Banking Law and Innovation Finance Ecosystems in Spain

1. Introduction

Innovation finance ecosystems in Spain refers to the network through which banks, fintech companies, technology businesses, investors, payment institutions, public authorities, research organizations, and financial regulators develop and finance new financial products and technologies.

From a banking-law perspective, the subject covers much more than fintech companies. It includes:

Banks + Fintech + Payment Services + Digital Finance + Venture Funding + Regulatory Sandboxes + Data + AI + DLT/Blockchain + Supervisors + Consumer Protection.

Spain has specifically encouraged financial innovation through Law 7/2020 of 13 November on the digital transformation of the financial system. The law establishes a controlled testing environment—the Spanish financial regulatory sandbox—for technology-based financial innovation. It seeks to encourage innovation while preserving consumer protection, financial stability and market integrity.

2. What Is an Innovation Finance Ecosystem?

An innovation finance ecosystem is not a particular legal entity. It describes the relationships among institutions participating in financial innovation.

For example:

Innovator → Fintech company → Bank → Investors → Technology provider → Customer

while simultaneously:

Banco de España / CNMV / other competent authorities → regulation and supervision.

Innovation may involve new:

• payment solutions;
• digital banking models;
• lending technologies;
• financial-data services;
• automated compliance systems;
• investment platforms;
• digital identification mechanisms;
• distributed-ledger applications;
• artificial-intelligence systems;
• cybersecurity technologies; and
• supervisory technologies.

Spanish legislation expressly recognizes that technological innovation can create new applications, processes, products and business models affecting financial markets, financial services and public financial functions.

3. Law 7/2020 and Spain's Financial Innovation Framework

The most directly relevant Spanish statute is Law 7/2020 on the Digital Transformation of the Financial System.

The legislation recognizes that digitization, increased computing capacity, internet connectivity, cheaper data storage and improved data processing have substantially transformed financial services.

It also identifies fintech, insurtech and regtech as examples of technological developments changing financial processes, customer relationships, business models and the structure of the financial sector.

The law pursues two objectives that sometimes pull in different directions.

First, Spain wants to facilitate financial innovation.

Second, innovation must not undermine:

consumer protection + financial stability + market integrity + financial-crime controls.

Thus, Spanish banking law does not approach innovation as an exemption from regulation. Instead, it tries to provide a controlled route through which innovative financial ideas can be tested and regulators can understand them.

4. The Spanish Regulatory Sandbox

The regulatory sandbox is one of the most important institutions within Spain's innovation-finance ecosystem.

Law 7/2020 establishes an “espacio controlado de pruebas”, or controlled testing environment.

It allows sufficiently advanced technology-based financial innovations to undergo controlled testing before they are introduced more broadly.

The sandbox has three particularly important characteristics:

1. it is a controlled environment;
2. it functions as a supervisory instrument; and
3. testing operates through the combination of the statute and an individual testing protocol. 

The sandbox therefore creates communication between innovators and regulators at an earlier stage than traditional authorization procedures.

5. Who Can Participate?

The framework is deliberately broader than traditional banks.

Projects may potentially originate from financial institutions, technology companies, research organizations and other eligible promoters.

The important issue is whether the proposed project involves sufficiently developed technology-based financial innovation capable of being tested.

Article 5 of Law 7/2020 requires qualifying projects to be sufficiently advanced and capable of producing relevant added value. Authorities also consider the project's potential impact on the Spanish financial system.

This permits innovation to originate outside the established banking sector.

Consequently:

traditional banking institution ≠ only source of banking innovation.

A technology startup can develop a financial technology that eventually becomes integrated into the services of regulated financial institutions.

6. Sandbox Participation Is Not a Banking Licence

A particularly important legal distinction must be made.

Admission to Spain's regulatory sandbox does not itself authorize a business to conduct a reserved financial activity permanently.

Article 4 of Law 7/2020 expressly separates controlled experimentation from ordinary authorization to provide regulated financial services.

In simplified form:

Sandbox admission → permission for controlled testing

but not:

Sandbox admission → permanent banking licence.

If a successful project subsequently requires regulated authorization for commercial operation, the promoter must comply with the relevant authorization framework.

This distinction protects competition and customers because experimental participation does not give a fintech business the regulatory status of a licensed bank.

7. Banks as Innovation Platforms

Banks occupy an important position in the Spanish innovation ecosystem because they already possess:

• customers;
• regulated infrastructure;
• capital;
• payment networks;
• customer data;
• compliance systems;
• risk-management expertise; and
• regulatory relationships.

Fintech businesses may instead contribute specialized technology, rapid development and new business models.

This can produce collaboration such as:

Fintech technology + bank infrastructure + regulatory supervision = new financial service.

But collaboration also creates legal questions concerning responsibility.

If a bank uses technology supplied by another company, the bank cannot necessarily treat all regulatory responsibilities as having transferred to the technology provider.

Governance, outsourcing, cybersecurity, operational resilience and customer-protection requirements remain relevant.

8. Open Banking and Payment Innovation

Another major part of the innovation ecosystem is open banking.

European payment-services legislation created legal foundations for regulated third-party providers to provide services involving customer payment accounts, subject to applicable requirements.

This has supported new models involving:

• payment initiation;
• account-information aggregation;
• financial-management applications;
• digital payments; and
• bank-fintech integration.

The economic importance is substantial.

Historically:

Bank → customer

was the dominant relationship.

Digital financial ecosystems increasingly involve:

Bank → regulated interface → third-party provider → application → customer.

Banking law therefore has to determine authentication, authorization, information access, responsibility and customer protection across multiple participants.

9. Data as an Innovation Asset

Data has become a major resource within financial innovation.

Banks and fintech businesses may use data for:

credit assessment → fraud detection → personalization → risk analysis → customer verification → compliance monitoring.

However, financial data cannot simply be treated as an unrestricted commercial resource.

Its processing may engage:

• GDPR requirements;
• Spanish data-protection legislation;
• banking confidentiality;
• payment-services rules;
• cybersecurity obligations;
• consumer law; and
• emerging European digital regulation.

This produces a fundamental legal tension:

Data enables innovation, but law restricts how that data may be collected, accessed, processed, transferred and retained.

10. Artificial Intelligence and Automated Finance

AI is becoming another important component of financial ecosystems.

Potential banking applications include:

• credit-risk assessment;
• fraud detection;
• AML monitoring;
• customer assistance;
• document analysis;
• transaction monitoring;
• investment-related technologies; and
• regulatory compliance.

From a legal perspective, however, efficiency is not enough.

Banks must consider whether automated systems comply with applicable requirements concerning data protection, transparency, governance, risk management, discrimination, cybersecurity and consumer protection.

The European AI Act adds another regulatory layer where financial-sector AI falls within its scope.

Innovation finance in Spain must therefore increasingly be understood as an intersection of banking law and technology regulation.

11. DLT, Blockchain and Tokenisation

Distributed-ledger technology can also form part of Spain's innovation ecosystem.

Potential applications include digital securities, transaction records, settlement infrastructure, tokenisation and automated contractual processes.

But using blockchain does not remove financial regulation.

The correct legal analysis normally begins with the economic function of the product.

For example:

What does the token represent?

Who issues it?

What rights does the holder receive?

Does it constitute a regulated financial instrument or crypto-asset?

Who provides custody or trading services?

Which authorization regime applies?

Consequently, innovative terminology does not automatically change the underlying legal character of a financial activity.

12. Consumer Protection Within the Ecosystem

Law 7/2020 makes clear that technological transformation should not reduce protection for financial-services users.

This principle is essential.

Innovation can increase:

speed + convenience + competition + accessibility

while simultaneously creating:

cybersecurity + privacy + fraud + operational + information-asymmetry risks.

Spanish and EU banking law therefore attempt to preserve customer protections while allowing technological experimentation.

The sandbox itself reflects this balance: experimentation is permitted, but within a controlled environment in which risks are mitigated and safeguards are established.

13. Financial Stability and Innovation

Innovation can improve financial stability by making processes more efficient and improving risk detection.

But it can also introduce new systemic risks.

For example, imagine that many Spanish banks depend on the same technology platform.

Initially, outsourcing may improve efficiency.

However:

Bank A → Cloud Provider X

Bank B → Cloud Provider X

Bank C → Cloud Provider X

Bank D → Cloud Provider X

A serious failure at Provider X could simultaneously disrupt several financial institutions.

Innovation regulation therefore increasingly examines concentration risk, third-party risk and operational resilience, not merely the safety of individual institutions.

14. Role of Spanish Financial Authorities

Financial innovation can involve different regulatory areas, so Spain's institutional framework necessarily involves cooperation among authorities.

Law 7/2020 specifically preserves existing allocations of regulatory competence while requiring cooperation in achieving the law's objectives. It also established a coordination structure connected with the development and monitoring of financial transformation.

Depending on the project, authorities may include the Banco de España, securities-market authorities and insurance/pension supervisors.

The regulatory sandbox therefore functions partly as a regulatory learning mechanism.

The innovator learns what regulation requires.

At the same time, the regulator learns how new technology operates and what risks or regulatory gaps it may create.

15. Relevant Case Laws

There is no single category in Spanish jurisprudence called “innovation finance ecosystem cases.” The legal principles come from banking, payments, fintech, electronic contracting, data, consumer and EU financial-services jurisprudence.

The following cases provide important principles for understanding the ecosystem.

Case 1 — CJEU, DenizBank AG v Verein für Konsumenteninformation, C-287/19

This case concerned innovative contactless payment functionality.

The Court examined how payment-services rules applied to contactless transactions and relevant payment instruments.

Importance

It demonstrates a central principle of fintech law:

technological innovation does not remove statutory consumer protections.

When banks introduce faster or less friction-heavy payment technologies, the applicable payment-services framework continues to determine matters such as authentication and risk allocation.

Case 2 — CJEU, Bundesverband der Verbraucherzentralen v Deutsche Kreditbank AG, C-602/15

The case involved information communicated through an electronic banking mailbox.

The Court considered when information delivered through online banking can satisfy the legal concept of information being provided on a durable medium.

Importance

The judgment demonstrates that software architecture can have legal consequences.

A bank cannot simply say:

“The information was available digitally.”

The method by which information is delivered, retained and accessed can determine whether regulatory requirements have been satisfied.

Innovation must therefore be legally compliant by design.

Case 3 — CJEU, BAWAG PSK, C-375/15

This judgment also dealt with electronic communication between payment-service providers and users.

The Court considered the distinction between information being actively provided to the user and information merely being made accessible through electronic banking.

Importance

The case demonstrates that digital banking interfaces are not simply technological products.

They are also mechanisms through which banks perform statutory information obligations.

Consequently:

UX design + banking regulation + consumer law can directly intersect.

Case 4 — CJEU, Content Services Ltd v Bundesarbeitskammer, C-49/11

Although arising from electronic consumer contracting rather than banking innovation specifically, this case is influential in determining what constitutes a durable medium in digital transactions.

Importance

Fintech ecosystems rely heavily on electronic contracts, disclosures, confirmations and records.

The judgment reinforces the broader proposition that digitization does not eliminate formal consumer-information requirements.

Electronic systems must be designed so legally required information can be appropriately provided and preserved.

16. Case 5 — CJEU, Verein für Konsumenteninformation v Amazon EU, C-191/15

This case concerned online contracting, applicable law and data-protection questions in cross-border digital commerce.

Although not a banking case in the narrow sense, its principles are highly relevant to fintech ecosystems operating across borders.

Importance

Digital businesses can reach customers in multiple jurisdictions without establishing traditional physical distribution networks.

Financial innovation therefore raises important questions concerning:

applicable law + consumer jurisdiction + data regulation + cross-border services.

The case illustrates why digital finance cannot be regulated solely according to where a technology company's servers or headquarters happen to be located.

17. Case 6 — CJEU, Wirtschaftsakademie Schleswig-Holstein, C-210/16

This important data-protection judgment concerned responsibility for processing personal information in a digital ecosystem involving more than one participant.

Importance

Its broader significance for financial innovation lies in the concept of shared data responsibility.

Modern fintech arrangements may involve:

Bank → fintech → cloud provider → analytics provider → customer interface.

Determining responsibility cannot always be solved by identifying only the company that physically stores the information.

Financial institutions must understand the roles performed by participants throughout the data-processing ecosystem.

18. Case 7 — CJEU, Fashion ID, C-40/17

Fashion ID similarly addressed responsibility within interconnected digital data-processing arrangements.

The Court considered circumstances in which an organization could bear responsibility concerning collection and transmission of personal information even though it did not control every later stage of processing.

Innovation-finance importance

Fintech services frequently combine APIs, analytics systems, external providers and banking platforms.

The case supports the broader proposition that:

technological interconnection can produce interconnected legal responsibility.

A financial business therefore needs to understand data flows across its entire technological architecture.

19. Case 8 — CJEU, SCHUFA Holding, C-634/21

This judgment is especially relevant to automated financial decision-making.

The dispute involved credit scoring and the relationship between scoring systems and automated decisions under European data-protection law.

The Court examined circumstances in which automated establishment of a probability value can fall within GDPR rules governing automated individual decision-making when third parties give that score a determining role.

Importance for Spanish financial innovation

This principle is highly relevant to:

• AI credit scoring;
• automated lending;
• risk profiling;
• fintech underwriting; and
• algorithmic financial decision-making.

It demonstrates that financial institutions cannot avoid automated-decision protections merely because an algorithm formally produces a “score” rather than the final contractual decision.

20. Case 9 — CJEU, OQ v Land Hessen, C-26/22 and C-64/22

These proceedings also concerned credit-information systems and GDPR requirements.

They addressed important issues relating to credit information, data retention and automated credit assessment.

Importance

Credit information is fundamental to innovation finance.

Fintech lenders may attempt to improve lending decisions through increasingly sophisticated data analysis.

However:

better prediction does not automatically justify unlimited collection or retention of personal information.

Credit innovation remains constrained by data-protection principles.

21. What the Case Law Shows

Taken together, these authorities reveal several important principles.

Principle 1 — Technology neutrality

A financial obligation does not disappear merely because the service moves from paper to an app.

Principle 2 — Consumer protection follows the financial function

Innovative payment technologies remain subject to applicable payment and consumer rules.

Principle 3 — Digital architecture has legal consequences

How information is displayed, communicated, retained and accessed can determine regulatory compliance.

Principle 4 — Data responsibility can extend across ecosystems

Using another technology provider does not necessarily remove the regulated firm's responsibilities.

Principle 5 — Algorithms remain legally accountable

Automated credit and risk decisions can trigger significant data-protection requirements.

Principle 6 — Innovation and regulation develop together

Spain's regulatory sandbox institutionalizes this relationship by allowing controlled testing and regulatory observation.

22. Funding the Innovation Ecosystem

Financial innovation also requires capital.

Funding may potentially come from:

Founders → venture capital → private equity → banks → public programs → institutional investors → capital markets.

Different financing methods create different legal relationships.

A bank loan produces a creditor-debtor relationship.

Equity investment gives investors ownership interests.

Venture-capital investment may involve governance and shareholder rights.

Capital-market financing may trigger securities regulation.

Token-based financing can potentially trigger crypto-asset or financial-instrument regulation depending on its legal characteristics.

Therefore, the term “innovation finance” concerns both innovation within finance and financing for innovative enterprises.

23. Regulatory Sandbox as an Ecosystem Connector

The Spanish sandbox can be represented as:

Innovator

↓

Technology-based financial project

↓

Application to controlled testing environment

↓

Regulatory assessment

↓

Testing protocol and safeguards

↓

Supervised testing

↓

Results and regulatory learning

↓

Exit from sandbox

↓

Authorization/commercial development where applicable

The important point is that sandbox participation does not itself grant permanent authorization for regulated financial activities.

24. Key Risks in Innovation Finance

Spanish regulators must balance innovation against several risks.

Consumer risk: customers may not understand complex digital products.

Cyber risk: interconnected financial platforms can create additional attack surfaces.

Data risk: increasingly intensive data processing can interfere with privacy rights.

Algorithmic risk: automated systems may generate inaccurate or unlawfully discriminatory outcomes.

Operational risk: software or infrastructure failures can interrupt financial services.

Third-party risk: banks can become dependent on external technology providers.

Concentration risk: many institutions may depend on the same infrastructure provider.

Financial-stability risk: innovation may create interconnected exposures that are not immediately obvious.

Regulatory-arbitrage risk: businesses may attempt to characterize regulated financial activities as technology services.

These risks explain why Law 7/2020 describes the sandbox as a controlled environment rather than a regulation-free environment.

25. Practical Example

Suppose a Spanish fintech develops an AI system capable of assessing small-business credit applications rapidly.

The legal ecosystem could involve:

Fintech developer — creates the algorithm.

Bank — provides regulated lending.

Cloud provider — hosts the system.

Data providers — supply information used for risk assessment.

Customer — applies for financing.

Supervisory authorities — oversee regulated activities.

Potential legal questions include:

Banking law: Who actually provides the credit?

Data protection: What customer information can be processed?

AI regulation: What obligations apply to the automated system?

Consumer law: What information must applicants receive?

Outsourcing: What responsibilities remain with the bank?

Cybersecurity: How is financial information protected?

Operational resilience: What happens if the technology becomes unavailable?

Discrimination: Could the model unlawfully disadvantage particular applicants?

This example demonstrates why innovation finance is an ecosystem issue rather than merely a fintech issue.

26. Relationship with Traditional Banking Law

Innovation does not replace conventional banking regulation.

Instead:

Traditional banking regulation

+ payment law

+ fintech regulation

+ data protection

+ cybersecurity

+ AI regulation

+ operational resilience

+ consumer protection

= modern innovation-finance regulation.

Traditional concerns—capital, liquidity, governance and customer protection—remain relevant even when financial services are delivered through sophisticated technology.

27. The Fundamental Regulatory Balance

Spain's approach can ultimately be represented as:

Innovation side

Competition → efficiency → financial inclusion → new products → investment → technological development

versus

Protection side

Consumer protection → privacy → cybersecurity → market integrity → prudential stability → operational resilience.

Law 7/2020 expressly reflects this balance. Its framework seeks greater efficiency and quality in financial services while improving security and protection against risks created by technological transformation.

28. Conclusion

Banking Law and Innovation Finance Ecosystems in Spain concerns the legal architecture connecting banks, fintech companies, technology providers, investors, customers and financial supervisors.

A central Spanish statute is Law 7/2020 on the Digital Transformation of the Financial System. It created a controlled regulatory sandbox in which sufficiently advanced technology-based financial projects can be tested while preserving safeguards for consumers and the financial system. Crucially, participation in that sandbox is not equivalent to receiving permanent authorization to conduct regulated financial business.

The wider framework incorporates EU rules governing payments, data protection, digital operational resilience, AI, crypto-assets and other areas of financial regulation.

At least six particularly useful judicial authorities are DenizBank (C-287/19), Deutsche Kreditbank (C-602/15), BAWAG (C-375/15), Content Services (C-49/11), Amazon EU (C-191/15), Wirtschaftsakademie (C-210/16), Fashion ID (C-40/17), and SCHUFA (C-634/21). These cases demonstrate that technological innovation remains subject to rules concerning payments, digital disclosures, consumer protection, data governance and automated decision-making.

The central principle is therefore:

Financial innovation is encouraged, but innovation does not create a regulation-free zone.

Spain's model seeks to create an ecosystem in which banks and technology companies can experiment and develop new financial services while regulators preserve customer protection, market integrity, operational resilience and financial stability.