1. Legal Architecture for Spain

EU Level:

• DORA Articles 17-23 + Commission Delegated Regulation (EU) 2024/1772 - RTS on ICT incident classification
• ITS on reporting templates - ESAs Final Report JC 2024 85

Spanish Competent Authorities:

• Banco de España - for credit institutions, including significant banks like Santander, BBVA, CaixaBank, Sabadell. For prudential and ICT risk supervision.
• CNMV - for investment firms, trading venues, CCPs, and CSDs. CNMV has created a Virtual Office procedure requiring a legal person certificate for submissions. When a breach is committed by a credit institution, CNMV needs a report from Banco de España as prerequisite for serious/very serious sanctions.
• DGSFP for insurance but relevant for bancassurance groups

All feed into ECB / SSM for significant banks and ESAs for EU aggregation.

Goal of DORA is to mitigate risks of digital transformation by establishing common framework for ICT risk management, incident reporting, resilience testing, third-party management.

2. What Must Be Reported - Classification as Major

A bank must report major ICT-related incidents where the incident is classified against thresholds in RTS:

• Number of clients, transactions, counterparts affected
• Duration and downtime of critical functions
• Geographical spread - one third of 2025 incidents had cross-border impact
• Data losses, integrity impact
• Criticality of service affected - systems that support important functions
• Economic impact

Under Article 19, once detected, financial entities shall report it to their respective Competent Authority. You must maintain incident logs, notification of major ICT and payment-related operational incidents.

ESAs first annual report June 2026 recorded 3,383 major incidents in 2025 across EU, 29% originated from failures at third-party providers, and 51% were system failures.

3. Timeline - The 4-72-1 month Rule

This is the most critical change for Spanish banks:

• Initial notification: within 4 hours of classification as major AND no later than 24 hours after becoming aware of incident. The clock starts at classification, not detection.
• Intermediate report: within 72 hours from initial notification, when status changes. Must update detection time, impact assessment.
• Final report: within 1 month of resolution, with full root-cause analysis, remediation costs, lessons learned. Requirement to inform affected clients without undue delay

For comparison, NIS2 is 24h initial / 72h assessment / 1 month final; DORA is stricter because of the 4h classification rule.

Content of template per ESMA/Banco de España operational instructions:

• affected financial entity, contact persons, reporting currency
• Date and time of detection and classification
• Type, critical functions affected, impact on clients
• Third-party provider involvement, if any

Reporting channel: Banco de España IT tool / CNMV eDesk. Format: xBRL-CSV plain CSV expected steady-state.

4. Spain-Specific Operational Requirements

• Banks must have a central point of contact for ICT incident reporting responsible for internal coordination
• Maintain Register of Information on all ICT third-party arrangements - ESAs built CTPP designation from it. In Nov 2025, 19 CTPPs designated including AWS, Microsoft, Google Cloud, Bloomberg, LSEG, IBM
• Third-party-originated incidents must still be reported by each affected bank individually unless aggregated reporting conditions met
• DORA requires regular assessment of IT systems, identification of critical functions, and measures to mitigate operational risks

5. Interaction With Other Reporting Regimes

Spanish banks face 3 parallel clocks:

Banks must file separately. ESAs are assessing a future EU Hub for centralization under Article 21 DORA, but baseline today is decentralised - entities report to national CA, CAs disseminate onwards.

6. Case Law and Enforcement Relevant to Spain

DORA enforcement started in 2025, so pure DORA fines are still emerging. Supervisors rely on pre-DORA case law for ICT failure:

a) AEPD vs Banco Santander - EXP202301519
AEPD fined Santander €50,000 for violation of art.5.1.f GDPR integrity/confidentiality principle after an ICT security incident where incident log was not properly updated. Principle: failure to log and secure is aggravating factor in sanction graduation.

b) AEPD vs BBVA - PS/00456/2022
BBVA fined €70,000 for not securely verifying data subject identity allowing third party who stole identity to withdraw money - violation Art 6 and Art 32 GDPR. Cited as ICT authentication control failure, now would be DORA major incident due to breach of payment function.

c) AEPD vs BBVA - €5 Million - Historic Max
AEPD imposed €2M for breach Arts 13/14 GDPR and €3M additional for unlawful processing via economic activity declaration after 25 May 2018. Establishes that systemic ICT processing design flaws can lead to multi-million fines, used by Banco de España as reference for DORA ICT risk management expectations.

d) Banco Santander Openbank - 2024
Santander hit with >€40M penalty by Spain's AML watchdog SEPBLAC over past deficiencies in internal processes at digital unit Openbank. Not pure ICT incident but supervisory reasoning explicitly cited insufficient ICT governance arrangements - the same governance that DORA Articles 5-16 require.

e) Systemic Event - April 2025 Spanish Electrical Grid Blackout
Banks' data centers operated on backup power; branches lost connectivity, POS offline, customers could not reach banks. ESAs report noted preparations that worked at firm level did not prevent disruption from outside. This event is now used by Banco de España as case study: it was reportable as major ICT incident under DORA because third-party infrastructure failure caused critical function unavailability, even though banks were not at fault. 29% multiplier effect noted.

f) ECB Outsourcing Review 2024
ECB found 12% of critical outsourcing contracts at significant banks non-compliant and 60% not audited in prior 3 years. Banco de España inspection practice in 2026 uses this as basis for DORA Article 28 third-party risk findings.

7. Sanctions Regime in Spain

• DORA itself does not set fines, leaves to national law. Spain implements via:
  • Ley 6/2023 de Mercados de Valores for CNMV entities - up to €5M or 10% turnover
  • Ley 10/2014 de Ordenación Bancaria for Banco de España - classified as serious / very serious infringement
• AEPD GDPR fines up to €20M still apply concurrently for personal data breach component

Practical compliance checklist for Spanish bank:

1. Implement automated detection + classification matrix aligned to RTS thresholds
2. Keep 4-hour internal escalation to CISO + reporting contact
3. Pre-fill Banco de España template in Spanish/English
4. Integrate third-party provider notification clause - provider must notify within contract SLA < 2h to allow you to meet 4h
5. Log every incident even if not major - required for supervisory review