1. Introduction

Critical financial infrastructure constitutional protection in Spain refers to the constitutional, statutory, regulatory, and judicial safeguards that protect financial institutions, payment systems, banking networks, clearing and settlement mechanisms, financial market infrastructures, and other essential financial services against disruptions that could threaten economic stability, public welfare, property rights, and the functioning of the Spanish constitutional economy.

The Spanish Constitution of 1978 does not expressly establish an independent fundamental right to the protection of critical financial infrastructure. Nevertheless, protection of essential financial systems can be derived from several constitutional provisions, including:

Article 9.3: Legal certainty, legality, and prohibition of arbitrary public action.

Article 33: Right to private property, subject to its social function.

Article 38: Freedom of enterprise within a market economy.

Article 51: Protection of consumers and users.

Article 128: Subordination of national wealth to the general interest and possibility of public intervention.

Article 131: Economic planning in accordance with constitutional requirements.

Article 149.1.11: State competence over monetary systems, foreign exchange, and the foundations of credit, banking, and insurance regulation.

Article 149.1.13: State competence over the foundations and coordination of general economic planning.

These provisions provide constitutional foundations for legislation safeguarding Spain's financial system.

However, constitutional protection should not be confused with immunity from regulation, insolvency, restructuring, or public intervention. Spanish constitutional law seeks to balance the continuity of essential financial functions with private property rights, economic freedom, consumer protection, financial stability, and democratic accountability.

2. Meaning of Critical Financial Infrastructure

Critical financial infrastructure includes institutions, systems, networks, technological assets, and operational processes whose disruption could seriously undermine essential economic or financial services.

Within Spain, potentially critical elements include:

Not every bank, payment provider, or financial software platform automatically qualifies as critical infrastructure under Spanish law.

Formal designation depends on the applicable statutory criteria and competent authorities. Moreover, classification as critical infrastructure under Spanish security legislation is distinct from classification as a critical or important entity under European operational-resilience rules.

3. Constitutional Foundations of Financial Infrastructure Protection

3.1 Article 9.3 — Legal certainty and protection against arbitrariness

Article 9.3 of the Spanish Constitution guarantees fundamental principles of the rule of law, including legal certainty and the prohibition of arbitrary public action.

These principles have particular significance for financial infrastructure because operators rely on predictable regulatory conditions.

Financial institutions must understand the legal consequences of operational failures, licensing restrictions, resolution proceedings, and intervention measures.

Practical implications

A regulatory authority imposing special security requirements on a payment system must act within its statutory powers and comply with applicable procedural requirements.

Similarly, an administrative decision suspending a financial operator's activities must be supported by an appropriate legal basis.

Article 9.3 does not prohibit changes to financial regulation. Rather, it provides constitutional limits on arbitrary or legally impermissible government action.

3.2 Article 33 — Constitutional protection of property rights

Article 33 recognises the right to private property and inheritance.

Article 33.2 provides that the social function of these rights determines their content in accordance with the laws.

Article 33.3 regulates deprivation of property, requiring a justified cause of public utility or social interest, appropriate compensation, and compliance with legal requirements.

Financial infrastructure may involve substantial private property interests, including banking assets, securities, operational facilities, intellectual property, and financial technology systems.

However, the protection of property does not mean financial infrastructure is exempt from prudential supervision, resolution, or other lawful restrictions.

Illustration

Suppose the Spanish authorities intervene in a systemically important financial institution to prevent disruption to essential payment services.

The authorities must distinguish between regulatory restrictions on property and measures amounting to deprivation of property. The constitutional requirements differ depending on the nature of the intervention.

3.3 Article 38 — Freedom of enterprise

Article 38 recognises freedom of enterprise within the framework of the market economy.

Public authorities must guarantee and protect its exercise in accordance with the requirements of the general economy and, where appropriate, planning.

Financial infrastructure operators therefore enjoy constitutional protection for lawful economic activity.

Nevertheless, freedom of enterprise is not absolute.

Special requirements may be justified by objectives such as:

Financial-system stability.

Protection of depositors and investors.

Continuity of payment services.

Prevention of systemic risk.

Cybersecurity and operational resilience.

Protection of the general economic interest.

For example, a central counterparty may be required to maintain recovery arrangements and operational-continuity capabilities even where compliance imposes substantial costs.

Such obligations do not automatically violate Article 38.

3.4 Article 51 — Consumer protection

Article 51 requires public authorities to guarantee the defence of consumers and users, protecting their safety, health, and legitimate economic interests through effective procedures.

In the financial sector, this principle supports the legislative protection of depositors, payment-service users, retail investors, and other financial consumers.

A serious interruption in essential banking services can affect wages, pensions, social payments, business transactions, and access to deposits.

Consequently, operational resilience is closely connected to legitimate consumer interests.

However, Article 51 is principally a constitutional directive to public authorities. It should not automatically be interpreted as an individually enforceable fundamental right to uninterrupted access to every financial service.

3.5 Article 128 — Subordination of wealth to the general interest

Article 128.1 provides that all the wealth of the country, in its different forms and regardless of ownership, is subordinate to the general interest.

Article 128.2 recognises public initiative in economic activity and permits the reservation of essential resources or services to the public sector by law, particularly in monopoly situations, and intervention in companies when required by the general interest.

This provision is especially important where disruption to financial infrastructure could create widespread economic harm.

It provides a constitutional foundation for certain forms of public economic intervention.

However, Article 128 does not independently authorise any particular bank takeover, nationalisation, or emergency measure without the legislation and procedures required by law.

3.6 Articles 149.1.11 and 149.1.13 — State regulatory competence

Article 149.1.11 reserves to the State competence concerning the monetary system and the foundations of credit, banking, and insurance regulation.

Article 149.1.13 concerns the foundations and coordination of general economic planning.

Together, these provisions support the State's central role in establishing the framework for financial stability and banking regulation.

They are particularly relevant where national financial systems extend across autonomous-community boundaries.

Nevertheless, the distribution of functions between the State and autonomous communities depends on the specific constitutional, statutory, and sectoral framework.

4. Statutory Framework Governing Critical Financial Infrastructure in Spain

4.1 Law 8/2011 on the protection of critical infrastructure

Law 8/2011 of 28 April, establishing measures for the protection of critical infrastructure, is a central component of Spain's critical-infrastructure protection framework.

Its purpose is to strengthen the protection of infrastructure necessary for essential services.

Its framework addresses the identification of critical infrastructure, coordination between authorities and operators, and planning measures to reduce vulnerability.

Financial infrastructure may fall within its scope where the relevant statutory criteria are satisfied.

The legislation is implemented principally through Royal Decree 704/2011 of 20 May.

The framework includes instruments such as strategic sectoral plans, operator security plans, and specific protection plans.

4.2 Law 10/2014 on credit institutions

Law 10/2014 of 26 June, on the organisation, supervision, and solvency of credit institutions, provides an important foundation for prudential regulation in Spain.

Its framework addresses institutional governance, supervision, and financial soundness.

These protections are relevant to critical infrastructure because serious institutional failure may disrupt deposits, payments, credit intermediation, and other essential financial functions.

4.3 Law 11/2015 on recovery and resolution

Law 11/2015 of 18 June, on the recovery and resolution of credit institutions and investment firms, establishes a framework for addressing institutional failure while seeking to preserve essential functions.

Its objectives include avoiding unnecessary disruption to financial stability and reducing reliance on extraordinary public financial support.

Resolution may involve transferring assets or liabilities, imposing losses on shareholders and creditors in accordance with the legal hierarchy, or using other statutory tools.

The regime is not equivalent to a constitutional guarantee against bank failure. Rather, it seeks to manage failure in an orderly manner.

4.4 Payment services and financial market legislation

Royal Decree-Law 19/2018 of 23 November regulates payment services and other urgent financial measures.

The framework is relevant to the reliable operation of payment services and the rights and obligations of payment-service providers and users.

The Spanish securities framework, including Law 6/2023 of 17 March on Securities Markets and Investment Services, also contributes to the regulation and supervision of financial markets and their infrastructure.

4.5 European Union law and operational resilience

Spain's financial infrastructure is also governed by directly applicable European Union legislation.

The most significant modern developments include:

Regulation (EU) 2022/2554 — Digital Operational Resilience Act (DORA)

DORA has applied since 17 January 2025. It establishes harmonised requirements concerning information and communication technology risks for financial entities within its scope.

It addresses ICT risk management, incident reporting, digital operational resilience testing, ICT third-party risk, and information sharing.

Regulation (EU) No 1024/2013 — Single Supervisory Mechanism

This regulation confers specified prudential supervisory tasks on the European Central Bank within the banking union.

Regulation (EU) No 806/2014 — Single Resolution Mechanism

This regulation provides a European framework for bank resolution within its scope.

Regulation (EU) No 909/2014 — Central Securities Depositories Regulation

This regulation addresses securities settlement and central securities depositories.

Regulation (EU) No 648/2012 — European Market Infrastructure Regulation

EMIR establishes requirements for derivatives markets, central counterparties, and trade repositories.

These laws help protect financial infrastructure through regulatory obligations rather than through a standalone constitutional right to infrastructure continuity.

5. Important Case Laws

The following decisions are important for understanding the constitutional and legal boundaries of financial infrastructure protection in Spain.

A distinction is necessary: some cases directly concern Spanish financial regulation or bank resolution, while others establish wider constitutional or European-law principles applicable to financial infrastructure. They should not all be treated as judgments specifically concerning infrastructure security.

Case Law 1: Spanish Constitutional Court — STC 111/1983, 2 December 1983

Tribunal Constitucional · Spain · RUMASA expropriation

Facts

The Spanish Government adopted Royal Decree-Law 2/1983 concerning the expropriation of the RUMASA group.

The group included banking and other commercial undertakings, and the government's intervention was presented as necessary in light of serious economic and financial concerns.

The intervention raised questions about property rights, emergency legislation, and constitutional limits on governmental economic action.

Legal issues

The principal issues included whether the government could use decree-law powers for a major economic intervention and whether the measure complied with the Constitution's protections of private property.

Articles 33 and 86 were especially significant.

Judgment and principle

The Constitutional Court upheld the challenged decree-law against the constitutional objections considered.

The judgment is important for its treatment of emergency economic legislation, the constitutional protection of property, and the scope of public intervention in exceptional financial circumstances.

It did not establish a general governmental power to expropriate financial companies without constitutional constraints.

Relevance to critical financial infrastructure

The case demonstrates that substantial intervention in private financial and economic assets may be constitutionally permissible when supported by a valid legal framework and justified public objectives.

For example, where a major financial group poses serious systemic risks, public authorities may have constitutional space to intervene.

However, the legality of any particular intervention depends on the statutory powers exercised and the constitutional requirements applicable to the measure.

Key principle: The public interest may justify exceptional economic intervention, but the State remains subject to constitutional limits.

Case Law 2: Spanish Constitutional Court — STC 37/1987, 26 March 1987

Tribunal Constitucional · Spain · Social function of property

Facts

The case concerned Andalusian agrarian reform legislation and restrictions affecting private property.

Although it did not concern banking, the judgment provided an important interpretation of the constitutional social function of property.

Legal issues

The Court examined the relationship between private property, legislative regulation, and the public interest under Article 33.

Judgment and principle

The Constitutional Court recognised the importance of the social function of property in defining the content of property rights.

Property rights must be understood within the constitutional framework, which permits legislative regulation pursuing legitimate social and economic purposes.

Such regulation remains subject to constitutional limits.

Relevance to financial infrastructure

The principle is relevant to privately owned infrastructure such as payment networks, data centres, financial technology systems, and securities-processing facilities.

Legislation may impose obligations designed to protect the public interest, including continuity, security, and resilience.

For instance, a financial infrastructure operator may be required by valid legislation to implement costly security and continuity arrangements.

The mere fact that these obligations restrict the owner's commercial discretion does not establish an unconstitutional interference with property.

Key principle: Private ownership does not eliminate the social obligations that legislation may lawfully attach to economically important assets.

Case Law 3: Spanish Constitutional Court — STC 83/1984, 24 July 1984

Tribunal Constitucional · Spain · Freedom of enterprise

Facts

This decision addressed constitutional questions surrounding regulation of economic activity in the pharmaceutical sector.

The judgment is relevant to the interpretation of Article 38 and the limits of economic regulation.

Legal issues

The Court considered the relationship between freedom of enterprise, statutory regulation, and legally permissible restrictions on economic activity.

Judgment and principle

The decision forms part of Spanish constitutional jurisprudence recognising that economic freedom operates within a legal and regulatory framework.

It does not require the State to permit all business activities on conditions selected exclusively by private undertakings.

Regulatory restrictions nevertheless require appropriate legal authority and must respect constitutional requirements.

Relevance to financial infrastructure

A bank, payment institution, or financial-market operator cannot rely on Article 38 alone to invalidate prudential or operational requirements.

For example, capital requirements, security measures, governance controls, and resilience obligations may restrict business discretion while serving legitimate regulatory objectives.

Key principle: Freedom of enterprise is constitutionally protected but can coexist with lawful regulation directed at important public interests.

Case Law 4: Spanish Constitutional Court — STC 135/1992, 5 October 1992

Tribunal Constitucional · Spain · Banking competences

Facts

This judgment concerned constitutional questions relating to the distribution of governmental responsibilities in banking and credit regulation.

It forms part of the Spanish Constitutional Court's jurisprudence concerning the allocation of financial regulatory competences between the State and autonomous communities.

Legal issues

The constitutional analysis concerned the role of State powers over the foundations of banking and credit regulation and the permissible scope of autonomous-community action.

Judgment and principle

The case illustrates that banking regulation is affected by the constitutional allocation of competences and that State basic regulation has particular importance within the financial system.

The judgment should not be interpreted as granting the central State unlimited competence over every activity conducted by a financial institution.

Relevance to critical financial infrastructure

Critical financial infrastructure commonly operates beyond regional borders.

Payment systems and banking networks may involve institutions, customers, and transactions throughout Spain and the European Union.

Uniform minimum requirements may therefore be important to protecting systemic stability.

For example, cybersecurity or supervisory arrangements affecting a nationwide banking system cannot be analysed exclusively as isolated regional economic matters.

Key principle: Financial infrastructure protection must respect Spain's constitutional distribution of governmental powers.

Case Law 5: Court of Justice of the European Union — Kotnik and Others v Državni zbor Republike Slovenije, Case C-526/14, 19 July 2016

CJEU · State aid and banking burden-sharing

Facts

The case arose from measures connected with the restructuring of Slovenian banks.

The dispute concerned European Commission guidance on State aid to financial institutions and requirements involving burden-sharing by shareholders and subordinated creditors.

Legal issues

The Court considered the legal effect and compatibility of the Commission's banking communication with EU law, including questions concerning property rights and legitimate expectations.

Judgment and principle

The CJEU held that the relevant Commission communication did not itself impose binding obligations on Member States comparable to directly applicable legislation.

The Court also found that the burden-sharing principles examined were not inherently incompatible with EU property-right protections.

The judgment addressed the limits and conditions of such measures rather than establishing unlimited authority to impose financial losses.

Relevance to Spain

Spain participates in the European banking and State-aid framework.

Measures used to stabilise or restructure financial institutions may affect shareholder and creditor property rights.

The case demonstrates that financial stability objectives can justify significant measures affecting private interests, provided the governing legal requirements are respected.

Key principle: Financial-sector stabilisation measures may be compatible with fundamental economic rights even where private investors bear losses.

Case Law 6: Court of Justice of the European Union — Ledra Advertising Ltd and Others v European Commission and European Central Bank, Joined Cases C-8/15 P to C-10/15 P, 20 September 2016

CJEU · Financial stability and EU fundamental rights

Facts

The dispute arose from measures connected with the financial assistance programme for Cyprus.

Bank restructuring measures affected certain depositors and investors.

Affected parties brought proceedings concerning the conduct of EU institutions in connection with the financial assistance arrangements.

Legal issues

The case concerned the possibility of reviewing the conduct of EU institutions against the Charter of Fundamental Rights, particularly Article 17 concerning property rights.

Judgment and principle

The CJEU recognised that EU institutions must respect the Charter when acting within the scope of their responsibilities.

The Court nevertheless rejected the damages claims on the circumstances before it.

In assessing the interference with property, the Court gave considerable importance to the objective of ensuring financial-system stability.

Relevance to Spanish financial infrastructure

The judgment illustrates that measures intended to preserve essential financial functions remain subject to fundamental-rights standards.

Financial stability is a powerful public-interest consideration, but it does not remove the obligation to comply with EU law.

Key principle: Financial stability measures are subject to fundamental-rights review, even in periods of serious economic crisis.

Case Law 7: Court of Justice of the European Union — Berlusconi and Fininvest, Case C-219/17, 19 December 2018

CJEU · ECB banking supervision and judicial review

Facts

The dispute arose from proceedings concerning the acquisition of a qualifying holding in an Italian credit institution.

The supervisory procedure involved both national authorities and the European Central Bank.

The litigation concerned the appropriate judicial forum for challenging acts undertaken during the supervisory process.

Legal issues

The principal question concerned the allocation of judicial review between national courts and the EU courts in a composite administrative procedure.

Judgment and principle

The CJEU held that where national authorities act within the preparatory stages of a procedure culminating in an ECB decision, the EU courts have exclusive jurisdiction to review the final ECB decision and relevant preparatory irregularities.

The ruling established important principles governing legal accountability within the Single Supervisory Mechanism.

Relevance to Spain

The Banco de España and the ECB operate within the European banking supervisory framework.

Decisions affecting systemically important banking activities may involve both national and European authorities.

The judgment helps clarify the judicial protection available when supervisory powers are exercised through an integrated administrative process.

Key principle: Financial supervisory powers are subject to judicial accountability, with the competent court determined by the applicable EU legal framework.

Case Law 8: General Court of the European Union — Steinhoff and Others v ECB, Case T-107/17, 6 May 2019

General Court · Banco Popular resolution context

Facts

This litigation arose from the events surrounding the failure and resolution of Banco Popular Español in June 2017.

The European Central Bank had determined that Banco Popular was failing or likely to fail.

The resolution of the bank subsequently became the subject of extensive litigation involving EU institutions and bodies.

Legal issues

The proceedings concerned the challenge to the ECB's assessment in the resolution sequence and questions about whether that assessment was independently open to annulment proceedings.

Judgment and principle

The General Court held that the ECB's failing-or-likely-to-fail assessment in this context was a preparatory measure that was not independently challengeable by an action for annulment.

The ruling concerned judicial procedure and the legal character of that particular assessment. It was not a general declaration that every act connected with a bank's resolution is immune from review.

Relevance to critical financial infrastructure

The Banco Popular case is particularly relevant to Spain because it involved the preservation of banking functions during an institutional failure.

It illustrates how financial resolution may proceed through several coordinated European and national decisions.

It also demonstrates that judicial protection may depend on identifying the legally operative decision, rather than challenging each preparatory step separately.

Key principle: The legal review of bank-resolution measures depends on the nature and effect of the particular administrative act.

Case Law 9: General Court of the European Union — Algebris (UK) Ltd and Anchorage Capital Group LLC v European Commission, Case T-570/17, 1 June 2022

General Court · Banco Popular resolution

Facts

Following Banco Popular's financial deterioration, the Single Resolution Board adopted a resolution scheme in June 2017.

The scheme involved the use of the sale-of-business tool and the transfer of the institution to Banco Santander.

Investors challenged aspects of the resolution arrangements and related European Commission action.

Legal issues

The litigation raised questions concerning the legality of the resolution framework and the treatment of shareholder and creditor interests.

The proceedings also involved broader questions of proportionality and judicial review in the context of EU banking resolution.

Judgment and principle

The General Court dismissed the annulment action.

The judgment supported the legality of the challenged decisions on the facts and legal grounds examined, although it did not mean that all resolution decisions are automatically lawful.

Relevance to Spanish critical financial infrastructure

The Banco Popular resolution is a major example of the use of European financial-resolution mechanisms concerning a Spanish bank.

It shows how a resolution strategy can aim to preserve essential banking operations while imposing financial consequences on shareholders and creditors.

The financial stability objective must nevertheless be implemented through the applicable statutory procedures and judicially reviewable decisions.

Key principle: Maintaining essential banking functions can justify an orderly resolution strategy, subject to applicable safeguards and judicial scrutiny.

Case Law 10: Court of Justice of the European Union — Banco Santander SA v J.A.C. and M.C.P.R., Case C-410/20, 5 May 2022

CJEU · Banco Popular and shareholder claims

Facts

The dispute concerned investors who had acquired shares in Banco Popular before its resolution.

Following the resolution, the investors sought remedies associated with alleged defects in information relating to their share acquisition.

The proceedings involved the relationship between investor-protection remedies and the effects of bank-resolution legislation.

Legal issues

The CJEU examined the interaction between Directive 2014/59/EU, establishing the bank recovery and resolution framework, and the legal consequences of claims relating to shares that had been cancelled or extinguished in the resolution.

Judgment and principle

The Court held, in the circumstances governed by the relevant provisions, that shareholders whose shares had been cancelled through resolution could not pursue the particular prospectus-related liability and annulment remedies against the successor institution in the manner claimed.

The result reflected the operation of the EU resolution framework.

The judgment should not be interpreted as extinguishing every conceivable claim connected with a bank's pre-resolution conduct.

Relevance to critical financial infrastructure

Resolution seeks to manage the failure of a financial institution without allowing uncontrolled disruption to the wider system.

This case illustrates how the legal framework may restrict particular shareholder remedies to maintain the effectiveness and finality of resolution measures.

It also illustrates the potential tension between individual investor interests and systemic financial stability.

Key principle: EU bank-resolution law may affect private investor remedies where necessary to give effect to the legally prescribed resolution mechanism.

6. Comparative Analysis of the Case Laws

7. Constitutional Protection of Payment Systems

Payment systems play an essential role in economic life because they facilitate wages, pensions, commercial transactions, government payments, and other transfers.

A serious disruption may affect economic activity well beyond the operator directly responsible.

Spanish payment infrastructure must be considered within the broader Eurosystem and European Union framework.

Relevant mechanisms include payment-services regulation, settlement-finality legislation, central-bank oversight, operational-resilience requirements, and applicable critical-infrastructure security obligations.

Constitutional dimensions

Article 33: Protects relevant private property interests, subject to lawful restrictions.

Article 38: Protects lawful payment-services business activity.

Article 51: Provides a constitutional foundation for safeguarding the legitimate economic interests of payment-service users.

Article 128: Supports legally authorised measures pursuing the general interest.

Article 149.1.11: Provides an important basis for central State competence concerning monetary and banking matters.

Hypothetical example

A major payment processing operator experiences a serious cyberattack that interrupts electronic transactions nationwide.

The competent authorities may act under applicable cybersecurity, financial supervision, and critical-infrastructure legislation.

Operators may face duties relating to incident reporting, recovery, security arrangements, and cooperation with regulators.

However, constitutional analysis must still consider whether administrative directions have a valid legal basis and whether any interference with private rights is legally justified.

The Constitution supports the protection of financial continuity, but the detailed response powers arise from specific legislation.

8. Constitutional Protection of Banking Infrastructure

Banking infrastructure includes deposit systems, loan administration systems, payment processing, operational platforms, interbank connections, and supporting technological services.

The legal protection of these systems involves several regulatory functions.

Prudential supervision

Banking supervisors assess risks that could threaten institutional soundness.

Weak governance, excessive exposures, operational deficiencies, or inadequate controls may affect the safety of the banking system.

Recovery and resolution

Recovery measures seek to restore an institution's viability.

Resolution provides a special legal framework for managing qualifying institutional failures in the public interest.

The continuity of critical functions is an important consideration in deciding whether and how an institution should be resolved.

Depositor protection

The Spanish deposit-guarantee framework provides specified protections for eligible deposits, subject to applicable rules and limitations.

The existence of deposit protection does not amount to an unlimited constitutional guarantee that every bank deposit is risk-free.

Operational resilience

Financial institutions must address risks associated with technology, outsourcing, cyber incidents, business continuity, and third-party providers.

This is particularly important where multiple financial institutions rely on the same technological infrastructure.

9. Financial Infrastructure and the Principle of Proportionality

A significant constitutional and European-law question concerns whether regulatory measures impose excessive restrictions on private interests.

Although the applicable legal test depends on the right, measure, and legal framework involved, proportionality analysis commonly examines the relationship between the legitimate objective and the measure adopted.

A useful analytical structure is:

1. Legitimate public objective

Protection of financial stability or essential services

2. Suitability

Can the measure contribute to achieving the objective?

3. Necessity

Is there a comparably effective, less restrictive lawful alternative?

4. Proportionality in the strict sense

Are the benefits adequately balanced against the interference with protected interests?

For example, a temporary restriction on a failing institution's activities may be more readily justified than an indefinite restriction unrelated to demonstrable risks.

Not every economic regulatory measure is reviewed using an identical four-stage formula. The applicable degree of scrutiny is determined by Spanish constitutional doctrine and, where relevant, EU law.

10. Role of Spanish and European Authorities

Protection of financial infrastructure is distributed among several authorities.

No single institution possesses an unlimited mandate to protect or control every component of financial infrastructure.

Competence depends on the kind of institution, the risk involved, and the specific statutory or European-law powers being exercised.

11. Cybersecurity as a Dimension of Constitutional Protection

Modern financial infrastructure depends heavily on digital systems.

Operational disruptions can arise from cyberattacks, network outages, software failures, third-party service interruptions, and failures of technological governance.

DORA provides an important European framework for addressing ICT-related financial risks.

Its requirements include areas such as incident management and reporting, resilience testing, and management of ICT third-party risk.

A further Spanish constitutional dimension is Article 18.4, which requires legislation to limit the use of information technology to safeguard honour, personal and family privacy, and the full exercise of citizens' rights.

This is relevant because financial infrastructure often processes large volumes of sensitive personal data.

Infrastructure security must therefore be reconciled with data-protection obligations.

A payment provider cannot assume that a legitimate cybersecurity objective automatically authorises unrestricted personal-data processing.

12. Constitutional Tensions in Protecting Critical Financial Infrastructure

A. Financial stability versus private property

Intervention may be necessary to protect essential financial services, but it may significantly affect shareholders, creditors, and owners.

The RUMASA and Banco Popular litigation illustrates different aspects of this tension.

B. Public security versus commercial freedom

Security obligations may impose substantial costs on private operators.

Nevertheless, those costs may be justified where lawful requirements address genuine risks to essential services.

C. Centralised regulation versus regional autonomy

Nationwide financial networks may require consistent regulatory standards.

At the same time, Spain's constitutional allocation of competences must be respected.

D. Operational continuity versus investor remedies

Financial resolution may require rapid and final decisions.

Such mechanisms can limit certain private remedies, as illustrated by Banco Santander, Case C-410/20.

E. Cybersecurity versus privacy

Financial operators must protect systems without disregarding personal-data rights and statutory protections.

F. Emergency intervention versus rule of law

Urgent action may be justified by financial instability.

However, urgency does not eliminate requirements relating to legal authority, judicial control, fundamental rights, and constitutional competence.

13. Hypothetical Applications

Scenario 1: Cyberattack against a national payment processor

A payment processor experiences a major outage affecting banking transactions across Spain.

Applicable legal considerations: DORA where applicable, payment-services regulation, data-protection law, and potentially critical-infrastructure legislation.

Constitutional considerations: Articles 9.3, 38, 51, and 128.

Likely legal analysis: The relevant authorities must establish their competence, identify the statutory obligations applicable to the operator, and assess whether their response measures are legally justified.

Scenario 2: Resolution of a systemically important Spanish bank

A large credit institution becomes failing or likely to fail.

The relevant authorities consider resolution to preserve essential banking functions and avoid wider financial disruption.

Applicable legal considerations: Law 11/2015 and the EU banking-resolution framework.

Constitutional considerations: Property rights, freedom of enterprise, the general interest, and judicial protection.

Relevant precedents: Algebris, Steinhoff, and Banco Santander.

Likely legal analysis: The public-interest assessment, resolution conditions, chosen resolution tools, creditor safeguards, and availability of judicial review become central.

Scenario 3: Compulsory security improvements at privately owned financial infrastructure

The competent authority requires an infrastructure operator to strengthen cybersecurity and business-continuity arrangements.

The operator argues that the requirements are expensive and interfere with its business operations.

Constitutional considerations: Articles 33 and 38.

Relevant precedents: STC 37/1987 and STC 83/1984.

Likely legal analysis: The legality of the requirement depends on statutory authorisation, the scope of regulatory competence, and compliance with applicable constitutional and administrative-law principles.

Scenario 4: Dispute concerning State and regional powers

A regional authority seeks to impose additional conditions on financial institutions operating nationally.

A dispute arises regarding the allocation of regulatory competence.

Constitutional considerations: Articles 149.1.11 and 149.1.13, alongside relevant autonomy-statute provisions.

Relevant precedent: STC 135/1992.

Likely legal analysis: The outcome depends on the subject matter of the regional measure, the applicable State basic legislation, and the constitutional distribution of competences.

14. Legal Remedies and Judicial Protection

Affected financial operators, shareholders, creditors, and consumers may have access to different remedies depending on the measure and their legal position.

Administrative proceedings: Administrative decisions may be challenged through the procedures established by applicable legislation.

Judicial review: Competent Spanish courts may review administrative acts, including questions of competence, legality, procedure, and applicable rights.

EU judicial proceedings: Decisions attributable to EU institutions or bodies may be subject to proceedings before the EU courts where the jurisdictional and admissibility conditions are satisfied.

Constitutional proceedings: Constitutional review may arise through the mechanisms provided under Spanish constitutional law. Not every financial regulatory dispute permits a direct constitutional complaint.

Compensation claims: Compensation may be available where the relevant legal conditions are satisfied, but financial losses do not automatically generate an entitlement to compensation.

The existence and scope of a remedy depend on the specific act, applicable legislation, claimant's standing, time limits, and competent forum.

15. Critical Evaluation

Spain's legal system provides substantial protection for important financial functions, but it does so through overlapping constitutional, national, and European legal mechanisms.

Three features are particularly important.

First, the constitutional system protects competing interests rather than a single overriding interest in financial continuity. Property, entrepreneurial freedom, public security, and economic stability must be reconciled.

Second, European integration is central to financial infrastructure governance. Spanish authorities operate within the Eurosystem, Single Supervisory Mechanism, Single Resolution Mechanism, and European financial-market regulatory framework.

Third, continuity and accountability must operate together. Financial institutions can perform essential economic functions without being constitutionally immune from failure, resolution, litigation, or regulation.

The Banco Popular litigation illustrates this point particularly clearly. The resolution of a financial institution can be directed toward preserving essential functions even where shareholders and creditors suffer serious financial consequences.

Similarly, the RUMASA judgment demonstrates that Spanish constitutional law permits exceptional economic intervention under constitutionally valid conditions.

Neither line of case law means that financial stability automatically overrides all other rights.

16. Conclusion

Critical financial infrastructure in Spain is protected through a combination of constitutional principles, special infrastructure-security legislation, banking supervision, operational resilience, and financial recovery and resolution mechanisms.

Articles 9.3, 33, 38, 51, 128, and 149 of the Spanish Constitution provide important foundations for legal certainty, property protection, economic freedom, consumer interests, public intervention, and the allocation of regulatory competence.

Law 8/2011, Law 10/2014, Law 11/2015, and EU regulations including DORA give these principles more specific operational effect.

The Spanish Constitutional Court's decisions in STC 111/1983, STC 37/1987, STC 83/1984, and STC 135/1992, together with European judgments such as Kotnik, Ledra Advertising, Berlusconi and Fininvest, Algebris, and Banco Santander, establish important principles for assessing State intervention, financial stability, property rights, business freedom, supervisory accountability, and bank resolution.

The central legal conclusion is that Spain's Constitution supports robust protection of essential financial infrastructure in the public interest, but does not grant such infrastructure absolute protection from economic failure or State regulation. Every intervention must remain grounded in the applicable law, constitutional allocation of powers, and judicial safeguards.

Research qualification: This analysis identifies established legal principles and leading judgments rather than presenting every decision as a direct ruling on critical-infrastructure designation. It is based on legal materials available in my knowledge, without live verification of amendments or subsequent judgments through October 2026. For formal legal submissions, the precise operative provisions, procedural history, and current status of each authority should be checked against official Spanish and EU case-law records.