Banking Law and Know-How Protection in Banking — Spain

1. Introduction

In Spanish banking, know-how means valuable practical, technical, commercial, organisational, financial or technological knowledge that gives a bank or financial business a competitive advantage.

Examples can include:

proprietary credit-scoring methodologies;

internal fraud-detection techniques;

risk-management models;

pricing methodologies;

customer-segmentation methods;

internal compliance procedures;

cybersecurity architecture;

payment-processing methods;

confidential business strategies;

software architecture and algorithms;

non-public financial models; and

confidential information concerning customers, suppliers and commercial partners.

Spanish law does not protect every piece of internal banking information automatically. The principal modern framework is Law 1/2019 of 20 February on Trade Secrets (Ley de Secretos Empresariales), which implemented Directive (EU) 2016/943. The legislation specifically covers technological, scientific, industrial, commercial, organisational and financial information or knowledge.

For banks, this framework operates alongside contractual confidentiality, employment law, unfair-competition law, intellectual-property rules, data-protection requirements, banking confidentiality and, in serious cases, criminal law.

2. What Qualifies as Protected Know-How?

Article 1 of Law 1/2019 establishes three fundamental requirements.

Information must:

be secret;

possess actual or potential business value because it is secret; and

have been subjected to reasonable measures to preserve its secrecy.

Therefore, calling information “confidential” is not enough.

A bank seeking protection should be capable of demonstrating that the information was genuinely non-public, economically valuable because competitors did not possess it, and actually protected through appropriate measures.

3. Banking Example

Suppose a Spanish bank develops an internal credit-risk methodology combining:

historical default information;

proprietary weighting criteria;

behavioural indicators;

internal risk thresholds; and

confidential modelling techniques.

The bank does not publish the methodology and restricts employee access to personnel working in risk management.

The bank also uses confidentiality agreements, access controls and information-security systems.

That methodology may potentially constitute a trade secret.

By contrast, a general banking technique that is publicly known or easily accessible within the banking industry will normally fail the secrecy requirement.

4. Importance of Reasonable Protective Measures

This is one of the most important practical requirements.

A bank cannot simply argue after a leak that information was secret. It should have taken reasonable steps beforehand.

Measures may include:

confidentiality clauses;

non-disclosure agreements;

restricted database permissions;

employee access controls;

encryption;

internal information classifications;

confidentiality markings;

cybersecurity safeguards;

access logging;

supplier confidentiality requirements; and

procedures when employees leave the institution.

The appropriate measures depend upon the circumstances.

The law does not require absolute secrecy. It requires reasonable measures to maintain secrecy.

5. Unlawful Acquisition of Banking Know-How

Article 3 of Law 1/2019 deals with unlawful acquisition, use and disclosure.

Acquisition can be unlawful when someone obtains confidential information without authorization through access to or copying of documents, electronic files or other materials containing the secret.

Other conduct contrary to honest commercial practices can also qualify.

For example, assume an employee downloads a bank's confidential risk-model documentation without authorization shortly before leaving to work elsewhere.

Whether liability arises depends on the particular facts, but unauthorized copying of genuine trade-secret material is precisely the type of conduct the legislation is designed to address.

6. Unlawful Use or Disclosure

Protection does not end with acquisition.

Article 3 also addresses unauthorized use or disclosure by someone who:

obtained the secret unlawfully;

breached a confidentiality agreement;

violated another duty not to disclose it; or

breached a contractual or other obligation limiting its use.

This is particularly relevant in banking because employees, consultants, fintech companies, technology suppliers and outsourcing providers can legitimately receive access to highly confidential systems.

Lawful access does not necessarily mean unrestricted freedom to reuse the information.

7. Employees and Banking Know-How

Employees create one of the most difficult legal boundaries.

Spanish trade-secret legislation cannot be used simply to prevent employees from changing employers.

Law 1/2019 expressly states that trade-secret protection cannot restrict employee mobility or prevent workers from using experience and skills honestly acquired during the normal course of their careers.

Therefore, an important distinction exists between:

general professional knowledge

and

a protected trade secret belonging to the bank.

A banker may leave one institution with substantial professional expertise.

That does not automatically permit taking confidential databases, proprietary algorithms, secret strategic documents or other qualifying trade secrets.

8. Independent Development

Trade-secret protection is fundamentally different from a patent monopoly.

Article 2 recognizes independent discovery or creation as lawful. It also permits certain observation, study, dismantling or testing of publicly available or lawfully possessed products or objects where no valid restriction prevents the activity.

This has an important banking-technology consequence.

Two banks can independently develop similar risk-management or fintech solutions.

The first bank cannot necessarily prevent the second from using its independently created system merely because the first developed something similar earlier.

The crucial issue is unlawful acquisition or use of protected confidential information.

9. Know-How Licensing

A trade secret has economic value and can itself become the subject of commercial transactions.

Spanish Law 1/2019 expressly recognizes that a trade secret is transferable. The statutory framework also addresses licensing.

This matters increasingly in modern banking.

A bank may obtain confidential technology from:

fintech companies;

cybersecurity providers;

payment processors;

AI developers;

cloud-service providers;

credit-analysis companies; or

specialist software developers.

Contracts should therefore identify:

ownership;

permitted use;

confidentiality;

sublicensing;

territorial scope;

duration;

access rights;

post-termination obligations; and

treatment of improvements.

10. Banking Outsourcing

Outsourcing increases know-how risk.

Suppose a bank allows an external technology provider to access confidential transaction-monitoring procedures.

The provider may need that information to perform the contract.

But contractual access should normally be limited to the purpose for which access was granted.

If the provider copies the methodology and uses it commercially for an unrelated purpose, questions of contractual liability and trade-secret infringement may arise.

Banks should therefore combine trade-secret law with strong outsourcing governance.

11. Know-How and Customer Information

Not all confidential banking information should be analysed solely as a trade secret.

Customer information can also engage:

GDPR;

Spanish data-protection legislation;

contractual confidentiality;

regulatory duties; and

sector-specific banking obligations.

Therefore, the fact that information qualifies as commercially valuable know-how does not displace other legal protections.

A customer database containing personal information can potentially create several overlapping legal obligations.

12. Whistleblowing and Public Interest

Trade-secret protection is not absolute.

Article 2 provides important exceptions, including certain disclosures made to expose wrongdoing, irregularities or illegal activities in defence of the general interest.

The legislation also protects disclosures required or permitted by Spanish or EU law and prevents trade-secret protection from being used to obstruct legally required disclosure to administrative or judicial authorities.

This is particularly important for banks.

A bank generally cannot invoke “trade secret” merely to prevent legitimate access by:

courts;

regulators;

supervisory authorities; or

other legally authorized public bodies.

13. Relationship With Unfair Competition Law

Before the specialized 2019 framework, Spanish trade-secret protection relied heavily on unfair-competition principles.

Law 1/2019 now operates as the specialized framework.

Its explanatory provisions also clarify its relationship with Law 3/1991 on Unfair Competition, including Article 13. The specialized trade-secret regime governs violations of business secrets, while unfair-competition legislation continues to form part of the broader legal framework.

For banking businesses, conduct involving stolen know-how can therefore intersect with broader allegations of unfair competitive behaviour.

14. Criminal Protection

The most serious cases can go beyond civil liability.

The explanatory provisions of Law 1/2019 expressly recognize the continued relevance of criminal offences concerning business secrets, including Articles 278 and 279 of the Spanish Criminal Code.

Criminal liability is distinct from an ordinary civil trade-secret dispute and requires satisfaction of the applicable criminal-law requirements.

Nevertheless, the existence of criminal protection demonstrates the importance Spanish law places on deliberate commercial espionage and serious misuse of confidential business information.

15. Civil Remedies

Law 1/2019 establishes extensive civil protection.

Depending upon the circumstances, remedies can address:

declaration of infringement;

cessation of unlawful conduct;

prohibition of future use or disclosure;

removal of infringing effects;

damages;

publication or dissemination of judgments in appropriate circumstances; and

measures concerning infringing goods or services.

Civil disputes under the legislation fall within the civil jurisdiction.

For banks, injunction-like relief can be particularly valuable because once a secret risk model, source code or security methodology becomes public, monetary compensation may not fully restore its economic value.

16. Interim Measures

Law 1/2019 therefore permits provisional judicial protection.

Article 21 specifically contemplates measures including an order stopping or prohibiting the use or disclosure of a trade secret and, where appropriate, preventive seizure of assets to secure potential damages.

Consider a situation where confidential banking technology is about to be commercially deployed by an alleged infringer.

Waiting several years for final judgment could make the ultimate victory practically meaningless.

Interim measures can therefore be crucial.

17. Confidentiality During Litigation

Trade-secret litigation creates a paradox:

A bank may have to disclose its secret in court to prove that someone stole it.

Spanish legislation addresses this problem.

Courts can restrict access to confidential documents, restrict attendance at hearings involving secret information and issue non-confidential versions of judicial decisions with sensitive passages removed.

This procedural protection is especially significant for banks because litigation may concern highly sensitive:

algorithms;

cybersecurity information;

source code;

risk parameters; or

commercial strategies.

18. Six Important Case-Law Authorities

Spanish know-how protection is heavily influenced by both national jurisprudence and EU principles. The following authorities are particularly useful for understanding the legal framework.

Case 1 — Vestergaard Frandsen A/S v Bestnet Europe Ltd, Case C-5/12

The Court of Justice considered misuse of confidential information connected with former employees and the development of competing products.

An important principle was that liability cannot simply be imposed on a person merely because another individual involved possessed confidential information.

Banking relevance

Suppose several employees leave Bank A and establish or join a fintech competitor.

The fact that they possess banking experience does not automatically establish that the new company unlawfully used Bank A's secrets.

Evidence connecting the defendant to acquisition or use of the protected information remains important.

Case 2 — Portakabin Ltd v Primakabin BV, Case C-558/08

Although principally a trademark and internet-advertising case rather than a modern trade-secret case, Portakabin illustrates the wider EU distinction between legitimate competitive conduct and conduct infringing another undertaking's legally protected commercial interests.

Banking relevance

Spanish banks cannot use know-how law to obtain ownership of ordinary industry knowledge.

Protection must attach to information satisfying the specific requirements for a trade secret.

Case 3 — Microsoft Corp v Commission, Case T-201/04

The General Court dealt extensively with valuable proprietary technological information and interoperability in competition proceedings.

The case illustrates that intellectual property and confidential technological know-how can interact with competition law.

Banking relevance

This principle has increasing significance where banks control technology necessary for:

payment ecosystems;

banking APIs;

fintech platforms; or

interoperable financial infrastructure.

Possession of valuable confidential technology does not automatically displace competition-law obligations.

Case 4 — Bank Austria Creditanstalt AG v Commission, Case T-198/03

This EU judgment is particularly relevant to banking confidentiality.

The dispute concerned confidential information and publication of a Commission decision.

The General Court addressed the protection of business secrets and other confidential information in administrative proceedings.

Banking relevance

Banks frequently provide sensitive commercial material to regulators.

Protection of know-how must therefore coexist with regulators' statutory powers and transparency obligations.

The existence of confidential banking information does not automatically prevent authorities from processing information necessary for their lawful functions.

Case 5 — Postbank NV v Commission, Case T-353/94

Postbank concerned confidential documents in EU competition proceedings.

The case addressed protection of business secrets and the handling of information obtained during regulatory procedures.

Banking relevance

The judgment illustrates a recurring banking-law issue:

A bank can be legally required to provide confidential information to a regulator without thereby making the information freely available for unrestricted commercial exploitation.

Regulatory disclosure and public disclosure are different concepts.

Case 6 — Evonik Degussa GmbH v Commission, Case C-162/15 P

The Court of Justice examined claims concerning confidential information and business secrets in the context of publication by the European Commission.

An important issue was whether information continued to qualify for confidentiality protection.

Banking relevance

Confidentiality is not necessarily permanent.

Information that has become public, outdated or otherwise lost its secret character may no longer receive the same protection.

Banks should therefore identify precisely what remains secret and commercially valuable, rather than describing entire documents or systems as confidential.

Case 7 — Pilkington Group Ltd v Commission, Case C-278/13 P(R)

This litigation concerned interim protection against disclosure of allegedly confidential commercial information.

The dispute illustrates the importance of provisional judicial measures where disclosure itself could cause irreversible harm.

Banking relevance

For a bank, disclosure of a proprietary fraud-detection algorithm or cybersecurity methodology may destroy much of its secrecy before final judgment.

Interim judicial protection can therefore be commercially critical.

Case 8 — Akzo Nobel Chemicals Ltd and Akcros Chemicals Ltd v Commission, Case C-550/07 P

This case primarily concerned legal professional privilege rather than trade-secret law.

Nevertheless, it demonstrates an important distinction between different categories of confidential corporate information.

Banking relevance

Banks should not treat:

trade secrets;

personal data;

legal professional privilege;

banking secrecy; and

contractual confidentiality

as if they were one legal concept.

Each has its own legal basis, conditions and exceptions.

19. Know-How Versus Patent Protection

Banks must also understand the difference between patents and trade secrets.

A patent generally requires disclosure of the invention in exchange for legally defined exclusive rights for a limited period.

A trade secret depends upon continuing secrecy.

This creates strategic choices.

A proprietary banking technology may sometimes be patentable, while another methodology may be more appropriately protected through confidentiality.

Trade-secret protection can potentially continue for as long as the statutory conditions remain satisfied.

But it has an important limitation:

If another company independently develops the same know-how lawfully, trade-secret legislation generally cannot prevent that independent development.

20. Know-How Versus Employee Skill

This distinction deserves particular emphasis in banking.

Assume a senior risk analyst works for a Spanish bank for ten years.

During that period the analyst becomes highly skilled in:

credit analysis;

financial modelling;

regulatory compliance; and

portfolio risk management.

The analyst later joins another institution.

The original bank cannot simply classify the employee's entire professional ability as its proprietary know-how.

Law 1/2019 specifically protects employee mobility and honestly acquired experience and skills.

However, deliberately taking confidential proprietary models, source code or secret customer strategies presents a fundamentally different legal question.

21. Fintech Partnerships

Know-how protection has become especially important as Spanish banks increasingly cooperate with technology providers.

A typical arrangement may involve:

Bank → customer and transaction infrastructure

Fintech → specialized technology

Cloud provider → computing infrastructure

Analytics provider → models and algorithms

Each participant may contribute proprietary information.

Contracts should consequently determine:

what each party owned before collaboration;

what information is confidential;

who owns newly developed technology;

who may use jointly generated know-how;

whether licensing continues after termination; and

how confidential information must be returned or destroyed.

Failure to address these matters can produce difficult ownership disputes.

22. AI and Banking Know-How

Artificial intelligence creates additional issues.

A Spanish bank may develop confidential:

model architecture;

training methodology;

risk parameters;

fraud indicators;

proprietary datasets; and

model-governance processes.

Some of these elements may potentially qualify as trade secrets where the statutory requirements are satisfied.

But simply labeling an AI system “proprietary” does not create trade-secret rights.

The bank still needs to establish secrecy, commercial value derived from secrecy and reasonable protective measures.

23. Cybersecurity Know-How

Cybersecurity creates perhaps the strongest practical justification for confidentiality.

Banks may possess information concerning:

network architecture;

authentication procedures;

fraud-monitoring logic;

security vulnerabilities;

incident-response systems; and

defensive controls.

Unauthorized disclosure can create both commercial and operational risks.

Banks therefore need a layered approach combining:

trade-secret protection + cybersecurity + access management + contractual confidentiality + regulatory compliance.

Trade-secret litigation should be the last protective layer, not the institution's only security measure.

24. Practical Test for Spanish Banks

When determining whether information constitutes protectable know-how, a bank can apply the following questions:

Step 1: What precisely is the information?

Step 2: Is it generally known within the relevant banking or technology sector?

Step 3: Is it easily accessible?

Step 4: Does secrecy create actual or potential business value?

Step 5: Who legitimately controls the information?

Step 6: What reasonable measures protect it?

Step 7: How did the alleged infringer obtain it?

Step 8: Was there a confidentiality or restricted-use obligation?

Step 9: Does an exception apply, such as lawful independent creation or legally required disclosure?

Step 10: What judicial remedy is proportionate?

This analysis is considerably stronger than merely arguing that a document carried a “confidential” label.

25. Overall Legal Position

Spanish banking know-how is protected through a multi-layered legal framework.

The central statute is Law 1/2019 on Trade Secrets, which expressly includes financial, technological, commercial and organisational information within the potential definition of a trade secret.

The legislation complements unfair-competition rules and preserves the relevance of criminal protection for serious misappropriation. It also establishes civil remedies and special procedural mechanisms designed to preserve confidentiality during litigation.

For banks, however, the strongest protection comes from combining the law with effective internal controls.

Conclusion

Banking Law and Know-How Protection in Spain concerns much more than traditional confidentiality agreements. Modern Spanish banks possess commercially valuable information in risk modelling, payments, cybersecurity, fraud prevention, software, customer analytics, business strategy and fintech systems.

Under Law 1/2019, banking know-how can qualify as a trade secret where it is genuinely secret, derives actual or potential business value from secrecy and has been subjected to reasonable measures designed to keep it secret.

Unauthorized acquisition, copying, use or disclosure can result in civil liability, while particularly serious conduct can potentially engage criminal law. Spanish law also provides interim measures and procedures for preserving secrecy during litigation.

At the same time, protection has important boundaries. It cannot normally be used to monopolize information that is generally known, prevent lawful independent development, block legitimate employee mobility, suppress protected public-interest disclosures, or prevent information from being supplied to competent authorities where disclosure is required by law.

The major case-law principles illustrated by Vestergaard Frandsen, Bank Austria Creditanstalt, Postbank, Microsoft, Evonik Degussa, Pilkington, Portakabin and Akzo Nobel reinforce the broader European approach: genuine confidential commercial know-how deserves meaningful legal protection, but confidentiality must be established and balanced against lawful competition, regulatory powers, employee mobility and other legally protected interests.

For Spanish banks, the practical objective should therefore be to identify valuable know-how precisely, restrict access proportionately, document confidentiality measures, regulate third-party access contractually, and preserve evidence of those safeguards. These steps both reduce the risk of misappropriation and strengthen the bank's position if judicial protection becomes necessary.