Banking Law and Inspection Procedures in Spain

1. Introduction

Banking inspection is a central part of Spain’s prudential supervisory system. Its purpose is not merely to identify misconduct after it occurs. Inspection is also preventive: supervisors examine whether banks have sufficient capital and liquidity, effective governance, reliable internal controls, appropriate risk-management systems and adequate procedures for complying with banking regulation.

The principal Spanish legislation is Law 10/2014 of 26 June on the regulation, supervision and solvency of credit institutions (Ley 10/2014). It gives the Banco de España important supervisory and investigative powers. Since November 2014, however, Spanish banking supervision also operates within the EU Single Supervisory Mechanism (SSM) headed by the European Central Bank (ECB). Significant institutions are primarily supervised by the ECB, working with national authorities, while the Banco de España has an important role regarding less significant institutions and performs functions allocated to it under Spanish and EU law.

Accordingly, banking inspection in Spain must be understood as a combination of Spanish administrative law and the EU banking-supervision framework.

2. Legal Framework

The principal sources governing banking supervision and inspection include:

Law 10/2014;

Royal Decree 84/2015;

Banco de España Circular 2/2016;

Regulation (EU) No 1024/2013 establishing the SSM;

Regulation (EU) No 468/2014, the SSM Framework Regulation;

Regulation (EU) No 575/2013 on prudential requirements; and

applicable ECB and European Banking Authority supervisory rules and guidance.

Banco de España identifies Law 10/2014, Royal Decree 84/2015 and Circular 2/2016 among the core components of the Spanish prudential framework.

3. Supervisory Authority of the Banco de España

Article 50 of Law 10/2014 establishes the supervisory function of the Banco de España.

The Banco de España is responsible, within the allocation of powers established by EU law, for supervising compliance with banking regulation by institutions falling within its supervisory jurisdiction.

Its supervisory powers include obtaining information from regulated institutions and relevant outsourced service providers.

Banks can be required to make available:

books;

records;

documents;

computer programs;

electronic files;

databases; and

other information necessary for supervision.

The Banco de España may also require documents, examine books and records, obtain copies or extracts, obtain written or oral explanations and conduct inspections at relevant business premises.

These are broad powers because modern banking supervision requires access not merely to accounting records but also to electronic systems and risk-management information.

4. Scope of Supervision

Article 56 of Law 10/2014 defines the Banco de España's supervisory scope, subject to the ECB's powers under the SSM.

Its responsibilities include supervision of Spanish credit institutions within the applicable allocation of competence, consolidated banking groups with Spanish parents and branches of credit institutions from non-EU states.

There are also specific arrangements concerning EU branches and cross-border supervision.

Supervision can therefore extend beyond the individual legal entity constituting the bank.

This is important because banking risks may originate in subsidiaries, parent companies or other members of a financial group.

5. Continuous Supervision

Inspection should not be understood as an isolated visit by regulators.

Spain's supervisory model involves continuing assessment.

Banco de España describes the supervisory system as combining:

prudential regulation;

continuous supervision and periodic information;

on-site inspections;

corrective measures; and

disciplinary and sanctioning mechanisms.

Consequently, an on-site inspection normally forms part of a much broader supervisory relationship.

6. Annual Supervisory Programme

Article 55 of Law 10/2014 requires the Banco de España, within its competence, to approve a supervisory programme at least annually.

Particular attention may be given to institutions where stress tests or the supervisory review process reveal significant risks to financial soundness or possible non-compliance with solvency requirements, as well as institutions requiring special supervisory consideration.

This illustrates the risk-based nature of banking supervision.

Supervisory resources can be concentrated where the potential threat to an institution or financial stability is greater.

7. Off-Site Supervision

Before an inspector physically enters a bank's premises, regulators may already possess substantial information concerning that institution.

Off-site supervision can involve analysis of:

regulatory returns;

capital ratios;

liquidity;

profitability;

asset quality;

credit concentration;

governance information;

internal controls;

risk reports; and

other prudential data.

Unusual developments identified through continuing supervision can lead to more intensive investigation.

Thus, off-site analysis and on-site inspection are complementary rather than competing mechanisms.

8. On-Site Inspections

Banco de España describes on-site supervision as an essential complement to off-site supervision.

An on-site mission provides an intensive examination of particular aspects of an institution.

For a significant institution, the inspection team is generally appointed within the ECB framework. For a less significant institution under national direct supervision, the Banco de España normally has the relevant inspection role.

A Head of Mission leads the inspection team.

Part of the investigation will usually occur at the bank's premises.

9. Subjects Examined During an Inspection

Depending upon the scope of the mission, inspectors may investigate areas such as:

Credit Risk

Inspectors may examine lending standards, borrower assessment, collateral, provisioning and concentrations.

Market Risk

They may investigate risks resulting from movements in interest rates, securities or other market variables.

Liquidity Risk

The bank's ability to satisfy payment obligations under normal and stressed conditions may be assessed.

Operational Risk

Supervisors can examine failures arising from processes, employees, technology or external events.

Governance

Board oversight, management responsibilities and internal decision-making can be reviewed.

Internal Controls

Inspectors may assess compliance, risk-management and internal-audit arrangements.

Capital

Supervisors may examine whether the institution has sufficient own funds for its risk profile.

The scope therefore depends on the objective specified for the particular inspection.

10. Internal Model Investigations

On-site supervision also includes internal model investigations.

Large banks sometimes use internal models to calculate regulatory capital requirements for particular risks.

Supervisors must determine whether those models satisfy regulatory requirements.

Banco de España distinguishes inspections from internal-model investigations: inspections conduct an in-depth examination of relevant risks, while internal-model investigations examine and, where appropriate, support decisions concerning the use of internal models for regulatory capital calculations.

This area is particularly important because an unreliable model can materially underestimate a bank's risk exposure.

11. Documentary Powers

Article 50 of Law 10/2014 gives the Banco de España significant investigatory powers.

It can require the production of documents and examine books and records.

The authority can also obtain copies or extracts.

These powers are important because effective banking supervision depends upon verifiable evidence.

A bank cannot normally avoid supervision simply by storing information electronically rather than on paper.

The statutory framework expressly extends access to computer programs, files and databases where required for supervisory purposes.

12. Interviews and Explanations

Supervision can also require explanations from relevant persons.

Article 50 permits the Banco de España, within its statutory powers, to request and obtain written or oral explanations necessary for an investigation.

This allows inspectors to understand why particular decisions were made rather than relying exclusively upon formal documents.

For example, supervisors examining a major credit exposure may want to understand:

who approved it;

what risk analysis was performed;

whether exceptions were granted;

why internal warnings were overridden; and

how the exposure was subsequently monitored.

13. Inspection of Outsourced Activities

Modern banks outsource substantial technological and operational activities.

Article 50 is important because the information-gathering framework also addresses third parties to whom supervised institutions have outsourced operational activities or functions.

This prevents outsourcing from becoming an easy mechanism for avoiding regulatory scrutiny.

A bank cannot ordinarily escape supervisory accountability simply by transferring a function to an external service provider.

14. Findings Following Inspection

An inspection may identify deficiencies known as findings.

Banco de España explains that inspection findings are classified according to their importance or severity.

Those findings then inform appropriate supervisory actions.

A finding does not automatically mean that the most severe sanction will follow.

The supervisory response should reflect matters such as the seriousness of the deficiency and the measures necessary to correct it.

15. Corrective Supervisory Measures

Where inspectors identify weaknesses, authorities may require corrective action.

Depending on the circumstances and applicable legal provisions, measures can concern matters such as:

additional capital;

improvements to governance;

strengthening internal controls;

remediation of risk-management weaknesses;

restrictions on certain activities;

changes to provisioning;

restrictions concerning distributions; or

other measures designed to restore regulatory compliance.

Law 10/2014 provides the Banco de España with significant intervention powers where prudential requirements are not satisfied.

16. Inspection and Sanctions Are Different

It is important to distinguish inspection from sanctioning.

An inspection is primarily an investigative and supervisory process.

Inspectors collect information, analyse risks and identify possible weaknesses.

A sanction, by contrast, is a formal legal consequence for an infringement and must comply with the applicable procedural safeguards.

Therefore:

Inspection → findings → supervisory assessment → possible corrective measures → possible sanctioning proceedings

is a useful conceptual sequence, although an actual case may follow a more complicated route.

17. Supervisory Proportionality

Supervisory measures should take account of the circumstances of the institution and the seriousness of identified deficiencies.

Article 50 expressly requires consideration of factors including the seriousness of detected facts, effective correction of deficiencies and the institution's previous behaviour when supervisory measures are selected.

This supports a risk-based and proportionate approach.

A minor technical weakness is therefore not necessarily treated in the same way as a major capital deficiency threatening depositors or financial stability.

18. The Single Supervisory Mechanism

A major change occurred on 4 November 2014, when European banking supervision began operating through the SSM.

The ECB leads the SSM, while national competent authorities—including the Banco de España—participate in the system.

The distinction between significant institutions (SIs) and less significant institutions (LSIs) is particularly important.

The ECB directly supervises significant institutions.

National authorities generally directly supervise less significant institutions, subject to the ECB's oversight and its powers under the SSM framework.

19. Joint Supervisory Teams

Significant banks are subject to continuous supervision through Joint Supervisory Teams (JSTs).

These teams contain personnel from the ECB and relevant national supervisory authorities.

They continuously assess matters such as:

risk profile;

capital adequacy;

liquidity;

governance; and

prudential compliance.

The assessment forms part of the Supervisory Review and Evaluation Process (SREP).

This means Spanish supervisors work within a genuinely European supervisory structure for major banks.

20. Inspections of EU Bank Branches

Article 59 of Law 10/2014 contains specific rules concerning branches of credit institutions authorised in another EU Member State.

The Banco de España may conduct checks and on-site inspections concerning their activities in Spain within the applicable statutory framework.

Before carrying out those checks or inspections, it must consult the competent authority of the institution's home Member State. Relevant information obtained from the inspection is subsequently communicated to that authority.

This reflects the principle of supervisory cooperation within the EU banking market.

21. Confidentiality

Banking inspectors inevitably obtain highly sensitive information.

They may see customer information, internal risk assessments, business strategies and confidential financial information.

Supervisory confidentiality is therefore an important component of banking law.

The existence of broad investigatory powers does not mean information obtained through supervision becomes publicly available without restriction.

Professional secrecy requirements protect the proper operation of the supervisory system.

22. Supervisory Technical Guidelines

Article 54 of Law 10/2014 permits Banco de España to publish technical supervisory guidelines.

These can describe criteria, practices, methodologies and procedures considered appropriate for compliance with supervisory requirements.

They can also explain criteria that Banco de España itself intends to apply in its supervisory work.

Such guidance improves predictability by helping institutions understand supervisory expectations before an inspection occurs.

Important Case Law

Direct Spanish reported judgments dealing solely with the mechanics of bank inspection are relatively limited. Because Spain participates in the SSM, EU judicial decisions concerning ECB banking supervision are particularly relevant. The following cases should therefore be understood according to their actual subject matter rather than incorrectly described as six Spanish inspection judgments.

23. Case 1 — PNB Banka AS v European Central Bank, T-275/19

This is one of the most directly relevant cases concerning banking inspections.

The ECB decided to conduct an on-site inspection at the premises of PNB Banka, a less significant Latvian credit institution.

The bank challenged that decision before the General Court.

The litigation addressed:

ECB investigatory powers;

on-site inspections;

competence;

judicial review;

the requirement to state reasons; and

the circumstances capable of justifying an inspection.

The General Court delivered judgment on 7 December 2022.

Importance for Spain

The judgment is particularly relevant because Spanish banks also operate within the SSM.

It confirms that an inspection decision constitutes an exercise of legally regulated supervisory power and can therefore raise questions of competence, justification and judicial protection.

24. Case 2 — Landeskreditbank Baden-Württemberg v ECB, T-122/15 and C-450/17 P

This major SSM case concerned the division of supervisory responsibility between the ECB and national authorities.

Landeskreditbank argued that it should be treated as less significant and consequently remain primarily under national direct supervision.

The litigation clarified important aspects of the ECB's role within the SSM.

Importance for Spanish inspections

Before considering the legality of an inspection, it may be necessary to determine which supervisory authority has jurisdiction.

For Spanish banks, that may involve the ECB, Banco de España or cooperation between them depending upon the institution and the particular supervisory power.

25. Case 3 — Crédit Mutuel Arkéa v ECB, T-712/15 and T-52/16

These proceedings concerned ECB prudential-supervision decisions involving the structure of the Crédit Mutuel group.

The General Court examined important questions concerning consolidated supervision and the ECB's supervisory powers.

Spanish relevance

Banking inspection is not necessarily limited to examining one corporate entity in isolation.

Where institutions form part of banking groups, supervisors may need to examine risks on a consolidated basis.

This principle is reflected in Spain's Law 10/2014, which expressly regulates consolidated supervision.

26. Case 4 — Berlusconi and Fininvest, C-219/17

This CJEU judgment concerned the acquisition of a qualifying holding in an Italian bank and the interaction between national authorities and the ECB.

The case clarified the nature of composite administrative procedures within the SSM.

Inspection relevance

Banking supervision sometimes involves a procedure in which national authorities investigate and prepare information while the ECB ultimately adopts the final decision.

The case is therefore important for understanding how national and EU supervisory procedures interact.

For Spain, the principle is relevant whenever Banco de España and the ECB participate in different stages of a common supervisory process.

27. Case 5 — Trasta Komercbanka and Others v ECB, C-663/17 P, C-665/17 P and C-669/17 P

These proceedings arose from the withdrawal of a credit institution's banking authorisation.

The litigation addressed questions of standing and judicial protection against ECB supervisory decisions.

Importance

Supervisory action can have extremely serious consequences for a financial institution.

Effective judicial review is therefore an important safeguard within the European supervisory system.

Inspection findings may ultimately contribute to more significant supervisory measures, making procedural legality and access to judicial review particularly important.

28. Case 6 — ECB v Espírito Santo Financial (Portugal), C-396/22

This litigation concerned access to documents relating to banking supervision and the confidentiality attaching to supervisory information.

Importance for inspections

Supervisors obtain commercially sensitive and confidential information during inspections.

The effectiveness of banking supervision partly depends upon institutions providing regulators with extensive information.

Confidentiality rules therefore perform an important function by restricting inappropriate disclosure of supervisory material.

This principle is directly relevant to Spanish institutions operating under the SSM.

29. Case 7 — Baumeister, C-15/16

The CJEU examined the concept of confidential information held by financial supervisory authorities.

Although the dispute arose in the context of financial-market supervision rather than an ordinary Spanish bank inspection, the judgment provides important guidance concerning professional secrecy and supervisory confidentiality.

Banking relevance

Inspection files may contain:

business secrets;

internal assessments;

risk information;

customer information; and

regulatory analysis.

The case demonstrates why demands for transparency must sometimes be balanced against the confidentiality necessary for effective financial supervision.

30. Case 8 — Activa Minoristas del Popular v ECB and SRB, T-618/17

This proceeding arose following the resolution of Banco Popular Español, one of the most important Spanish banking episodes under the post-2014 European framework.

An investor association sought annulment of measures connected with Banco Popular's resolution.

The General Court declared the particular action manifestly inadmissible because the applicant association lacked the required direct concern.

Importance for inspection law

The case should not be characterised as an ordinary inspection judgment.

Its relevance lies instead in demonstrating how prudential supervision, bank resolution and judicial review can intersect when the financial condition of a Spanish bank deteriorates severely.

It also illustrates the procedural requirements that must be satisfied before EU supervisory or resolution measures can be challenged judicially.

31. Procedural Rights of Banks

Extensive inspection powers do not mean that supervised institutions have no procedural rights.

Depending on the nature and stage of proceedings, important principles can include:

legal certainty;

proportionality;

proper exercise of statutory powers;

adequate statement of reasons;

rights of defence;

confidentiality;

access to judicial review; and

compliance with EU and Spanish administrative law.

The precise safeguards available depend upon whether the authority is conducting ordinary supervision, adopting a binding supervisory decision or commencing sanctioning proceedings.

32. Inspection Versus Search in Criminal Proceedings

A prudential banking inspection should also be distinguished from a criminal search.

A supervisor enters or examines business premises under banking-supervision legislation for regulatory purposes.

Criminal investigations operate under a different legal framework and may involve prosecutors, police and judicial authorisation.

Evidence discovered through regulatory supervision can potentially reveal conduct requiring further legal action, but the two procedures should not automatically be treated as identical.

33. Digital Banking Inspections

Modern banking supervision increasingly requires examination of technology.

An inspection can potentially examine:

cybersecurity controls;

IT governance;

digital operational resilience;

outsourcing arrangements;

cloud services;

electronic records;

access controls;

data quality;

automated risk models; and

business-continuity systems.

This explains why Law 10/2014 expressly gives supervisors access not only to traditional books and documents but also to software, electronic files and databases.

34. Practical Example

Suppose a Spanish bank reports a strong capital position, but off-site supervisory analysis detects an unusual increase in non-performing corporate loans.

Supervisors could request additional information.

If concerns remain, an on-site inspection might examine:

Loan files — whether borrowers were properly assessed.

Collateral — whether valuations are reliable.

Classification — whether deteriorated loans were identified promptly.

Provisions — whether expected losses were adequately recognised.

Internal models — whether credit risk was underestimated.

Governance — whether management ignored internal warnings.

Internal audit — whether weaknesses had previously been identified.

The inspection team could then classify its findings by severity and determine the appropriate supervisory follow-up.

This illustrates why an inspection is much more than a simple audit of financial statements.

35. Consequences of Serious Findings

Where serious deficiencies are identified, the supervisory response can escalate.

Depending on the legal circumstances, authorities may:

require remediation;

impose additional prudential requirements;

demand stronger governance or controls;

restrict certain activities or distributions;

commence sanctioning proceedings;

take intervention measures where statutory conditions exist; or

use other powers available under Spanish and EU banking law.

Law 10/2014 expressly provides significant intervention powers where solvency requirements are breached.

The purpose of supervision is therefore both preventive and corrective.

36. Key Principles from the Case Law

The cases provide several useful principles.

PNB Banka v ECB demonstrates that an ECB on-site inspection is an exercise of legally reviewable supervisory authority and raises questions of competence and reasons.

Landeskreditbank v ECB clarifies the structure of authority between the ECB and national banking supervisors within the SSM.

Crédit Mutuel Arkéa v ECB illustrates the significance of group and consolidated supervision.

Berlusconi and Fininvest explains the relationship between national and ECB stages in composite banking-supervision procedures.

Trasta Komercbanka demonstrates the importance of judicial protection in relation to serious ECB supervisory action.

Baumeister provides important guidance concerning confidentiality of information held by financial supervisors.

Espírito Santo Financial further illustrates the importance of confidentiality surrounding prudential supervisory material.

Activa Minoristas del Popular illustrates procedural questions concerning judicial challenges following the resolution of a major Spanish bank.

37. Conclusion

Banking inspection procedures in Spain form part of a sophisticated system combining national banking law and European prudential supervision.

Law 10/2014 provides the Banco de España with extensive powers to obtain information, require documents, examine records, seek explanations and conduct on-site inspections. The supervisory system also extends to consolidated groups and, under specific conditions, branches and outsourced activities.

Since 2014, these national powers operate within the Single Supervisory Mechanism, under which the ECB directly supervises significant banks while Banco de España participates in European supervision and retains important direct responsibilities, particularly concerning less significant institutions.

Inspection normally forms part of a wider cycle:

risk identification → supervisory planning → information gathering → off-site analysis → on-site inspection → findings → remediation → supervisory measures and, where legally justified, sanctioning proceedings.

The European cases—including PNB Banka, Landeskreditbank, Crédit Mutuel Arkéa, Berlusconi and Fininvest, Trasta Komercbanka, Baumeister, Espírito Santo Financial and Activa Minoristas del Popular—help explain the powers of supervisors, division of competence within the SSM, confidentiality, procedural safeguards and judicial review.

The central principle is that Spanish banking inspection is not simply an accounting examination. It is a risk-based prudential process designed to identify weaknesses early, verify regulatory compliance, require corrective action and protect the stability of individual institutions and the wider financial system.