of ISO 20022 messages. The most relevant judicial authorities therefore come mainly from the Court of Justice of the European Union (CJEU) and concern payment instructions, authentication, digital communications and information requirements. These decisions form part of the EU legal environment applicable in Spain.

1. BAWAG PSK Bank v Verein für Konsumenteninformation, Case C-375/15

This case concerned electronic banking communications and whether information transmitted through an online banking mailbox could satisfy the requirement that information be provided on a durable medium.

The CJEU distinguished between information that is actively provided to customers and information that is merely made available.

For financial messaging compliance, the case demonstrates that electronic transmission alone does not automatically satisfy legal communication requirements. The design of the communication mechanism matters.

2. Bundesverband der Verbraucherzentralen v Deutsche Kreditbank AG, Case C-602/19

This case also addressed electronic banking communications and payment-service information.

Its significance lies in the relationship between technological communication methods and mandatory customer-information requirements. Banks adopting automated digital messaging must ensure that required communications satisfy the legal characteristics demanded by payment law.

3. DenizBank AG v Verein für Konsumenteninformation, Case C-287/19

The CJEU examined payment-services rules in relation to contactless payment functionality.

The judgment is relevant because modern messaging standards operate within a wider legal structure governing payment instruments, authorization and liability. Technical automation cannot by itself determine whether a transaction is legally authorized.

4. ZG v Beobank SA, Case C-351/21

This case concerned the interpretation of EU payment-services rules relating to information supplied concerning payment transactions.

The dispute demonstrates the importance of transaction information being sufficiently meaningful for payment-service users. Standardized messages may facilitate processing, but customer-facing transaction information must still comply with substantive legal requirements.

5. Bundesverband der Verbraucherzentralen v Amazon EU, Case C-649/17

Although this was not specifically a banking-messaging case, the CJEU considered requirements concerning communication channels in consumer relationships.

Its broader relevance lies in the principle that digital communication methods must be assessed according to the applicable statutory requirements rather than according to technological convenience alone.

6. Content Services Ltd v Bundesarbeitskammer, Case C-49/11

The CJEU considered electronic information and the meaning of a durable medium in an online environment.

The judgment remains useful for financial institutions because regulated banking information increasingly travels through digital portals, applications and automated messaging systems.

7. Bank Melli Iran v Telekom Deutschland GmbH, Case C-124/20

Although primarily involving EU sanctions law rather than payment-message formatting, this CJEU judgment illustrates the broader compliance environment affecting financial transactions.

Banks cannot assess payment messages exclusively from a technical perspective. Transaction processing may also require sanctions, AML/CFT and other legal compliance controls before execution.

Relationship Between Message Standards and Liability

Messaging errors can potentially produce several categories of legal risk.

An incorrect message may cause a payment to be rejected, delayed or directed incorrectly. An authentication failure may raise questions concerning whether a transaction was authorized. Incomplete regulatory information can produce supervisory consequences.

Banks therefore need controls covering the complete message lifecycle:

creation → validation → authentication → transmission → processing → settlement → confirmation → record retention.

Automation does not eliminate legal responsibility. Instead, it changes where compliance controls must operate.

Operational Resilience

Financial messaging systems are critical banking infrastructure. A prolonged inability to transmit or receive messages could interrupt payments even where the bank itself remains financially solvent.

Banco de España therefore maintains TARGET technical rules covering contingency and business continuity alongside ordinary processing specifications. Its current regulatory materials include Technical Application 6/2025 concerning contingency and operational continuity.

Spanish institutions must also consider the wider EU operational-resilience framework, including DORA where applicable. Messaging platforms, network connections, external ICT providers and recovery systems therefore form part of financial institutions' operational-risk management.

Future Development

The direction of regulation is toward greater standardization, richer structured data and increased automation.

T2 documentation already includes the June 2026 release, while Banco de España has published further TARGET technical applications scheduled to take effect in November 2026.

For banks, this means compliance requires continuous technical governance. New message versions should be tested before deployment, legacy systems must be managed carefully, and regulatory and infrastructure changes must be incorporated into internal procedures.

Conclusion

Financial messaging standards compliance in Spain is governed by an interconnected framework of Spanish banking law, payment-services legislation, Banco de España technical requirements and Eurosystem rules.

ISO 20022 and related standardized messaging arrangements enable Spanish banks to communicate efficiently with modern European payment infrastructures. However, technical conformity is only one component of legal compliance. Banks must also address authentication, customer information, cybersecurity, transaction authorization, regulatory reporting, operational resilience and record keeping.

The relevant CJEU case law demonstrates that courts focus on the legal substance of electronic communications and payments rather than merely their technological form. A correctly formatted message therefore does not automatically establish legal compliance.

For Spanish banks, effective financial messaging compliance requires the integration of technical standards, payment law, security controls, consumer protection and regulatory governance throughout the entire payment process.