Banking Law and Insurance of Banking Liabilities in Spain

1. Introduction

Banking institutions face a wide range of legal liabilities arising from their daily activities. A Spanish bank may potentially incur liability because of negligent advice, breach of contract, employee misconduct, misleading information, failures in payment services, data breaches, cyber incidents, regulatory violations, or failures in corporate governance.

Insurance of banking liabilities refers to the use of insurance contracts to transfer some of these financial risks from the bank or its directors, officers and employees to an insurer.

The subject lies at the intersection of:

Spanish banking law;

insurance law;

contract law;

corporate law;

securities regulation;

consumer protection;

cybersecurity;

data protection; and

bank-resolution law.

The principal Spanish insurance statute is Law 50/1980 on Insurance Contracts (Ley de Contrato de Seguro). Banking institutions are additionally governed by legislation including Law 10/2014 on the organisation, supervision and solvency of credit institutions.

A fundamental distinction must be maintained:

Liability insurance protects against certain liabilities of the bank or insured persons.

Deposit guarantee protects eligible depositors subject to the statutory scheme.

Bank resolution provides mechanisms for dealing with failing banks.

These are legally different mechanisms.

2. Why Banks Need Liability Protection

Banks operate in a particularly high-risk legal environment.

They hold customer money, provide credit, execute payments, sell financial products and process large quantities of personal and financial information.

Potential liabilities can therefore arise from:

negligent professional services;

incorrect financial advice;

misleading disclosure;

unauthorized payments;

employee wrongdoing;

cyber incidents;

data-protection violations;

directors' decisions;

contractual breaches;

regulatory investigations; and

claims involving investment products.

One significant claim can involve substantial financial losses.

Insurance can therefore form one part of a bank's broader operational-risk strategy.

3. Spanish Insurance Contract Law

Law 50/1980 provides the general legal framework governing private insurance contracts in Spain.

Under a liability insurance arrangement, the insurer generally undertakes, within the limits established by legislation and the insurance contract, to cover the risk that the insured becomes legally responsible for compensating a third party for damage covered by the policy.

For banks, this principle is important because banking activities can generate claims from:

customers;

investors;

counterparties;

shareholders; and

other third parties.

However, purchasing insurance does not mean that every banking liability is automatically insured.

The precise result depends upon:

policy wording;

insured risks;

exclusions;

deductibles;

monetary limits;

notification requirements;

territorial limitations; and

the circumstances giving rise to the claim.

4. Professional Liability Insurance

Professional liability insurance can protect against certain claims resulting from errors or negligence in providing professional financial services.

Possible examples include allegations concerning:

incorrect execution of instructions;

administrative mistakes;

negligent financial services;

documentation errors; and

other covered professional failures.

Suppose a bank employee negligently processes an instruction and the customer suffers a legally compensable loss.

The first legal question is whether the bank is liable.

Only after establishing the underlying liability does the separate insurance question arise:

Does the bank's policy cover that particular liability?

Liability and insurance coverage should therefore be analyzed separately.

5. Directors' and Officers' Liability Insurance

Directors and senior managers can face personal claims connected with decisions taken in their corporate roles.

Banks may therefore obtain Directors' and Officers' liability insurance (D&O insurance).

Depending upon the policy, D&O insurance can potentially respond to covered claims involving alleged wrongful acts committed by directors or officers while performing their functions.

Relevant allegations might concern:

breach of directors' duties;

inaccurate corporate disclosure;

governance failures;

negligent management decisions; or

failures of supervision.

However, D&O insurance does not provide unlimited immunity.

Deliberately unlawful conduct and other excluded matters may fall outside insurance protection.

6. Employee Misconduct

Banks can also face liability because of employee conduct.

An employee might:

mishandle customer instructions;

improperly disclose information;

manipulate records;

execute unauthorized operations; or

otherwise cause loss.

The bank's responsibility and the employee's personal responsibility must first be determined under the relevant law.

Insurance coverage is then a separate contractual issue.

Banks therefore cannot use insurance as a substitute for effective employee supervision and internal controls.

7. Cyber Liability Insurance

Modern Spanish banks depend heavily upon digital infrastructure.

Cyber incidents can result in:

interruption of online banking;

compromised customer information;

incident-response expenses;

third-party claims;

forensic investigation costs; and

operational disruption.

Cyber insurance can transfer some financial consequences of specified incidents.

However, cyber insurance should supplement rather than replace cybersecurity.

Spanish and EU financial-sector rules increasingly require banks to maintain operational resilience regardless of whether insurance is available.

A bank cannot simply outsource its regulatory cybersecurity responsibilities to an insurer.

8. Data Protection Liability

Banks process highly sensitive personal information, including:

customer identities;

addresses;

account information;

transaction histories;

credit information; and

payment information.

Violations can create regulatory and civil consequences under the GDPR and Spanish data-protection legislation.

Some insurance arrangements may cover certain liabilities or response expenses associated with privacy incidents, depending upon applicable law and policy wording.

However, whether regulatory penalties themselves are insurable is a separate question that depends upon mandatory law, public-policy considerations and the particular circumstances.

A policy should never be assumed to cover every financial consequence of regulatory misconduct.

9. Payment-Service Liability

Banks may also incur liabilities in connection with payment services.

Examples include:

unauthorized payment transactions;

incorrectly executed transfers;

technical failures;

payment authentication problems; and

failures involving payment instructions.

Spanish payment-services legislation contains specific rules allocating responsibility between payment service providers and customers.

Insurance does not alter mandatory statutory rights.

A bank therefore cannot rely on its insurance arrangements as a reason for reducing customer protections imposed by payment law.

10. Investment and Advisory Liability

Spanish banks frequently provide or distribute investment products.

Potential liability can arise where a bank breaches applicable duties concerning:

information;

suitability;

appropriateness;

product characteristics;

disclosure of risks; or

investment advice.

Spanish Supreme Court litigation concerning subordinated debt and other financial products demonstrates that failures in information or advisory duties can result in damages claims.

These liabilities can become relevant to professional-liability and other insurance arrangements, depending upon their terms.

11. Claims-Made Insurance

A particularly important insurance concept is the claims-made clause.

Under certain liability policies, coverage depends upon when a claim is made rather than simply when the underlying event occurred.

This is particularly important for banks because liability claims may arise years after the original transaction.

For example:

financial advice occurs in Year 1;

a customer discovers the alleged problem in Year 3;

litigation begins in Year 4.

The bank must determine which policy period responds.

Spanish Supreme Court jurisprudence has specifically considered the validity and operation of temporal delimitation clauses in liability insurance.

Therefore, banks should carefully understand:

retroactive coverage;

policy periods;

notification requirements;

extended reporting periods; and

prior-knowledge exclusions.

12. Direct Action Against the Insurer

An important feature of Spanish liability insurance is the possibility of direct action under Article 76 of the Insurance Contract Act.

Under the statutory framework, an injured third party can, in relevant circumstances, proceed directly against the liability insurer.

This is important because liability insurance is not merely an internal financial arrangement between the bank and insurer.

It can affect the legal position of an injured third party.

However, the existence of direct action does not automatically establish that the underlying event falls within the policy's coverage.

Coverage, liability and quantum must still be legally analyzed.

13. Defence Costs

Banking litigation can be extremely expensive even before liability is finally established.

Liability insurance may therefore address defence costs, depending upon the contract.

These can include certain:

lawyers' fees;

litigation expenses;

investigation expenses;

expert costs; and

defence-related expenses.

Banks should determine whether defence costs are:

inside the policy limit, meaning they reduce the remaining amount available for damages;

or

outside the policy limit, where the policy provides separate treatment.

This distinction can materially affect the practical value of insurance.

14. Policy Exclusions

Banking liability policies normally contain exclusions.

Potential exclusions can concern:

intentional wrongdoing;

fraudulent conduct;

known circumstances;

certain contractual liabilities;

prior claims;

specific regulatory matters;

particular cyber risks; or

risks falling within another insurance policy.

Exclusions are extremely important in banking because one incident can involve several categories simultaneously.

For example, a cyber incident might involve:

customer compensation;

business interruption;

privacy claims;

regulatory investigation; and

system restoration.

Different parts of the loss may therefore fall under different insurance arrangements.

15. Regulatory Liability

Banks operate under extensive supervision.

Regulatory failures can lead to:

investigations;

corrective measures;

administrative sanctions; and

reputational consequences.

Insurance may cover some associated expenses where lawful and contractually included.

However, a crucial distinction must be maintained between:

insurable defence or investigation costs

and

the underlying regulatory penalty itself.

Whether a particular fine or penalty can legally and contractually be insured must be determined under the applicable legal framework.

Insurance cannot lawfully be used to eliminate mandatory regulatory accountability.

16. Deposit Guarantee Is Different

Deposit protection should not be confused with liability insurance.

Spain has a statutory Deposit Guarantee Fund for Credit Institutions (Fondo de Garantía de Depósitos de Entidades de Crédito).

Its purpose is fundamentally different.

Liability insurance protects an insured against specified legal liabilities.

The deposit-guarantee framework protects eligible depositors when statutory conditions are satisfied, subject to the applicable coverage limit.

Under the Spanish/EU framework, eligible deposits are generally protected up to €100,000 per depositor per credit institution, subject to the applicable statutory rules and exceptions.

Therefore:

Liability insurance → protects against covered liability risks.

Deposit guarantee → protects qualifying deposits within the statutory system.

17. Bank Resolution Is Also Different

Bank resolution must also be distinguished from insurance.

Resolution law provides authorities with mechanisms for managing failing banks while attempting to preserve financial stability and critical functions.

Potential resolution mechanisms can include:

sale of business;

transfer mechanisms;

bridge institutions;

asset separation; and

bail-in.

The Banco Popular resolution provides an important Spanish example.

Banco Popular was placed into resolution in 2017, and its business was transferred to Banco Santander.

The legal consequences generated extensive litigation before Spanish and EU courts.

Resolution mechanisms determine how losses and liabilities are treated in a failing-bank situation; they are not liability-insurance policies.

18. Case Law

Case 1 — Spanish Supreme Court Judgment 252/2018

Judgment of 26 April 2018 — Claims-Made Liability Insurance

The Spanish Supreme Court examined a professional liability policy containing a temporal limitation clause under Article 73 of the Insurance Contract Act.

The Court clarified important principles governing claims-made clauses.

It distinguished between different statutory forms of temporal delimitation permitted for liability policies.

Importance for Banking

The decision is directly relevant to banks purchasing professional and D&O liability insurance.

A bank should determine precisely:

when the wrongful act occurred;

when the claim was made;

when the insurer was notified; and

which policy was in force.

A bank cannot assume that insurance existing when the original transaction occurred will necessarily respond years later.

19. Case 2 — Spanish Supreme Court Judgment 273/2018

Judgment of 10 May 2018

This Supreme Court case involved interpretation of an insurance contract and the insured's duty to disclose risk-related information.

Although the underlying policy was life insurance rather than banking liability insurance, the judgment illustrates a fundamental Spanish insurance principle: accurate disclosure of circumstances relevant to risk can materially affect insurance coverage.

Banking Importance

When obtaining complex liability coverage, banks must provide insurers with accurate information requested for underwriting.

Material inaccuracies concerning known risks, prior claims or relevant circumstances can generate later disputes over coverage.

20. Case 3 — Spanish Supreme Court Judgment 323/2019

Judgment of 6 June 2019

This case concerned banking contracts and responsibility connected with the commercialization of bonds issued by a banking entity.

The litigation raised questions concerning which banking entity could properly be sued after part of a banking business had been transferred.

Importance

Banking liabilities can move through:

mergers;

acquisitions;

restructuring;

transfers of business; and

resolution measures.

Liability insurance programmes therefore need to address corporate restructuring carefully.

A merger or transfer can create questions concerning:

historic liabilities;

predecessor entities;

successor entities;

run-off insurance; and

notification of circumstances.

21. Case 4 — Spanish Supreme Court Judgment 40/2020

Judgment of 16 January 2020

This case concerned damages arising from a bank's alleged failure to comply with advisory and information obligations when marketing subordinated debt and preference-type financial products.

The Supreme Court addressed calculation of damages.

It held that when determining compensatory loss, financial returns obtained from the investment had to be considered together with the loss suffered.

Insurance Importance

The judgment illustrates why liability insurance cannot be evaluated simply by looking at the amount originally invested.

The legally recoverable damage must first be established.

Only then can the amount potentially falling within insurance coverage be calculated.

22. Case 5 — Spanish Supreme Court Judgment 117/2020

Judgment of 22 January 2020

This case also concerned damages resulting from alleged failures in information or advisory duties relating to subordinated financial products.

The Supreme Court reiterated that compensation must reflect the actual economic loss.

Returns received from the investment had to be considered when calculating damages.

Importance

For liability insurers, this principle affects the quantification of the insured loss.

Insurance generally responds to legally established liability rather than providing the claimant with an economic windfall.

Therefore, determining the bank's net legal liability is essential before calculating the insurer's payment obligation.

23. Case 6 — Spanish Supreme Court Judgment 1034/2020

Judgment of 19 May 2020

This case again concerned damages for breach of legal advisory and information obligations in the marketing of subordinated debt.

The Supreme Court held that the damages calculation had to take into account the financial returns received by the investor.

The objective was to compensate the actual loss rather than place the claimant in a better financial position than proper performance would have produced.

Banking Liability Importance

This judgment reinforces the relationship between:

wrongful banking conduct → legally established damage → compensable amount → potential insurance coverage.

An insurance policy does not independently determine the amount of the bank's civil liability.

The underlying legal rules determine the liability first.

24. Case 7 — Banco Santander / Banco Popular

Case C-410/20, CJEU, Judgment of 5 May 2022

This important case followed the resolution of Banco Popular.

Investors sought remedies connected with shares acquired before the bank entered resolution.

The Court considered the relationship between investor claims and the EU Bank Recovery and Resolution Directive.

It held, in the circumstances covered by the judgment, that the resolution framework prevented certain actions for liability based on prospectus information or nullity of share-subscription contracts after the shares had been completely written down in the resolution process.

Importance for Banking Liabilities

This case demonstrates that ordinary civil liability principles can interact with special bank-resolution legislation.

Where a bank enters resolution, liability cannot be analyzed only through:

ordinary contract law;

tort law; or

liability insurance.

The special resolution framework can fundamentally alter the legal position.

This distinction is crucial when insurers assess historic liabilities of distressed or resolved banks.

25. Case 8 — Bankia Institutional Investor Case

Spanish Supreme Court, Judgment of 22 June 2022

The Supreme Court considered the acquisition of Bankia shares by an institutional investor.

The Court found that the investor did not possess privileged internal information capable of correcting inaccuracies in the public information on which the investment had been based.

The lack of reliability of the relevant public financial information was therefore legally significant.

Importance

The case demonstrates how inaccurate banking disclosures can generate substantial civil liability.

Such litigation is particularly relevant to:

D&O insurance;

securities liability insurance;

professional liability;

prospectus-related claims; and

corporate disclosure risk.

Banks and insurers must therefore treat financial-reporting risk as an important component of liability management.

26. Case 9 — Banco Santander as Successor to Banco Popular

Spanish Supreme Court, 2023

The Spanish Supreme Court confirmed a €1 million regulatory sanction against Banco Santander as successor to Banco Popular concerning misleading or omitted information in Banco Popular's annual reports regarding executive-director remuneration arrangements.

Importance

The case illustrates an important distinction between insurance and succession of regulatory responsibility.

Corporate restructuring does not necessarily make historical regulatory liabilities disappear.

When one bank succeeds another, historical conduct can continue to generate legal consequences.

Insurance due diligence in bank acquisitions should therefore investigate:

outstanding proceedings;

regulatory investigations;

notified circumstances;

historic claims;

policy periods; and

predecessor coverage.

27. Lessons from the Case Law

These cases demonstrate several important principles.

First — Establish Liability Before Coverage

The court must determine whether the bank has a legally compensable liability.

Insurance coverage is a separate question.

Second — Actual Damage Matters

Spanish Supreme Court jurisprudence emphasizes compensation for actual economic loss rather than overcompensation.

Third — Timing Matters

Claims-made policies make the timing of claims and notification extremely important.

Fourth — Corporate Changes Matter

Mergers, transfers and resolution can change the legal identity against which liabilities are pursued.

Fifth — Special Banking Law Can Override Ordinary Expectations

The Banco Popular litigation demonstrates that bank-resolution legislation can materially affect otherwise available claims.

Sixth — Insurance Does Not Replace Governance

Insurance transfers certain financial consequences. It does not remove the bank's regulatory obligations.

28. Relationship with Capital Requirements

Insurance can reduce certain operational exposures, but a bank cannot simply insure away all regulatory capital requirements.

Banking prudential regulation requires institutions to maintain adequate financial resources against their risks.

Insurance can therefore operate as one risk-management mechanism, but it is not a universal substitute for:

regulatory capital;

liquidity;

internal controls;

governance;

compliance; or

operational resilience.

This distinction protects financial stability.

29. Insurance and Moral Hazard

Insurance can create a theoretical problem known as moral hazard.

If an institution believes every consequence of misconduct will be paid by an insurer, it may have weaker incentives to control risk.

Banking regulation counters this problem through:

governance duties;

personal responsibilities;

regulatory sanctions;

capital requirements;

compliance obligations; and

supervisory oversight.

Insurance should therefore function as a financial risk-transfer mechanism rather than permission to engage in careless conduct.

30. Practical Banking Liability Insurance Structure

A large Spanish banking group may maintain several complementary insurance arrangements rather than one policy covering everything.

These could include:

Professional liability insurance
For specified liabilities arising from professional services.

D&O insurance
For specified liabilities involving directors and officers.

Cyber insurance
For specified cyber and privacy risks.

Crime or fidelity insurance
For specified dishonest or fraudulent conduct producing financial loss.

Property and business-interruption insurance
For physical and operational losses.

Each policy has its own scope and exclusions.

A single incident may potentially engage more than one policy.

31. Example

Suppose a Spanish bank suffers a major cyber incident.

Attackers obtain customer information and interrupt online banking.

Several different consequences arise:

customers bring compensation claims;

the bank incurs forensic investigation costs;

systems require restoration;

regulatory authorities investigate;

customers claim financial losses;

business operations are interrupted.

The bank cannot simply state, "We have insurance."

Instead, it must determine separately whether:

cyber liability coverage applies;

professional liability coverage applies;

business-interruption coverage applies;

regulatory defence expenses are covered;

exclusions operate; and

deductibles or policy limits apply.

At the same time, the bank must continue satisfying its regulatory duties.

32. Risk Management Before Purchasing Insurance

A bank should first identify its major liability exposures.

The process can include:

Step 1 — Risk Identification

Identify professional, operational, cyber, employee, management and customer risks.

Step 2 — Legal Analysis

Determine which risks can legally be transferred through insurance.

Step 3 — Coverage Mapping

Compare each risk against existing policies.

Step 4 — Gap Analysis

Identify important uninsured exposures.

Step 5 — Policy Negotiation

Determine appropriate limits, exclusions, deductibles and notification provisions.

Step 6 — Claims Procedures

Establish internal mechanisms for notifying insurers promptly.

Step 7 — Continuous Review

Update coverage when the bank introduces new technologies, products or corporate structures.

33. Importance of Notification

Claims-made insurance makes notification procedures especially important.

Employees who become aware of:

customer claims;

threatened litigation;

regulatory investigations;

cyber incidents;

potential director claims; or

circumstances likely to produce claims

should escalate them through the institution's internal procedures.

Late notification can generate disputes over insurance coverage.

Banks therefore need coordination between:

legal departments;

compliance teams;

risk management;

cybersecurity;

senior management; and

insurance managers.

34. Insurance During Bank Mergers and Acquisitions

Insurance becomes especially complex when banks merge.

Suppose Bank A acquires Bank B.

Bank B may have historical liabilities relating to conduct occurring years before the acquisition.

Questions can arise concerning whether:

Bank B's old policy applies;

Bank A's new policy applies;

run-off coverage exists;

the claim was previously notified; or

the acquisition changed the insured entity.

The Spanish cases involving restructuring and Banco Popular illustrate why historical liabilities must be investigated carefully during banking transactions.

35. Role of Banco de España

The Banco de España supervises Spanish credit institutions within the broader Spanish and European supervisory framework.

Its principal concern is not whether a bank has purchased insurance for every possible liability.

The broader prudential question is whether the bank has effective:

governance;

risk management;

capital;

internal controls;

operational resilience; and

compliance systems.

Insurance can support risk management, but responsibility for prudent banking remains with the institution and its governing bodies.

36. Insurance Versus Legal Responsibility

The most important conceptual distinction can be expressed simply:

Legal liability asks:
"Is the bank legally responsible?"

Insurance asks:
"If the bank is responsible, does an insurance contract cover this liability?"

Deposit guarantee asks:
"Does the statutory deposit-protection scheme protect this depositor?"

Resolution law asks:
"How should a failing bank be reorganized or resolved and its losses allocated?"

These questions are related but legally separate.

Confusing them can produce an incorrect analysis of Spanish banking law.

Conclusion

Insurance of banking liabilities in Spain forms an important part of financial risk management, but it operates within a much broader system of banking regulation.

Spanish banks can potentially use professional liability insurance, D&O insurance, cyber insurance, crime or fidelity coverage, and other specialized policies to transfer specified financial risks.

The general insurance framework is principally governed by Law 50/1980 on Insurance Contracts, while banks remain subject to the prudential and governance framework established by Law 10/2014 and the wider Spanish and EU banking system.

Spanish and EU jurisprudence provides important guidance. Relevant decisions include Spanish Supreme Court Judgment 252/2018 on claims-made liability coverage; Judgment 273/2018 concerning insurance risk disclosure; Judgment 323/2019 concerning banking liabilities following business transfers; Judgments 40/2020, 117/2020 and 1034/2020 concerning calculation of damages for banking information/advisory failures; the Bankia judgment of 22 June 2022 concerning inaccurate financial information; and Banco Santander/Banco Popular (C-410/20) concerning the effect of bank resolution on investor claims.

The central principle is that insurance transfers specified financial consequences of banking liability; it does not eliminate the underlying legal responsibility of the bank.

A Spanish bank must therefore maintain sound governance, regulatory capital, internal controls, cybersecurity, compliance and operational resilience even where extensive insurance protection exists. Liability insurance should function as an additional layer of financial protection—not as a substitute for responsible banking.