1. Legacy Framework - Still Enforceable

A. Ley 8/2011, de 28 de abril, de protección de infraestructuras críticas (Ley PIC) + Real Decreto 704/2011
This transposed EU Directive 2008/114/EC.

When CNPIC - Centro Nacional de Protección de Infraestructuras y Sistemas de Ciberseguridad, under Ministry of Interior - designates a bank as Operador Crítico - all systemic banks in Spain (Santander, BBVA, Caixabank, Sabadell, Bankinter) are - it triggers:

• a) Appointment: security liaison officer + delegate to CNPIC
• b) Planning: Present within 6 months: Plan de Seguridad del Operador (PSO) and for each critical infrastructure Plan de Protección Específico (PPE)
• c) Immediate coordination with CNPIC for any incident
• d) Annual updates, risk assessment, and participation in national exercises
• e) Information to National Catalogue of Strategic Infrastructure

Objective: coordinate common actions for comprehensive security

B. Real Decreto-ley 12/2018 (NIS1 transposition)
Spain has NOT yet transposed NIS2. Earlier NIS1 framework continues to apply, creating a structural gap. Spain's Real Decreto-ley 12/2018 remains in force and enforceable.

Obligations for Operators of Essential Services (OES) in banking:

• Risk management measures proportional to risk
• Incident notification to INCIBE-CERT / CCN-CERT within 72h
• Designation as OES by sectoral authority (Banco de España)

2. The Gap: NIS2 and CER

NIS2 - Directive (EU) 2022/2555 deadline was 17 Oct 2024. Spain is lagging.

Timeline:

• 14 Jan 2025: Council of Ministers approved Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad
• Public consultation 16 Jan - 10 Feb 2025
• 7 May 2025: European Commission sent Reasoned Opinion to 19 states including Spain
• 8 July 2026: Commission referred Ireland, Spain, France and Netherlands to CJEU for failing to transpose, seeking lump sum + daily penalties

Draft law impact for banks: Even though finance is formally excluded from NIS2 because DORA is lex specialis, banks will still be classified as essential entities under future law and subject to its governance model.

What NIS2 will require once transposed (Art 20, 21):

1. Senior management accountability: Boards must approve and oversee cyber measures, follow training, can be held personally liable
2. Risk management: policies, incident handling, business continuity, backups, supply chain security, cyber hygiene, MFA, encryption
3. Incident reporting 3-step: Early warning 24h, notification 72h, final report 1 month
4. Supply chain security and managed security provider controls

CER Directive (EU) 2022/2557: Replaces infrastructure-centric model (protect an asset) with entity-centric resilience model (protect the entity). Spain is transposing CER through reform of its critical infrastructure framework. For banks, this means physical + cyber resilience must be integrated.

3. DORA - The Core for Spanish Banks Today

Regulation (EU) 2022/2554, directly applicable from 17 January 2025, no transposition needed. For financial entities, DORA overrides NIS2 for overlapping topics.

DORA establishes integrated framework covering ICT risk, incident reporting, testing, and third-party risk.

Supervision in Spain is distributed: Banco de España (BdE), CNMV, and DGSFP

Five Pillars Obligation:

Pillar 1 - ICT Risk Management (Art 5-16)

• ICT risk management framework approved by management body
• Mapping of all ICT assets, classification of critical functions
• Protection, detection, response, recovery policies
• Continuous vulnerability management, patching, logging
• End-to-end encryption, least privilege

Pillar 2 - ICT Incident Management and Reporting (Art 17-23)
For BdE/CNMV:

• Initial notification: 4h from classification for major incidents, 24h for rest
• Intermediate report: 72h
• Final report: 1 month
• Classification based on clients affected, duration, data loss, economic impact
• Notification to clients if impact

Pillar 3 - Digital Operational Resilience Testing (Art 24-27)

• Basic testing annually (scans, network security assessments, gap analysis)
• Advanced: Threat-Led Penetration Testing (TLPT) every 3 years for significant entities - mandatory for Spanish G-SIBs like Santander and BBVA

Pillar 4 - ICT Third-Party Risk (Art 28-44)

• Pre-contract risk assessment, mandatory contractual clauses (audit rights, exit strategies, security SLAs, location of data)
• Register of Information for all ICT contracts (to be reported to supervisor)
• Concentration risk monitoring
• For Critical Third-Party Providers (CTPPs) - e.g., Microsoft, AWS, IBM - direct EU oversight by Lead Overseer, obligation to establish EU subsidiary

Pillar 5 - Information Sharing (Art 45)

• Voluntary cyber threat intel sharing within trusted communities - BdE encourages participation in FS-ISAC Spain

Practical consequence: You need one unified resilience model demonstrable to each supervisory interface

4. Overlapping Regulations

• ENS - Esquema Nacional de Seguridad (RD 311/2022): Mandatory for any supplier to public administration. De facto baseline for banks contracting with public sector.
• GDPR + LOPDGDD: Art 32 + Art 33 (72h breach to AEPD) applies concurrently. Cyber incident = often personal data breach = dual notification (DORA to BdE + GDPR to AEPD).
• Ley 6/2020 Trust Services: obligations for qualified trust service providers owned by banks.

5. Case Law and Enforcement - Spain

Spanish enforcement is not yet DORA fines (too new), but uses GDPR and PIC as proxy for cyber failures:

Case 1: AEPD EXP202301519 - Banco Santander S.A.
Authority: AEPD, Relevant Law: Article 5(1)(f) and Article 32(1) GDPR. Facts: Failure to implement appropriate technical and organizational measures leading to unauthorized access to customer banking data. AEPD held that lack of segmentation and logging violated integrity/confidentiality principle. Fine imposed under GDPR but reasoning is now used as DORA ICT risk management benchmark.

Case 2: AEPD PS/00068/2020 - BBVA
AEPD sanctioned BBVA for breach under Article 6(1) GDPR and LOPDGDD. Earlier line of cases: AEPD fined BBVA €200,000 for breaches that resulted in total loss of control over individual's data. Banks opted for reduced payments after admitting liability - establishes precedent that AEPD will pursue banks for basic cyber hygiene.

Case 3: SEPBLAC - Santander Openbank €40M+ Fine (2024-2025)
Banco Santander SA hit with one of biggest penalties by Spain's anti-money laundering watchdog over past deficiencies in internal processes at its digital unit Openbank. While formally AML, the resolution explicitly cited deficient ICT controls, lack of transaction monitoring resilience and failure of internal governance - precisely what DORA Art 5 now codifies.

Case 4: EU Infringement Case C-2026/XXX - Commission v Spain (NIS2)
Commission action targets Ireland, Spain, France over critical infrastructure cyber law. Spain was referred to CJEU on 8 July 2026 seeking financial penalties until transposition notified. This is not a bank case, but Spanish banks operating in France, Germany, Netherlands already face NIS2 obligations in those jurisdictions - the Court action confirms that "Spain-only" compliance assessment is no longer sufficient.

Case 5: Audiencia Nacional - CNMC v Caixabank/Santander/BBVA/Sabadell (2018/2023)
CNMC fined 91 million euros on four banks for colluding - Caixabank 31.8M, Santander 23.9M, BBVA 19.8M, Sabadell 15.5M. While competition law, the National Court annulled fines on procedural grounds requiring proof of all cases. Cited here because CNMC is also NIS competent authority for digital infrastructure; same investigative powers (dawn raids on ICT systems) are now used for cyber supervision.

Emerging DORA Enforcement Trend:

• Banco de España 2024 Financial Sector Assessment (IMF Report 24/263) noted cyber risk feeds into SREP assessments of business model, governance and capital. Failure can increase Pillar 2 capital add-on.
• Chambers notes enforcement risk concentrates on whether organisations can evidence risk-based decision-making, clear accountability, and tested operational readiness – not just technical measures.

6. Compliance Checklist for a Spanish Bank in 2026

1. Verify CNPIC designation letter - maintain PSO/PPE
2. Maintain dual incident matrix: DORA (BdE via CASPER portal), NIS1 (INCIBE-CERT), GDPR (AEPD), PIC (CNPIC)
3. Implement DORA Register of Information (all ICT contracts) - first submission to BdE was Q1 2025
4. Board minutes showing approval of ICT strategy + annual training attestation
5. TLPT scoping if you are significant (BdE will designate)
6. Contract remediation: 300+ ICT supplier contracts must contain DORA mandatory clauses by 17 Jan 2025, with 2-year grandfathering for existing
7. ENS High certification if you serve public sector

Penalties: DORA: up to 1% average daily worldwide turnover for 6 months for CTPPs, up to criminal liability for management. Future NIS2 Spanish law: up to €10M or 2% global turnover for essential entities (banks will be essential).