Banking Law and Global Systems Integration – Spain

Introduction

Global systems integration in banking refers to the connection of national banking institutions with international payment networks, financial-market infrastructures, regulatory systems, digital platforms, clearing and settlement arrangements, data networks and cross-border supervisory mechanisms.

For Spain, systems integration is particularly important because Spanish banks operate within the European Union, the euro area and the European Banking Union. A Spanish bank may simultaneously interact with the European Central Bank (ECB), Banco de España, payment infrastructures, securities settlement systems, foreign correspondent banks, international card networks, cloud providers and financial institutions operating in numerous jurisdictions.

There is no single Spanish statute called a "Global Systems Integration Banking Law." Instead, the legal framework consists of Spanish banking legislation combined with directly applicable EU regulations and other EU measures governing prudential supervision, payments, operational resilience, resolution, cybersecurity, data and financial-market infrastructure.

The central legal question is therefore how Spanish banks can participate in interconnected financial systems while maintaining regulatory compliance, financial stability, customer protection and operational resilience.

Legal and Regulatory Framework

The principal Spanish banking statute is Law 10/2014 of 26 June on the organisation, supervision and solvency of credit institutions.

It establishes fundamental rules concerning the authorisation, organisation and supervision of Spanish credit institutions.

Royal Decree 84/2015 further develops important aspects of Law 10/2014.

At EU level, Spanish banks operate under the Capital Requirements Regulation and related prudential rules. Significant Spanish banking groups are directly supervised by the ECB under the Single Supervisory Mechanism (SSM), while Banco de España performs important supervisory responsibilities within the integrated European framework.

Consequently, Spanish banking supervision itself represents an example of systems integration: national and European authorities operate within a coordinated supervisory structure.

European Banking Union

Spain's participation in the Banking Union is one of the clearest examples of international financial-system integration.

The Banking Union includes the Single Supervisory Mechanism and the Single Resolution Mechanism.

Under the SSM, the ECB directly supervises significant credit institutions while national competent authorities participate in supervision and retain responsibilities for other institutions and areas of banking law.

The Single Resolution Mechanism provides a coordinated European framework for dealing with failing banks.

This structure reduces the limitations of purely national supervision where banking groups operate across borders.

Payment-System Integration

Modern Spanish banking depends heavily upon integrated European payment infrastructure.

The euro area uses TARGET Services for central-bank money settlement and related functions. TARGET provides the infrastructure through which payments and securities-related cash transactions can be settled across participating European financial institutions.

Spanish banks also participate in the Single Euro Payments Area (SEPA).

SEPA enables standardised euro payments across participating European countries, reducing legal and technical differences between domestic and cross-border payments.

Payment integration therefore allows a customer in Spain to transfer euros to another participating jurisdiction through harmonised payment arrangements.

Securities Settlement Integration

Banking integration also involves securities markets.

Financial institutions participate in systems connecting trading, clearing, settlement and custody.

Spain's securities-market infrastructure operates within the wider European framework, including integration with European settlement mechanisms.

For banks providing custody, investment or collateral services, this means internal systems must communicate accurately with external financial-market infrastructures.

Failures in reconciliation or settlement can create legal, liquidity and operational risks.

Digital Systems Integration

Banks increasingly connect their internal infrastructure with external technology providers.

Cloud computing, application programming interfaces, payment processors, digital identity systems and cybersecurity providers can all become part of the banking ecosystem.

The Digital Operational Resilience Act (DORA) became applicable from 17 January 2025 and establishes harmonised EU requirements concerning ICT risk management, incident reporting, resilience testing and risks involving ICT third-party providers.

For Spanish banks, global systems integration therefore requires technological resilience as well as financial regulation.

A bank cannot outsource responsibility for regulatory compliance merely by outsourcing technological operations.

Third-Party Technology Risk

Modern banking institutions may depend upon a relatively small number of major technology providers.

This creates concentration risk.

For example, if several major European banks depend upon the same cloud infrastructure and that infrastructure experiences a serious disruption, the consequences could extend across the financial system.

DORA addresses this problem through requirements concerning contractual arrangements, ICT third-party risk and oversight of critical ICT providers.

Spanish banks therefore need detailed registers, risk assessments, contractual protections, monitoring arrangements and exit strategies concerning important technology providers.

Open Banking and API Integration

European payment regulation has encouraged greater technological integration between banks and authorised third-party providers.

Under the payment-services framework, customers may authorise regulated third parties to access certain payment-account services.

This has contributed to open banking.

From a legal perspective, API integration raises questions concerning authentication, cybersecurity, customer consent, liability and data protection.

Banks must ensure that technological openness does not compromise payment security.

Cross-Border Banking Groups

Large Spanish banking groups operate in multiple jurisdictions.

This creates complex integration requirements.

A banking group may need consolidated information concerning capital, liquidity, risk exposures and operational incidents while simultaneously complying with different national requirements.

Supervisory cooperation becomes particularly important where the parent institution is established in Spain but subsidiaries operate elsewhere.

Global systems integration therefore requires both technical compatibility and legal coordination.

Anti-Money-Laundering Integration

Cross-border payment systems can also create money-laundering and terrorist-financing risks.

Spain's principal AML legislation includes Law 10/2010 on the prevention of money laundering and terrorist financing.

Banks need systems capable of identifying customers, beneficial owners and suspicious transactions.

Where transactions move through correspondent banks or several jurisdictions, information can become fragmented.

Integrated compliance systems can therefore help institutions detect unusual patterns across accounts, products and geographical locations.

Data Protection

Systems integration often involves extensive data transfers.

Banks may exchange customer and transaction information with processors, payment institutions, cloud providers and other financial entities.

The General Data Protection Regulation (GDPR) and Spanish data-protection legislation therefore form an important part of global banking-system integration.

Banks need a lawful basis for processing personal information and must comply with requirements concerning security, transparency, purpose limitation and data-subject rights.

Cross-border transfers outside the European Economic Area can create additional legal requirements.

Bank Resolution as Systems Integration

The 2017 resolution of Banco Popular Español provides a major practical example of integrated European banking law.

The ECB determined that Banco Popular was failing or likely to fail. The Single Resolution Board adopted a resolution scheme, the European Commission endorsed the scheme, and the institution was transferred to Banco Santander following the write-down and conversion of relevant capital instruments.

The episode demonstrated how European and Spanish institutions can operate within a single resolution architecture.

It also generated extensive litigation concerning resolution powers, valuation, investor rights and judicial review.

Relevant Case Laws and Judicial Authorities

1. Banco Santander SA v Banco Popular Investors – Joined Cases C-775/22, C-779/22 and C-794/22

These Court of Justice proceedings arose from Banco Popular's resolution.

The cases concerned investor claims relating to capital instruments issued before the resolution and the effect of EU resolution rules upon those claims.

The judgments demonstrate the importance of uniform application of the Bank Recovery and Resolution Directive within an integrated European banking system.

2. García Fernández and Others v European Commission and Single Resolution Board – Case C-541/22 P

This case also arose from Banco Popular's resolution.

The Court considered legal questions surrounding the European resolution process, including the conditions and procedural structure governing resolution.

The litigation demonstrates how decisions affecting a Spanish bank can involve several EU institutions while remaining subject to judicial review by EU courts.

3. Banco Santander SA – Banco Popular Resolution III – Case C-687/23

This later Court of Justice proceeding concerned rights connected with actions initiated before Banco Popular's resolution.

The Court addressed the effect of the resolution framework on certain investor claims against the successor institution.

The case demonstrates the continuing interaction between national private-law proceedings and EU bank-resolution law.

4. Landeskreditbank Baden-Württemberg v European Central Bank – Case C-450/17 P

This important Court of Justice case concerned the allocation of supervisory responsibilities within the Single Supervisory Mechanism.

The judgment clarified the integrated nature of the SSM and the relationship between the ECB and national competent authorities.

Although the institution involved was German rather than Spanish, the ruling is directly relevant to Spain because the same SSM legal framework governs Spanish participating banks.

5. Berlusconi and Fininvest – Case C-219/17

The Court of Justice considered judicial review in a composite administrative procedure involving national authorities and the ECB.

The proceedings concerned the acquisition of a qualifying holding in a credit institution.

The case is particularly relevant to systems integration because it demonstrates how national authorities can participate in a regulatory process whose final decision belongs to an EU institution.

6. Rimšēvičs and ECB v Republic of Latvia – Joined Cases C-202/18 and C-238/18

The Court of Justice examined measures affecting the governor of Latvia's central bank.

Although the dispute did not involve Spain, the judgment is relevant to the integrated European central-banking structure in which Banco de España also participates.

It demonstrates that the European System of Central Banks creates legal relationships extending beyond purely national institutional arrangements.

7. ECB v Crédit Lyonnais – Case C-389/21 P

This case concerned prudential banking supervision and the treatment of particular exposures when calculating the leverage ratio.

The Court examined the ECB's supervisory reasoning and discretion.

For Spanish banks supervised within the SSM, the case illustrates the judicial standards applicable to ECB prudential decisions.

8. La Quadrature du Net and Others – Joined Cases C-511/18, C-512/18 and C-520/18

These cases concerned electronic communications data and EU privacy law.

Although not specifically banking cases, their principles are relevant to interconnected digital financial systems because banking integration increasingly depends upon electronic data processing and communications infrastructure.

The cases demonstrate that security objectives must operate within EU fundamental-rights and data-protection requirements.

Operational Resilience

A globally integrated banking system can transmit operational problems rapidly.

An outage at a payment processor, cyberattack against an important provider or failure of a data centre may affect several institutions simultaneously.

Operational resilience therefore requires banks to identify critical functions and establish recovery arrangements.

DORA has strengthened this area by requiring financial institutions to maintain structured ICT risk-management frameworks.

For Spanish banks, resilience is no longer solely an internal IT issue. It is a regulatory obligation connected to financial stability.

Interoperability and Legal Responsibility

Technical interoperability means different systems can exchange and process information.

Legal interoperability is equally important.

Two financial systems may technically communicate while operating under different rules concerning settlement finality, data protection, insolvency or liability.

Banks therefore need to understand both technical and legal consequences when connecting systems across jurisdictions.

Contracts with service providers should clearly allocate responsibilities for security, availability, data, incident reporting and termination.

Systemic Risk

Global integration creates efficiency but can also increase systemic risk.

A highly interconnected bank may transmit losses or operational disruption to counterparties.

Similarly, dependence upon common technology or payment infrastructure can create concentration vulnerabilities.

Banking regulation therefore uses capital requirements, liquidity standards, stress testing, recovery planning, resolution planning and operational-resilience requirements to reduce systemic risk.

The objective is not to prevent integration but to ensure that integration does not make the financial system excessively fragile.

Artificial Intelligence and Integrated Banking Systems

Artificial intelligence is increasingly incorporated into fraud detection, credit analysis, customer service, AML monitoring and risk management.

AI systems may receive information from numerous databases and external providers.

This creates additional governance questions concerning accuracy, explainability, data protection and human oversight.

For Spanish banks, the EU AI regulatory framework interacts with banking, consumer-protection, privacy and operational-resilience requirements.

An automated system therefore remains subject to the legal obligations applicable to the banking activity in which it is used.

Consumer Protection

Global systems integration should not reduce customer rights.

A customer may see a single banking application even though a transaction passes through several technological providers and financial infrastructures.

The complexity behind the interface should not make responsibility impossible to determine.

Banks and payment providers therefore need clear contractual arrangements, secure authentication procedures and appropriate complaint mechanisms.

EU consumer and payment-services legislation remains applicable even where services rely upon complex technological chains.

Future Development

Spain's banking system is likely to become increasingly integrated through instant payments, digital identity systems, cloud infrastructure, artificial intelligence, digital assets and further European financial-market integration.

At the same time, regulators are focusing increasingly on third-party dependencies, cybersecurity and operational resilience.

The legal challenge will therefore be to obtain the efficiency benefits of integration while maintaining institutional accountability.

Conclusion

Banking law and global systems integration in Spain describe the legal framework governing the connection of Spanish banks with European supervision, payment systems, securities infrastructures, international banking groups, digital platforms and technology providers.

Law 10/2014 provides Spain's principal domestic banking framework, while EU measures governing the Single Supervisory Mechanism, Single Resolution Mechanism, payments, prudential regulation, data protection and digital operational resilience provide much of the integrated regulatory structure.

Global integration creates major advantages, including faster payments, cross-border financial services, coordinated supervision and efficient settlement. However, it also creates cybersecurity, concentration, data, operational and systemic risks.

Cases including Banco Santander/Banco Popular, García Fernández, Landeskreditbank, Berlusconi and Fininvest, Rimšēvičs, ECB v Crédit Lyonnais and La Quadrature du Net illustrate different dimensions of this integrated framework.

Overall, Spanish banking law increasingly operates within a network rather than as an isolated national system. Effective regulation therefore depends on coordination among Spanish authorities, European institutions, financial-market infrastructures, banks and technology providers while preserving financial stability and customer protection.